Light

Episode #914 Quiz

Sony Sues Quad9
Date: 2023-03-14 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Quad9 learned that malicious Chrome extensions can exfiltrate URLs and persistent cookies, enabling session hijacking. A DFIR report showed phishing caused 69.2% of intrusions, while Microsoft’s macro blocking reduced document-based attacks. Kudelski’s “polynonce” attack exploits weak ECDSA nonces to recover private keys from Bitcoin, Ethereum, TLS, and other signatures.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the episode's discussion of the 'Get Cookies.txt' Chrome extension, what specific data did the later version begin exfiltrating in addition to the browser-tracking details first reported in January?

Question 1

In the episode's discussion of the 'Get Cookies.txt' Chrome extension, what specific data did the later version begin exfiltrating in addition to the browser-tracking details first reported in January?

Entire user cookie files that the extension had permission to access Stored password vaults from the browser's password manager TLS session tickets from the browser's network cache Private key material from locally installed certificate stores

Question 2: What was the episode's key statistic from the DFIR report about the dominant initial intrusion method used by attackers?

Question 2

What was the episode's key statistic from the DFIR report about the dominant initial intrusion method used by attackers?

Public-facing applications accounted for 69.2% of intrusion methods Drive-by compromises accounted for 69.2% of intrusion methods Phishing accounted for 69.2% of intrusion methods Abuse of valid accounts accounted for 69.2% of intrusion methods

Question 3: What change in Microsoft behavior did the episode identify as having materially reduced macro-based attack volume in the DFIR data?

Question 3

What change in Microsoft behavior did the episode identify as having materially reduced macro-based attack volume in the DFIR data?

Blocking all VBA code from opening unsigned documents Removing all scripting support from Outlook attachments Forcing Office documents to open only in read-only sandbox mode Disabling default execution of Word and Excel macros

Question 4: According to the episode's summary of Kudelski's work, what minimum set of conditions was required to run their ECDSA key-recovery attack in practice?

Question 4

According to the episode's summary of Kudelski's work, what minimum set of conditions was required to run their ECDSA key-recovery attack in practice?

Two signatures, the private key, and one message hash Five signatures, the curve parameters, and the signer identity Four signatures, the block timestamp, and the wallet balance Four signatures, the public key, and each message hash

Question 5: How did the episode describe the court's remedy in Sony's case against Quad9?

Question 5

How did the episode describe the court's remedy in Sony's case against Quad9?

Quad9 was ordered to delete cached DNS records only in Germany Quad9 was ordered to disable its malware filtering service entirely Quad9 was ordered to block the domains globally Quad9 was ordered to forward all requests for the domains to Sony

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.