Security Now·TWiT
Wszystkie odcinki
1 sezon · 1105 odc.
S1 · E1
90 min
How a never-disclosed Windows vulnerability was quickly reverse-engineered from the patches to fix it and turned into more than 12 potent and damaging Internet worms in three days. What does this mean for the future of Internet security?
S1 · E2
90 min
How Microsoft's "HoneyMonkey" system works, how it finds malicious web sites before they find you, and what Microsoft is doing (and NOT doing) with this valuable security information it is now collecting.
S1 · E3
90 min
Most people don't think of common NAT routers as hardware firewalls, but ANY NAT router inherently provides terrific security and protection against incoming malicious traffic. Learn how and why this is, and which default settings MUST be changed to lock down the security of your NAT router.
S1 · E4
90 min
Everyone who uses web-based services such as eBay, Amazon, and Yahoo, needs to authenticate their identity with passwords. Password quality is important since easily guessable passwords can be easily defeated. Leo and I recap a bit from last week's program, then discuss passwords. We suggest an approach that anyone can use to easily create unbreakable passwords.
S1 · E5
90 min
Our previous episode (#4), which discussed personal password policies, generated so much great listener feedback, thoughts, ideas, and reminders about things we didn't mention, that we decided to wrap up this important topic with a final episode to share listeners' ideas and to clarify some things we left unsaid.
S1 · E6
90 min
Triggered by a recent report of three UC Berkeley researchers recovering text typed at a keyboard (any keyboard) after simply listening to ten minutes of typing, Leo and I discuss the weird realm of "alternative information leakage" — from CRT glowing, to radio emissions, to LEDs lamps on the front of network equipment . . . to a microphone listening to anyone typing.
S1 · E7
90 min
Any contemporary discussion of threats to Internet security must discuss the history, current situation, and future of spyware. Leo and I spend a little more time than usual covering many aspects of this important topic. DON'T MISS the Episode Notes Page for this episode!
S1 · E8
90 min
Distributed Denial of Service (DDoS) attacks are occurring with ever-greater frequency every day. Although these damaging attacks are often used to extort high-profile gaming and gambling sites before major gambling events, attacks are also launched against individual users who do something to annoy "zombie fleet masters" while they are online. Some router and firewall vendors claim that their devices prevent DDoS attacks. Is that possible? What can be done to dodge the bullet of a DDoS attack launched against you while you're online?
S1 · E9
90 min
This week we discuss "rootkit technology". We examine what rootkits are, why they have suddenly become a problem, and how that problem is rapidly growing in severity. We also discuss their detection and removal and point listeners to some very effective free rootkit detection solutions.
S1 · E10
90 min
Leo and I examine the security and privacy considerations of using non-encrypted (i.e. 'Open') wireless access points at home and in public locations. We discuss the various ways of protecting privacy when untrusted strangers can 'sniff' the data traffic flowing to and from your online PC.
S1 · E11
90 min
Leo and I answer some questions arising from last week's episode, then plow into a detailed discussion of the lack of security value of MAC address filtering, the futility of disabling SSID's for security, and the extremely poor security offered by the first-generation WEP encryption system.
S1 · E12
90 min
Leo and I discuss details and consequences of Sony Corporation's alarming "Rootkit" DRM (digital rights management) copy protection scheme. This poorly written software unnecessarily employs classic rootkit technology (see episode #9) to hide from its users after installation. It can not be uninstalled easily, it can be easily misused for malicious purposes, and it has been implicated in many repeated BSOD "blue screen of death" PC crashes.
S1 · E13
90 min
Leo and I follow-up on last week's discussion of the Sony Rootkit debacle with the distressing news of "phoning home" (spyware) behavior from the Sony DRM software, and the rootkit's exploitation by a new malicious backdoor Trojan. We then return to complete our discussion of WiFi security, demystifying the many confusing flavors of WPA encryption and presenting several critical MUST DO tips for WPA users.
S1 · E14
90 min
Leo and I first follow-up on the past two episodes, discussing new developments in the continuing Sony Rootkit DRM drama, and clearing up some confusion over the crackability of WPA passphrases. Then, in this first of our two-part series on VPNs, we discuss the theory of VPN connections and tunnels, explaining how they work and why they represent such a terrific solution for anyone who needs security while they're away from home.
S1 · E15
90 min
Leo and I discuss the use of SSL and SSH encrypted tunneling for providing privacy and security whenever an insecure local network is being used — such as at an open WiFi hotspot or when using a hotel's network. These solutions are not transparent and tend to be configuration intensive. They also require the use of a "server" of some sort at the user's home or office. This makes these approaches less suitable for casual users, but offers a solution for the more technically inclined road warriors.
S1 · E16
90 min
Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies we have previously discussed.
S1 · E17
90 min
In our continuing exploration of VPN technology for protecting network users on networks they don't control, Leo and I discuss the oldest "original" VPN protocols: Industry standard IPSec, and Microsoft's own PPTP and L2TP/IPSec. We examine and explain the trouble with interconnecting Windows machines to third-party VPN routers and examine the many reasons these older technologies are probably not optimal for on-the-go road warriors.
S1 · E18
90 min
This week Leo and I discuss and describe the brand new, ready to emerge from a its long development beta phase, ultra-secure, lightweight, high-performance, highly-polished, multi-platform, peer-to-peer and FREE! personal virtual private networking system known as "Hamachi". After two solid weeks of testing and intense dialog with Hamachi's lead developer and designer, I have fully vetted the system's security architecture and have it running on many of my systems. While I am travelling to Toronto this week, Hamachi is keeping my roaming laptop securely and directly connected to all of my machines back home. Don't miss this one!
S1 · E19
90 min
Leo and I wrap up our multi-week, in-depth coverage of PC VPN solutions by discussing some aftermath of the zero-configuration Hamachi system; introducing "iPig," a very appealing new zero-configuration VPN contender; and describing the many faces of OpenVPN, the "Swiss army knife" of VPN solutions.
S1 · E20
90 min
On December 28th a serious new Windows vulnerability has appeared and been immediately exploited by a growing number of malicious web sites to install malware. Many worse viruses and worms are expected soon. We start off discussing this and our show notes provides a quick necesary workaround until Microsoft provides a patch. Then we spend the next 45 minutes answering and discussing interesting listener questions.
S1 · E21
90 min
Leo and I discuss everything known about the first serious Windows security exploits of the New Year, caused by the Windows MetaFile (WMF) vulnerability. In our show's first guest appearance, we are joined by Ilfak Guilfanov, the developer of the wildly popular -- and very necessary -- temporary patch that was used by millions of users to secure Windows systems while the world waited for Microsoft to respond.
S1 · E22
90 min
Leo and I carefully examine the operation of the recently patched Windows MetaFile vulnerability. I describe exactly how it works in an effort to explain why it doesn't have the feeling of another Microsoft "coding error". It has the feeling of something that Microsoft deliberately designed into Windows. Given the nature of what it is, this would make it a remote code execution "backdoor". We will likely never know if this was the case, but the forensic evidence appears to be quite compelling.
S1 · E23
90 min
Leo and I "close the backdoor" on the controversial Windows WMF Metafile image code execution (MICE) vulnerability. We discuss everything that's known about it, separate the facts from the spin, explain exactly which Windows versions are vulnerable and why, and introduce a new piece of GRC freeware: MouseTrap which determines whether any Windows or Linux/WINE system has 'MICE'.
S1 · E24
90 min
Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world "application notes" for any of the security technologies we have previously discussed.
Steve talks about the Kama Sutra virus, scheduled to strike tomorrow, and PC World's anti-virus roundup. Then we delve into How the Internet Works, part 1. We'll wrap things up next week.
Part 2 of Steve's discussion of how the fundamental Internet technologies work. This and the previous episode will provide the foundation for our future podcasts on Internet security issues.
Steve continues to lay a foundation on understanding networking. This week, part one of how LANs work. We cover DHCP, Subnet Masks, Routers, and hubs. We'll conclude with part two on episode 29.
Steve answers your questions on this episide. With further clarification on VPN security, Hamachi, and the answer to the eternal question, which operating system is the most secure.
In this week's marathon edition Steve tackles security issues inherent to Ethernet, including ARP spoofing.
This week Steve takes a look at how cryptography is used and the difficult issues strong crypto raises.
This week Steve continues his discussion of crypto with a look at secret decoder rings and one-time pads.
Episode 32 is our monthly question and answer session.
Part three of Steve's overview of cryptography looks at symmetric block ciphers.
This week Steve explains how public key cryptography works, and we welcome our new sponsor, Astaro! Thanks so much for the support guys.
This week Steve talks about how cryptographic hashes work and are used to verify the integrity of files and email. We also talk about email signing and recommend the Gnu Privacy Guard.
As usual on every fourth episode, Steve answers listener questions.
We wrap up our talk about cryptography with a discussion of prime number generation, key recovery, and digital certificates.
Why is Internet Explorer so insecure? What can you do to secure it? And why is it so hard to make a secure browser? Steve talks about security policy vs. browser flaws, how he uses IE safely, and why Java and Javascript are inherently more secure than ActiveScript and ActiveX.
Buffer overflows... they're the most common kind of security flaw, but what are they and how do they happen? Finally, how can we protect ourselves from them? Steve explains all.
As he does every fourth episode, Steve answers your questions. But first, an update on some recent security news...
The ultimate encryption program, free, open source, strong, and flexible: Truecrypt.
Steve explains the clever technique that Skype and other programs use to end around NAT routers.
Ever wonder what a port is? Steve explains what they are and what terms like "stealth ports" and "port sniffing mean." Leo reads a little poetry.
On this episode, one dozen questons and answers
This week Steve explains the mysterious HOSTS file - part of Windows, OS X, Linux, and many other operating systems. He talks about how malicious programs may misuse it, and how you can use it to protect yourself.
This week Steve tells us what to do with the router logs. What a router can (and can't) tell you about your security situation?
This week Steve tells us about distributed denial of service attacks and how hackers use IRC botnets to create them.
How big can a HOSTS file get? Does a firewall slow you down? A plan to fight phishers. All on this week's edition of Security Now! with Steve Gibson.
How can you tell what your computer is doing on the net? Netstat. This handy program comes with almost all operating systems. On Windows, click Start, then select Command Prompt from the Programs->Accessories menu. To run Netstat, type netstat at the command prompt. For more readable output type netstat -ab.
Virtualization, its history and uses in security.
Will Windows Vista be secure? According to a new study from Symantec, the decision to re-write the networking stack from the ground up means it will be much less secure than XP.
Steve normally answers questions on shows divisible by four, but not this week. There's just too much security news including javascript exploits, Ebay gaming, and the sale of Hamachi.
More on Virtualization technology, with a special focus on VMWare's Virtual Appliances.
The Blue Pill demonstrates a serious security concern with the Hypervisor mode in Windows Vista. Steve discusses the threat and arguments against it.
Sandboxing your browser to keep your system secure.
Our regular session of questions and answers deals with Vista security, remote access, the HOSTS files, and Zone Alarm.
Steve wraps up his rundown of Virtualization programs with a look at Microsoft's free Virtual PC.
Guest: Eric Sites, VP R&D Sunbelt Software Two serious Windows flaws have surfaced today. One, a zero-day exploit, makes it possible for any web site (or HTML email) to take over a Windows machine, even if it's been fully patched. The other is a file corruption error on Windows 2000 NTFS systems introduced by a Microsoft patch.
We conclude our coverage of virtual machine software with a review of Parallels - the fastest of the VM programs.
First a review of three more zero day exploits in Windows XP, then a look at what your ISP knows about you and how to protect your privacy.
How proxy servers work to both speed up access and protect users.
MojoPac software lets you put your entire Windows configuration on a thumbdrive or portable disk and take it with you anywhere. It works surprisingly well, but there are some caveats. Steve reviews.
What makes it so hard to secure Windows? Steve says ultimate security is ultimately impossible.
Why the 64-bit version of Windows is both more secure and less compatible. Steve explains why.
Microsoft is touting PatchGuard, a new security feature in 64-bit versions of XP and Vista. Steve explains how easy it is to hack, and what it's really for if it's not for deterring hackers.
Our monthly question and answer session goes long - but there's lots of good information.
Is there such a thing as anonymity on the Internet? How important is it?
Two interesting implementations of Internet anonymization: The Freenet Project for anonymously storing and transmitting files, and Tor, "the onion router" which can anonymize all your Internet accesses.
Steve's latest free security application is called Securable. It's not quite ready yet, but Steve gives us a preview in this episode.
Our monthly question and answer segment covers TOR details, overheating hard drives, and what happens to your data when you die...
Steve and Leo survey the history and evolution of media property rights and the technologies used to enforce them as they prepare for next week's show: a look at AACS, the most pervasive and invasive system for digital rights management ever created.
Steve and Leo interview Peter Gutmann about his paper A Cost Analysis of Windows Vista Content Protection.
We wrap up our discussion of the premium content protection features in Vista and announce Steve's newest free security utility: Securable.
Our monthly question and answer segment covers DEP on the Mac, HD-DVD decryption, and email privacy...
Steve and Leo discuss Dave Marsh's response on behalf of Microsoft to Peter Gutmann's paper about Windows Vista Content Protection.
Hardware Data Execution Protection is one of the best ways to protect your PC from hackers. Steve discusses how it works, how to turn it on, and the possible pitfalls of using it.
How do spambots work, why do spammers need them, and the best way to block them and prevent spam.
Our monthly question and answer segment covers spam spoofing, VPN mysteries, and online backup security...
Google's massive study of hard drive reliability yields some surprising results. Read more at http://www.grc.com/sn/notes-081.htm
Steve comments on the Federal Computer Week article Cyber officials: Chinese hackers attack 'anything and everything'.
A closer look at Vista's User Access Control.
Jikto is a Javascript tool that can take over your computer and use it to find sites with vulnerabilities. We describe it and the cross-site scripting flaws it looks for.
Updates on the Animated Cursor Vulnerability, a recommendation for security software from eEye, and how the Sony Reader works, plus an in depth discussion of scripting vulnerabilities.
Another common attack vector in web software is the SQL injection. Steve explains what it is and how it happens.
WEP gets even more insecure with a new cracking technique that's 1000 times faster.
Steve explains the theory and practice of multifactor authentication which uses combinations of "something you know," "something you have," and "something you are" to provide stronger remote authentication than traditional, unreliable single-factor username and password authentication.
Guest: Marc Maiffret of eEye Digital Security Marc talks about Windows and Mac security, the coming threat from web applications, and eEye's free, all-in-one protection program, Blink Personal Edition.
Steve looks at software patents and the Microsoft challenge to open source software from the point of view of a developer, patent holder, and expert witness in patent cases.
We've already talked about the three factors of authentication: something you know (e.g. a password), something you have (a passcard), and something you are (a fingerprint). Now Steve talks about the fourth factor of authentication: someone you know, or who knows you.
Open ID, how it works and what it means to you (not having to remember so many passwords for starters).
Steve answers listener mail on subjects like authentication and more...
The FBI says it has uncovered one million computers that are being used by hackers without their owners' knowledge. Today Steve talks about BotNets and the FBI's Operation Bot Roast.
Steve continues our discussion of authentication with a look at Internet identity metasystems.
The Trusted Platform Module - a hardware solution to security now shipping on many computers.
Your questions, Steve's answers as we complete 100 consecutive weeks of shows!
Steve looks at Captcha and Re-Captcha - the pros and cons of trying to distinguish humans from robots, with a side look at Alan Turing and Jeff Hawkins's On Intelligence.
Our first mailbag episode with 20 questions and comments from our listeners.
A closer look at the Paypal Security Key with Michael Vergara, Director of Account Protections at Paypal.
For 16Kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written - Spinrite 6.
Steve, the creator of the original leak test program, talks about leak testing and how hackers work to get around them.
Our second mailbag episode with a dozen questions and comments from our listeners.
Steve looks at Verisign's Personal Identity Provider, an OpenID service that works with the Paypal token, and talks about updates to his Perfect Password page.
Steve talks about developing his in-house E-Commerce system, and how he solved some issues other e-commerce system handle poorly. We also talk about the pleasures of assembly language programming.
Our regular mailbag episode with a dozen questions and comments from our listeners, plus an extra one for fun.
Steve responds to criticisms of the OpenID system and offers some issues to consider when you use it.
How do you solve the problem of secure access to data on the road? Steve shows how he tackled roaming authentication at grc.com and proposes a general solution for everyone.
Our regular mailbag episode with a dozen questions and comments from our listeners including our Great Idea of the Week...
Following up on Episode 113, Roaming Authentication, Steve proposes a great way to strengthen remote access using Perfect Paper Passwords.
Perfect Paper Passwords version two!
Why does Paypal secretly send you through Doubleclick to get to some of its web pages? Steve explains how third-party cookies can violate your privacy and what to do about it.
Is it possible to preserve your privacy in the digital age? It's certainly worth trying.
Our regular mailbag episode with a dozen questions and comments from our listeners...
Steve interviews Dave Wright of JungleDisk, a data storage optimization product for Amazon's S3...
Steve further elaborates on symmetric ciphers, the workhorses of encryption.
Steve discusses Treewalkdns.com, OpenDNS, Rijndael encryption Flash animation, Ironkey, and Opera mini security FAQ.
Steve talks about the challenges of corporate IT security policy and enforcement and the inherent tension between IT security staff and employees.
Steve talks about the remote code execution exploit of the Microsoft Windows TCP/IP vulnerability and answers your questions.
Steve discusses how network administrators can protect their systems using Windows SteadyState.
Microsoft's Super Patch Tuesday, Macintosh updates, Adobe Acrobat exploit, Firefox patch, Vista SP-1, and more.
Steve explores whole-drive encryption and details the release of TrueCrypt 5.0.
Guest: Dave Jevans, CEO of IronKey Steve interviews Dave Jevans of IronKey.
Steve breaks down the concept of dynamic RAM hijacking raised by the recent Princeton study.
The logistics of network congestion, network neutrality and prioritized packets.
ClamAV security flaw, ICQ vulnerability, Opera and more.
Leo and I delve into the detailed operation of the YubiKey, the coolest new secure authentication device I discovered at the recent RSA Security Conference. Our special guest during the episode is Stina Ehrensvrd, CEO and Founder of Yubico, who describes the history and genesis of the YubiKey, and Yubico's plans for this cool new technology.
The free vulnerability scanner and update management tool Secunia PSI.
Two useful but lesser-known Microsoft security utilities.
An overview of next-generation behavioral tracking and profiling systems.
How third parties are gaining footholds in ISP facilities in order to access your data.
More on the privacy threat from the Phorm system.
The nuts and bolts of DNS and the DNS cache poisoning attacks.
A follow-up on the serious, and somewhat still present, DNS protocol spoofability flaw.
Black Hat Conference revelations, where Vista's security improvements fall short, and more.
Steve drills down to determine the security levels offered by Google Chrome.
The benefits, challenges, and nuances of secure DNS.
Steve explains yet another security flaw in the TCP stack.
Airport security checks and balances, white knuckle Disney adventures, and the limits of spyware infestations?
Steve tells you why you must always explicitly log out from banking and other important sites.
Steve discusses clickjacking, aka UI redressing, which tricks users into unintended web-based actions.
Why you shouldn't worry about the TKIP crack.
Steve and Leo return to take a much closer look at "Sandboxie", an extremely useful, powerful, and highly recommended Windows security tool they first mentioned two years ago. This time, after interviewing Sandboxie's creator, Ronen Tzur, Steve explains why he is totally hooked and why Leo is wishing it was available for his Macs.
The limitations of sandboxing in preventing the negative impacts of malware.
How to use Microsoft's little-known DropMyRights utility for safer browsing.
Breaking SSL, PDP-8s, and Ultracapacitors. Full show notes are available at grc.com.
How security certificates are created and signed, what they do for us, and the MD5 hash.
Steve gives an overview of the major concepts and components of encryption.
Windows Update, IE7 Problems, ActiveX and Windows 7 issues, SQL attacks, and more.
MSFT Autorun updates, FreeBSD telnetd, IE7 critical exploit, Acrobat Reader, and more.
Past and recent problems with Windows Autorun.
Internet Explorer 8 speed benchmarks, cookies, Compatibly Mode, Smart Screen filter, DEP, and more.
