Light

Episode #891 Quiz

Poisoning Akamai
Date: 2022-10-04 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Akamai’s CDN used hop-by-hop header handling to desynchronize proxy parsing: a crafted GET with Connection: Content-Length caused the first proxy to split one request into two, cache attacker-chosen responses regionally, and serve poisoned content to other users. Akamai fixed parsing; customers mitigated via WAF rewrite rules.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the key storage flaw in Microsoft Teams that Vectra identified?

Question 1

According to the episode, what was the key storage flaw in Microsoft Teams that Vectra identified?

It required interactive reauthentication after every Teams restart It stored authentication tokens in plaintext on disk It encrypted tokens in memory but exposed them through Graph API logs It derived tokens from a machine-bound TPM secret

Question 2: What did Microsoft say about the Teams credential issue when Vectra reported it?

Question 2

What did Microsoft say about the Teams credential issue when Vectra reported it?

It was already scheduled for the next Patch Tuesday release It did not meet Microsoft's bar for immediate servicing It affected only consumer Teams clients on Windows It had been fixed by moving the tokens into browser cookies

Question 3: In the Exchange zero-day discussion, what did GTSC say the exploit did after initial compromise?

Question 3

In the Exchange zero-day discussion, what did GTSC say the exploit did after initial compromise?

It downloaded a malicious DLL and injected it into svchost.exe It encrypted mailbox databases and demanded payment It abused Outlook macros to run code in the user context It modified IIS logs to hide the originating client IP

Question 4: What was one of the workarounds Microsoft and GTSC discussed for the Exchange zero-day mitigation, and what problem did GTSC note about it?

Question 4

What was one of the workarounds Microsoft and GTSC discussed for the Exchange zero-day mitigation, and what problem did GTSC note about it?

A firewall block on outbound SMTP, which GTSC said was too slow to deploy A kernel patch for svchost.exe, which GTSC said caused blue screens A DNS sinkhole for the command-and-control IP, which GTSC said broke mail flow A Rewrite rule in IIS, which GTSC said could be bypassed by the regex

Question 5: How did Akamai initially respond when Jacopo Tediosi reported the CDN smuggling flaw?

Question 5

How did Akamai initially respond when Jacopo Tediosi reported the CDN smuggling flaw?

It acknowledged the report but said it had no bug bounty program It disputed the report and denied the behavior existed It asked the researchers to continue testing privately before any acknowledgment It immediately paid the researchers a standard public bounty amount

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.