Light

Episode #871 Quiz

The New EU Surveillance State
Date: 2022-05-17 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Episode 871 covered multiple security incidents: a Microsoft Patch Tuesday rollback for domain controllers after a PetitPotam/NTLM relay zero-day caused Active Directory authentication failures; Apple fixed an exploited AppleAVD kernel write; F5 BIG-IP CVE-2022-1388 enabled unauthenticated root command execution; and Google created an Open Source Maintenance Crew to improve supply-chain security.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Why did CISA temporarily remove CVE-2022-26925 from its Known Exploited Vulnerability Catalog?

Question 1

Why did CISA temporarily remove CVE-2022-26925 from its Known Exploited Vulnerability Catalog?

Because the May 10 Microsoft rollup could trigger authentication failures on domain controllers Because the vulnerability was no longer being exploited in the wild Because Microsoft had already fixed the PetitPotam relay path in all affected servers Because the Known Exploited Vulnerability Catalog had been retired during the Patch Tuesday cycle

Question 2: What did the active exploitation of CVE-2022-1388 on F5 BIG-IP systems allow an attacker to do through the iControl REST endpoint?

Question 2

What did the active exploitation of CVE-2022-1388 on F5 BIG-IP systems allow an attacker to do through the iControl REST endpoint?

Execute arbitrary system commands without authentication Escalate only local user privileges after valid login credentials were supplied Bypass TLS inspection by downgrading encrypted traffic to plaintext Disable only the web management interface while leaving routing untouched

Question 3: What concrete role did Google's new Open Source Maintenance Crew have in the episode's discussion?

Question 3

What concrete role did Google's new Open Source Maintenance Crew have in the episode's discussion?

A dedicated staff of Google engineers working with upstream maintainers A public bug bounty program for any open source package used by Android A group focused on scanning apps for known malicious domains and IPs A team that replaced all third-party open source maintainers inside Google

Question 4: According to the episode, which pair of cryptographic schemes did Steve correct himself about as not being safe from Shor's algorithm?

Question 4

According to the episode, which pair of cryptographic schemes did Steve correct himself about as not being safe from Shor's algorithm?

Kerberos and TLS session keys AES and SHA-256 Diffie-Hellman and HMAC RSA and elliptic curve cryptography

Question 5: What did the proposed EU legislation require beyond scanning for known child sexual abuse material hashes?

Question 5

What did the proposed EU legislation require beyond scanning for known child sexual abuse material hashes?

Collecting metadata from voice calls to identify suspected hosts Decrypting all stored email archives only after a warrant was issued Restricting the law to photos and videos already flagged by users Automatically reading interpersonal text messages for possible grooming

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.