A look into GhostNet, the alleged Chinese cyber-spying network.
This mailbag episode discusses new Firefox plugins, Conficker, buffer overflow, and more.
Steve analyzes Conficker, the sophisticated worm that has spread to more than 10 million PCs worldwide.
This mailbag episode covers Conficker, Windows process control, NeXT, Ironkey, and more.
Steve describes the Internet's most-used security protocol, SSL, now evolved into TLS.
This mailbag episode includes SSL/TLS, worms-resistant NATs, PDF JavaScript, nuclear power stations running Windows, and more.
Security changes, additions and enhancements to Microsoft Windows 7.
This mailbag episode includes FASM, scripts, sockets, SSL/TLS, HTTPS, Windows 7's XP mode, and more.
A good book, the IPv6 protocol, and Steve's secure TCP idea that doesn't use a VPN tunnel.
In this mailbag episode we discuss IPv6, Non-VPNs, Microsoft ClickOnce, expired SSL certificates, and more.
The operation, features, and security of PKWARE?s free SecureZIP file archiving and encrypting utility.
In this mailbag episode we discuss SecureZip, WPA/WPA2, home-grown VPNs, foreign ATMs, and more.
Steve tells of the Bob Boyer and J Strother Moore algorithm for finding a substring in a buffer.
An examination of Lempel-Ziv data compression, one of the most prevalent computer algorithms of all time.
Security updates in Windows Office, IAS, Virtual PC, Virtual Server, msvid control, and more.
Steve answers questions on AES-256, iPhone security, TrueCrypt, Firefox privacy, and more.
Steve answers questions on SSL encryption, 3g security, Trojans, VPNs as infection vectors, and more.
A rare off-topic discussion about Steve's research into vitamin D.
Security news and listeners' questions...
Steve covers the security implications of electronic voting machines.
Steve answers questions on iPIG VPN, Flash cookies, firewalls, parents' passwords, and more.
The inherent insecurities of GSM, the pseudo-random bitstream cipher protecting data on billions of phones.
Steve addresses feedback on GSM security, cookies, router admin passwords, proxy servers, and more.
Steve and Leo talk about various security maxims, what they mean, why you should follow them, and more.
Leo and Steve talk about Microsoft Security Essentials, your questions, and more.
How SSLs can be spoofed in man-in-the-middle attacks.
Why patches are impossible, the Total (In)security virus, and why writing software shouldn't be too easy.
The problem with Javascript and security. Guest John Graham-Cumming says it's the "elephant in your browser."
We've got the latest security news, including an SSL hack, plus eight great questions from you and Steve's answers...
Steve explains how a serious exploit in SSL works.
Security news, including the NSA's contributions to Windows 7, iPhone bot nets, plus Steve answers your questions.
Apple fixes security flaws, Ford SYNC SDK, black screen of death, same origin troubles, and more.
Digital voting goes open source, patch Tuesday news, and Steve answers your questions.
Steve covers what may be the future of conflict, Cyberwarfare.
Steve responds to questions covering Skype spam, SSL cracking, unencrypted UAV video feeds, free SSL certificates, and more.
A hard look at the costs and benefits of following all security advice.
This week's questions cover packet flow, hijacking DNS queries, router DNS, Patch Tuesday, and more.
Steve catches up with a mega security update, then gives us some of his favorite (wacky) products from CES.
Steve answers listener questions about live Linux CDs, TrueCrypt RAM encryption, resetting Thomson modem passwords, and more.
Steve explains how computers work by designing one from first principles.
Internet Explorer as a file system, using Live CDs for security, and Steve takes on the iPad...
For 16kpbs versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
More flash vulnerabilities, security updates, fake security software, Steve answers your questions, and more.
An introduction to the use of "indirection" in computer science, security news, and more.
Steve answers your questions about webcam privacy, unencrypted data in ram, and more.
How stacks, registers and recursion are interrelated, the latest security news, and more.
Patch Tuesday, Opera vulnerabilities, the RSA conference, RealDVD, and more.
Steve continues his talk on the foundational technologies of computing. This week: how computers do more than one thing at a time using interrupts.
Critical updates from Microsoft and Apple, good news for Gmail security, and a warning for nudists...
Firefox updates, vulnerabilities in .PDFs, Steve's iPad review, SSL/TLS, and more.
Microsoft security updates, the FCC's jurisdiction on bandwidth shaping, Java flaws, iPhone OS security, the state of SSL security, and more.
Steve and Leo seriously examine the proven comparative security of open versus closed source and development software, and open versus closed execution platforms.
Stolen Google source code, GSM hacked, photocopy machine hard drive security, your questions, and more.
Opera vulnerabilities, Adobe PDF insecurities, malware from the US Treasury, Steve joins Twitter, and more.
Patch tuesday, laptop camera surveillance, Yahoo! messenger worm, and more.
Shockwave issues, Mozilla's plug-in check, weaponized email, hacking cars, your questions, and more.
Manually updating IrfanView and Free Download Manager, Google wifi litigation, how operating systems work, and more.
Tabnabbing, Adobe security rumors, iPad data plan changes, your questions, and more.
Adobe zero-day, overwrought iPad security news, the evolution of computing architectures, and more.
Mac update, AT&T hijinks, another zero-day vulnerability from Microsoft, Adobe delays pdf fix, your questions, and more.
The 25 year legacy of unbelievably complex technologies used in microprocessors to maximize performance.
Out of cycle Acrobat and Reader updates, Firefox improvements, flawed SSL study, internet kill switch, your questions, and more.
Steve thoroughly evaluates LastPass, explains why high-security passwords are necessary, and tells us how LastPass makes storing those passwords secure.
Chrome update, ClearCloud DNS, Microsoft and Russian camaraderie, LastPass, your questions, and more.
Windows shell worm in the wild, Security Essentials 2.0 beta, Secunia's 5-year analysis, and more.
Firefox mega security update, WPA2 broken?, .LNK viruses in the wild, infected Dell motherboards, your questions and more.
Windows .LNK vulnerability fixed, Google's WiFi "overcollection" in the UK, news from Blackhat, DNS rebinding, and more.
PayPal discontinues their virtual credit card service, RIM placing servers in Saudi Arabia, Firefox v4 updates silently, your questions and more.
Apple fixes the jailbreak hole, trojans on Android, Strict Transport Security (STS), and more.
Out-Of-Cycle update from Adobe, Apple security update, binary planting, Spanair 2008 crash, your questions, and more.
Consequences of the web not being designed for privacy, including non-consensual user tracking.
Fix-It for .dll hijack, danger from applications changing the working directory, first successful 64-bit Windows root kit, your questions, and more.
Microsoft's 2nd Tuesday update, new 0-day vulnerabilities in Adobe, Firefox fixes, "Stuxnet" worm, delegated access through OAuth, and more.
Flash update, Microsoft ASP .NET problem, HDCP master key leak, Twitter "OnMouseover" XSS flaw, your questions, and more.
New 0-day for Windows, HDCP decryption software, Stuxnet & Iran, COICA, cryptography systems and backdoors for law enforcement, and more.
Adobe Acrobat patched, RIM and India going 'round & 'round, Comcast VS. Bot, and more.
Microsoft breaks Patch Tuesday update record, Facebook adds OTPs and remote signout, What is The Evercookie?, and more.
Microsoft reports on Java exploits, new Adobe Reader will sandbox, feedback from MSRT, your questions, and more.
Mozilla and Real Player updates, Firefox 0-day, Wall Street Journal tracking and privacy series, session hijacking for the rest of us, and more.
Firesheep firestorm, Flash 0-day exploit in the wild, another iPhone lock screen bypass, your questions, and more.
Second Tuesday updates, critical Outlook fix, Android risks, Google expands "bug bounty", GRC's DNS Benchmark, and more.
Big Apple update, IE6/7 0-day unpatched, infected Chinese cell phones, Stuxnet's probable target, your questions, and more.
Safari update, HTTPS Everywhere, FBI wants to wiretap the Internet, comprehensive DNS spoofability test, and more.
New WIndows kernel vulnerability, Wikileaks siprnet, Vitamin D findings, your questions, and more.
Windows 7 SP1 reaches RC level, Google Chrome v8.0 released, What is SHIELD?, How to keep track of people using RFID tags, and more.
Microsoft's December security updates, backdoor in BSD, WikiLeaks DDoS, your questions, and more.
OpenBSD discredits backdoor, weak net neutrality, compromised site warnings from Google, Bluetooth in depth, and more.
An encore presentation of an enlightening story from Steve's past.
Microsoft acknowledges IE problem, hacking GSM phones, Stuxnet update, your questions, and more.
Cross Fuzz, warrantless cell phone searches, Obama's "Unified Internet Identity", flavors of bluetooth hacking, and more.
Israel and US teamed up on Stuxnet, global IPv6 test coming, your questions, and more.
Google awards first "Elite" security award, Facebook SSL and HTTPS, unprivileged work e-mail, stress testing browsers, and more.
Gingerbread data disclosure vulnerability, SourceForge hack, IPv4 depletion, zero-day attacks no more, your questions, and more.
Firefox adds "Do Not Track", Verizon alters web content, McAfee on Mobile Malware, BitCoin, and more.
A critical Microsoft vulnerability, The differences between open and closed source software, A number of questions around BitCoin, and more.
After catching up with the week's security updates and other security-related news, Steve and Leo discuss the many modes of operation of "Proxied Web Surfing" which are used to bypass firewalls and Internet filters, aid free speech, and alter the contents of web pages retrieved from the Internet.
Windows 7 service pack 1 is out, Apple's Thunderbolt security, Facebook's HTTPS security turns itself off, and more.
The anatomy of Stuxnet, plus Pwn2Own is underway meaning updates from Apple, Google, Microsoft, and more.
The consequences of Pwn2Own, Issues around the Japanese earthquake, reverse DNS, and more.
Internet Explorer 9, RSA Security comprimised, India versus Blackberry, and more.
Fraudulent SSL certificates, RSA SecurID breach update, Real Player vulnerability, your questions, and more.
RSA SecurID Break-in, YubiHSM, Epsilon security breach, DNT gets traction, and more.
64 fixes from Microsoft, Another Flash exploit, Wordpress hacked, your questions, and more.
iOS location tracking, Pass phrase security, Dropbox authentication, and more.
Sony Playstation Network breach, Mobile tracking, Disc Drive steganography, your emails, and more.
Firefox and Chrome updates, Apple tracks differently, Bin Laden's security, relying on randomness, and more.
Reasons you should change your Facebook password right now, Zero Day, a new Do Not Track bill, and more.
DIY Malware kite for Mac, Protect IP act, Achieving true randomness, and more.
Mac Defender malware, Sony's continuing security woes, Android vulnerability patched by Google, your questions, and more.
Making passwords memorable AND uncrackable, More on Mac Defender, Lockheed Martin breach, and more.
RSA SecurID token replacement, Sony breaches continue, your questions, and more.
Website surveillance monitoring and blocking, IMF breach, commercial bank fraud liability, and more.
Malware stealing Bitcoins, Dropbox security, WordPress hacked, your questions, and more.
LulzSec says farewell, cost of Citigroup attack, National Institute of Standards and Technology, and more.
Dropbox TOS update, Microsoft's Skype intercept patent, evaluating LulzSec, your questions, and more.
Steve explains how the internet works with three basic principles, plus security updates, security news, and more.
iOS updates, careers in computer security, randomness in cryptography, your questions, and more.
Apple iOS Certificate, Passware, dissecting the crypt_blowfish bug, and more.
We find a way to keep Tor from being censored, KISSmetrics's sneaky cookie and your questions answered by Steve.
Adobe patches galore, a deep look at ICMP and UDP, and more.
Tons of Firefox news, Gizmodo off the hook, lot's of questions, and more.
Caesar Cipher, Playfair Cipher, going off the grid and more.
Google's fraudulent SSL Certificate, Pakistan bans encryption software, your questions, and more.
DigiNotar mega-update, DNS hack of NetNames, TCP demystified, and more.
More on DigiNotar, GlobalSign security breach, your questions, and more.
DigiNotar bankruptcy, SSL weakness discovered, alternatives to the CA Hierarchy Model, and more.
Kindle Fire and the Silk browser, MySQL breach, your questions, and more.
HTC not sandboxing Android data, phishing on the rise, Browser Exploit Against SSL/TLS, and more.
Fighter drone's malware infection, Germany deliberately installing malware on traveller's computers, your questions and Steve's answers.
Details on the Silk browser, Google encrypted search, TCP attacks, and more.
Two Internets, Stuxnet variant "DuQu", Spanning Tree Protocol, your questions, and more.
Certificate authorities compromised, BT to block Newzbin, Mac OSX Bitcoin mining malware, "Bytes in Flight", and more.
DuQu worm, remote code execution kernel vulnerability, Adobe abandons Flash for mobile, your questions, and more.
Firefox 8, SOPA, Kindle Fire first look, and more.
SOPA, SCADA hacked, Kindle Fire extended review, your questions, and more.
Comparing Mozilla's BrowserID to other security technologies, Android malware, Malvertising, and more.
DNSCrypt Beta for Mac, Zeus banking trojan, Carrier IQ, your questions, and more.
Microsoft, Adobe, and Carrier IQ security news, and more.
Background updates of IE, more on Carrier IQ, your questions, and more.
Firefox 9, SOPA, Sci-Fi movie and book recommendations, and more.
Microsoft's Out-Of-Cycle patch, FISA constitutionality, your questions, and more.
Simple Secure Wifi isn't very secure, password recovering charger, WPA cracker, and more.
Zappos customer data breach, Slow Motion DDoS, your questions, and more.
Forcing laptop decryption, GPS tracking now requires a warrant, DNS poisoning, and more.
Google's privacy policy changes, Region's lost 401k data, pcAnywhere source stolen years ago, your questions, and more.
NSTIC update, webcam nightmare, a NoScript-like extension for Chrome, and more.
SSL's public key encryption, pcAnywhere, Google Wallet, your questions, and more.
The iOS cookie incident, whether Anonymous might take down the Internet, and more.
HTML video copy protection, protection against forced decryption, Yubico "Nano", your questions, and more.
LulzSec leader betrays Anonymous , how a site can know your social networks, comparing HTTP to SPDY, and more.
6th annual Pwn2Own, Microsoft's noisy 2nd Tuesday, Wikipedia transfer from GoDaddy complete, your questions, and more.
Buffer Bloat on the internet, NSA Super-Super Computer Center, Apache Server Status information leakage, and more.
Ten great answers and questions, buffer bloat, security news, and more.
Global Payments card processor breach, Apple holds security key for iCloud, iPhone passcode exploit, and more.
Flashback infects 670,000 Macs, safety of Safari password storage, Windows Defender Offline, your questions, and more.
Steve gathers up all the cloud storage solutions and gives us his review.
During this special Q&A episode, Iyaz and I host an entirely Twitter-driven Q&A episode, caused by the flurry of interest created by last week's focus upon Cloud Storage Solutions. After catching up with the week's security-related events, we zip through 21 tweets, then focus upon and examine the security architecture of one controversial and popular cloud storage provider: Backblaze.
After catching up with the week's news and Twitter feedback, Leo and I closely examine three remote cloud storage solutions whose Crypto was done COMPLETELY right, Offering full TNO (Trust No One) security. And one of them makes me (Steve) wish I were a Mac user!
After catching up with the week's news, Steve and Leo look at the state of the slow but sure and steady progress being made to tighten up the Internet's eMail security. Since spoofing and phishing continue to be huge problems, these problems continue to command the attention of the Internet's largest commerce, financial, and social networking domains. The good news is: There's good reason for hope!!
Steve and Leo tackle two new and interesting threats to Internet security. First, the newly discovered “Flame” / “Flamer” / “Skywiper” malware dwarfs Stuxnet and Duqu in capability and complexity. Then they examine the work of two University of Michigan researchers who have detailed a collection of new ways to attack the TCP protocol. They inject malicious content into innocent web pages and add malicious links to online chats.
This week, after catching up with a large amount of the week’s news, Leo and I carefully examine two major new discoveries about the Windows Flame worm.
S1 · E358
90 min
S1 · E359
90 min
After catching up with a few items of security and privacy news, Leo and I return to the Internet's "Buffer Bloat" problem to share the new solution “CoDel” (pronounced “coddle”) that has been developed by several of the Internet's original and leading technologists and designers.
S1 · E360
90 min
S1 · E361
90 min
After catching up with the week's security news, Leo and I take a close look at the recent “DNS Changer” malware, the FBI's role in the “takedown” of the malicious servers, and the expert technical assistance provided by Paul Vixie, one of the pioneers and principal developers of the Internet's Domain Name System (DNS).
S1 · E362
90 min
S1 · E363
90 min
After catching up with an eventful week of security news, Leo and I explore a variant of the story of “Ali Baba's Cave” as a means for clearly explaining the operation and requirements of cryptographic Zero-Knowledge Interactive Proofs.
S1 · E364
90 min
After catching up with an eventful week of security news, Leo and I describe and explore the details of the “epic hack” that recently befell well-known technology writer Mat Honan.
S1 · E365
90 min
S1 · E366
90 min
After catching up with a collection of miscellaneous and interesting security-related news, Leo and I take a close look at the long-term consequences of the many massive password leakages which have occurred. The upshot? Hackers are getting MUCH better at cracking passwords, and “clever” techniques can no longer be regarded as safe.
S1 · E367
90 min
We have so much security news and information to cover this week that we didn’t have time to take questions from our listeners. What we have, instead, is a LOT of interesting news about the new Java vulnerabilities, new TNO cloud storage solutions, and lots more.
S1 · E368
90 min
S1 · E369
90 min
After catching up with an eventful week of security news, Leo and I step back for an overview and discussion of the slowly evolving state of the art in Internet Identity Authentication.
S1 · E370
90 min
We begin the week with a visit with our distinguished guest, Mark Russinovich, late of Sysinternals and now with Microsoft. Mark joins us to chat about the release of his second security thriller, “Trojan Horse,” and to share some of his view of the security world.
S1 · E371
90 min
S1 · E372
90 min
After catching up with just a tiny bit of security news (it was a very quiet week in security), Leo and I take the podcast's first-ever comprehensive look at the emerging and increasingly popular NFC (Near Field Communications) technology, which is now present in tens of millions of cell phones and other mobile and fixed-location devices.
S1 · E373
90 min
S1 · E374
90 min
After catching up with the week's most important security news, Leo and I wind up our propeller-cap beanies, right to the breaking point of their springs, in order to obtain enough lift to examine and explore the operation of ECC - Elliptic Curve Cryptography - the next-generation public key cryptography technology.
S1 · E375
90 min
S1 · E376
90 min
This week, after failing to find much in the way of interesting security news, Leo and I make up for that by introducing the concept of “Fully Homomorphic Encryption,” which allows encrypted data to be operated upon WITHOUT it first being decrypted, and results remain encrypted.
S1 · E377
90 min
S1 · E378
90 min
After catching up with an interesting and varied grab-bag of security news and paraphernalia, Tom and I further examine the controversy surrounding Microsoft's decision to enable the Do Not Track (DNT) "signal" header in IE10, and share some insights gained from a recent Microsoft Executive VP Keynote presentation about exactly this issue.
S1 · E379
90 min
S1 · E380
90 min
After catching up with lots of interesting security news, updates on Steve's Acoustic Dog Training project, and lots of other miscellany, Leo and I examine a recently developed and increasingly popular Internet security protocol, DTLS, which combines the advantages of UDP with SSL security.
S1 · E381
90 min
S1 · E382
90 min
After catching up with the week's news, Leo and I take a deep dive into the technology of the ever-more-ubiquitous “QR Codes” which are popping up everywhere and are increasingly being used, not only for good, but with malicious intent.
S1 · E383
90 min
S1 · E384
90 min
For this special year-end holiday edition of Security Now!, I dug down deep into my video archives, taking back 22 years, to 1990, to share a 45-minute presentation I gave, once upon a time, on the inner workings of the “megabyte-sized” hard disk drives that gave birth to the PC industry.
