Light

Episode #859 Quiz

A BGP Routing Attack
Date: 2022-02-22 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

WordPress force-updated UpdraftPlus after a missing permissions check let any authenticated user download backups, risking PII and site takeover. Xenomorph Android banking malware used accessibility overlays, SMS and notification interception, and extensive logging to steal credentials. Hive ransomware’s flawed custom XOR keystream was reverse-engineered, enabling decryption without the attacker’s private key.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the UpdraftPlus vulnerability discussed in the episode, what prerequisite did an attacker need in order to abuse the backup-download flaw?

Question 1

In the UpdraftPlus vulnerability discussed in the episode, what prerequisite did an attacker need in order to abuse the backup-download flaw?

Administrator credentials for the WordPress dashboard An account of some kind on the target WordPress site Direct database credentials for the WordPress backup database A vulnerable PHP 8 installation on the WordPress server

Question 2: What did ThreatFabric identify as the main attack vector used by the Xenomorph Android banking trojan?

Question 2

What did ThreatFabric identify as the main attack vector used by the Xenomorph Android banking trojan?

A malicious kernel module installed through rooted-device exploits A credential-stuffing attack against bank web portals A DNS cache poisoning attack against mobile banking apps A classic overlay attack powered by accessibility services privileges

Question 3: How did the South Korean researchers say Hive ransomware generated the keystream used for file encryption?

Question 3

How did the South Korean researchers say Hive ransomware generated the keystream used for file encryption?

It requested a unique keystream from the command-and-control server for each file It generated a 10 MB master key and reused offsets from it per file It derived each file key directly from the victim's password hash It generated a fresh RSA key pair for every file and stored the private key locally

Question 4: Why was the BGP attack against KLAYswap able to divert traffic to the attackers' server even though the site used HTTPS?

Question 4

Why was the BGP attack against KLAYswap able to divert traffic to the attackers' server even though the site used HTTPS?

HTTPS bypasses BGP and follows DNS responses instead of routing tables The attackers forged TCP sequence numbers and hijacked established browser sessions The browser ignored the certificate and accepted any JavaScript served over TLS A more specific /24 route beat the legitimate /23 route in longest-prefix matching

Question 5: What did the attackers do after setting up the fraudulent routing entry and serving malicious JavaScript in the KLAYswap incident?

Question 5

What did the attackers do after setting up the fraudulent routing entry and serving malicious JavaScript in the KLAYswap incident?

They removed the fraudulent BGP entry about two hours later They kept the route in place until the exchange publicly disclosed the compromise They patched the affected developer site and left the route unchanged They switched to a DNS poisoning campaign against the same domain

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.