Light

Episode #868 Quiz

The Zero-Day Explosion
Date: 2022-04-26 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

CISA’s exploited-vulnerability catalog now includes older flaws, reflecting long patch tails. Lenovo UEFI drivers left in production firmware let privileged code disable SPI flash protections and Secure Boot, enabling bootkits. A browser-based wallet exposed private keys via a constant nonce and six-digit PIN brute force. Java ECDSA flaws let attackers forge signatures.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the critical flaw in the Everscale/Ever Surf web wallet that made the browser version fundamentally unsafe?

Question 1

According to the episode, what was the critical flaw in the Everscale/Ever Surf web wallet that made the browser version fundamentally unsafe?

It depended on a broken TLS certificate chain that let attackers impersonate the blockchain It used a hardware-backed key store that failed open when the browser was offline It stored all private keys only in server-side memory, making remote cache poisoning possible It reused a constant "unknown" device identifier as a nonce salt, enabling brute force of the PIN

Question 2: What was the specific problem ESET found in the Lenovo UEFI firmware that let an attacker with privileges disable protections and plant bootkit-style malware?

Question 2

What was the specific problem ESET found in the Lenovo UEFI firmware that let an attacker with privileges disable protections and plant bootkit-style malware?

Manufacturing-only drivers were left in production images and could disable SPI flash protections or Secure Boot A malformed ACPI table allowed arbitrary code execution before firmware initialization A missing TPM endorsement key check allowed external media to bypass firmware measurement A signed update package was accepted without signature verification by the bootloader

Question 3: Which combination of Lenovo vulnerabilities and effects was reported by ESET and confirmed by Lenovo in the episode?

Question 3

Which combination of Lenovo vulnerabilities and effects was reported by ESET and confirmed by Lenovo in the episode?

CVE-2022-3970 causes denial of service only, CVE-2022-3971 causes privilege escalation only, and CVE-2022-3972 causes file corruption only CVE-2022-3970 enables SMM arbitrary read/write, CVE-2022-3971 disables SPI flash protections, and CVE-2022-3972 disables Secure Boot CVE-2022-3970 affects Windows Print Spooler, CVE-2022-3971 affects WhatsApp VoIP, and CVE-2022-3972 affects Java ECDSA CVE-2022-3970 disables Secure Boot, CVE-2022-3971 enables SMM arbitrary read/write, and CVE-2022-3972 disables SPI flash protections

Question 4: What exploitability threshold did the episode highlight for the Java flaw affecting versions 15 through 18?

Question 4

What exploitability threshold did the episode highlight for the Java flaw affecting versions 15 through 18?

An attacker could bypass RSA-based certificates but only after stealing the server's private key An attacker could corrupt the JVM heap and crash any Java application, but only on Linux servers An attacker could forge ECDSA-based certificates, JWTs, SAML assertions, OIDC tokens, and WebAuthn messages An attacker could downgrade TLS 1.3 to TLS 1.2, but only for anonymous cipher suites

Question 5: What did Mandiant report about zero-day activity in 2021 compared with prior years?

Question 5

What did Mandiant report about zero-day activity in 2021 compared with prior years?

They identified 80 zero-days exploited in the wild, more than double the previous record of 32 in 2019 They identified 32 zero-days exploited in the wild, matching the previous record in 2019 They identified 80 zero-days in lab testing, but only 8 were ever exploited publicly They identified 128 zero-days exploited in the wild, all of them in Microsoft products

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.