S1 · E385
90 min
S1 · E386
90 min
After catching up with a very busy week of interesting security news and events, Leo and I examine the growing privacy and security problems created by the ever more pervasive social widgets - Facebook's LIKE button, Google's +1, Twitter's Tweet!, and others - and they offer an easy-to-use free solution!
S1 · E387
90 min
S1 · E388
90 min
After catching up with a bunch of fun and interesting news of the week, Leo and I examine the future of anti-hacking password scrambling and storage with the introduction of “Memory Hard Problems,” which are provably highly resistant to massive hardware acceleration.
S1 · E389
90 min
Leo and I discuss the week's major security events—and the disastrous news of 81 million exposed vulnerable routers!—discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.
S1 · E390
90 min
After covering “UPnP a week later” and catching up with some interesting security industry happenings, Leo and I take a look into the controversy surrounding the security (or lack thereof) of Kim Dotcom's new “Mega” cloud storage offering.
S1 · E391
90 min
S1 · E392
90 min
We first converse with today's special guest, Brian Krebs, who for many years wrote for the Washington Post and is now publishing his own “Krebs on Security” blog. Our topic is “The Internet Underground.” After that, we catch up with a somewhat busy and interesting week in Internet security.
S1 · E393
90 min
S1 · E394
90 min
Evernote resets 50 million passwords, Oracle issues emergency JAVA update, Tor's updated operation, and more.
S1 · E395
90 min
More JAVA vulnerabilities, more Flash vulnerabilities, DNT and IE10, your questions, and more.
S1 · E396
90 min
Bitcoin, Carna Botnet, Krebs DDoS'd, distributed hash tables, and more.
S1 · E397
90 min
Apple authentication, FBI and Real-Time interception, your questions, and more.
S1 · E398
90 min
COX is blocking UPnP, "Darkleech", poor Comcast JavaScript, Distributed Database technology, and more.
S1 · E399
90 min
Comcast's Blocked Ports, Verizon DSL begins to NAT it's users, VUDO, your questions, and more.
S1 · E400
90 min
Wordpress botnet, another JAVA update, CRAPCHAs, Virtual Private Networks, and more.
S1 · E401
90 min
Another JAVA flaw, Google Street View data collection in Germany, Malware in Google Play Apps, and more!
S1 · E402
90 min
Security news, "BitTorrent Sync", and more.
S1 · E403
90 min
Quantum Internet, BT tests IP address sharing, Syria on the Internet, your questions, and more.
S1 · E404
90 min
iPhone cracking for law enforcement, New Yorker opens an anonymous dead-drop system, Syria dropped off the Net again, and more.
S1 · E405
90 min
New Firefox cookie policy, Skype snooping, your questions, and more.
S1 · E406
90 min
Login with Amazon, Google to update SSL certificates, anatomy of a hack, and more.
S1 · E407
90 min
Car door lock mystery, Zeus Trojan on Facebook, your questions, and more.
S1 · E408
90 min
Diving deep and defining NSA's PRISM data collection, and more.
S1 · E409
90 min
More on PRISM, the business of secretive communication, your questions, and more.
S1 · E410
90 min
S1 · E411
90 min
S1 · E412
90 min
A creepy PRISM thought, a defense against it, a big Microsoft patch Tuesday, and more.
S1 · E413
90 min
Microsoft handing NSA encrypted messages, Feds disinvited to Def Con, and more.
S1 · E414
90 min
Department of Homeland Security overreaction, Feds want master encryption keys, Apple's dev site hacked, and more.
S1 · E415
90 min
XKeyscore, SkyDrive looking for a new name, Megamos Crypto, your questions, and more.
S1 · E416
90 min
Firefox 23, Twitter multi-factor auth improvements, NSA Director's bad time at Black Hat, and more.
S1 · E417
90 min
Lavabit, Silent Circle, Android and BitCoin, your questions, and more.
S1 · E418
90 min
Steve and Leo cover the consequences of the Snowden leaks and, with that in mind, they examine the Pretty Good Privacy (PGP) system for encrypting email and attachments.
S1 · E419
90 min
Kim Dotcom's secure email solution, Wickr, Cackle, Hemlis, your questions, and more.
S1 · E420
90 min
NSA and USA in the doghouse, New Zealand bans software patents, more JAVA trouble, and more.
S1 · E421
90 min
LastPass and the NSA, MyOpenID, Patch Tuesday, NSA versus encryption, and more.
S1 · E422
90 min
Social media monitoring at school, unpatchable Java 6 exploits, IPv6 subversion, and more.
S1 · E423
90 min
NSA-influenced code and backdoors, iOS7 flaws, TouchID, and more.
S1 · E424
90 min
Fingerprints are usernames, BitTorrent Chat, Steve's practical replacement for website usernames and passwords, and more.
S1 · E425
90 min
Secure QR Login followup, Lavabit defied the FBI, Microsoft's second Tuesday, your questions, and more.
S1 · E426
90 min
Two new valuable features of SQRL, Internet Governance Project, Lavabit, and more.
S1 · E427
90 min
Google's “Project Shield”, CryptoSeal, CryptoLocker, Shumway, and more.
S1 · E428
90 min
Firefox 25, LinkedIn Intro, CryptoLocker, SQRL, your questions, and more.
S1 · E429
90 min
TrueCrypt Audit, Google versus the NSA, LastPass update, and much more news.
S1 · E430
90 min
Microsoft TIFF 0-day flaw, lots of Bitcoin happenings, your questions, and more.
S1 · E431
90 min
Security news, the coin wallet idea, why does proXPN allow only twelve characters, Steve explains RADIUS, and more.
S1 · E432
90 min
Following another week overfilled with interesting security-related news, Steve and Leo spend an hour and a half diving deeply into an updated (and likely very close to correct) understanding of the COIN payment card, news on the CryptoLocker front, a close look at a patent troll case that has so far done the wrong way, and much more.
S1 · E433
90 min
A closer look at "BULLRUN", the NSA's code name for their Encryption Cracking initiative, TL Warp Drive, and more.
S1 · E434
90 min
Patch Tuesday, Firefox 26, NSA and Google cookies, your questions, and more.
S1 · E435
90 min
All things NSA, Acoustic Crypto Key leakage, FIDO Alliance and SQRL, your questions, and more.
S1 · E436
90 min
Steve opens up his archives to show some of his first appearances with Leo on the Screen Savers.
S1 · E437
90 min
We talk about the NSA and ANT protocols, more CryptoLocker news, the SnapChat leak of names and phone numbers, and more.
S1 · E438
90 min
After catching up with another busy week of security news, we dive into the amazing NSA ANT documentation to learn about the NSA's field capabilities.
S1 · E439
90 min
S1 · E440
90 min
More point-of-sale malware news, overtrain Apple's TouchID for reliability, BlueTooth LE's pairing is "just broken" and more.
S1 · E441
90 min
Steve and Leo examine research performed by Dashlane (makers of a password manager). They have researched and presented the current state of the Top100 web retailer's password policies.
S1 · E442
90 min
S1 · E443
90 min
Steve's original plan to explain Google's terrific innovations in web performance, known as "QUIC" were derailed by the overwhelmingly worrisome security news, so this week's podcast is pure, and rather sobering, news of the week.
S1 · E444
90 min
Goto: Fail, Apple's SSL screw up, WhatsApp TOS change, Telegram, Mt. Gox & Bitcoin, and more!
S1 · E445
90 min
Was the iOS SSL flaw done on purpose? NSA spying on Yahoo users' webcams, Steve makes a shocking admission about Windows XP, and more!
S1 · E446
90 min
Snowden's SXSW appearance, SQRL coming in 34 languages, the deepest look yet into Apple's iOS security, and more!
S1 · E447
90 min
More "XP Armageddon", PwnToOwn, cloud storage costs plummet, and more!
S1 · E448
90 min
An important Fix-It for a new 0-day vulnerability in Microsoft Word, has WPA2 Wi-Fi been cracked? iOS security part 3, and more.
S1 · E449
90 min
The NSA / Dual_EC_DRBG flaw is worse than we knew, is Google's Always HTTPS for Gmail a bad thing? A quick WiFi password install for iPhones, and more.
S1 · E450
90 min
The end of updates for Windows XP, AnyDVD, the Heart Bleed Bug, and more.
S1 · E451
90 min
The previous week consisted of nearly a single story: Heartbleed. It was only "nearly", though, because we also received the results from the first phase of the TrueCrypt audit.
S1 · E452
90 min
Ladar Levinson's appeal ruling, Google could bring end-to-end encryption to the masses, Jailbreaking iOS and more!
S1 · E453
90 min
Internet Explorer 0-day flaw, a new look for Firefox v29, what do we do when good certificates go bad? And more!
S1 · E454
90 min
OpenID and OAuth vulnerability rediscovered, US Gov begins testing Universal CyberID, certificate revocation part 2: how practice follows theory, and more!
S1 · E455
90 min
Microsoft's 2nd Tuesday patches, the Certificate Authority Security Council weighs in on Chrome's revocation solution, the appeal decision in Oracle vs. Google, and more!
S1 · E456
90 min
Steve and Leo examine the practical size of randomness and the challenge of collecting Entropy in a client that may not have any built-in support for providing it, and may also be surrounded by active attackers.
S1 · E457
90 min
During this week's Q&A we host a special guest, industry veteran and ISP, Brett Glass, who shares his views on the confusing Network Neutrality debate. We also catch up with the past week's security news and answer 10 questions and comments from our listeners.
S1 · E458
90 min
Steve and Leo look back upon and analyze the past seven days of insanity which followed the startling surprise "self-takedown" of the long standing TrueCrypt.org website, and of TrueCrypt itself.
S1 · E459
90 min
Google's browser-based PGP, more OpenSSL troubles, iOS8 thwarts tracking? And Steve answers your questions!
S1 · E460
90 min
Steve and Leo discuss the need for, and the Internet industry's search for, new standards for "Authenticated Encryption" which simultaneously encrypts messages for privacy while also authenticating them against any active in-flight tampering.
S1 · E461
90 min
The EFF wants internet users to open up their Wi-Fi networks, BoringSSL, Google to start offering domains, and more.
S1 · E462
90 min
Paypal's security misfires, serious Android crypto key theft vulnerability affecting 86% of devices, and we announce and launch the beginning of a multi-part podcast series which will examine and analyze the many current alternatives for securely (TNO) storing our files "in the cloud."
S1 · E463
90 min
Microsoft's Patch Tuesday & they fumble a takedown, Oracle ends XP's Java, Cloud Storage Solutions update and more!
S1 · E464
90 min
Three Internet of Things standardization groups, Google hires a team of hackers for "Project Zero," Has CryptoLocker been neutralized? And more!
S1 · E465
90 min
Level3 responds to Verizon's network congestion chart, Canvas Fingerprinting, Microsoft Research says not to use strong passwords? And more!
S1 · E466
90 min
iOS v7 HAS been Jailbroken, iOS Backdoors and Canvas Fingerprinting, WhisperSystems' truly secure "Redphone" comes to iPhone as "Signal", Android found not to be checking certificate chains, Clarification in the Verizon vs Level3 argument, and Q&A #193.
S1 · E467
90 min
HP's recent analysis of the (lack of) security in "Internet of Things" appliances, BadUSB, Steve's analysis of browser-based password managers, and more!
S1 · E468
90 min
BadUSB follow-up, LastPass outage, Google to prioritize websites with HTTPS, and more!
S1 · E469
90 min
Who can access your digital assets after death? HTTP Shaming, last week's internet outage, and more!
S1 · E470
90 min
"Autonomous" vs. "Anonymous", Sony's Playstation Network DDoS attack, the first confirmed Heartbleed intrusion and more.
S1 · E471
90 min
The iCloud iBrute iHack, more consumer Wi-Fi router security troubles, encrypting email... with PGP? And more!
S1 · E472
90 min
The Home Depot breach, Comcast gets pretty intrusive, Google declares war on the SHA-1 hash and more!
S1 · E473
90 min
Comcast versus TOR, a big Linked-In mistake, a serious pre-KitKat Android problem and more!
S1 · E474
90 min
Apple's iOS 8 security, Google and Dropbox team up in a new venture, encrypting some data versus all data, and more!
S1 · E475
90 min
After covering a very busy and interesting past week of security and privacy news, Father Robert and Steve explain, examine, and dig down deep into the many fascinating details of the worst-ever, two-decade old, latent and pervasive Internet bug known as "ShellShock."
S1 · E476
90 min
JP Morgan Chase and the largest breach yet, Yahoo!'s servers hit by ShellShock, BadUSB exploit code posted to Github, and your Q&A!
S1 · E477
90 min
A new Windows 0-day exploit, rumor of a pending SSLv3 flaw and Steve analyzes the next evolution in online payment technology which replaces traditional credit card numbers with "Payment Tokens."
S1 · E478
90 min
FBI director wants Congress to fix phone encryption, Google adds Yubikey 2nd-factor authentication, and is there anything to worry about Poodle?
S1 · E479
90 min
Apple Pay vs. CurrentC, Verizon (and AT&T) inserting a sticky cookie, RC4 gets an upgrade tweak, and listener feedback!
S1 · E480
90 min
CurrentC already hacked, a serious OSX Yosemite vulnerability, is your TV watching you? And your questions!
S1 · E481
90 min
Microsoft's Mega Patch Tuesday, Obama wants to reclassify ISPs as telecommunications carriers, verifying a website's authenticity with certificates and more.
S1 · E482
90 min
Dirtboxes spying on cellphones, an update for AT&T and Verizon's Cellular Super-Cookie, worries about BitTorrent Sync's security and privacy, and your questions!
S1 · E483
90 min
Intelligence gathering malware Regin, the Edward Snowden documentary Citizenfour, upcoming Certificate Authority Let's Encrypt and more.
S1 · E484
90 min
Firefox v34, iOS 8 bugs, how to safely report a vulnerability and more of your questions.
S1 · E485
90 min
Poodle Bites (again!), TURLA - an APT (Advanced Persistent Threat) targeting Linux, and very expensive lessons learned from Target and Sony's recent security breaches.
S1 · E486
90 min
Chrome UX changes in 2015, a Las Vegas casino struck hard by a cyberattack, the ethics of disclosing illegally obtained content, your questions and Steve's answers!
S1 · E487
90 min
Steve Gibson introduces and explains Secure Quick Reliable Login (SQRL), Steve's proposal for a replacement for website passwords at DigiCert Security Summit 2014 in Las Vegas.
S1 · E488
90 min
Who hacked Sony? Apple deploys their first forced-update, Snowden docs revealing NSA headaches, and a look back on a busy 2014 for security!
S1 · E489
90 min
The HSTS Super-Cookie, "ThunderStrike," CryptoLocker's successor, and questions from listeners!
S1 · E490
90 min
Lizard Squad's DDoS network largely powered by SOHO Routers, Google abandons pre-v4.4 Android Updates, and British Prime Minister David Cameron proposes outlawing communications that the government cannot eavesdrop on.
S1 · E491
90 min
Why the President was sure it was North Korea, a few Sci-Fi recommendations from Steve, and separating fact from fiction about Cryptographic Backdoors.
S1 · E492
90 min
The Firefox Marketplace, Google takes a bite out of Apple too, Apple agrees to a Chinese audit of their product security, and your questions!
S1 · E493
90 min
Regin's apparent heritage, Bad Linux "GHOST" vulnerability, and how TOR may not be so anonymous after all.
S1 · E494
90 min
Adobe's multiple Flash patches, the U.S. Government announces a cyber threat integration center, the latest on the Anthem breach, and Steve answers listener questions!
S1 · E495
90 min
Leo and Steve catches up with several VERY interesting security events and stories of the week, then we take a close look and a deep dive into the operation of the industry's first change in the official HTTP protocol in 15 years -- the finalization and emergence of the HTTP/2 IETF specification which significantly streamlines web browser and web server interaction.
S1 · E496
90 min
Leo and Steve discuss the week's major security events, including the revelation of the Lenovo crapware "Superfish," the joint GCHQ/NSA Gemalto attack which rendered cellular phones insecure, and Steve answers more of your questions!
S1 · E497
90 min
Leo and I discuss the week's tamer-than-usual news, then we host a terrific interview of the team (recently featured on Sunday's 60 Minutes) who have been working with DARPA to address the challenge of hardening high-tech networked vehicles -- autos and UAVs -- against malicious hacking attacks.
S1 · E498
90 min
Steve and Leo catch up with several VERY interesting security events and stories of the week, then we take a deep dive into two of the week's big security stories: FREAK and RowHammer.
S1 · E499
90 min
A look at the new TeslaCrypt, Yahoo! to eliminate passwords, InstantCryptor and Steve answers your questions!
S1 · E500
90 min
An iPhone/iPad 4-digit PIN hack, the recent Pwn2Own hacking competition, and Steve takes a look at the evolution of booting from BIOS to UEFI and how Microsoft has leveraged this into their "Windows Secure Boot" system.
S1 · E501
90 min
The ongoing GitHub/GreatFire.org DDoS attack, a bad vulnerability discovered in hotel/convention center/visitor routers, a detailed analysis of 10 million passwords and your questions!
S1 · E502
90 min
CNNIC's Root CA cert to be removed from Chrome, Microsoft to change handling of Do Not Track, the "After Market" for IPv4 address space is heating up, and Steve looks at the findings of the TrueCrypt Audit.
S1 · E503
90 min
The EFF wins its Podcast Patent Challenge, an update on CNNIC's root certificates, the Mac "Rootpipe" vulnerability, more viewer questions and Steve's Answers!
S1 · E504
90 min
TrueCrypt audit follow up, Google search history dump, and Steve Gibson and Leo Laporte take a close look at the mechanisms China has developed - both filtering and offensive weaponry - to provide for their censorship needs and to potentially attack external internet targets.
S1 · E505
90 min
Wi-Fi access points can crash iOS devices, CryptoWall installed via malicious ads for two months, thoughts about ad blocking, and Steve answers your questions!
S1 · E506
90 min
The "Pixie Dust" failure of WPS, disabling RC4, Mozilla putting on the pressure to phase out HTTP, two very different and well thought out statements about law enforcement backdoors.
S1 · E507
90 min
Appeals court rules that sweeping up Americans' data is illegal, Europe's Smart Grid crypto is dumb, SSD on-the-shelf data retention, your questions and Steve's answers!
S1 · E508
90 min
Starbucks discovers the downside of convenience over security, the "Venom" vulnerability, and a look at how crooks are ransacking and stealing cars.
S1 · E509
90 min
Let's Encrypt's Terms of Service, more on "plane hacker" Chris Roberts, a major new vulnerability in the Internet's TLS protocol known as "Logjam," and more!
S1 · E510
90 min
Crashing (your friends') iPhones, a worrisome Mac firmware problem, Microsoft annoying and/or frightening users with unsolicited "Win10 upgrade" offers, Google's Vault and Soli projects, and your questions and Steve's answers!
S1 · E511
90 min
Patch Tuesday, Federal backdoor development funding, a real HDD firmware bootkit, iOS v9, your questions and Steve's answers!
S1 · E512
90 min
Steve Gibson and Leo Laporte discuss Firefox's Tracking Protection and the state of tracking users on the internet. The LastPass network breach, more bad news from the Office of Personnel Management, did China & Russia obtain and decrypt Snowden's document cache? And examining the revelations about the current state of Internet user tracking arising from Mozilla's Firefox tracking protection instrumentation.
S1 · E513
90 min
How does a buffer overflow lead to an exploit? A significant cross-application security flaw in Mac OS X and iOS, the Samsung keyboard flaw, how safe is your Lastpass master password, transmitting sensitive data to "tech-unsavvy people", and more of your questions with Steve's answers!
S1 · E514
90 min
Should we trust NoScript? Adobe issues an emergency out-of-cycle patch for FLASH, an update to Google's Chrome browser unnerves some, an AM radio that steals nearby Crypto keys, a truly fabulous site of privacy tools, a look at recent research into improving the privacy delivered to users of the Tor network.
S1 · E515
90 min
Steve Gibson talks about his concerns of "Wi-Fi Sense" on Windows 10, a feature that shares your Wi-Fi password with your contacts in Facebook, Outlook and Skype. Firefox v39, ICANN's WHOIS privacy policy, a new old DDoS attack protocol in use, Amazon rolls their own TLS stack, ARIN runs out of IPv4 space, Italy's Hacking team gets hacked... with a surprise in the disclosed data! Juicy new details about the NSA's XKEYSCORE and international spying, Windows 10 gets privacy-worrisome "WiFi Sense" facility, and more!
