Light

Episode #895 Quiz

After 20 Years in GCHQ
Date: 2022-11-01 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft finally updated the Windows vulnerable driver blocklist, usable via WDAC policies and SiPolicy.p7b, to block BYOVD abuse, though it normally refreshes only with major releases. The episode also covered Microsoft’s CVE omission policy, OpenSSL 3.0.7’s critical flaw, a Windows TCP/IP RCE, malicious GitHub PoCs, and SQLite’s 22-year string-formatting bug.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the documented reason Microsoft gave for why the vulnerable driver blocklist had not been broadly updated for older Windows versions until the October 2022 preview release?

Question 1

According to the episode, what was the documented reason Microsoft gave for why the vulnerable driver blocklist had not been broadly updated for older Windows versions until the October 2022 preview release?

It only updated the blocklist when WDAC was manually disabled It only updated the blocklist for full Windows OS releases It only updated the blocklist on clean installations of Windows 11 It only updated the blocklist after each monthly security patch

Question 2: What did Microsoft say Windows users could do if they wanted the most up-to-date vulnerable driver blocklist without waiting for the next major Windows release?

Question 2

What did Microsoft say Windows users could do if they wanted the most up-to-date vulnerable driver blocklist without waiting for the next major Windows release?

Download the blocklist only from the Microsoft Store as a policy app Install the blocklist only through Microsoft Defender Antivirus definitions Enable Secure Boot to pull the latest blocklist from Windows Update Use Windows Defender Application Control to apply the recommended driver blocklist

Question 3: What was the main technical condition that made the Windows TCP/IP remote code execution flaw discussed in the episode largely unlikely to be exploitable in practice?

Question 3

What was the main technical condition that made the Windows TCP/IP remote code execution flaw discussed in the episode largely unlikely to be exploitable in practice?

It depended on SMBv1 negotiation across untrusted networks It depended on Kerberos tickets being replayed in the clear It depended on fragmented IPv6 IPSec packet reassembly It depended on DNS cache poisoning during name resolution

Question 4: How many malicious GitHub proof-of-concept repositories did the Leiden University researchers report finding, out of how many total repositories studied?

Question 4

How many malicious GitHub proof-of-concept repositories did the Leiden University researchers report finding, out of how many total repositories studied?

489 out of 4,731 4,893 out of 47,313 3,487 out of 31,420 4,893 out of 41,793

Question 5: According to the episode’s description of the SQLite 'Stranger Strings' flaw, under what compilation condition was arbitrary code execution confirmed to be possible?

Question 5

According to the episode’s description of the SQLite 'Stranger Strings' flaw, under what compilation condition was arbitrary code execution confirmed to be possible?

When SQLite was compiled with stack canaries enabled When SQLite was compiled without stack canaries When SQLite was compiled with Unicode normalization disabled When SQLite was compiled only for 32-bit processors

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.