Light

Episode #968 Quiz

A Cautionary Tale
Date: 2024-04-02 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

XZ Utils 5.6.0/5.6.1 hid a multi-year supply-chain backdoor that abused systemd-linked liblzma to alter sshd pre-authentication behavior, enabling remote RSA-keyed code execution with root privileges across Linux. Discovery came from anomalous SSH CPU use. Separately, Linux kernels 5.14–6.6.14 needed patching for a local privilege escalation bug.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the key technical reason AT&T's leaked four-digit account passcodes could be inferred from the dataset?

Question 1

According to the episode, what was the key technical reason AT&T's leaked four-digit account passcodes could be inferred from the dataset?

The passcodes were encrypted with a fixed cipher and no salt, producing only 10,000 unique values The passcodes were protected by per-user keys that were exposed through a separate vendor breach The passcodes were stored in plaintext alongside customer records and needed no cryptanalysis The passcodes were hashed with SHA-1 and later reversed using a published rainbow table

Question 2: What was the specific architectural path by which XZ Utils could influence SSH on affected Linux systems, as described in the episode?

Question 2

What was the specific architectural path by which XZ Utils could influence SSH on affected Linux systems, as described in the episode?

OpenSSH directly linked to libzstd, and that direct dependency let XZ Utils alter sshd behavior systemd embedded sshd as a plugin, and XZ Utils modified that plugin during startup OpenSSH linked to systemd, systemd linked to liblzma, and that chain let XZ Utils control sshd sshd loaded liblzma only for log compression, which let XZ Utils intercept authentication packets

Question 3: What did the episode say happened when the malicious XZ backdoor package versions were pushed into Linux distributions?

Question 3

What did the episode say happened when the malicious XZ backdoor package versions were pushed into Linux distributions?

They were blocked before leaving the XZ maintainer's personal repository and never entered any distro channel They were only distributed as source tarballs and were never repackaged by downstream maintainers They reached multiple distro channels, including Fedora, Debian testing, openSUSE, Kali, Homebrew, and OpenWRT They were already in Ubuntu stable, RHEL stable, and all major enterprise LTS releases

Question 4: What did Ghostery's report find about ad blocker usage among the professional groups it surveyed?

Question 4

What did Ghostery's report find about ad blocker usage among the professional groups it surveyed?

Cybersecurity experts used ad blockers the most, followed by programmers and advertisers Advertisers used ad blockers the most, followed by cybersecurity experts and programmers Programmers used ad blockers the most, followed by cybersecurity experts and advertisers All three professional groups used ad blockers at roughly the same rate near fifty percent

Question 5: What internal characterization of Chrome Incognito Mode did the lawsuit discovery reveal, according to the episode?

Question 5

What internal characterization of Chrome Incognito Mode did the lawsuit discovery reveal, according to the episode?

Google employees described it as a beta feature that had not yet been officially released Google employees described it as a secure container that blocked all website-level tracking Google employees described it as a confusing mess and effectively a lie Google employees described it as a fully anonymous mode that only needed clearer help text

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.