Light

Episode #878 Quiz

The ZuoRAT
Date: 2022-07-05 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Chrome 103.0.5060.114 fixed a high-severity WebRTC heap-buffer overflow zero-day, reported by Avast and assigned CVE-2022-2294. Firefox 102 added query-parameter stripping to remove tracking identifiers, but private browsing needs privacy.query_stripping.enabled.pbmode enabled. HackerOne found an ex-employee abusing internal disclosure logs, sockpuppet accounts, and payment trails to resubmit vulnerabilities for profit.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the specific reason Firefox v102’s new query-parameter stripping feature was still not enabled in private browsing mode for Steve until he made an additional tweak?

Question 1

According to the episode, what was the specific reason Firefox v102’s new query-parameter stripping feature was still not enabled in private browsing mode for Steve until he made an additional tweak?

Mozilla had not yet shipped the stripping code to private browsing builds of Firefox v102. The feature was disabled globally whenever Firefox entered private browsing mode. Enhanced Tracking Protection in Strict mode automatically overrides the stripping feature in private browsing. The private-browsing preference had a separate about:config key that remained false by default.

Question 2: In the HackerOne insider-threat case, what combination of evidence most directly let the team link the suspicious external disclosure to the then-employee?

Question 2

In the HackerOne insider-threat case, what combination of evidence most directly let the team link the suspicious external disclosure to the then-employee?

A single endpoint malware alert, a public GitHub repository, and a customer subpoena response. Internal access logs, payment-provider information, and network-traffic analysis tied to the sockpuppet account. A browser exploit trace, a DNS sinkhole log, and a hardware badge audit. A leaked Slack archive, a certificate revocation notice, and a router fingerprint match.

Question 3: What did Black Lotus Labs say ZuoRAT’s first-stage router implant did if it could not obtain a public IP address during execution?

Question 3

What did Black Lotus Labs say ZuoRAT’s first-stage router implant did if it could not obtain a public IP address during execution?

It retried indefinitely until the public IP service responded. It deleted itself and terminated, assuming sandbox analysis. It switched to port 6666 and attempted command-and-control directly. It fell back to a hardcoded private subnet and continued scanning.

Question 4: Which set of services did ZuoRAT query to try to determine the router’s public IP address, as described in the episode?

Question 4

Which set of services did ZuoRAT query to try to determine the router’s public IP address, as described in the episode?

ifconfig.me, ipinfo.io, checkip.dyndns.org, and dns.google whatismyip.com, icanhazip.com, api.ipify.org, and ident.me whatismyip.akamai.com, ident.me, myipdnsomatic.com, and ipecho.net akamai.com, myip.com, openresolver.net, and ipecho.org

Question 5: What was Steve’s recommended defensive use of TTL values for equipment that should never be reachable from outside a local network?

Question 5

What was Steve’s recommended defensive use of TTL values for equipment that should never be reachable from outside a local network?

Increase TTL to the maximum possible value so packets survive extra hops during normal routing. Emit packets with a very low TTL, such as two or three, so they die before leaving the local network. Set TTL to one so packets always reach the first upstream Internet router before expiring. Disable TTL checks on border routers so internal devices never lose reachability.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.