Take Quiz

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1

What was the problematic practice Microsoft used regarding SharePoint software maintenance that posed a security risk according to the episode?

Allowing users to directly patch SharePoint servers without centralized Microsoft controls. Outsourcing all SharePoint development to contractors in Eastern Europe with minimal oversight. Publishing patches on public forums before internal testing was complete. Using China-based engineers to support and patch SharePoint on-premises, despite active cyberattacks from China.

Question 2

How did the Russian group tracked as Secret Blizzard or Turla manage to spy on foreign embassies within Russia?

By hacking embassy Wi-Fi routers and extracting unencrypted traffic directly from them. By intercepting unencrypted HTTP traffic using SORM hardware at the Russian ISPs. By exploiting vulnerabilities in embassy virtual private networks (VPNs) to decrypt traffic. By redirecting embassy users to fake Kaspersky antivirus update portals that installed a root certificate and malware for man-in-the-middle attacks.

Question 3

What is the main security concern with TP-Link Archer C50 routers as discussed in the episode?

They use DES encryption in ECB mode for configuration settings, allowing attackers to recover admin passwords. They have a hardcoded backdoor user account enabling remote access without authentication. They expose SNMP management interfaces to the internet with default passwords. They fail to implement WPA3, making Wi-Fi connections vulnerable to KRACK attacks.

Question 4

What unique protection feature did Google introduce for Chrome extension developers to prevent malicious modification of published extensions?

Mandating two-factor authentication on all developer accounts before publishing any extension. Providing developers the ability to generate an RSA key pair offline and upload only the public key for signature verification of extension uploads. Requiring developers to submit source code for all extensions to a manual Google security review prior to approval. Implementing blockchain-based timestamping for all extension uploads to prove integrity.

Question 5

According to the episode's discussion of Microsoft’s MAPP program, why is China's participation in it considered a high security risk?

Because Microsoft only allows Chinese companies entry to MAPP after a background check by U.S. intelligence, which is easily circumvented. Because Chinese law requires companies to report zero-day vulnerabilities to state authorities within 48 hours, possibly enabling the government to weaponize them. Because Chinese companies share their MAPP data publicly on open forums, exposing sensitive info to attackers worldwide. Because Chinese MAPP members are unable to detect advanced persistent threats, invalidating early warning efforts.

Cancel

Episode #1037 Quiz

Question 1

Question 2

Question 3

Question 4

Question 5