Light

Episode #931 Quiz

SATELLITE INSECURITY, PART 1
Date: 2023-07-18 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft’s July Patch Tuesday fixed 132 flaws, including six actively exploited zero-days. Kaspersky highlighted MSHTML and scripting bypasses, SmartScreen, Outlook, and Error Reporting privilege escalation, plus a dangerous Office vulnerability abusing file:// cross-protocol navigation. Microsoft recommended Defender protections or a registry block, while revoking over 100 malicious drivers.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, which Microsoft protection directly helps subscribers avoid exploitation of CVE-2023-36884 through Office attachments?

Question 1

According to the episode, which Microsoft protection directly helps subscribers avoid exploitation of CVE-2023-36884 through Office attachments?

The IE Cumulative Updates channel Microsoft Defender for Office 365 Windows Code Integrity revocation updates SmartScreen download warnings

Question 2: What exact mitigation did Microsoft recommend for organizations that cannot use the cloud protections against CVE-2023-36884 exploitation?

Question 2

What exact mitigation did Microsoft recommend for organizations that cannot use the cloud protections against CVE-2023-36884 exploitation?

Set FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION Remove the MSHTML platform from Windows Block all email attachments from Word Disable the Chakra scripting engine

Question 3: Which July 2011 Microsoft update page did Steve trace the cross-protocol file:// behavior back to?

Question 3

Which July 2011 Microsoft update page did Steve trace the cross-protocol file:// behavior back to?

Microsoft Edge Legacy security advisory Internet Explorer 9.0.2 Update Internet Explorer 10 Platform Preview MSHTML cumulative security bulletin

Question 4: What was the stated operating-system requirement for the malicious drivers Microsoft added to the Windows Driver.STL revocation list?

Question 4

What was the stated operating-system requirement for the malicious drivers Microsoft added to the Windows Driver.STL revocation list?

They needed a Microsoft 365 Apps subscription to run They needed a UWP app container to execute They needed signed kernel patches to be loaded They needed admin privileges to be exploited

Question 5: What was the key technical requirement behind Google Play's new organization-account verification policy announced in the episode?

Question 5

What was the key technical requirement behind Google Play's new organization-account verification policy announced in the episode?

Provide a public PGP signing key Provide a verified domain control record Provide a notarized certificate chain Provide a D-U-N-S number

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.