Light

Episode #913 Quiz

A Fowl Incident
Date: 2023-03-07 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Fosstodon and Mastodon faced sustained DDoS floods mitigated by Cloudflare, illustrating that modern IoT botnets can overwhelm upstream routers and require DDoS protection. Europol/FBI takedowns reduced attacks. The episode also covered DNS-based TikTok blocking, GitHub secret scanning, CISA red-team phishing persistence, TPM buffer overflows, WordPress plugin flaws, and credential-stuffing via Facebook OAuth.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what did the GitHub secret scanning service become for public repositories as of the prior Tuesday’s rollout?

Question 1

According to the episode, what did the GitHub secret scanning service become for public repositories as of the prior Tuesday’s rollout?

Restricted to repositories owned by GitHub partners Generally available and free for all public repositories Limited to enterprise customers under a paid preview Available only for private repositories with audit logging

Question 2: What was the key result CISA reported from its secret red-team exercise against the unnamed critical infrastructure organization?

Question 2

What was the key result CISA reported from its secret red-team exercise against the unnamed critical infrastructure organization?

It disabled perimeter defenses before being detected by the SOC It obtained persistent access and moved laterally across multiple sites It only achieved temporary access to a single endpoint It exfiltrated customer data from the organization’s public website

Question 3: Which set of messaging apps was explicitly named as banned by Russia from foreign messaging use inside financial institutions and state-owned companies?

Question 3

Which set of messaging apps was explicitly named as banned by Russia from foreign messaging use inside financial institutions and state-owned companies?

Discord, Teams, Skype for Business, Snapchat, Telegram, Threema, Viber, WhatsApp, and WeChat Discord, Teams, Skype for Business, Facebook Messenger, Telegram, Threema, Viber, WhatsApp, and WeChat Signal, Wire, Element, Telegram, Threema, Viber, WhatsApp, and WeChat Discord, Teams, Skype, Slack, Telegram, Threema, Viber, WhatsApp, and WeChat

Question 4: What did the episode identify as the most likely explanation for the Chick-fil-A account compromise pattern?

Question 4

What did the episode identify as the most likely explanation for the Chick-fil-A account compromise pattern?

A generic credential stuffing campaign aimed at loyalty accounts A phishing campaign targeting Chick-fil-A employees with admin access A direct compromise of Chick-fil-A’s own password database A Facebook credential reuse attack via Login with Facebook

Question 5: What specific mitigation did Steve describe for blocking TikTok traffic on federal networks?

Question 5

What specific mitigation did Steve describe for blocking TikTok traffic on federal networks?

Block all outbound HTTPS at the border until TikTok is removed Install a device certificate that rejects TikTok mobile app updates Rewrite app binaries to remove TikTok SDK references from devices Blackhole TikTok-related domains in local DNS and let caches expire

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.