Light

Episode #962 Quiz

The Internet Dodged a Bullet
Date: 2024-02-20 | Length: 2 hrs | Episode page at twit.tv

About this episode

Wyze’s cloud camera mix-up exposed thumbnails and some event video between accounts, illustrating risks of remote home surveillance. Microsoft’s Patch Tuesday fixed 73 flaws, including two actively exploited Windows bypasses, Exchange and Outlook 9.8 issues, and 15 SQL OLE DB RCE bugs. DNSSEC KeyTrap enabled single-packet CPU exhaustion, mitigated by validation limits.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the core reason last week’s Microsoft patch set included a DNS-related mitigation that mattered to the Internet as a whole?

Question 1

According to the episode, what was the core reason last week’s Microsoft patch set included a DNS-related mitigation that mattered to the Internet as a whole?

It fixed certificate parsing failures in DNS-over-HTTPS clients It limited CPU exhaustion from DNSSEC validation edge cases It blocked cache poisoning by enforcing DNS query randomization It reduced DNS query amplification in recursive resolvers

Question 2: What combination of DNSSEC conditions did the researchers exploit to create the quadratic KeySigTrap attack?

Question 2

What combination of DNSSEC conditions did the researchers exploit to create the quadratic KeySigTrap attack?

Many keys and one matching signature Many colliding keys and many matching signatures One key and many matching signatures One key and one oversized response record

Question 3: Why did the Unbound resolver suffer a longer denial-of-service duration than some other resolvers in the KeyTrap testing?

Question 3

Why did the Unbound resolver suffer a longer denial-of-service duration than some other resolvers in the KeyTrap testing?

It cached every failed signature attempt for 16 hours It re-queried the attacker’s nameserver five extra times by default It accepted only RSA signatures and retried them serially It refused to validate zones containing more than one DNSKEY

Question 4: What router-management mistake did Gavin report that allowed an ISP to remotely alter customer router settings?

Question 4

What router-management mistake did Gavin report that allowed an ISP to remotely alter customer router settings?

It exposed Telnet on the LAN interface with randomized credentials It exposed SSH on the WAN interface with a shared customer password It exposed HTTPS management on the WAN interface with an expired certificate It exposed SNMP on the WAN interface with default admin/admin credentials

Question 5: What was the episode’s recommended reason that a website might still enforce a maximum password length or forbid special characters today?

Question 5

What was the episode’s recommended reason that a website might still enforce a maximum password length or forbid special characters today?

They are required because modern password hashes cannot accept long inputs They exist because client-side hashing only works with short ASCII strings Those restrictions often persist from legacy mainframe-era policies and inertia They are needed because browsers cannot transmit UTF-8 passwords securely

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.