S1 · E516
90 min
Steve Gibson revisits SQRL with Fr. Robert Ballecer. More Hacking Team revelations including another Adobe Flash exploit and a UEFI rootkit, OpenSSL's latest problem, another plea to the government from encryption experts, even worse news from the OPM breach, an updated look at SQRL and more!
S1 · E517
90 min
Steve loses his T1, the official SQRL logo, Auto hacking matures from "connect" to "Internet", Microsoft's emergency out-of-cycle update, Progress in attacking RC4, and more of your questions with Steve's answers!
S1 · E518
90 min
A significant Android problem is found in the "StageFright" module, with almost a billion Android devices at risk. Fiat/Chrysler hacking follow-up, the Android "StageFright" flaw, the security practices of experts vs. non-experts, Major DMCA news, the Anti-Phishing Working Group's Global Phishing Survey, the right way to silence the Windows 10 upgrade pesterings, and what is HORNET?
S1 · E519
90 min
Steve Gibson analyzes Windows 10's privacy settings. StageFright update, a DNS vulerability in BIND, PagerDuty suffered a database breach, OSX has a somewhat worrisome 0-day in the wild, NoScript versus Sandboxie, and examining what we know of the Windows 10 privacy tradeoff.
S1 · E520
90 min
Steve Gibson and the search for safely navigating the internet. StageFright Watch, Windows 10 Tracking disable tool, was TrueCrypt decrypted by the FBI? Firefox vulnerability, and Steve's search for a low-hassle solution for safely browsing the danger-filled World Wide Web.
S1 · E521
90 min
Steve Gibson and Leo Laporte discuss the distressing state of online web advertising. Two steps forward, one step back for Android StageFright, new Windows 10 privacy concerns, high profile malvertising surfaces, Kaspersky, Lenovo, HTC and AT&T each in their own doghouses and more!
What is the best way to securely wipe a drive? Lenovo BIOS behavior retraction and update, ransomware file encryptor appears on Github, consequences of the growing intersection of life and the Internet, the need for physical security and Hilary's email server, and Steve answers your questions!
S1 · E523
90 min
Steve Gibson and Leo Laporte look at uBlock Origin, an add-on blocker for web browsers. Running Firefox as a "normal" user, malvertising hits MSN, Amazon & Google tighten up on Flash, Windows 7& 8 quietly get new and unwanted features, Dave Winer: "Mac OS is spyware too," and Steve Gibson goes over the features of uBlock Origin.
S1 · E524
90 min
How is data stored on glass platters used in hard drives? Seagate Wi-Fi drive nightmare, AdBlock plus releases adblocking browsers on the eve of iOS 9, Android phones now coming with pre-installed malware, your questions and Steve's answers!
Steve Gibson talks with co-founder and CTO of Disconnect, a privacy and security tool to block trackers. Has LastPass been hacked? Matthew Green's look at iMessage's assurances, Canary Tokens, Let's Encrypt issues first certificate, and a discussion with Patrick Jackson, co-founder and CTO of Disconnect..
iOS XcodeGhost, critical Adobe FLASH update, Ashley Madison password mystery. iOS XcodeGhost discovered by Chinese developer, critical Adobe Flash update, AVG begin selling browsing and search history to advertisers, Cisco routers in at least 4 countries infected by stealthy backdoor, 11+ million Ashley Madison passwords cracked, VW & Audi recall after EPA hack programming.
Listener and columnist for ComputerWorld Michael Horowitz found that Lenovo's ThinkPad line still monitors and tracks users. Time to migrate away from TrueCrypt? AdBlocker App update, Thinkpad is, sadly no longer "clean", new concerns over Anti Virus add-on utilities and Steve answers your questions!
Linux.Wifatch is a piece of code that behaves like a worm, has infected vulnerable routers, removes malware and secures the router. Breaches at Patreon, Experian & Scottrade, Stagefright 2, Linux.Wifatch: The Router Vigilante Worm, problems with VeraCrypt, Anrdroid Marshmallow's major security improvements and more!
Joe Siegrist talks with Steve Gibson and Leo Laporte about the recent news that LogMeIn has purchased LastPass. Joe Siegrist and the LastPass acquisition, Patch Tuesday, another dent in SHA-1, U.S. Government plans not to force "cryptotapping"... for now and Steve answers your questions!
Steve Gibson takes a look at four companies getting security wrong. An emergency Adobe FLASH vunerability, sneaking naughty iOS apps pas Apple's scrutiny and a look at four examples (from this week) of companies getting security wrong.
Is it time to drop TrueCrypt for VeraCrypt? 1Password metadata, revisited, bad Western Digital hard drive encryption, how the NSA is seeing into encrypted data, an update on the "Let's Encrypt" project, the future of the beleaguered SHA-1 hash and Steve answers your questions!
Steve Gibson explores the fundamental problem with iOS application security enforcement. Brief glitch with uBlock Origin in the Chrome store, Symantec screws up cert issuance, "the Hacking Team" returns, Tor Messenger, US and UK take differing cybersecurity paths, a clever new browser fingerprinting hack, JavaScript (ECMAScript) 6 peek, Threema gets an independent audit and the disconcerting result of Steve's analysis of iOS application vetting.
A variant of the ransomware "Power Worm" can not be decrypted even after the ransom is paid. China's new hiring problem, Firefox v42 update, don't pay the "Power Worm" ransomware, CAs mis-issuing banned certificates, Microsoft rethinks their January 1st 2017 SHA-1 cutoff date, and Steve Gibson answers your questions!
The post-Paris Encryption controversy. Leo and Steve discuss a wide range of security news, Steve's feelings about the new iPad Pro, lots of interesting bit of miscellany, and we then revisit the newly controversial question of Internet encryption which has been raised with great emphasis after last week's terrorist attacks in Paris.
Dell, Lastpass, Windows 10, and Q&A with Steve. Dell steps in it big time, Windows 10's various recent struggles, a report of the Manhattan DA's office about Smartphone Encryption, various updates and miscellany including an Errata, ten listener thoughts, and questions!
A security researcher finds 600,000 Arris cable modems have two backdoor vulnerabilities. A Follow up on last week's thoughts on warranted iPhone unlocking, Mozilla's life after Google, Arris cable modems in the doghouse, Blackberry says no to a large government, another nail in the Adobe Flash coffin, and Steve answers more viewer questions!
France considers counter-terrorism measures such as blocking TOR and public Wi-Fi. Microsoft's Patch Tuesday (and Adobe Flash mega patch Tuesday!) Microsoft's new moves to force Windows 10 onto unwanting users, even bigger trouble for Dell, and trouble for AOL and Lenovo, Let's Encrypt public beta goes live, what did President Obama mean on Sunday? Perhaps France is (over)reacting? The Republic of Kazakhstan paves a worrisome path, ISIS releases an app for Android, CryptoWall gets even worse and more!
A security researcher exposes 13 million MacKeeper user data using the Shodan search engine. Is Kazakhstan's new encryption law a preview of future U.S. policy? FBI chief asks tech companies to stop offering end-to-end encryption, 13 million MacKeeper user's data exposed, Cloudflare, Facebook and others compromise on SHA-1 sunsetting, Google to deprecate one of Symantec's root certificates, major expoit in Bell Canada's routers reveal WPA2-PSK, Wired thinks it has unmasked Satoshi Nakamoto... maybe not, a suspected hit and run driver caught in Florida after car called the cops, Telegram cryptanalysis, and Steve answers possibly the coolest question he's ever been asked for a Q&A!
Should password length be kept a secret? The stunning Juniper router backdoor, Oracle gets smacked by the U.S. Federal Trade Commission, what happens if you simply press backspace 28 times at a Linux password prompt? WhatsApp briefly banned in Brazil, Hillary's call for a Manhattan-style effort on encryption, a recent audit provides an updated snaptshot of the state of web privacy, Microsoft increases the GWX controversy and Steve answers your questions!
This special episode from 2009 featured a rare off-topic discussion about Steve Gibson's research into vitamin D. This episode was originally recorded with audio only.
A look back at security vulnerability counts of 2015. Some GWX (Get Windows X) news updates, a Windows 10 market share snapshot, hysteria over Windows 10 disk encryption, Google issues critical updates for recent Android versions, ransomware goes multi-platform with JavaScript, the next IoT Wi-Fi standard is ratified, smartwatch side-channel attacks, IPv6 adoption at its 20 year mark and more!
How can LastPass' Emergency Access be TNO? TrendMicro drastically lowers the bar on "you're doing it wrong", Symantec issues banned SHA-1 certs in 2016, Firefox backs off from disallowing newly issued SHA-1 certs in 2016, a sad day has finally arrived for Windows XP Embedded SP3, how LastPass v4.0's new Emergency Access feature can be TNO, and more!
Steve Gibson analyzes the ShmooCon presentation on "LostPass" and LastPass' response. Major Internet of Things news: Ring Doorbell, Webcams, Wi-Fi passwords in the cloud, more malvertising in the news, a major internet appliance backdoor discovered, New York State Assembly Bill about phone encryption, more Microsoft and Windows 10 news and the ShmooCon presentation of the LastPass phishing hack.
How do I know that I am on the most secure connection with a VPN? More on the consumer encryption fight, a smartphone updating lawsuit, a new web compression standard, a website that (deliberately) crashes iOS, a new Firefox and Steve answers your questions!
Steve Gibsons guide to using multiple routers for a secure network. Java is finally leaving the browser, Google's February Nexus Android update, the ongoing encryption debate, and Steve talks about how to set up a secure network for all your devices with no less than three dumb routers. GRC.com: NAT Router Security Solutions - https://www.grc.com/nat/nat.htm
Steve Gibson looks at a severe vulnerability in eBay's online sales platform that could be the "hack of the decade." iOS Error 53 and an interesting Apple 3rd party service conundrum, Comodo's crummy Cromodo browser, a new Google search safely feature, an interesting audit of Windows 10 after enabling all privacy features, Steve's experience with GWX and a new Windows 7 install, the amazing clever hack of the decade, and Steve answers three listener follow-up questions from last week's "Three Dumb Routers" episode.
Steve Gibson details how vulnerable websites can be to attacks. Steve and Leo talk about what is happening to the grc.com website and how a DDoS attack brings down a website.
Steve Gibson on what has happened in the last week since the DDoS attack on GRC.com. Apple vs the FBI, Linux Mint, more Comodo bad news, Hollywood Presbyterian Medical Center pays Crypto ransom, Glibc flaw follow-up, Error 53 follow-up and Steve details everything that has transpired since last week's "GRC is Down" episode.
Steve Gibson tries to find a formal definition of a "backdoor." The ongoing Apple iPhone battle, iPhone passcode length helps a lot! So does not running as Admin under Windows, local network scanning tools, and Steve answers your questions!
Steve Gibson takes a look at the CacheBleed attack. A brief Apple decryption dispute update, the first Mac OS X ransomware strikes, will quantum computing mean the end of encryption? Verizon gets a barely noticeable slap on the wrist, Facebook missed a huge security hole, next-gen fingerprint spoofing with an inkjet printer, John McAfee, RSA, a wonderfull Let's Encrypt milesotone, and a look at the CacheBleed attack.
Storing encrypted information in the cloud. Encryption - dispute or dispute? A specific IoT nightmare example, BleepingComputer gets sued and asks for help, a new and horrifying DDoS attack amplifier, Microsoft pushes Windows 10 even harder and Steve answers your questions!
S1 · E552
90 min
Steve Gibson takes a closer look at the D.R.O.W.N. vulnerability & attack (and why security is hard!). FBI postpones today's court hearing, Matthew Green and four students poked a hole in iMessage, another side channel attack against mobile devices, massive malvertising campaign hits many major sites, Levovo back in the dog house... again! 2016 Pwn2Own competition results, Android StageFright module even more unsafe than believed, and a closer look at the D.R.O.W.N. vulnerability & attack.
S1 · E553
90 min
Steve Gibson unveils his free tool to hold off that Windows 10 update: Never10! U.S. says it has unlocked the iPhone without Apple, California Assembly Bill AB-1681, was TrueCrypt originally created by an international arms dealer? A major flaw in the StartSSL Certificate Authority, two more hospitals hit with ransomware, a problem found in the SAMBA protocol, good news on the IoT device setup front, GRC's Never10 freeware, and Steve gives details on his new monster PC!
S1 · E554
90 min
IoT: Whose "lifetime" is a lifetime subscription? A quiet week gives us a chance to catch up on some listener feedback, a few words of caution about jumping in to the IoT gadget world too soon, Bruce Schneier on the FBI/Apple outcome, a bit of miscellany (some of it is amazing), ten great observations, comments and questions from our listeners.
S1 · E555
90 min
Steve Gibson analyzes the Open Whisper "Signal" protocol that has been integrated into WhatsApp. BadLock, the latest draft of the Burr/Feinstein encryption bill, the iPhone FBI hack update, a worrisome architectural problem in Mozilla's Firefox extension handling, HTTPS gets a BIG new supporter, at least tens of thousands of commercial CCTV DVRs can be remotely hacked, Amazon is (was) selling a malware-infected Webcam system, and the results of Steve's deep dive into the security of WhatsApp.
S1 · E556
90 min
A look at SMTP STS: a new specification to add Strict Transport Security (STS) to email. 60 Minutes expose' on the interprovider SS7 signalling system, the future appears black for BlackBerry, quicksand for QuickTime, what was found in the decrypted San Bernardino phone, Threema vs WhatsApp vs Signal, and a look at SMTP STS: a new specification to add Strict Transport Security (STS) to email.
S1 · E557
90 min
Let's Encrypt certificate issuance update, the Net Snowden effect, the cost to unlock an (empty) iPhone, a clever AppLocker bypass to run any program, Opera's built in VPN announcement, TeslaCrypt ransomware updated again, fake DDoS extortionists, the U.S. launches first-ever public Cyberbomb at ISIS, DNSSEC and another reason to choose Hover and Steve answers your questions!
S1 · E558
90 min
The U.S. Congress passed a new eMail privacy act, Edward Snowden and Fareed Zakaria debate, the still unresolved fingerprint question, Android's continuing troubles with "Stagefright", Brazillian judge shuts down WhatsApp for three days, will the real Satoshi Nakamura please stand up? And Steve answers more of your questions!
S1 · E559
90 min
Today's Mega Patch Tuesday for Windows, closing the chapter on Dr. Craig Wright, Lenovo, Microsoft and Qualcomm all in separate doghouses, another fun bit on Curl bashing, the unintended consequences of "Terrorist Math," the Temperfect Mug finally arrives and a look at Samsung's not ready for prime time SmartThings.
S1 · E560
90 min
Steve's long love affair with Windows, the Oracle/Google JAVA API lawsuit, the pending registration of "burner" phones, surveillance microphones found in public areas, John McAfee and team cracks WhatsApp encryption? The Ring Doorbell may need another update, a security-related Kickstarter which Security Now listeners would never fall for, a controversial feature being removed from Windows 10, a worrisome and exploitable heap corruption in the popular 7-Zip application and a look a the Z-Wave Home Automation system.
S1 · E561
90 min
A surprising end to the Teslacrypt file encrypting malware, Google's plan to continue squeezing Flash off the web, anyone want 117 million (old) LinkedIn email messages and passwords? They're for sale. News of the technology underlying Google's new Allo messaging system, save Firefox and Steve answers listener questions!
S1 · E562
90 min
Over-the-top Feinstein-Burr encryption bill dies in the Senate, Google's fair use API defense prevails, Google's increasing pressure on its Android partners, Bluecoat Systems obtains an Intermediate CA cert from Symantec/Verisign, the insecurity of add-on laptop bloatware and custom updating software, a promised update on SQRL and Rapid7's sobering analysis of Internet-connected baby monitors.
S1 · E563
90 min
A "Reality-Check" timeout, a new 0-day Windows exploit on the market, a truly horrifying (and clever) chip-level exploit, yesterday's monthly Android Security Update, a sad side-effect of the GWX push, the LinkedIn breach apparently bites Mark Zuckerberg, Facebook plans to offer optional encryption for Messenger, five things that give self-driving cars headaches, a follow-up on SQRL's authentication management and some truly horrifying details of internet-connected baby monitor implementations.
S1 · E564
90 min
BlueCoat Systems gets a new parent, a bad Chrome bug you never knew you had, prolific hacker "Peace" has another 51 million account credentials to sell, LetsEncrypt's mass emailer reveals a fun bug, Visual Studio 2015 C++ compiler secretly inserts telemetry code into binaries and Steve answers your questions!
S1 · E565
90 min
Palantir got owned - in a good way, confirmation of the danger of SMS as a 2nd factor, a frightening IoT camera experience, some confusion over the GotoMyPC full password reset, the machine under the machine: do our systems have a designed-in rootkit? And Steve takes a deep dive into Intel's forthcoming anti-hacking Control-Flow Enhancement Technology!
S1 · E566
90 min
One Windows update was expensive for Microsoft, a troubling court ruling about FBI hacking, hope for slow Windows 7 updates, Comodo dops to a new low level of slimy behavior, malware moves to pure JavaScript, stealing data by spinning your computer fans, a worrisome flaw found in most NetGear routers, and Steve answers your questions!
S1 · E567
90 min
Leo and I catch up with another packed week of security news, including an update on mobile ransomware, the successful extraction of Android's full disk encryption (FDE) master keys, Google's Tavis Ormandy finds horrific flaws in all Symantec traffic analyzing software, a Brazilian judge is at it again with WhatsApp, this week's IoT horror story, some miscellany and errata, and finally a look at a horribly flawed attempt to copy Let's Encrypt automation of free SSL certificate issuance.
S1 · E568
90 min
Facebook Messenger adds "Secret Conversations", Putin vs. the Internet, the fate of Russian-based VPN endpoints, Russian hackers compromising iOS devices, Steve's follow-up to the Lenovo SMM hack, is sharing your Netflix password illegal? Post-quantum crypto testing in Chrome, reconsidering anti-virus add-ons, Pokemon Go woes, a possible defense against CryptoMalware and Steve answers five viewer questions from Twitter.
S1 · E569
90 min
Leo and I catch up with a fun and interesting week of security happenings, including a bit of daylight on the password sharing question, the trouble with self reporting security breaches, trouble in TOR-land, what future AI assistants mean for our privacy, a terrific looking new piece of security monitoring freeware, a startlingly worrisome 20-year-old fundamental Windows architectural design flaw, a problem with Juniper router's OS certificate validation, some errata, a bunch of miscellany, and the promised follow-up dissection of Facebook Messenger's extra features, the anti-ransomware CryptoDrop, and MIT's "Riffle" anonymity enforcing networking solution.
S1 · E570
90 min
Apple gets Stagefright, is Russia trying to influence the U.S. presidential election? Microsoft's battles and wins against U.S. privacy overreach, Grace Hopper (who coined the term "software bug") brilliantly demonstrates "a nanosecond", a bug-fix update to pfSense, a "doing it weird" look at the CUJO security appliance, and Steve answers your questions!
S1 · E571
90 min
Keysniffer: More fun with wireless keyboards. LastPass vulnerabilities, new wireless keyboard headaches, deprecating SMS as a second authentication factor, obtaining Windows 10 for free after July, the pervasive problem with website spoofing, and the power and application of multi-interface packet filtering.
S1 · E572
90 min
Does ZFS "Scrub" on a FreeNAS replace SpinRite? A distressing quantity of Win10 news, Apple's changing bug bounty policy, newly disclosed Android takeover flaws, yet another way to track web visitors, hackers spoof Tesla auto sensors, Firefox and LastPass news, a19-year old stubborn decision by Microsoft comes home to roost, and a handful of new problems found with HTTP.
S1 · E573
90 min
Did Microsoft really leak their secure boot "Golden Key?" AdBlock, unblock, counter-unblock, and counter-counter-unblock is well underway, Leo's story from the field about Avast A/V, a "security is hard to do" mistake in an update to the Internet's TCP protocol, Microsoft's evolving Windows Update policies, an uber-cool way for developers to decrypt and inspect their Firefox and Chrome local TLS traffic, trouble with Windows Identity leak mitigation, and discussion of micro kernels and Intel's forthcoming memory breakthrough!
