Light

Episode #863 Quiz

Use After Free
Date: 2022-03-22 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Security Now examined a new U.S. law mandating critical infrastructure breach reporting within 72 hours and ransomware payments within 24, plus CISA subpoena power. It highlighted npm supply-chain sabotage, Browser-in-the-Browser phishing, Trickbot’s MikroTik proxy abuse, an OpenSSL infinite-loop DoS in certificate parsing, Duo fail-open MFA bypasses, and use-after-free dangers.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Under the new U.S. cybercrime reporting law discussed in the episode, which organizations are required to report a breach to CISA within 72 hours?

Question 1

Under the new U.S. cybercrime reporting law discussed in the episode, which organizations are required to report a breach to CISA within 72 hours?

Only organizations operating in the defense industrial base Owners and operators of critical U.S. infrastructure All companies with more than 1,000 employees All federally chartered financial institutions

Question 2: What did the malicious Node-IPC update do when it detected an IP address geolocated to Russia or Belarus?

Question 2

What did the malicious Node-IPC update do when it detected an IP address geolocated to Russia or Belarus?

It encrypted local files and demanded a ransom note It disabled network access until the package was removed It wiped file contents and replaced them with a heart emoji It silently logged the geolocation and exited without action

Question 3: What made the Browser-in-the-Browser phishing technique especially convincing, according to the episode?

Question 3

What made the Browser-in-the-Browser phishing technique especially convincing, according to the episode?

It required the victim to install a signed helper application first It forced the browser to display a verified certificate inside the address bar It hijacked the native browser chrome through a local extension vulnerability It perfectly simulated a third-party sign-in pop-up using HTML, CSS, and JavaScript

Question 4: How did the Russian actors disable Duo MFA on the NGO's Windows environment, according to the CISA write-up discussed in the episode?

Question 4

How did the Russian actors disable Duo MFA on the NGO's Windows environment, according to the CISA write-up discussed in the episode?

They modified the hosts file to redirect Duo requests to localhost They replaced Duo with a different MFA provider on the victim network They blocked Duo's outbound traffic with a firewall rule on the VPN gateway They deleted the Duo service binaries from the domain controller

Question 5: What was the immediate effect of the OpenSSL flaw centered on BN_mod_sqrt() when triggered with a crafted certificate?

Question 5

What was the immediate effect of the OpenSSL flaw centered on BN_mod_sqrt() when triggered with a crafted certificate?

It sent the parser into an infinite loop that pegged the CPU It caused certificate verification to accept any invalid signature It crashed only TLS servers that used RSA certificates It leaked private key material through error messages

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.