Light

Episode #909 Quiz

How ESXi Fell
Date: 2023-02-07 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

The EU plans mandatory, universal CSAM surveillance, forcing providers to detect, report, block, and remove images and grooming text via an EU Centre database, despite privacy-rights rulings. VMware ESXiArgs exploited a two-year-old OpenSLP heap overflow on port 427, encrypting VM files; patching, disabling OpenSLP, and reducing attack surface are key mitigations.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what made the EU’s proposed CSAM surveillance regime especially significant compared with the earlier arrangement?

Question 1

According to the episode, what made the EU’s proposed CSAM surveillance regime especially significant compared with the earlier arrangement?

It would limit screening to providers already using end-to-end encryption It would shift screening from voluntary use by a few providers to mandatory use by all providers It would restrict screening to cases where a prior suspicion of wrongdoing exists It would replace content scanning with metadata-only monitoring

Question 2: What did the HSTS preload discussion say about the .dev top-level domain?

Question 2

What did the HSTS preload discussion say about the .dev top-level domain?

It is preloaded so browsers require HTTPS for every .dev site It redirects only subdomains that individually opt into preload It requires browsers to use HTTPS only after the first successful HTTP visit It is exempt from HSTS because certificates are optional for new TLDs

Question 3: What did the episode identify as the immediate technical weakness behind the ESXi ransomware wave?

Question 3

What did the episode identify as the immediate technical weakness behind the ESXi ransomware wave?

An unpatched OpenSLP heap overflow in VMware’s ESXi implementation A zero-day in VMware’s vCenter authentication service A TLS certificate validation failure in the ESXi web UI A weak default password on the ESXi management console

Question 4: Which deployment choice did VMware later announce for newer ESXi releases to reduce exposure to the OpenSLP issue?

Question 4

Which deployment choice did VMware later announce for newer ESXi releases to reduce exposure to the OpenSLP issue?

Requiring all customers to tunnel OpenSLP through an authenticated VPN Moving OpenSLP to an alternate high-numbered port to avoid scans Shipping ESXi 7.0 U2c and ESXi 8.0 GA with OpenSLP disabled by default Removing the ESXi hypervisor’s ability to host virtual machines on shared hardware

Question 5: What was the main criticism Steve raised about accountability in the ESXi attack?

Question 5

What was the main criticism Steve raised about accountability in the ESXi attack?

VMware blamed customers for not patching even though it had been capable of protecting them more proactively Patch management was impossible because VMware had never released any fix for the bug Customers should have expected the ransomware because ESXi is designed to expose OpenSLP publicly The attackers were legally responsible because they failed to disclose the exploit to VMware

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.