S1 · E574
90 min
Did the Shadow Brokers hack the NSA's Equation Group? Apple's bug bounty gets quickly outbid, a critical flaw discovered in the RNG of GnuPG, the EFF weighs in on Windows 10, Chrome browser is frightening people unnecessarily, a Johns Hopkins team of cryptographers, including Matthew Green, disclose a weakness in Apple's iMessage technology, unused router hardware capabilities, what's a "Micro Kernel?" And more!
S1 · E575
90 min
The FBI has found evidence that two state election systems were attacked and hacked. Dropbox and Opera handle incidents responsibly, while a Chinese certificate authority could not have been more irresponsible. Facebook and WhatsApp announce an information sharing arrangement, the FBI discloses election site hacking, Tavis prepares DashLane and 1Password vulnerability disclosures, the threat of autonomous weapon systems and Wi-Fi router radio wave spying, the details behind Pegasus and Trident, the emergency Apple iOS v9.3.5 patch and more!
S1 · E576
90 min
Weaponizing RowHammer with "Flip Feng Shui" - the most incredibly righteous and sublime hack... ever! The continuing woes of WoSign, autonomous micro-recon drones turn out to be real, a new crypto attack on short block ciphers prompts immediate changes oin OpenVPN and OpenSSL, introducing a new Security Now! Abbreviation: "YAWTTY": Yet Another Way To Track You, a discouraging social engineering experiment, another clever USB attack and a look at the weaponizing of RowHammer with "Flip Feng Shui" - the most incredibly righteous and sublime hack... ever!
S1 · E577
90 min
Is secure delete still necessary on a drive with whole disk encryption? Flip Feng Shui follow-up, Apple's announcements, Android's rough week, a bank's data center shuts down due to noise, Bluetooth device privacy leakages, and Steve answers your questions! We invite you to read our show notes.
S1 · E578
90 min
Steve Gibson recommends the best website security scanner. Concerns over a significant expansion in effectively warrantless intrusion into end-user computers, the forthcoming change in Internet governance, NTIA's contract with ICANN to handle IANA is expiring in ten days! Google's next move in using Chrome to push for improved security, the interresting details emerging from a successful NAND memory cloning attack on the iPhone 5c and Steve shares the details and findings of a recent Cross-Site Scripting (XSS) problem on GRC and his recommendation for the best website security scanner!
S1 · E579
90 min
Brian Krebs, Akamai and Google's Project Shield, Yahoo's record-breaking, massive 500 million user data breach, Apple's acknowledged iOS 10 backup PBKDF flaw, well known teen hacker jailbreaks his new iPhone 7 in 24 hours, Microsoft formally allows removal of "Get Windows 10", a new OpenSSL SERVER DoS flaw, more WoSign/StartCom woes (Mozilla prepares to pull the plug), Bittorrent Sync renamed and more deeply documented, and more!
S1 · E580
90 min
What is the difference between HTTPS and HSTS? An "update" on Microsoft's GWX remover, an encouraging direction for the Windows 10 Edge browser, HP's "security update" blocks non-HP ink cartridges, a clarification about how to upgrade a site's password hashing, a really terrific DNS hack, another update on Windows update, our web browsers may be fatiguing oru SSD's, and Steve answers your questions!
S1 · E581
90 min
Yahoo security, $1.5 mil iPhone bug bounty, WoSign woes, trapdoored primes. Leo and Steve discuss today's Windows update changes for 7 and 8.1, an exploit purchaser offers a $1.5 million bounty for iOS hacks, WhisperSystems encounter first bug, an IEEE study reveals pervasive "Security Fatigue" among users, Firefox and Chrome news, following the WoSign Woes, Samsung Note 7 news, some errata, a bunch of miscellany... and a look into new Yahoo troubles and concerns over the possibility of hidden trapdoors in widely deployed prime numbers.
S1 · E582
90 min
Feds demand fingerprints to unlock phones, VeraCrypt audited, life in a simulation. Leo and Steve discuss some serious concerns raised over compelled biometric authentication, a detailed dive into the recently completed audit of VeraCrypt (the successor to TrueCrypt), more on web browsers fatiguing system main SSD storage, a bunch of interesting miscellany (including... are we living in a simulated reality?), and eleven questions and observations from our terrific listeners.
S1 · E583
90 min
Last Week's Botnet DDoS, Linux "Dirty COW" bug, the DRAMMER exploit. Leo and Steve discuss last week's major attack on DNS, answering the question of whether the Internet is still working?, we look at Linux's worrisome "Dirty COW" bug rediscovered in the kernel after nine years, we address the worrisome average lifetime of Linux bugs, share a bit of errata and miscellany, and offer an in-depth analysis of DRAMMER, the new, largely unpatachable, Android mobile device Rowhammer 30-second exploit.
S1 · E584
90 min
Windows "Atom Bomb" exploit, side-channel attack on Intel processors, verifiable hacker-proof code. Leo and Steve discuss an oh-so-subtle side-channel attack on Intel processors, the quest for verifiable hacker-proof code (which oh-so-subtle side-channel attacks on processors can exploit anyway!), another compiler optimization security gotcha, the challenge of adding new web features without opening routes of exploitation, some good news about the DMCA, Matthew Green and the DMCA, the relentless MPAA and RIAA still pushing the limits and threatening the Internet, the secure ProtonMail service feels the frightening power of skewed search results, regaining control over Windows 10 upgrade insistence, a new 0-day vulnerability Google revealed before Microsoft has patched it, a bit of errata, miscellany and as many listener feedback questions and comments as we have time for.
S1 · E585
90 min
LastPass goes mobile-free, MySQL patches, problems with OAuth, Windows Atombomb attack, and the open source LessPass app. Leo and I discuss the answer to last week’s security & privacy puzzler, Let's Encrypt Squarespace, the new open source "LessPass" app, LastPass goes mobile-free, many problems with OAuth, popular Internet services' privacy concerns, news from the IP spoofing front, Microsoft clarifies Win10 update settings and winds down EMET, a hacker finds a serious flaw in Gmail, MySQL patches need to be installed now, a tweet from Paul Thurrott, a bit of errata and... and the Windows AtomBomb attack.
S1 · E586
90 min
The BlackNurse Attack, PwnFest. Results from our listener's informal CAIDA spoofing testing. LessPass turned out to be even less than it appeared. Steve's day at Yubico. News from PwnFest & Mobile Pwn2Own. The probable elimination of Dark Matter. A new Wi-Fi field disturbance attack. A wacky Kickstarter "fingerprint" glove. The "BlackNurse" reduced-bandwidth DoS attack.
S1 · E587
90 min
Weaponized $5 Raspberry Pi. Samy Kamkar is back with a weaponized $5 RaspberryPI. "El Cheapo" Android phones bring new meaning to "Phoning it in". Watching a webcam getting taken over. Bruce Schneier speaks to Congress about the Internet. A(nother) iPhone Lockscreen Bypass and another iPhone lockup link. Ransomware author asks a security researcher for help fixing their broken crypto. Britain finally passed that very extreme surveillance law. Some more fun miscellany… and more!
S1 · E588
90 min
San Francisco Muni hacked. A wonderful quote about random numbers, our standard interesting mix of security do's and dont's, new exploits (WordPress dodged a big bullet!), planned changes, tips & tricks, things to patch, a new puzzle/game discovery, some other fun miscellany... and, finally! Ten comments, thoughts and questions from our terrific listeners!
S1 · E589
90 min
Gooligan breaches 1m Google accounts. Leo and Steve discuss Android meeting Gooligan, Windows Upgrades bypass Bitlocker, nearly one million UK routers taken down by a Mirai variant, the popular AirDroid app is "Doing it wrong", researchers invent a clever credit card disclosure hack, Cloudflare reports a new emerging botnet threat, deliberate backdoors discovered in 80 different models of Sony IP cameras, we get some closure on our SanFran MUNI hacker, a fun hack with Amazon's Echo and Google's Home, How to kill a USB port in seconds, a caution about keyless entry (and exit), too-easy-to-spoof fingerprint readers, an extremely troubling report from the UK, and finally some good news: the open-source covert USB hack defeating “BeamGun”!... plus a bunch of fun miscellany, some great Sci-Fi reader/listener book news, and... however many questions we're able to get to by the end of two hours!
S1 · E590
90 min
A Brilliantly Horrific New Ransomware Twist. This week, Leo and Steve discuss ticket-buying bots getting their hand slapped (do they have hands?), a truly nasty new addition to encrypting ransomware operation, a really dumb old problem returns to many recent Netgear routers, Yahoo!'s being too pleased with their bug bounty program, Steganometric advertising malware that went undetected for two years, uBlock Origin readies for a big new platform, what exactly is the BitDefender "BOX"? (We wish we knew!), VeraCrypt was audited... next up is OpenVPN! (Yay!), the definitive answer to the question of where Spock's thumb should be, Steve's new relaxing and endless puzzler, and... questions from our listeners!
S1 · E591
90 min
1 Billion Yahoo Accounts Hacked. This week, Leo and Steve discuss Russia’s hacking involvement in the US Election; that, incredibly, it gets even worse for Yahoo!, misguided anti-porn legislation in South Carolina, troubling legislation from Australia, legal confusion from the Florida appellate court, some good news from the U.S. Supreme Court, Linux security stumbling, why Mac OS X got an important fix last week, the Steganography malvertising attack that targets home routers, news of a forthcoming inter-vehicle communications mandate, professional cameras being called upon to provide built-in encryption, LetsEncrypt gets a worrisome extension, additional news, errata, miscellany… and how exactly DOES that “I really really promise I'm not a robot (really!)” non-CAPTCHA checkbox CAPTCHA work?
S1 · E592
90 min
Steve Gibson tells how he built a device to solve a problem with a neighborhood dog. Steve Gibson tells how he built a device at 16 years old to solve a problem with a neighborhood dog. Original podcast date: May 13, 2010, Episode 248.
S1 · E593
90 min
The Internet of Tattling Things. Law enforcement and the Internet of Tattling things, a very worrisome new and widespread PHP eMail vulnerability, Paul and Mary Jo score a big concession from Microsoft, a six-year-old "hacker" makes the news, Apple discovers how difficult it is to make developers change, hyperventilation over Russian malware found on a power utility's laptop, the required length of high entropy passwords, more pain for Netgear, an update on the just finalized v1.3 of TLS, the EFF's growing "Secure" messaging scorecard, a bunch of fun miscellany... and how does that "I'm not a Robot" checkbox work?
A TV station learns to be careful when saying the "A" word. The US Federal Trade Commission steps into the IoT and home networking malpractice world, a radio station learns a lesson in what words NOT to repeat, Google plans to even eliminate the checkbox, a crucial caveat to the "passwords are long enough" argument, more cause to be wary of third-party software downloads, a few follow-ups to last week's topics, a bit of miscellany and a close look at a well-known piece of PHP malware.
WhatsApp's non-backdoor "backdoor". A classic bug at GoDaddy bypassed domain validation for 8850 issued certificates, could flashing a peace sign compromise your biometric data?, it's not only new IoT devices that may tattle, many autos have been able to for the past 15 years, McDonald's gets caught in a web security bypass, more famous hackers have been hacked, Google uses AI to increase image resolution, more on the value or danger of password tricks, and... does WhatsApp incorporate a deliberate crypto backdoor?
A phishing attack that uses a browser's autofill. Symantec issues additional invalid certificates while on probation, Tavis Ormandy finds a very troubling problem in Cisco's Web conferencing extension for Chrome, yesterday's important update to iOS, renewed concerns about LastPass metadata leakage, the SEC looks askance at what's left of Yahoo, a troubling browser form auto-fill information leakage, Tor further hides it's hidden services, China orbits a source of entangled photons? Heartbleed three years later, a new take on compelling fingerprints, approaching the biggest Pwn2Own ever, some miscellany... and some tricks for computing password digit and bit complexity equivalence.
Robot is "Not a Robot," Netgear exploit. The best “I'm not a Robot” video ever, Cisco's WebEx problem is far more pervasive than first believed, more bad news (and maybe some good news) for Netgear, Gmail adds .js to the no-no list, a hotel finally decides to abandon electronic room keying, more arguments against the use of modern AV, another clever exploitable CSS browser hack, some (hopefully final) password complexity follow-ups, a bit of errata and miscellany, a SQRL status update, a "Luke... trust the SpinRite" story, and a very nice analysis of a little-suspected threat hiding among us.
150,000 printers "pwned". Speak of the devil... printers around the world get hacked! Vizio's TVs really were watching their watchers, Windows has a new 0-day problem, Android's easy-to-hack pattern lock, an arsonist's pacemaker rats him out, a survey finds that many iOS apps are not checking TLS certificates, the courts create continuing confusion over eMail search warrants, a blast from the past: SQL Slammer appears to return, Cellebrite's stolen cell phone cracking data begins to surface, some worrisome events in the Encrypted Web Extensions debate, Non-Windows 10 users are not alone, a couple of questions answered, my report of a terrific Sci-Fi series, a bit of miscellany... and a fun story about one-armed bandits being hacked by two armed bandits.
Uncontrolled TLS Interception. Patch Tuesday DELAYED (and we may know why!), our favorite ad-blocker embraces the last major browser, a university gets attacked by its own vending machines, PHP leaps into the future, a slick high-end Linux hack, the rise of fileless malware, some good advice for tax time, it's not only Android's pattern lock that's vulnerable to visual eavesdropping, what happens with you store a huge pile of Samsung Note 7's in one place?, some fun miscellany, a MUST NOT MISS science fiction TV series, a look at the growing worrisome security implications of uncontrolled TLS interception.
Microsoft Patch Tuesday for February is cancelled! The story behind Microsoft's Patch Tuesday security update disaster. CyberX discovered a new large-scale cyber-reconnaissance operation targeting Ukraine targets: using vulnerabilities in Dropbox data traffic, DDL malware injection. Find out how easy it is to hack and steal an internet connected car. Chrome 56 update that hides connection certificate info. The future of Firefox add-ons. The lock screen of Win 10 leaking Clipboard contents. Project Zero's Windows flaw and NVIDIA Driver. pfSense and Ubiquity follow-ups. The MMU side-channel attack: it has nothing to do with chip flaws. ASLR will need your full attention.
Cloudbleed vs. Cloudflare. This week, Leo and Steve discuss the "CloudBleed" adventure, another project zero 90-day timer expires for Microsoft, this week's IoT head-shaker, a New York airport exposes critical server data for a year, another danger created by inline third party TLS-intercepting "middleboxes", more judicial thrashing over fingerprint warrants, Amazon says no to Echo data warrant, a fun drone-enabled proof on concept is widely misunderstood, another example of A/V attack surface expansion, some additional Crypto education pointers and miscellany... and what does Google's deliberate creation of two SHA-1-colliding files actually mean?
Why Amazon AWS S3 crashed the web. Countdown to March's patch Tuesday; what was behind Amazon's S3 outage? Why don't I have a cellular connectivity backup? Some additional Cloudflare perspective, Amazon to fight another day over their Voice Assistant's privacy, an examination of the top 9 Android password managers uncovers problems, another lifeless malware campaign found in the wild, security improvements in Chrome and Firefox, a proof of concept for BIOS ransomware, a how-to walk-through for return-oriented programming, a nifty new site scanning service, Matthew Green compares desktop and mobile security, a bunch of feedback quickies, an incredibly wonderful waste of time accomplishment, the future threat of deliberately fooling AI, and the dark side of automated domain validation certificate issuance.
CIA Vault 7 Tools Analyzed. This week Steve and Leo discuss March's long-awaited patch Tuesday, the release deployment of Google Invisible reCaptcha, getting more than you bargained for with a new Android smartphone, the new "Find my iPhone" phishing campaign, the failure of Wi-Fi anti-tracking, a nasty and significant new hard-to-fix web server 0-day vulnerability, what if your ISP decides to unilaterally block a service you depend upon? Shining some much-needed light onto a poorly conceived end-to-end messaging application, two quick takes, a bit of errata and miscellany... and a look into what Wikileaks revealed about the CIA's data collection capabilities and practices.
Bye-Bye, Windows 7 Updates. This week Steve and Leo discuss developments in the new windows on old hardware front, Cisco finds a surprise in the Vault7 docs, Ubiquity was caught with the PHPs down, CheckPoint discovered problems in WhatsApp and Telegram, some interesting details about the long-running Yahoo breaches, the death of the "eBay Football", the latest amazing IoT insanity, the incredible results of the CanSecWest Pwn2Own competition, a classic "you're doing it wrong" example, Tavis pokes LastPass again, some miscellany and an interesting proposal about controlling web advertising abuse.
This week Steve and Jason discuss… Google’s Tavis Ormandy takes a shower, iOS gets a massive feature and security update, a new target for ‘Bot money harvesting appears, Microsoft suffers a rather significant user-privacy fail, the UK increases its communications decryption rhetoric, a worrisome vote in the US senate, NEST fails to respond to a researcher's report, this week in IoT nonsense, a fun quote of the week, a bit of miscellany, some quickie questions from our listeners, and a close look at the developing drama surrounding Google's enforcement of the Certificate Authority Baseline rules with Symantec.
Step-by-step digital privacy. This week Steve and Leo discuss another iOS update update, more bad news and some good news on the IoT front, the readout on Tavis Ormandy's shower revelation, more worrisome anti-encryption saber rattling from the EU, a look at a recent Edward Snowden tweet, Samsung's S8 mistake, a questionable approach to online privacy, celebrating the 40th anniversary of Alice and Bob, some quickie feedback loops from our listeners, and an update on Steve's projects.
Protecting your privacy as you surf online. This week Steve and Leo discuss Symantec finding 40 past attacks explained by the Vault7 document leaks, an incremental improvement coming to CA certificate issuance, Microsoft patches a 0-day Office vulnerability that was being exploited in the wild, what's a "BricketBot"?, why you need a secure DNS registrar, This Week in IoT Tantrums, a head shaker from our "You really can't make this stuff up" department, the present danger of fake VPN services, an older edition of Windows reaches end-of-patch-life, some "closing the loop" feedback from our listeners, a bit of miscellany, and a comprehensive survey of privacy encroaching technologies and what can be done to limit their grasp.
Stealing PINs, Fingerprint Sensors. This week Steve and Leo discuss another new side-channel attack on smartphone PIN entry (and much more), Smartphone fingerprint readers turn out to be far more spoofable that we had hoped. All Linux kernels prior to v4.5 are vulnerable to a serious remote network attack over UDP, a way to prevent Google from tracking the search links we click (and to allow us to copy the links from the search results), the latest NSA Vault7 data dump nightmare, the problem with punycode domains, four years after the public UPnP router exposure, looking closely at the mixed blessing of hiding WiFi access point SSID broadcasts, some miscellany, and then a collection of quick "Closing The Loop" follow-ups from last week's "Proactive Privacy" podcast.
DoublePulsar, Google Ad Blocking. This week Steve and Leo discuss how one of the NSA's Vault7 vulnerabilities has gotten loose, a clever hacker removes Microsoft deliberate (and apparently unnecessary) block on Win7/8.1 updates for newer processors, Microsoft refactors multifactor authentication, Google to add native ad-blocking to Chrome… and what exactly *are* abusive ads?, Mastercard to build a questionable fingerprint sensor into their cards, are Bose headphones spying on their listeners? 10 worrisome security holes discovered in Linksys routers, MIT cashes out half of its IPv4 space, and the return of two meaner BrickerBots. Then some Errata, a bit of Miscellany, and, time permitting, some "Closing the Loop" feedback from our podcast's terrific listeners.
A May Day Mayday for Intel. This week Steve and Leo discuss the long-expected remote vulnerability in Intel's super-secret motherboard Management Engine technology, exploitable open ports in Android apps, another IoT blows a suspect's timeline, newly discovered problems in the Ghostscript interpreter, yet another way for ISPs and others to see where we go, a new bad problem in the Edge browser, Chrome changes its certificate policy, an interesting new "Vigilante Botnet" is growing fast, a proposed solution to smartphone-distracted driving, Ransomware as a service, Net Neutrality heads back to the chopping block (again), an intriguing new service from Cloudflare, and the ongoing Symantec certificate issuance controversy. Then some fun errata, miscellany, and some closing-the-loop feedback from our terrific listeners.
