Light

Episode #864 Quiz

Targeted Exploitation
Date: 2022-03-29 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Chrome’s second 2022 zero-day was a V8 type-confusion bug enabling out-of-bounds memory access; Google patched it after in-the-wild exploitation and urged Enhanced Safe Browsing and updates. The episode also covered Ukraine ISP resilience, npm typosquatting against @azure packages, fixed-code Honda key replay attacks, and FCC restrictions on Kaspersky and Chinese telecoms.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific condition did JFrog say made the npm attack particularly effective against Azure developers who were not careful about package names?

Question 1

According to the episode, what specific condition did JFrog say made the npm attack particularly effective against Azure developers who were not careful about package names?

The Azure scope required manual approval before any dependency update Scoped packages could share the same base name as unrelated packages Package downloads were blocked unless they came from verified Microsoft domains Packages with identical names were automatically merged by npm

Question 2: What did Google’s TAG team say the initial Chrome exploit kit did before delivering the Chrome RCE in the North Korean campaigns?

Question 2

What did Google’s TAG team say the initial Chrome exploit kit did before delivering the Chrome RCE in the North Korean campaigns?

It immediately downloaded the payload to every visiting browser It fingerprinted the client and only continued if conditions matched It used a DNS-based redirect to bypass browser defenses It required the victim to install a browser extension first

Question 3: How did the attackers constrain delivery of the Chrome exploit stages to make analysis and reuse difficult?

Question 3

How did the attackers constrain delivery of the Chrome exploit stages to make analysis and reuse difficult?

They relied on unsigned binaries and public paste sites They depended on user-installed VPN software to hide traffic They reused the same payload URL across all targets to simplify tracking They used one-time links and session-specific encryption

Question 4: What was the key security flaw identified in the 2016–2020 Honda Civic key system discussed in the episode?

Question 4

What was the key security flaw identified in the 2016–2020 Honda Civic key system discussed in the episode?

The remote signals used rolling codes that could be replayed after a delay The remote signals were fixed codes that never changed The engine start system failed only when the car battery was weak The key fob only worked when paired through Bluetooth authentication

Question 5: What did the episode say about the likely duration of active exploitation of Chrome’s first zero-day of the year before it was spotted and patched?

Question 5

What did the episode say about the likely duration of active exploitation of Chrome’s first zero-day of the year before it was spotted and patched?

About 42 days of targeted exploitation About 90 days of broad public exploitation About 7 days of opportunistic exploitation About 12 months of persistent exploitation

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.