Light

Episode #919 Quiz

Forced Entry
Date: 2023-04-18 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Microsoft patched 97 vulnerabilities, including an exploited Windows Common Log File System elevation-of-privilege zero-day, critical MSMQ and DHCP remote code execution flaws, and multiple RCE, info-disclosure, DoS, spoofing, and feature-bypass issues. Google launched free Assured OSS, providing vetted Java and Python packages, SBOMs, tamper-evident provenance, scanning, fuzzing, and upstream fixes.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the episode’s discussion of Microsoft’s April 2023 Patch Tuesday, what made the Windows Common Log File System Driver zero-day especially dangerous from an operational standpoint?

Question 1

In the episode’s discussion of Microsoft’s April 2023 Patch Tuesday, what made the Windows Common Log File System Driver zero-day especially dangerous from an operational standpoint?

It depended on prior local access and authenticated RPC calls on a DHCP server It affected only optional Edge browser components that were patched the week before It required a specially crafted packet delivered only to exposed MSMQ servers It was a kernel resident component installed on every Windows computer

Question 2: According to the episode, what was the key feature Google highlighted in Assured Open Source Software that distinguished it from a generic package mirror?

Question 2

According to the episode, what was the key feature Google highlighted in Assured Open Source Software that distinguished it from a generic package mirror?

It offered unmanaged mirrors of every public package registry without additional curation It focused solely on scanning container images for malware after deployment It provided Google-curated Java and Python packages with signed, tamper-evident provenance It restricted access to proprietary internal packages that Google did not use itself

Question 3: What mechanism did WhatsApp’s new Device Verification feature use to detect that the same account was being accessed from a physically separate client?

Question 3

What mechanism did WhatsApp’s new Device Verification feature use to detect that the same account was being accessed from a physically separate client?

It encrypted all offline messages with a one-time key unique to each chat contact It compared a device-stored token against the most recently issued server nonce It required a password reset whenever a new device opened the app It blocked any message retrieval unless the sender approved the device in real time

Question 4: What did WhatsApp’s Automatic Security Codes feature add to contact verification, according to the episode?

Question 4

What did WhatsApp’s Automatic Security Codes feature add to contact verification, according to the episode?

A public append-only directory of user public keys for one-sided verification A server-side message filter that scans chats for spoofed text before delivery A requirement that both users exchange QR codes in person before chatting A temporary encryption key that expires after every received message

Question 5: In the ForcedEntry deep dive, what sequence allowed a malicious file disguised as a GIF to become code execution on iPhone?

Question 5

In the ForcedEntry deep dive, what sequence allowed a malicious file disguised as a GIF to become code execution on iPhone?

A fake GIF overflowed the iMessage database and caused a remote cloud sync compromise A fake GIF triggered PDF parsing, which exposed JBIG2 logic that became Turing complete A fake GIF triggered JavaScript execution in the PDF parser, which directly ran attacker code A fake GIF bypassed the sandbox by exploiting a signed kernel extension, then loaded a rootkit

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.