Intel AMT Horror, Net Neutrality. This week Steve and Leo discuss much more about the Intel ATM nightmare, Tavis and Natalie discover a serious problem in Microsoft's built-in malware scanning technology, Patch Tuesday, Google's Android patches, SMS 2-factor authentication breached, Google goes phishing, the emergence of ultrasonic device tracking, lots of additional privacy news, some errata and miscellany, actions US citizens can take to express their dismay over recent Net Neutrality legislation, and some quick closing the loop feedback from our terrific listeners.
WannaCry Ransomware, FCC DDoS. This week Steve and Leo discuss an update on the FCC's Net Neutrality comments, the discovery of an active keystroke logger on dozens of HP computer models, the continuing loss of web browser platform heterogeneity, the OSTIF's just-completed OpenVPN security and practices audit, more on the dangers of using smartphones as authentication tokens, some extremely welcome news on the Android security front, long-awaited updated password recommendations from NIST, some follow-up errata, a bit of tech humor and miscellany, closing the loop with some listener feedback... then a look at last week's global explosion of the WannaCry worm.
WannaCry Aftermath, Hacking Trump. This week we examine a bunch of WannaCry follow-ups, including some new background, reports of abilities to decrypt drives, attacks on the Killswitch, and more. We also look at what the large StackOverflow site had to do to do HTTPS, the Wi-Fi security of various properties owned by the US president, more worrisome news coming from the UK's Teresa May, the still sorry state of certificate revocation, are SSDs also subject to RowHammer-like attacks? Some miscellany, and closing the loop with our listeners.
Chipotle Hack, Malware Subtitles. This week we discuss a new non-eMail medium for spear phishing, Chipotle can't catch a break, social engineering WannaCry exploits on Android, video subtitling now able to take over our machines, a serious Android UI design flaw that Google appears to be stubbornly refusing to address, Linux gets its own version of WannaCry, another dangerous NSA exploit remains unpatched and publicly exploitable on WinXP and Server 2003 machines, a look at 1Password's brilliant and perfect new "Travel Mode", Google extends its ad-tracking into the offline world, some follow-ups, miscellany, and closing-the-loop feedback from our terrific listeners... concluding with my possibly useful analogy to explain the somewhat confusing value of open versus closed source.
OneLogin Breach, Hacking Submarines. This week we discuss an embarrassing high-profile breach of an online identity company, an over-hyped problem found in Linux's sudo command, the frightening software used by the UK's Trident nuclear missile submarine launch platforms, how emerging nations prevent high school test cheating, another lesson about the danger of SMS authentication codes, another worrisome SHODAN search result, high-penetration dangerous adware from a Chinese marketer, another "that's not a bug" bug in Chrome allowing websites to surreptitiously record audio and video without the user's knowledge, the foreseeable evolution of hybrid crypto-malware, the limp return of Google Contributor, Google continues to work on end-to-end eMail encryption, a follow-up on straight-to-voicemail policy, “Homomorphic Encryption” (what the heck is that?), and "closing the loop" follow up from recent discussions.
Social media malware, Russia is hacking through AMP, Bitcoin malware. This week we discuss clever malware hiding its social media communications, the NSA documents the Russian election hacking two-factor authentication bypass, meanwhile, other Russian attackers leverage Google's own infrastructure to hide their spoofing, Tavis finds more problems in Microsoft's anti-malware protection, a cryptocurrency-stealing malware, more concerns over widespread Internet-connected camera design, malware found to be exploiting Intel's AMT motherboard features, the new danger of mouse cursor hovering, Apple's iCloud sync security claims, Azure changes their CA, a bunch of catch-up miscellany and a bit of closing the loop feedback from our listeners.
Governments Want Web Security Keys. This week we discuss France, Britain, Japan, Germany & Russia each veering around in their Crypto Crash Cars, Wikileaks' Vault7 reveals widespread CIA WiFi router penetration, why we can no longer travel with laptops, HP printer security insanity, how long are typical passwords?, Microsoft to kill off SMBv1, the all-time mega ransomware payout, Google to get into the whole-system backup business, hacking PCs with "Vape Pens", a bit of miscellany, and a bunch of Closing the Loop feedback with our terrific listeners.
Crypto in a Lightbulb. This week we discuss another terrific NIST initiative, RSA crypto in a quantum computing world, Cisco's specious malware detection claims, the meaning of post-audit OpenVPN bug findings, worrisome bugs revealed in Intel's recent Skylake and KabyLake processors, the commercialization of a malware technique, WannyCry keeps resurfacing, LinkSys responds to the CIA's Vault7 CherryBomb firmware, another government reacts to encryption, the NSA's amazing Github repository, more news about HP printer auto-updating, a piece of errata, some miscellany, and some closing the loop feedback from our listeners.
W3C adds DRM to HTML5, Facebook can track logged out users, jailbreaking drones and more! This week we have all the usual suspects: Governments regulating their citizenry, evolving Internet standards, some brilliant new attack mitigations and some new side-channel attacks, browsers responding to negligent certificate authorities, specious tracking lawsuits, flying device jailbreaking, more IoT tomfoolery, this week's horrifying Android vulnerability, more Vault7 CIA Wikileaks, a great tip about controlling the Internet through DNS... and even more! In other words, all of the usual suspects! (And two weeks until our annual BlackHat exploit extravaganza!)
MySpace Hack, Net Neutrality. This week, while waiting for news from the upcoming BlackHat & DefCon conventions, we discuss another terrific security eBook bundle offer, a Net Neutrality follow-up, a MySpace account recovery surprise, another new feature coming to Win10, the wrongheadedness of paste-blocking web forms, Australia versus the laws of math, does an implanted pacemaker meet the self-incrimination exemption?, an updated worse-case crypto-future model, it's surprising what you can find at a flea market, another example of the consumer as the product, an SQRL technology update, and some closing-the-loop feedback from our terrific listeners.
Arresting ethical hackers, Verizon caught violating Title II, Roomba maker wants to sell maps of your home. We start off this week with a fabulous picture of the week and for the first time in this podcast's 12-year history, our first quote of the week. Then we'll be discussing the chilling effects of arresting ethical hackers, the upcoming neutrality debate congressional hearing, something troubling encountered at McAfee.com, an entirely new IoT nightmare you couldn't have seen coming and just won't believe, the long-awaited Adobe Flash end-of-life schedule, welcome performance news for Firefox users, the FCC allocates new sensor spectrum for self driving cars, three bits of follow-up errata, a bit of miscellany, and then: "Crypto Tension" -- a careful look at the presently ongoing controversy surrounding the deliberate provisioning of passive eavesdropping decryption being seriously considered for inclusion in the forthcoming TLS v1.3 standard.
DEF CON Antics, Facebook Kills AI. This week we look at the expected DEF CON fallout including the hacking of US election voting machines, Microsoft's enhanced bug bounty program, the wormification of the Broadcom WiFi firmware flaw, the worries when autonomous AI agents begin speaking in their own language which we cannot understand, Apple's pulling VPN clients from its Chinese app store, a follow-up on iRobot's floor plan mapping intentions, some new on the Chrome browser front, the 18th Vault-7 Wikileaks dump, and some closing-the-loop feedback from our terrific podcast followers.
DigiCert, LastPass, IoT Security. This week we discuss and look into DigiCert's acquisition of Symantec's certificate authority business unit, LogMeIn's LastPass Premium price hike, the troubling case of Marcus Hutchins' post-Defcon arrest, another instance of WannaCry-style SMBv1 propagation, this week's horrific IoT example, some hopeful IoT legislation, the consequences of rooting early Amazon Echoes, the drip drip drip of Wikileaks Vault 7 drips again, Mozilla's VERY interesting easy-to-use secure large file encrypted store and forward service, the need to know what your VPN service is really up to, a bit of errata, miscellany, and some closing-the-loop feedback from our always-attentive terrific listeners.
Password Rules Changes. This week we have a Marcus Hutchins update, the backstory on the NIST's rewrite of their 15-year-old password guidance, can DNA be used to hack a computer? Can stop sign graffiti be used to misdirect autonomous vehicles?, the final nail in the WoSign/StartCom coffin, why we need global Internet policy treaties, this week in "researchers need protection", a VPN provider who is doing everything right, Elcomsoft's password manager cracker, a bit of errata and miscellany... and some closing the loop feedback from this podcast's terrific listeners.
Marcus Hutchins drama update, Apple's Secure Enclave decryption key, rating "Terms of Service". This week we discuss the continuing Marcus Hutchins drama, the disclosure of a potentially important Apple secret, a super-cool website and browser extension our listeners are going to appreciate, trouble with extension developers being targeted, a problem with the communication bus standard in every car, an important correction from Elcomsoft, two 0-days in Foxit's PDF products, Lava lamps for entropy, the forthcoming iOS 11 TouchID kill switch, very welcome Libsodium audit results, a mistake in AWS permissions, a refreshingly forthright security statement, a bit of errata, miscellany, and a few closing the loop bits from our terrific listeners!
CIA Hacks FBI & NSA. This week we cover a bit of the ongoing drama surrounding Marcus Hutchins, examine a reported instance of interagency hacking, follow the evolving market for 0-day exploits, examine trouble arising from the continued use of a deprecated Apple security API, discover that Intel's controversial platform management engine can , after all, be disabled, look into another SMS attack, bring note to a nice looking TOTP authenticator, recommend an alternative to the shutting-down CrashPlan, deal with a bit of errata and miscellany, then we look into an interesting bit of research which invokes "The Wrath of Kahn".
SharknAT&To Zero Day Hack. (Although there are an unbelievable FIVE Sharknado movies, this will be the first and last time we use that title for a podcast!) This week we have another update on Marcus Hutchins, we discuss the validity of Wikileaks documents, the feasibility of rigorously proving software correctness, nearly half a million people need to get their body's firmware updated, another controversial CIA project exposed by Wikileaks, a careful analysis of the FCC's Title II Net Neutrality public comments comments, a neat two factor auth tracking site, the stupid patent of the month, an example of a vanity top level domain, a bit of errata, where did SpinRite come from?, and ... utterly unconscionable security mistakes made by AT&T in their line of U-Verse routers.
Biggest. Security Leak. Ever. This week we discuss last Friday's passing of our dear friend and colleague Jerry Pournelle, when AI is turned to evil purpose, whether and when Google's Chrome browser will warn of man in the middle attacks, why Google is apparently attempting to patent pieces of a compression technology they did not invent, another horrifying router vulnerability disclosure -- including ten 0-day vulnerabilities, an update on the sunsetting of Symantec's CA business unit, another worrying failure at Comodo, a few quick bits, an update on my one commercial product SpinRite, answering a closing the loop question from a listener, and a look at the Equifax fiasco.
Equifax, EFF vs WC3, CCleaner. This week Padre and Steve discuss what was up with Security Now's recent audio troubles, more on the Equifax Fiasco, the EFF & Cory Doctorow weigh in on forthcoming browser encrypted media extensions (EME), an emerging browser-based payment standard, when 2-factor is not 2-factor, the CCleaner breach and what it means, a new Bluetooth-based attack, an incredibly welcome and brilliant cookie privacy feature in iOS 11, and a heads-up caution about the volatility of Google's Android smartphone cloud backups.
Did China Attack Equifax? CCleaner breach, DOM fuzzing at Google's Project Zero. This week, Father Robert and Steve follow more Equifax breach fallout, look at encryption standards blowback from the Edward Snowden revelations, examine more worrisome news of the CCleaner breach, see that ISPs may be deliberately infecting their own customers, warn that turning off iOS radios doesn't, look at the first news of the FTC's suit against D-Link's poor security, examine a forthcoming Broadcom GPS chip features, warn of the hidden dangers of high-density barcodes, discuss Adobe's disclosure of their own private key, close the loop with our listeners, and examine the results of DOM fuzzing at Google's Project Zero.
Moxie Marlinspike and Signal. This week we discuss some aspects of iOS v11, the emergence of browser hijack cryptocurrency mining, new information about the Equifax hack, Google security research and Gmail improvements, breaking DKIM without breaking it, concerns over many servers in small routers and aging unpatched motherboard EFI firmware, a new privacy leakage bug in IE, a bit of miscellany, some long-awaited closing the loop feedback from our listeners, and a close look at a beautiful piece of work by Moxie & Co on Signal.
Domain Name System SECurity Extensions. This week we take a look at a well-handled breach-response at Disqus, a rather horrifying mistake Apple made in the implementation of their APFS encryption (and the difficulty to the user of fully cleaning up after it), the famous "robots.txt" file gets a brilliant new companion, somewhat shocking news about Windows XP... or is it? Firefox EOL for Windows XP support coming next summer, the sage security thought for the day, an update on "The Orville", some closing the loop comments, including a recommendation of the best Security Now series we did in the past... and finally, a look at the challenge of DNSSEC.
KRACK and ROCA. This week, we examine ROCA's easily factorable public keys, the surprising prevalence of web-based cryptocurrency mining, some interesting work in iOS password dialog spoofing, Google's Advanced Protection Program, some good "Loopback" comments from our listeners... and then we take a close look at KRACK - the Key Reinstallation AttaCK against ALL unpatched WiFi systems.
The Next Big IoT Botnet. This week we discuss some ROCA fallout specifics, an example of PRNG misuse, the Kaspersky Lab controversy, a DNS security initiative for Android, another compromised download occurrence, a browser-based cryptocurrency miner for us to play with... and Google considering blocking them natively, other new protections coming to Chrome, an update on Marcus Hutchins, Microsoft's "TruePlay" being added to the Win10 fall creators update, some interesting "Loopback" from our terrific listeners... and then we take a closer look at the rapidly growing threat of IoT-based "Flash Botnets."
An update on the Reaper botnet. This week we examine the source of WannaCry, a new privacy feature for Firefox, Google's planned removal of HPKP, the idea of visual objects as a second factor, an iOS camera privacy concern, the CAPTCHA wars, a horrifying glimpse into a non-Net Neutrality world, the CoinHive DNS hijack, the new Bad Rabbit crypto malware, a Win10 anti-crypto malware security tip, spying vacuum cleaners, a new Amazon service, some loopback Q&A with our listeners and another look at the Reaper botnet.
ROCA Crypto Key Flaw Even Worse. This week we discuss the inevitable dilution in the value of code signing, a new worrisome cross-site privacy leakage, is Unix embedded in all our motherboards? The ongoing application spoofing problem, a critical IP address leakage vulnerability in TOR and the pending major v3 upgrade to TOR, a Signal app for ALL our desktops, an embarrassing and revealing glitch in Google Docs, bad behavior by an audio driver installer, a pending RFC for IoT updating, two reactions to Win10 Controlled Folder Access, a bit of miscellany, some closing the loop with our listeners, and, three weeks after the initial ROCA disclosure I'm reminded of two lines from the movie "Serenity": Assassin:"It's worse than you know." Mal:"It usually is."
Mr. Schneier Goes to Washington. This week we discuss why Steve won't be relying upon Face ID for security, a clever new hack of longstanding NTFS and Windows behavior, the Vault8 WikiLeaks news, the predictable resurgence of the consumer device encryption battle, a new and clever data ex-filtration technique, new anti-Malware features coming to Chrome, an unbelievable discovery about access to the IME in Skylake and subsequent Intel chipsets, a look at who's doing the unauthorized cryptomining, WebAssembly is ready for prime time, a bit of miscellany, some closing the loop feedback with our listeners... and then we share Bruce Schneier's congressional testimony about the Equifax breach.
Quad 9 is the New DNS Hotness. This week we discuss Windows having a birthday, Net Neutrality about to succumb to big business despite a valiant battle, Intel's response to the horrifying JTAG over USB discovery, another surprising AWS public bucket discovery, Android phones caught sending position data when all permissions are denied, many websites found to be watching their visitors' actions, more Infineon ID card upset, the return of BlueBorne, a new arrival to our "Well... THAT didn't take long" department, speedy news for Firefox 57, some miscellany, listener feedback, and a look at the very appealing and speedy new "Quad9" alternative DNS service.
Hide Your Mac! This week we discuss a new bad bug found in the majority of SMTP mailing agents, 54 high-end HP printers found to be remotely exploitable, more than 3/4ths of 433,000 websites are using vulnerable JavaScript libraries, horrible free security software, some additional welcome Firefox news, a bit of errata, some fun miscellany, and a BUNCH of feedback from our listeners including reactions to last week's Quad 9 recommendation.
Apple Snafu, FB Wants Your Pix. This week we discuss the long-awaited end of StartCom & StartSSL, inside last week's macOS passwordless root account access and problems with Apple's patches, the question of Apple allowing 3D facial data access to apps, Facebook's new and controversial use of camera images, in-the-wild exploitation of one of last month's patched Windows vulnerabilities, an annoying evolution in browser-based cryptocurrency mining, exploitation of Unicode in email headers, Google's advancing protection for Android users, a terrific list of authentication dongle-supporting sites and services, Mirai finds another 100,000 exposed ZyXEL routers, Google moves to reduce system crashes, a bit of miscellany including another security-related Humble Bundle offering and some closing the loop feedback from our terrific listeners.
iOS Jailbreak, Cryptocurrency Woes. This week we discuss the details behind the "USB / JTAG takeover" of Intel's Management Engine, a rare Project Zero discovery, Microsoft's well-meaning but ill-tested IoT security project, troubles with EV certs, various Cryptocurrency woes, a clever DNS spoofing detection system, a terrific guide to setting up the EdgeRouterX for network segmentation, last week's emergency out-of-cycle patch from Microsoft, a mitigated vulnerability in Apple's Homekit, Valve's ending of Bitcoin for Steam purchases, finally some REALLY GOOD news in the elusive quest for encrypted eMail, a bit of miscellany, some closing the loop feedback with our listeners, and a look at the security sacrifice Apple made in the name of convenience... and what it means.
Border Gateway Protocol Security. This week we examine how Estonia handled the Infineon crypto bug, two additional consequences of the pressure to maliciously mine cryptocurrency, 0-day exploits in the popular vBulletin forum system, Mozilla in the doghouse over Mr. Robot, Win10's insecure password manager mistake, when legacy protocol comes back to bite us, hole to bulk-steal any Chrome user's entire stored password vault... and we finally know where and why the uber-potent Mirai botnet was created, and by whom. We also have a bit of errata and some fun miscellany.. then we're going to take a look at BGP, another creaky yet crucial -- and vulnerable -- protocol that glues the global Internet together.
How Bitcoin works. In this special rebroadcast of Security Now from February 9, 2011, Steve Gibson explains, in detail, exactly how Bitcoin works.
Betrayed by Our Browser's AutoFill. This week we discuss a new clever and disheartening abuse of our browser's handy-dandy username and password autofill, some recent and frantic scurrying around by many OS kernel developers, a just-released MacOS 0 day allowing full local system compromise, another massively popular router falls to the IoT botnets, even high-quality IoT devices have problems, the evolution of adblocking and countermeasures, an important update for Mozilla's Thunderbird, a bit of miscellany, listener feedback, and an update on the NSA's possible intervention into secure encryption standards.
Meltdown and Spectre Explained. This week, before we focus upon the industry-wide catastrophe enabled by precisely timing the instructed execution of all contemporary high-performance processor architectures... we examine a change in Microsoft's policy regarding non-Microsoft A/V systems, Firefox Quantum's performance when tracking protections are enabled, the very worrisome hard-coding backdoors in ten of Western Digital's MyCloud drives, and if at first (WEP) and at second (WPA) and at third (WPA2) and at forth (WPS), you don't succeed... try, try, try, try, try yet again... with WPA3... another crucial cryptographic system being developed by a closed, members-only, committee.
Steve Gibson explains his "Inspectre" utility for Meltdown and Spectre. This week we discuss more trouble with Intel's AMT, what does Skype's use of Signal really mean, the UK's data protection legislation gives researchers a bit of relief, the continuing winding down of HTTP, "progress" on the development of Meltdown attacks, Google successfully tackles the hardest-to-fix Spectre concern with a Return Trampoline, some closing the loop feedback with our terrific listeners, and the evolving landscape of Meltdown and Spectre, including Steve's just completed "InSpectre" test & explanation utility.
