Light

Episode #937 Quiz

The Man in the Middle
Date: 2023-08-29 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

WinRAR 6.23 fixed CVE-2023-38831, where crafted RAR/ZIP archives with innocuous files and hidden scripts could execute malware when opened; active exploitation targeted traders. HTTPS/TLS protects against passive eavesdropping, but man-in-the-middle attacks require privileged interception. Self-signed certificates secure local devices, and fake storage media can silently falsify capacity, corrupting data.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the WinRAR zero-day described in the episode, what subtle action caused the malicious script to run when the victim interacted with the archive?

Question 1

In the WinRAR zero-day described in the episode, what subtle action caused the malicious script to run when the victim interacted with the archive?

Opening the archive caused WinRAR to decompress and auto-run every embedded executable Extracting the archive into a temporary directory caused WinRAR to trust the extracted contents Double-clicking a harmless-looking file caused a script in a same-named folder to execute Previewing the archive metadata caused a command shell to launch from the archive header

Question 2: Why did Gibson say HTTPS/TLS is less necessary on a small local network than on the public Internet?

Question 2

Why did Gibson say HTTPS/TLS is less necessary on a small local network than on the public Internet?

Because private subnets cannot be reached by any other device on the LAN Because local traffic automatically becomes encrypted by consumer routers Because the packet path is local and usually stays within trusted household equipment Because browser vendors already exempt all RFC 1918 addresses from HTTPS policy

Question 3: What middle-ground solution did Gibson recommend for local appliances that need browser trust without public CA certificates?

Question 3

What middle-ground solution did Gibson recommend for local appliances that need browser trust without public CA certificates?

Create a self-signed certificate and import its trust root into the browser Replace HTTPS with HTTP after verifying the device is on the LAN Use an expired public certificate and rely on browser cache continuity Disable certificate validation only for 192.168.0.0/16 addresses

Question 4: Why did the TLS working group draft argue that gmt_unix_time in ClientHello was unnecessary?

Question 4

Why did the TLS working group draft argue that gmt_unix_time in ClientHello was unnecessary?

Because it was only meant to help avoid repeated nonces from poor RNGs Because the only safe nonce source was a synchronized NTP timestamp Because it leaked the server's current time and enabled clock-skew tracking Because TLS handshakes no longer used any random values at all

Question 5: What did SpinRite discover about the suspicious 256MB flash device that made the failure especially alarming?

Question 5

What did SpinRite discover about the suspicious 256MB flash device that made the failure especially alarming?

It rejected writes until the firmware was updated to a newer FAT driver It reported read errors whenever the second half of the device was accessed It exposed its true size as 128MB in the device inquiry response It claimed 256MB but silently stored only 128MB

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.