Light

Episode #945 Quiz

The Power of Privilege
Date: 2023-10-24 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Microsoft is demoting VBScript to optional Feature on Demand, and plans to retire NTLM after adding Kerberos alternatives, monitoring, and blocking tools. Meanwhile cURL fixed a heap overflow in SOCKS5 hostname handling, and Cisco patched IOS XE WebUI flaws enabling remote admin, root backdoors, and widespread device compromise.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the key reason Microsoft gave for moving VBScript into Feature on Demand rather than removing it immediately from Windows?

Question 1

According to the episode, what was the key reason Microsoft gave for moving VBScript into Feature on Demand rather than removing it immediately from Windows?

To allow Microsoft to ship it separately from PowerShell in future releases To keep legacy system administrators able to install it only when needed To preserve compatibility with Windows 10 after NTLM is retired To enable malware authors to keep using it during the transition period

Question 2: What did Microsoft say it was adding to Windows 11 to prepare enterprises for NTLM's eventual disablement?

Question 2

What did Microsoft say it was adding to Windows 11 to prepare enterprises for NTLM's eventual disablement?

A compatibility layer that converts NTLM traffic into SMB3 A mandatory Kerberos-only mode for all domain logons New tools and logging to monitor NTLM usage A client-side credential cache that replaces domain authentication

Question 3: In the cURL issue discussed on the show, what specific condition could cause the heap-based buffer overflow in the SOCKS5 proxy handshake?

Question 3

In the cURL issue discussed on the show, what specific condition could cause the heap-based buffer overflow in the SOCKS5 proxy handshake?

A slow handshake that lets the hostname-resolution flag take the wrong value A proxy that refuses to resolve names and forces local caching A malformed TLS certificate presented by the upstream server A DNS response that exceeds 255 bytes during proxy authentication

Question 4: What did Cisco and the scanning efforts show about the IOS XE compromise campaign after the Lua backdoor became visible?

Question 4

What did Cisco and the scanning efforts show about the IOS XE compromise campaign after the Lua backdoor became visible?

A few hundred devices were initially exposed, then the number rose into the tens of thousands The compromise was limited to devices in North America and Europe The implant count stayed flat until Cisco's first patch was released About 42,000 devices were initially exposed, then the visible implants dropped sharply

Question 5: What limit did Privacy Badger use to automatically classify a third-party host as tracking behavior in the episode's explanation?

Question 5

What limit did Privacy Badger use to automatically classify a third-party host as tracking behavior in the episode's explanation?

The host appeared to track the browser on three separate sites The host loaded any advertising content at all The host set a uniquely identifying cookie on the first visit The host appeared on three different pages within one site

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.