State-sponsored Cyber Espionage. The Meltdown and Spectre vulnerabilities continue to dominate the week’s news. So we’ll first catch up with what's new there, then discuss the new Net Neutrality violation detection apps that are starting to appear, a new app and browser plug from the search privacy provider DuckDuckGo, a bit of welcome news from Apple's Tim Cook about their planned response to the iPhone battery-life and performance debacle, a bit of errata and some feedback from our terrific listeners. Then we take a look into a state-level, state-sponsored, worldwide, decade-long cyber espionage campaign which the EFF and Lookout Security have dubbed: Dark Caracal.
Spectre Keeps on Giving. This week we discuss continuing Spectre updates, how not to treat Tavis Ormandy, a popular dating app where you'd really hope for HTTPS but be surprised to find it missing, the unintended consequences of global posting of fitness tracking data, gearing up (or not) for this year's voting machine hack'fest, another record broken by a cryptocurrency exchange heist, bad ads and fake ads, the unclear fate of the BSD operating systems, a caution about Dark Caracal's CrossRAT Trojan, another way to skin the Net Neutrality cat, a bit of errata and miscellany, one of the best SpinRite testimonials in a long time, and some closing the loop feedback from our terrific listeners.
Meltdown & Spectre in the Wild. This week we observe that the Net Neutrality battle is actually FAR from lost, ComputerWorld’s Woody Leonard enumerates a crazy January of updates, "EternalBlue" is turning out to be far more eternal than we'd wish, will Flash EVER die? A new 0-day Flash exploit in the wild, what happens when you combine Shodan with Metasploit?, Firefox 59 takes another privacy enhancing step forward, a questionable means of sneaking data between systems, another fun SpinRite report from the field, some closing the loop feedback from our listeners, and a look at the early emergence of Meltdown and Spectre exploits appearing in the wild.
5 Interesting CryptoCurrency Tales. This week we discuss today's preempted 2nd Tuesday of the month, slow progress on the Intel Spectre firmware update front, a worse-than-originally-thought Cisco firewall appliance vulnerability, the unsuspected threat of hovering hacking drones, hacking at the Winter Olympics, Kaspersky's continuing unhappiness, the historic leak of Apple's iOS boot source code, a critical WiFi update for some Lenovo laptop users, a glitch at Wordpress, a butt of miscellany -- including a passwords rap -- some closing-the-loop feedback from our listeners... and then a look at a handful of CryptoCurrency Antics.
How Russia's 2016 election information warfare worked. This week we examine and discuss the appearance of new forms of Meltdown and Spectre attacks, the legal response against Intel, the adoption of new cybersecurity responsibility in New York, some more on Salon and authorized crypto mining, more on software cheating auto emissions, a newly revealed instance of highly profitable mal-mining, checking in on Lets Encrypts steady growth, the first crack of Windows uncrackable UWP system, Apple' whacky Telugu Unicode attacks, a frightening "EternalBlue" experiment, another aspect of crypto mining annoyance, a note now that Chrome's new advertising controls are in place, a bit of closing the loop with our listeners. And then we conclude with a look at the technology that was revealed in last week's indictment of election meddling Russians... and from a practical technology standpoint, the feasibility of anything changing.
iPhones Hacked, Android P Security. This week we discuss Intel’s Spectre & Meltdown microcode update, this week in crypto jacking, Tavis strikes again, Georgia on my mind (and not in a good way), news from the iPhone hackers at Cellebrite, Apple to move its Chinese customer data, e-Passports? Not really, Firefox 60 loses a feature, the IRS, and cryptocurrencies, Android P enhances Privacy, malicious code signing news, a VERY cool Cloudfront/Troy Hunt hack, a bit of errata, miscellany, and closing the loop feedback from our terrific listeners, and a closer look at WebAssembly.
Biggest. DDoS. Ever. This week we discuss some very welcome microcode news from Microsoft, ten (yes, ten!) new 4G LTE network attacks, the battle over how secure TLS v1.3 will be allowed to be, the incredible Trustico certificate fiasco, the continually falling usage of Adobe Flash, a new and diabolical cryptocurrency-related malware, the best Sci-Fi news in a LONG time, some feedback from our terrific listeners... and a truly record smashing (and not in a good way) new family of DDoS attacks.
AMD Security Flaws, DDoS Attacks. This week we discuss the just-released news of major trouble for AMD's chipset security, ISPs actively spreading state-sponsored malware, Windows 10 S coming soon, a large pile of cryptocurrency mining-driven shenanigans, tomorrow's Pwn2Own competition start, surprising stats about Spam botnet penetration, and a week #2 update on the new Memcached DDoS attacks.
AMD Flaws, Pwn2Own winners. This week we discuss the aftermath of CTS Labs' abrupt disclosure of flaws in AMD's outsourced chipsets, Intel's plans for the future and their recent microcode update news, several of Microsoft's recent announcements and actions, the importance of testing... in this case VPNs; the first self-driving automobile pedestrian death, a SQRL update, a bit of closing the loop feedback with our listeners, and a look a the outcome of last week's annual Pwn2Own hacking competition.
Election Security, CLOUD Act. The mess with US voting machines, technology's inherent security vs convenience tradeoff, the evolving 2018 global threat landscape, welcome news on the bug bounty front from Netflix and Dropbox, we have the interesting results of Stack Overflow's 8th annual survey of 101,592 developers, worrisome news on the US government data overreach front, some useful and important new web browser features, messenger app troubles, a CRITICAL Drupal updated coming tomorrow, some welcome news for DNS security & privacy, a bit of miscellany and a look at the just-ratified TLS v1.3.
Secure Email, 1.1.1.1. This week we discuss "DrupalGeddon2", Cloudflare's new DNS offering, a reminder about GRC's DNS Benchmark, Microsoft's Meltdown meltdown, the persistent iOS QR Code flaw and its long-awaited v11.3 update, another VPN user IP leak, more bug bounty news, an ill-fated-seeming new eMail initiative, Free electricity, a policy change at Google's Chrome store, another "please change your passwords" after another website breach, a bit of miscellany, a heart-warming SpinRite report, some closing the loop feedback from our terrific listeners, and a closer look at the Swiss encrypted ProtonMail service.
Spectre, Net Neutrality, Kill TLS 1.0. This week we discuss Intel's big Spectre microcode announcement, Telegram is not long for Russia, the US law enforcement's continuing push for "lawful decryption", more state-level net neutrality news, Win10's replacement for "Disk Cleanup", a bug bounty policy update, some follow-up to last week's Quad-1 DNS conversation, why clocks had been running slow throughout Europe... then a look at the deprecation of earlier version of TLS and a big Cisco mistake.
AMD vs Spectre, Telegram vs Russia. This week we discuss AMD's release of their long-awaited Spectre variant 2 microcode patches, the end of Telegram messenger in Russia, the on-time arrival of Drupalgeddon2, Firefox and TLS v1.3, the new and widespread UPnProxy attacks, Microsoft's reversal on no longer providing Windows security updates without A/V installed, Google Chrome's decision to prematurely remove HTTP cookies, the Android "patch gap", renewed worries over old and insecure Bitcoin crypto, new attacks on old IIS, a WhatsApp photo used for police forensics, and an IoT vulnerability from our "you can't make this stuff up" department.
IoT Security. This week we discuss Drupalgeddon2 continuing to unfold right on plan, the Orangeworm takes aim at medical equipment and companies, the FDA moves forward on requiring device updates, Microsoft leads a new Cybersecurity Tech Accord, another instance of loud noises and hard drives not mixing, considerations for naming your WiFi network, the unappreciated needs of consumer routers, Google's new unencrypted messaging app push, Amazon pulls the trigger on "in-car" package delivery, the first puzzle recommendation in a long time, and Microsoft's move to secure the IoT space.
IoT Security Complications. Windows 10 got a new spring in its step, Microsoft further patches Intel microcode, even the UK's NHS plans to update, another hack of modern connected autos, Oracle's botched WebLogic patch, an interesting BSOD-on-demand Windows hack, a PDF credentials theft hack (which Adobe won't fix), your Echo may be listening to you, a powerful Hotel keycard hack, a bit of errata and feedback, and a discussion of another Microsoft-driven security initiative.
Russia v Telegram, New Spectre Bug. This week we begin by updating the status of several ongoing security stories: Russia vs Telegram, DrupalGeddon2, and the return of RowHammer. We will conclude with MAJOR new bad news related to Spectre. We also have a new cryptomalware, Twitter's in-the-clear passwords mistake, New Android 'P' security features, a crazy service for GDPR compliance, Firefox's sponsored content plan, another million routers being attacked, More deliberately compromised JavaScript found in the wild, a new Microsoft Meltdown mistake, a comprehensive Windows command reference, and signs of future encrypted Twitter DMs.
eFail and Throwhammer. This week we will examine two incredibly clever, new (and bad) attacks named eFail and Throwhammer. But first we catchup on the rest of the past week's security and privacy news, including the evolution of UPnProxy, a worrisome flaw discovered in a very popular web development platform, the 1st anniversary of EternalBlue, the exploitation of those GPON routers, this week's disgusting security head shaker, a summary of the RSA conference's security practices survey, the appearance of persistent IoT malware, a significant misconception about hard drive failure, an interesting bit of listener feedback... then a look at two VERY clever new attacks.
Next-generation of Spectre speculation flaws. This week we examine the recent flaws discovered in the secure Signal messaging app for desktops, the rise in DNS router hijacking, another seriously flawed consumer router family, Microsoft Spectre patches for Win10's April 2018 feature update, the threat of voice assistant spoofing attacks, the evolving security of HTTP, still more new trouble with GPON routers, Facebook's Android app mistake, BMW's 14 security flaws and some fun miscellany. Then we examine the news of the next-generation of Spectre processor speculation flaws and what they mean for us.
FBI Says: Reboot Your Router NOW. This week we discuss Oracle's planned end of serialization, Ghostery's GDPR faux paus, the emergence of a clever new banking Trojan, Amazon Echo and the case of the Fuzzy Match, more welcome movement from Mozilla, yet another steganographic hideout, an actual real-world appearance of HTTP Error 418 (I'm a Teapot!), the hype over Z-Wave's Z-Shave, and a deep dive into the half a million strong VPNFilter botnet.
What is "Certificate Transparency?" This week we discuss yesterday's further good privacy news from Apple, the continuation of VPNFilter, an extremely clever web browser cross-site information leakage side-channel attack, Microsoft Research's fork of OpenVPN for security in a post-quantum world, Microsoft drops the ball on a 0-day remote code execution vulnerability in JScript, Valve finally patches a longstanding and very potent RCE vulnerability, Redis caching servers continue to be in serious trouble, a previously patched IE 0-day continues to find victims, Google's latest Chrome browser has removed support for HTTP public key pinning (HPKP), and... what is "Certificate Transparency" and why do we need it?
Active Wormable Exploitation. This week we update again on VPNFilter, look at another new emerging threat, check in on Drupalgeddon2, examine a very troubling remote Android vulnerability under active wormable exploitation, take stock of Cisco's multiple firmware backdoors, look at a new cryptomining strategy, the evolution of Russian state-sponsored cybercrime, a genealogy service that lost its user database, ongoing Russian censorship, another Adobe FLASH mess, and a check-in on how Marcus Hutchins is doing. Then we look at yet another huge mess resulting from insecure interpreters.
S1 · E668
90 min
Meltdown, Spectre & Lazy Restores. This week we examine a rather "mega" patch Tuesday, a nifty hack of Win10's Cortana, Microsoft's official "when do we patch" guidelines, the continuing tweaking of web browser behavior for our sanity, a widespread Windows 10 rootkit, the resurgence of the Satori IoT botnet, clipboard monitoring malware, a forthcoming change in Chrome's extensions policy, hacking apparent download counts on the Android store, some miscellany, an update on the status of Spectre & Meltdown... and yes, yet another brand new speculative execution vulnerability our OSes will be needing to patch against.
SCOTUS Cell Phone Location Privacy. This week we examine some new side-channel worries and vulnerabilities, did Mandiant "hack back" on China?, more trouble with browsers, the big Google Firebase mess, sharing a bit of my dead system resurrection, and a look at the recent Supreme Court decision addressing cellular location privacy.
WPA3 Wi-Fi Security on the Way. This week we discuss the interesting case of a VirusTotal upload... or was it?, newly discovered problems with our 4G LTE... and even what follows, another new EFF encryption initiative, troubles with Spectre and Meltdown in some browsers, the evolution of UPnP-enabled attacks, an unpatched Wordpress vulnerability that doesn't appear to be worrying the Wordpress devs... and an early look at next year's forthcoming WPA3 standard... which appears to fix everything!
Fortnite Malware, Email Security. This week we discuss another worrisome trend in malware, another fitness tracking mapping incident and mistake, something to warn our friends and family to ignore, the value of periodically auditing previously-granted web app permissions, when malware gets picky about the machines it infects, another kinda-well-meaning Coinhive service gets abused, what are the implications of D-Link losing control of its code signing cert?, some good news about Android apps, iOS v11.4.1 introduces "USB Restricted Mode"... but is it?, a public service reminder about the need to wipe old thumb drives and memory cards, what about those free USB fans that were handed out at the recent North Korea / US summit?... and then we take a look at eMail's STARTTLS system and the EFF's latest initiative to increase its usefulness and security.
Russian Election Hack Indictments. This week we look at even MORE, new, Spectre-related attacks, highlights from last Tuesday's monthly patch event, advances in GPS spoofing technology, GitHub's welcome help with security dependencies, Chrome's new (or forthcoming) "Site Isolation" feature, when hackers DO look behind the routers they commandeer, the consequences of deliberate BGP routing misbehavior... and reading between the lines of last Friday's DOJ indictment of the US 2016 election hacking by 12 Russian operatives -- the US appears to really have been "all up in their business."
Google, MS, FB, & Twitter Play Nice. This week as we examine still another new Spectre processor speculation attack, some news on DRAM hammering attacks and mitigation, the consequences of freely available malware source code, the reemergence of concern over DNS rebinding attacks, Venmo's very public transaction log, more Russian shenanigans, the emergence of flash botnets, Apple continuing move of Chinese data to China, another (the 5th) Cisco secret backdoor found, an optional missing Windows patch from last week, a bit of Firefox news and piece of errata... and then we look at "The Data Transfer Project" which, I think, marks a major step of maturity for our industry.
"Death Botnet," Google Titan Key. This week we examine still another new Spectre processor speculation attack, we look at the new "Death Botnet", the security of the US DoD websites, lots of Google Chrome news, a push by the US Senate toward more security, the emergence and threat of clone websites in other TLDs, more cryptocurrency mining bans, Google's Titan hardware security dongles, and we finish by examining the recently discovered flaw in the Bluetooth protocol which has device manufacturers and OS makers scrambling. (But do they really need to?)
Hacking WiFi passwords. This week we discuss yet another new and diabolical router hack and attack, Reddit's discovery of SMS 2FA failure, WannaCry refuses to die, law enforcement's ample unused forensic resources, a new and very clever BGP-based attack, Windows 10 update dissatisfaction, Google advances their state-sponsored attack notifications, what is Google's project Dragonfly?, a highly effective and highly targeted Ransomware campaign, some closing-the-loop feedback from our listeners, and a breakthrough in hacking/attacking WiFi passwords.
Black Hat and DEF CON 2018 Hacks. This week we cover lots of discoveries revealed during last week's Black Hat 2018 and DEF CON 26 Las Vegas security conferences. Among them, 47 vulnerabilities across 25 Android smartphones, Android "Disk-In-The-Middle" attacks, Google tracking when asked not to, more Brazilian DLink router hijack hijinks, a backdoor found in VIA C3 processors, a trusted-client attack on WhatsApp, a macOS 0-day, a tasty new feature for Win10 Enterprise, a new Signal-based secure eMail service, Facebook's FIZZ TLS v1.3 library, another Let's Encrypt milestone, and then "FaxSploit" the most significant nightmare in recent history (FAR worse, I think, than any of the theoretical Spectre & Meltdown attacks).
The Latest Intel Speculation Disaster. As we head into our 14th year of Security Now, this week we look at some of the research released during last week's USENIX Security symposium, we also take a peek at last week's Patch Tuesday details, Skype's newly released implementation of Open Whisper Systems' Signal privacy protocol, Google's Chrome browser's increasing pushback against being injected into, news following last week's observation about Google's user tracking, Microsoft's announcement of more spoofed domain takedowns, another page table sharing vulnerability, believe it or not... "Malicious Regular Expressions", some numbers on how much money CoinHive is raking in, flaws in browser and their add-ons that allow tracking-block bypasses, two closing-the-loop bits of feedback, and then a look at the details of the latest Intel Speculation disaster known as "The Foreshadow Flaw".
Another busy week. This week we catch-up with another busy week. We look at Firefox's changing certificate policies, the danger of grabbing a second-hand domain, the Fortnite mess on Android, another patch-it-now Apache Struts RCE, a frightening jump in Mirai Botnet capability, an unpatched Windows 0-day privilege elevation, malware with a tricky new C&C channel, A/V companies are predictably unhappy with Chrome, Tavis found more serious problems in GhostScript, a breakthrough in contactless RSA key extraction, a worrisome flaw that has always been present in OpenSSH, and problems with never-dying Hayes AT commands in Android devices.
Turn Your Phone Into a Sonar. This week we cover the expected exploitation of the most recent Apache STRUTS vulnerability, a temporary interim patch for the Windows 0-day privilege elevation, an information disclosure vulnerability in all Android devices, Instagram's moves to tighten things up, another OpenSSH information disclosure problem, an unexpected outcome of the GDPR legislation and sky high fines, the return of the Misfortune Cookie, many thousands of Magneto commerce sites are being exploited, a fundamental design flaw in the TPM v2.0 spec, trouble with Mitre's CVE service, Mozilla's welcome plans to further control tracking, a gratuitous round of Win10 patches from Microsoft.... and then a working sonar system which tracks smartphone finger movements!
Win7 2023, Chrome 69, PWD=1234. This week we discuss Windows 7's additional three years of support life, MicroTik routers back in the news (and not in a good way), Google Chrome 69's new features, the hack of MEGA's cloud storage extension for Chrome, Week 3 of the Windows Task Scheduler 0-day, a new consequence of using '1234' as your password, Tesla makes their white hat hacking policies clear... just in time for a big new hack!, our PCs as the new malware battlefield, a dangerous OpenVPN feature is spotted, and Trend Micro, caught spying, gets kicked out of the MacOS store.
Presidential Alerts, Safari Ripper. This week we prepare for the first ever Presidential Alert unblockable nationwide text message, we examine Chrome's temporary "www" removal reversal, checkout Comodo's somewhat unsavory marketing, discuss a forthcoming solution to BGP hijacking, examine California's forthcoming IoT legislation, deal with the return of Cold Boot attacks, choose not to click on a link that promptly crashes any Safari OS, congratulate Twitter on adding some auditing, check in on the Mirai Botnet's steady evolution, look at the past year's explosion in DDoS number of size, note another new annoyance brought to us by Windows 10... Then we take a look at the state of the quietly evolving web browser extension ecosystem.
Chrome 69 Issues, Browser Reaper. This week we look at additional changes coming from Google's Chromium team, another powerful instance of newer cross-platform malware, the publication of a 0-day exploit after Microsoft missed its deadline, the return of Sabri Haddouche with browser crash attacks, the reasoning behind Matthew Green's decision to abandon Chrome after a change in release 69... and an "UnGoogled" Chromium alternative that Matthew might approve of, Western Digital's pathetic response to a very serious vulnerability, a cool device exploit collection website, a question about the future of the Internet, a sobering example of the aftermarket in unwiped hard drives, the Mirai Botnet creators are now working with and helping the FBI, another fine levied against Equifax, and a look at Cloudflare's quick move to encrypt a remaining piece of web metadata.
US Sues CA, 50M FB Accounts Hacked. This week we discuss yet another treat from Cloudflare, the growing legislative battle over Net Neutrality, the rise of Python malware, Cisco's update report on the VPNFilter malware, still more Chrome controversy and some placating, the rapid exploitation of 0-day vulnerabilities, the first UEFI rootkit found in the wild, another new Botnet discovery, the danger of the RDP protocol, a nasty website browser trick and how to thwart it, a quick update on recent non-fiction and science fiction, and then a look into the recent massive 50 million account Facebook security breach.
