Light

Episode #896 Quiz

Something for Everyone
Date: 2022-11-08 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Dropbox mitigated a CircleCI phishing compromise that stole GitHub credentials via hardware-key OTP replay and copied 130 repositories. OpenSSL 3.0.7 fixes stack overflows in X.509 name-constraint checking, potentially causing DoS or RCE. Chegg’s failures included plaintext S3 data, no MFA, weak hashes, poor training, and repeated phishing breaches.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the specific phishing-chain technique Dropbox described as succeeding against its GitHub organization access?

Question 1

What was the specific phishing-chain technique Dropbox described as succeeding against its GitHub organization access?

A password-spraying campaign against Dropbox’s GitHub organization that bypassed multifactor authentication by using leaked session cookies A fake CircleCI login page that stole GitHub credentials and then used a hardware key prompt to pass a one-time password A malicious browser extension that intercepted Dropbox employee GitHub sessions and silently forwarded them to a cloned repository host A fake GitHub support portal that harvested CircleCI API tokens and then replayed them against internal deployment servers

Question 2: According to the episode, what was the key technical precondition for the more serious OpenSSL CVE-2022-3602 to become exploitable in a way that could lead to remote code execution?

Question 2

According to the episode, what was the key technical precondition for the more serious OpenSSL CVE-2022-3602 to become exploitable in a way that could lead to remote code execution?

A forged OCSP response that causes a server to skip validating the trust anchor entirely A malformed TLS record that overflows the heap before certificate verification begins A malicious email address in certificate name-constraint checking after chain signature verification succeeds A client certificate with excessive SAN entries that triggers a parser error in the handshake transcript

Question 3: What combination of weaknesses did the FTC cite in Chegg’s S3 environment as part of its data-security complaints?

Question 3

What combination of weaknesses did the FTC cite in Chegg’s S3 environment as part of its data-security complaints?

Per-user access keys with hardware tokens, encrypted object storage, and quarterly key rotation across all buckets A single access key with full administrative privilege, no MFA, and plaintext storage of personal information Federated identity only, encrypted object storage, and passwordless access enforced for all contractors Temporary shared tokens, customer-managed encryption, and network segmentation that isolated payroll from scholarship data

Question 4: How did the OPERA1ER bank-heist group reportedly turn access into cash once they reached the money-transfer systems?

Question 4

How did the OPERA1ER bank-heist group reportedly turn access into cash once they reached the money-transfer systems?

They used card skimmers to clone customer debit cards and withdrew funds from individual retail accounts over several weeks They issued fraudulent wire reversals from the bank’s treasury system and waited for automated clearing to settle the losses They synchronized transfers into about 400 mule accounts and rapidly cashed out at ATMs before employees could react They encrypted the bank’s payment databases and demanded a ransom from the institution’s fraud team

Question 5: What opt-out mechanism did the NCSC provide for systems administrators who did not want their servers scanned?

Question 5

What opt-out mechanism did the NCSC provide for systems administrators who did not want their servers scanned?

Register the server in a public DNS allowlist so the probes automatically skip it on each scan cycle Email [email protected] with the IP addresses to exclude from future scan activity Reply to the scanning probe with a 403 status code and the NCSC will permanently blacklist the host Submit a web form using the X-NCSC-Scan header to request exclusion from all probe activity

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.