Light

Episode #969 Quiz

Minimum Viable Secure Product
Date: 2024-04-09 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

The episode highlights recurring IoT and web-security failures: D-Link NAS devices exposed hardcoded backdoor credentials plus command injection in nas_sharing.cgi, enabling remote code execution on 92,589 Internet-facing units and active malware exploitation.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the hard-coded backdoor username used in the exposed D-Link NAS devices discussed in the episode?

Question 1

What was the hard-coded backdoor username used in the exposed D-Link NAS devices discussed in the episode?

messagebus adminbus rootbus servicebus

Question 2: According to the episode, which CVE tracked the command-injection flaw in the D-Link NAS devices?

Question 2

According to the episode, which CVE tracked the command-injection flaw in the D-Link NAS devices?

CVE-2024-3297 CVE-2024-3273 CVE-2024-3723 CVE-2024-3272

Question 3: What was the approximate number of exposed D-Link NAS devices found on the public Internet during the researcher’s scan?

Question 3

What was the approximate number of exposed D-Link NAS devices found on the public Internet during the researcher’s scan?

82,959 29,589 92,589 95,289

Question 4: What did the episode identify as the current final step in the chain that lets the D-Link NAS flaw be triggered remotely?

Question 4

What did the episode identify as the current final step in the chain that lets the D-Link NAS flaw be triggered remotely?

A DNS rebinding sequence A simple HTTP GET request A WebSocket upgrade handshake A TLS client certificate exchange

Question 5: Which organization did the episode say had newly joined the Minimum Viable Secure Product Working Group?

Question 5

Which organization did the episode say had newly joined the Minimum Viable Secure Product Working Group?

NIST FBI CISA ENISA

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.