Light

Episode #865 Quiz

Port Knocking
Date: 2022-04-05 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The episode surveys Spring4Shell, a Java Spring Core bypass on JDK 9+ enabling unauthenticated remote code execution through crafted HTTP requests, plus related exploitation uncertainty. It also covers QNAP and Sophos firewall vulnerabilities, browser-in-the-browser phishing, NPM dependency-confusion package flooding, and Wyze camera flaws, stressing patching and concealment.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to Steve Gibson, what made the original old-school port knocking approach vulnerable to replay attacks?

Question 1

According to Steve Gibson, what made the original old-school port knocking approach vulnerable to replay attacks?

It used a fixed HMAC over the client IP, which could be cloned from one host to another It opened the firewall for all clients once the secret sequence was observed once It relied only on packet arrival, so a captured sequence could be resent unchanged It depended on TCP source ports, which could be trivially rewritten by NAT devices

Question 2: What specific mechanism did Steve say FWKNOP uses to prevent reuse of a previously valid authorization packet?

Question 2

What specific mechanism did Steve say FWKNOP uses to prevent reuse of a previously valid authorization packet?

It requires the client to renew a one-time password from an external identity provider It stores a small hash of each successful packet and rejects repeats It changes the destination port after every accepted knock sequence It rotates the server's public key after every successful connection

Question 3: In the Wyze camera flaw Steve described, what exact mistake in the handshake allowed unauthenticated access?

Question 3

In the Wyze camera flaw Steve described, what exact mistake in the handshake allowed unauthenticated access?

The camera left the stored nonce as all zeroes until the first handshake step ran The camera accepted any packet on port 80 as a valid login request The client could decrypt the nonce without knowing the shared secret because it was weakly XORed The camera used the wrong 128-bit secret when encrypting the nonce

Question 4: What did Bitdefender say could be done after exploiting the Wyze authentication bypass, before chaining to code execution?

Question 4

What did Bitdefender say could be done after exploiting the Wyze authentication bypass, before chaining to code execution?

Control pan, tilt, and recording settings on the device Extract the camera's firmware signing key from the web server View the live audio and video feed without further steps Bypass the SD-card symlink protection and read logs only

Question 5: What did Steve identify as the immediate public-risk condition for the OpenSSL denial-of-service issue affecting some QNAP NAS devices?

Question 5

What did Steve identify as the immediate public-risk condition for the OpenSSL denial-of-service issue affecting some QNAP NAS devices?

The NAS had to expose SMB shares directly to unauthenticated users SSH had to be enabled for any authenticated local user on the LAN The attacker had to upload a malicious certificate through the admin web portal TLS connections had to be accepted from random IPs on the public Internet

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.