Light

Episode #917 Quiz

Zombie Software
Date: 2023-04-04 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

CISA’s KEV database reveals “zombie software”: systems still publicly exposed to known exploited vulnerabilities long after fixes exist. Examples include Apache SSRF enabling internal-network proxying and an older Microsoft web-server RCE. Risks persist because patches are applied slowly or never; mitigation requires timely updates, shutdown, and software inventory visibility.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the Oldsmar water-treatment story, what did former city manager Al Braithwaite say the incident actually was?

Question 1

In the Oldsmar water-treatment story, what did former city manager Al Braithwaite say the incident actually was?

A malware infection that altered the lye setpoint A former employee’s unauthorized TeamViewer intrusion A supervisory override that was later misreported An employee’s mistaken click of the wrong button

Question 2: What was the Italian Data Protection Authority’s immediate action regarding ChatGPT in the episode?

Question 2

What was the Italian Data Protection Authority’s immediate action regarding ChatGPT in the episode?

It imposed a temporary limitation on processing Italian users’ data It ordered ChatGPT to stop indexing public Italian websites It required OpenAI to publish its source code It fined OpenAI for a confirmed credential breach

Question 3: According to the episode, why was Twitter’s code release on GitHub mainly notable from an algorithmic perspective?

Question 3

According to the episode, why was Twitter’s code release on GitHub mainly notable from an algorithmic perspective?

It demonstrated that tweets were selected by manual moderation only It showed that the feed ranking relied mostly on user behavior signals It revealed a hidden encryption layer for private messages It proved the system sorted posts purely by follower count

Question 4: What did the FDA’s new medical-device cybersecurity guidance require manufacturers to include in submissions?

Question 4

What did the FDA’s new medical-device cybersecurity guidance require manufacturers to include in submissions?

A cryptographic attestation from every third-party supplier A ban on any Internet connectivity in approved devices A requirement for annual source-code publication to the FDA A plan for vulnerabilities, patching processes, and an SBOM

Question 5: How did Steve characterize the large population of still-exposed KEV-listed systems?

Question 5

How did Steve characterize the large population of still-exposed KEV-listed systems?

As fully supported software awaiting routine maintenance As zombie software living past its useful life on life support As proof that KEV only tracks newly disclosed flaws As a short-lived anomaly caused mainly by false positives

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.