Light

Episode #860 Quiz

Trust Dies in Darkness
Date: 2022-03-01 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The episode surveys why ransomware payments rarely stop extortion, with operators reusing stolen data, double-extorting victims, and selling exfiltrated information. It details Daxin, a stealthy Windows kernel-driver backdoor using hijacked TCP connections, custom key exchange, tunneling, and multi-hop routing. It also explains Log4Shell persistence and Samsung TrustZone AES-GCM IV-reuse flaws.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the Venafi survey discussed in the episode, what happened to a notable share of victims after they paid ransomware extortion demands?

Question 1

According to the Venafi survey discussed in the episode, what happened to a notable share of victims after they paid ransomware extortion demands?

They automatically received permanent deletion proofs from the attackers. They were exempted from any second extortion demand. They regained all encrypted data without any decryption failures. They still had their data exposed on the dark web.

Question 2: What stealth technique was central to Daxin’s ability to hide its communications on protected networks?

Question 2

What stealth technique was central to Daxin’s ability to hide its communications on protected networks?

It commandeered legitimate services already running on infected computers. It started its own visible network services on random ports. It relied on public DNS queries to tunnel its traffic outward. It encrypted all traffic only after exposing it in cleartext first.

Question 3: How did Daxin establish its multi-hop path through multiple infected computers?

Question 3

How did Daxin establish its multi-hop path through multiple infected computers?

It depended on dynamic Internet routing tables learned from BGP updates. It used a fixed central relay that every infected host contacted directly. It required each infected host to broadcast its presence to every other host. It used a list of nodes supplied by the attacker in a single command.

Question 4: What did the March 2022 Log4j retrospective show about Internet scanning activity after the initial disclosure?

Question 4

What did the March 2022 Log4j retrospective show about Internet scanning activity after the initial disclosure?

It vanished within hours and never reappeared. It lasted for about three weeks and then settled into a lower level. It remained at peak intensity for many months. It was driven mainly by a one-day coordinated scan from a security firm.

Question 5: What specific flaw did the Tel Aviv researchers identify in Samsung’s TrustZone Keymaster design?

Question 5

What specific flaw did the Tel Aviv researchers identify in Samsung’s TrustZone Keymaster design?

It used RSA instead of authenticated encryption for key blobs. It generated IVs correctly but failed to store them with the encrypted blobs. It leaked keys by decrypting before authenticating the ciphertext. It reused initialization vectors in AES-GCM because the caller could supply them.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.