China Chip Hack, Google+ . An October Surprise of a different sort - Windows 10 update deletes users' files. A security researcher has massively weaponzied the existing MicroTik vulnerability and released it as a proof-of-concept. A clever voicemail WhatsApp OTP bypass. What happened with that recent Google+ breach? Google tightens up its Chrome extensions security policies WiFi radio protocol designations finally switch to simple version numbering Intel unwraps its 9th-generation processors Head-spinning PDF updates from Adobe and Foxit (this isn't a competition, guys!) Bloomberg's earth-shaking controversial report on Chinese hardware hacking
Paul Allen, Microsoft's October patching fiasco, & the end of TLS v1.0 and 1.1. This week we observe the untimely death of Microsoft’s co-founder Paul Allen, revisit the controversial Bloomberg China supply chain hacking report, catch up on Microsoft's October patching fiasco, follow-up on Facebook's privacy breach, look at the end of TLS v1.0 and 1.1, explore Google's addition of control flow integrity to Android 9, look at a GAO report about the state of US DOD weapons cybersecurity, consider the EOL of PHP 5.x chain, take a quick look at an A/V comparison test, entertain a few bits of feedback from our listeners, and then consider the implications of grey-hat vigilante hacking of others’ routers.
A Truly Gobsmacking Libssh Error. This week a widely used embedded OS (FreeRTOS) is in the doghouse, as are at least eight D-Link routers which have serious problems most of which D-Link has stated will never be patched. We look at five new problems in Drupal 7 and 8, two of which are rated critical, trouble with Live Networks RTSP streaming server, still more trouble with the now-infamous Windows 10 Build 1809 feature update, and a long standing 0-day in the widely used and most popular plugin for jQuery. We then look at what can only be described as an embarrassing mistake in the open source libssh library, and we conclude by examining a fun recent hack and pose its solution to our audience as our Security Now Puzzler of the Week!
More Zero-day exploits in Windows 10, publicly exposed Docker Engine APIs, Google's plan to fix Android, the DoD is expanding its existing "Hack the Pentagon" bug-bounty program to include hardware assets, the going rate for DDoS-for-Hire, and Steve has the answer to our vending machine conundrum from last week.
A close look at the impact and implication of the new “PortSmash” attack against Intel (and almost certainly other) processors. The new “BleedingBit” Bluetooth flaws. JavaScript is no longer optional with Google. A new Microsoft Edge browser 0-day. Windows Defender plays in its own sandbox. Microsoft and SysInternals news. The further evolution of the CAPTCHA. The 30th anniversary of the Internet's first worm. A bizarre requirement of Ransomware. A nice new bit of security non-tech from Apple.
SSD Encryption Flaws. Last month's Patch Tuesday, this month. A GDPR-inspired lawsuit filed by Privacy International. Check these two router ports to protect against a new botnet that's making the rounds. Another irresponsibly disclosed zero-day, this time in Virtual Box. CloudFlare's release of a very cool 1.1.1.1 app for iOS and Android. Microsoft's caution about the in-RAM vulnerabilities of the BitLocker whole drive encryption A deep dive into last week's worrisome revelation about the lack of true security being offered by today's Self-Encrypting SSD drives.
Pwn2Own, the Future of Passwords. All the action at last week's Pwn2Own Mobile hacking contest. The final word on processor mis-design in the Meltdown/Spectre era. A workable solution for unsupported Intel firmware upgrades for hostile environments. A forthcoming Firefox breach alert feature. The expected takeover of exposed Docker-offering servershe recently announced successor to recently ratified HTTP/2. 1.1.1.1 errata. The future of passwords: a thoughtful article written by Troy Hunt, the creator of the popular "Have I Been Pwned" web service.
The Next Evolution of Rowhammer. Yesterday, the US Supreme Court heard Apple's argument about why a class action lawsuit against their monopoly App Store should not be allowed to proceed. How could this affect iOS security? Google and Mozilla are looking to remove support for FTP from their browsers. From our “what could possibly go wrong” department, we have browsers asking for explicit permission to leave their sandboxes. The next step in the evolution of RowHammer attacks which do, as Bruce Schneier once opined, only get better… or in this case, worse!
Marriott Breach, Printer Spam. Another Lenovo SuperFish-style local security certificate screw up. The Marriott breach and several other new, large and high-profile secure breach incidents. The inevitable evolution of exploitation of publicly exposed UPnP router services. The emergence of "Printer Spam". How well does ransomware pay? We have an idea now. The story of two iOS scam apps. Progress on the DNS over HTTPS front. Rumors that Microsoft is abandoning their EdgeHTML engine in favor of Chromium We also have a bit of a Cyber Security related Humble Book Bundle just in time for Christmas. Some new research that reveals that it's possible to recover pieces of web browser page images that have been previously viewed.
Australia's recently passed anti-encryption legislation Details of a couple more mega-breaches including a bit of Marriott follow-up A welcome call for legislation from Microsoft A new twist on online advertising click fraud The DHS is interested in deanonymizing cryptocurrencies beyond Bitcoin The changing landscape of TOR funding. An entirely foreseeable disaster with a new Internet IoT-oriented protocol Google finds bugs in Google+ and acts responsibly -- again -- what that suggests for everyone else
Rhode Island's response to Google's recent API flaw Signal's response to Australia's anti-encryption legislation The return of PewDiePie US border agents retaining traveler's private data This Week in Android Hijinks Confusion surrounding the Windows v5 release Another Facebook API mistake The 8th annual most common passwords list (AKA "How's 'monkey' doing?") Why all might not be lost if someone is hit with drive encrypting malware Microsoft's recent 4-month run of 0-day vulnerability patches The Firefox 64 update A reminder of an awesome train game for iOS, Mac and Android A look at a new and very troubling flaw discovered in the massively widespread SQLite library... and what we can do.
The Best of Security Now from 2018!
The NSA announces the forthcoming release of an internal powerful reverse-engineering tool for examining and understanding other people's code. Emergency out-of-cycle patches from both Adobe and Microsoft. PewDiePie hacker strikes again. Prolific 0-day dropper SandboxEscaper ruffles some feathers. A new effort by the US government to educate industry about the risks of Cyber attacks. Welcome news on the ransomware front. VERY welcome news of a new Windows 10 feature. A note about a just-published side-channel attack on OS page caches.
The implications of the recent increase in bounty for the purchase of 0-day vulnerabilities. The intended and unintended consequences of last week's Windows Patch Tuesday. Speaking of unintended consequences, the US Government shutdown has had some, too! A significant privacy failure in WhatsApp. Another Ransomware decryptor (with a twist). Movement on the DNS-over-TLS front. An expectation of the cyberthreat landscape for 2019. A cloudy forecast for The Weather Channel App. A successful 51% attack against the Ethereum Classic cryptocurrency. Another court reversing compelled biometric authentication. An update on the lingering death of Flash... now in hospice care.
Which is the right VPN client for Android, and which should you avoid at all costs? A very worrisome WiFi bug affecting billions of devices Hack a Tesla Model 3 at Pwn2Own Russia's ongoing, failing and flailing efforts to control the Internet The return of the Anubis Android banking malware Google's changing policy for phone and SMS App access Tim Cook's note in TIME Magazine News of a nice Facebook Ad auditing page Another Cisco default password nightmare in widely used lower-end devices
Can browsers be flexible and secure? The expressive power of the social media friends we keep The persistent DNS hijacking campaign which has the US Government quite concerned Last week's iOS and macOS updates (and doubtless another one very soon!) A valiant effort to take down malware distribution domains Chrome catching up to IE and Firefox with drive-by file downloads Two particularly worrisome vulnerabilities in two Cisco router models publicly disclosed last Friday The state of the industry and the consequences of extensions to our web browsers.
Battle Typo-squatters, Linux Patch Chrome gets "spell-check for URLs" Catch up on your Linux patch up! Performance enhancements for Chrome and FireFox. Facebook must really like being in the doghouse. The Japanese government takes on IoT security. Ubiquity routers are in trouble again. Chrome "Never Slow" mode in the works.
Google Adiantum, FaceTime Fix Apple's most recent v12.1.4 iOS update and the two 0-day vulnerabilities it closed Worrisome new Android image-display vulnerability An interesting "reverse RDP" attack The new LibreOffice & OpenOffice vulnerability Microsoft's research into the primary source of software vulnerabilities MaryJo gets an early peek at enterprise pricing for extending Windows 7 support China and Russia continue their work to take control of their countries' Internet Firefox's resumption of its A/V warning in release 65. How Google does the Cha-Cha with their new "Adiantum" ultra-high-performance cryptographic cipher.
Elon's Dangerous AI, PiDP-11. Last week's doozy of a patch Tuesday for both Microsoft and Adobe An interesting twist coming to Windows 7 and Server 2008 security updates Eight mining apps pulled from the Windows Store Another positive security initiative from Google Electric scooters being hacked Chipping away at Tor's privacy guarantees A year and a half after Equifax, and where's the data? The beginnings of GDPR-like legislation for US An extremely concerning new and emerging threat for the Internet
Attacks in the Wild A number of ongoing out-in-the-wild attacks Another early-warned Drupal vulnerability A 19-year old flaw in an obscure decompress for the "ACE" archive format Microsoft reveals an abuse of HTTP/2 protocol which is DoSing its IIS servers. Mozilla faces a dilemma about a wanna-be Certificate Authority and they also send a worried letter to Australia. Microsoft's Edge browser is revealed to be secretly whitelisting 58 web domains which are allowed to bypass its "Click-To-Run" permission for Flash. ICANN renews its plea for the Internet to adopt DNSSEC. NVIDIA releases a handful of critical driver updates for Windows. Apple increases the intelligence of it's Intelligent Tracking Prevention.
The increasing feasibility of making a sustainable career out of hunting for software bugs A newly available improvement in Spectre mitigation performance and who can try it now Adobe's ColdFusion emergency and patch, More problems with A/V and self-signed certs A Docker vulnerability being exploited in the wild The end of Coinhive A new major Wireshark release A nifty web browser website screenshot hack Continuing troubles with the over-privileged Thunderbolt interface Bot-based credential stuffing attacks
0-day exploit bidding war NSA releases Ghidra v9 Firefox's adds Tor privacy A pair of nasty 0-days A worrisome breach at Citrix The risk of claiming to be an unhackable aftermarket car alarm A new and interesting "Windows developers chatting with users" idea at Microsoft A semi-solution to Windows updates crashing systems Detailed news of the Marriott/Starwood breach, a bit of miscellany from SPOILER: Another new and different consequence of speculation on Intel machines.
Last week's Patch Tuesday March Madness Win7 SHA256 Windows Update... Update Many attacks leveraging the recently discovered WinRAR vulnerability What happens when Apple, Google, and GoDaddy all drop a bit? A big recent jump in Mirai Botnet Capability Compromised Counter-Strike gaming servers Privacy enhancements coming in Android Q A pair of very odd web browser extensions for Chrome and Firefox from Microsoft A VERY exciting and encouraging project to create an entirely open eVoting system
The return of "Clippy", Microsoft's much-loathed dancing paperclip Operation "ShadowHammer" which reports say compromised ASUS (... but did it?) The ransomware attack on Norsk Hydro aluminum The surprise renaming of Windows Defender A severe bug revealed in the most popular PDF generating PHP library An early look at Microsoft's forthcoming Chromium-based web browser Hope for preventing caller ID spoofing A needed update for users of PuTTY Mozilla's decision to conditionally rely upon Windows' root store Microsoft to offer virtual Windows 7 and 10 desktops through Azure Details of the Windows 7 End of Life warnign dialog
Android Security, 10 Years Later WinRAR, a 20+ Year Old Tool With 500M Users, Acknowledged Vulnerability Russian GPS Hacking and What It Means For Us Android's April Fools Day Patches Tesla Autopilot Spoofing The ASUS "ShadowHammer" Attack Windows 10 (last) October 2018 Update A VMware Update
Your Browser is Tracking You, UK vs Social Media Yet another capitulation in the (virtually lost) battle against tracking our behavior on the Internet with URL "ping" tracking. UK government's plan to legislate, police and enforce online social media content Microsoft's Chromium-based Edge browser's security Improvements to Windows 10's update management News from the "spoofing biometrics" department The worrisome state of Android mobile financial apps NSA's GHIDRA software reverse engineering tool suite Perhaps the dumbest thing Facebook has done yet (and by policy, not by mistake) An important change in Win10 1809 external storage caching policy
DragonBlood: the first effective attack on the new WPA3 protocol • Malicious use of the URL tracking "ping" attribute • The WinRAR Nightmare • More 3rd-party A/V troubles with Microsoft • What good did April's patch Tuesday accomplish? • Adobe 's big patch Tuesday • Google considering automatically blocking "high risk" downloads • Russia's Roskomnadzor finally lowers the boom on Facebook • The incredible Taj Mahal APT framework
Top Security Stories this Week: • Google uses its "sensorvault" to help catch the bad guys. • Time to update Drupal again. • Facebook steals users' email contact lists, logs plaintext Instagram passwords • Russia moves closer to adopting "Internet Master Cutoff Switch" legislation. • A reminder that "USB Killers" are a real thing. • Marcus Hutchins' plea deal • A new(ish) actively exploited Windows 0-day • A bunch of Microsoft Edge news • Windows 7 end-of-life notices • Something from the "I did say this was bound to happen" department • Detailed threat research from Cisco's Talos group about the leveraging of DNS espionage.
The large and emerging threat of website credential stuffing attacks. • Privacy fallout from our recent coverage of Facebook and Google • The uptake rate of recent Windows 10 feature releases • The source of the A/V troubles with the April patch Tuesday updates • The NIST's formal fuzzing development • A massive and ongoing database data leak involving more than half of all American households • Windows Insiders are already finding that their systems won't update to the May 2019 feature update. • United Airlines passengers have noticed and been understandably upset by seatback cameras pointing at them.
This Week's Stories • The continuing and changing world of cryptojacking after Coinhive closed their doors last month. • Google's announcement of self-expiring data retention • The mess arising from Mozilla's intermediate certificate expiration • Another wrinkle in the exploit marketplace • Mozilla's announcement about deliberate code obfuscation • A hacker who hacked at least 29 other botnet hackers • A warning about a very popular D-Link netcam • Who's paying and who's receiving bug bounties by country • Another User-Agent gotcha with Google Docs • A problem with Google Earth on the new Chromium-Edge browser • A bit more about Edge's future just dropped at the start of Microsoft's Build 2019 conference.
This Week's Stories • Update WhatsApp NOW! • Security News from Google I/O 2019 conference • A new exploitable flaw in all Linux kernels earlier than v5.0.8 • A new set of flaws affecting all Intel processors known as "ZombieLoad" • Security enhancements in Android Q.
This Week's Stories • The next round of Intel processor information leakage problems: Microarchitectural Data Sampling vulnerabilities • Last Tuesday's patches from Microsoft, Abode and Apple includes one for Windows XP • Security problem for Cisco that ever has stock analysts taking notice • Ongoing troubles with the cryptocurrency market • Trouble with Google's Titan Bluetooth dongle • Another monthly problem with Windows 10 updates
• The Internet is Doomed: BlueKeep Attacks Windows Remote Desktop Protocol • Google Stores Unhashed G Suite Passwords • Sandbox Escaper Drops FIVE New Zero-Day Exploits • Microsoft's Just-released Win10 Feature Update 1903 • Security Enhancements in Firefox's Release 67
Checking in on the BlueKeep RDP vulnerability • The planned shutdown of one of the most "successful" affiliate-based ransomware systems • An update on the anti-Robocalling problem • Russian and Chinese militaries plan to quit using Windows • Apple's announcement yesterday of their forthcoming "Sign in with Apple" service • The Nansh0u campaign, apparently sourced from China, has successfully compromised many tens of thousands of servers exposed to the Internet.
SandboxEscaper drops another 0-day • The still-not-yet-widely-exploited BlueKeep vulnerability • GoldBrute Botnet pounding on RDP servers (but not yet using BlueKeep) • The FBI issued an interesting advisory about not trusting secure sites just because they're secure • VLC receives 33 security bug fixes • Microsoft's Edge browser takes another step forward • Mozilla reorganizes • MUST HAVE utility of the week: DNS Query Sniffer • The first formal full release of SQRL • Anyone running an Exim mail server needs to update immediately!
• A new DRAM problem called "RAMBleed" • A bad Linux TCP SACK server kernel crashing flaw • Last week's patch Tuesday • A Bluetooth surprise • Another useless warning about the BlueKeep vulnerability • Microsoft misses a 90-day Tavis Ormandy deadline • Good news about GandCrab wrapup • Yubico's entropy mistake • Post-announce SQRL news • Our favorite iOS security app • Attacks on Exim mail servers and other pending disasters
Update on the Linux TCP SACK Kernel panic • Hackers exploit a Firefox flaw and attack Coinbase • Google corrects a flaw with Nestcam • An elegant solution to OpenSSH key theft via Rowhammer attacks • Update on the BlueKeep RDP vulnerability • Verizon's negligence caused a major Cloudflare and Amazon customer outage • NASA was infected by an APT for more than a year • Should you pay ransomware? • Microsoft's Chromium-based Edge browser Update • The state of the commercial Bug Bounty Business
Ransomware in Florida and elsewhere • The "Going Dark" anti-encryption debate • A BlueKeep Proof of Concept demo produced by the guys at SophosLabs • Massive publicly-exposed databases • Chinese IoT manufacturer logs a million+ customer devices into a 2+ billion record publicly-exposed database, • The dilemma we have with the utter lack of oversight and control over our own IoT devices
• Mozilla's privacy-enhancing DNS over HTTPS support • Facial recognition and automobile license plate scanners • The future of satellite-based Internet services • How a Ruby code repository was hacked • The UK GCHQ's proposal for adding "ghost" participants into private conversations
• Bullet points from last Tuesday's monthly Windows patches as well • Notes from the end of Windows 7 • Laporte County Under Ransomware Attack • The mixed blessing of fining companies for self-reporting • A survey of enterprise malware headaches • Some Mozilla/ Firefox news • Another (kinda obvious) way of exfiltrating information from a PC • DNS Encryption
This Week's Stories • Welcome to Kazakhstan! Please check your privacy at the border. • Mozilla marking all non-HTTPS pages as "not secure" • Chrome Incognito Mode getting a bit more incognito • A forthcoming "super Incognito mode" for Firefox • Rust-TLS outperforms OpenSSL in nearly every way • Microsoft announces "ElectionGuard" during last week's Aspen Security Forum • ProFTPD Server is wide open to remote compromise • Sophos: "RDP exposed: the wolves already at your door"
This Week's Stories Marcus Hutchins … is Free! U.S. Attorney General Bill Barr on "warrant proof data encryption" What malware is the most popular underground? This Week in Ransomware Your NAS is Grass! 11 vulnerabilities in VxWorks’ TCP/IP stack
This week's stories • A widespread false alarm about Facebook's planned subversion of end-to-end encryption • Still more municipality Ransomware attacks • Anti-encryption saber rattling among the Five Eyes nations • Microsoft's discovery of Russian-backed IoT compromise • Chrome 76's changes • Black Hat and Def Con preview • The challenge of synchronizing a working set of files between two locations
S1 · E727
90 min
This Week's Stories BlackHat and Def Con 2019 Microsoft dangles $300,000 for Azure hacks at BlackHat... Hotel chaos from Germany's Chaos Computer Club 40 dangerous drivers Google’s battle to allow its Incognito users' Incognitoness to be Incognito Microsoft ranks the industry's top bug hunters Apple bumps its bounties
S1 · E728
90 min
• Last Tuesday was another busy and important patch Tuesday • And speaking of Patch Tuesday... 3rd-Party A/V Strikes Again! • Kaspersky facilitates independent web tracking • So, what the heck is "CTF" ?? • 23 Government agencies in Texas were hit with a well-coordinated ransomware attack last Friday, August 16th • RIP, EV: The coming demise of Extended Validation (EV) certificates • And... So long FTP! • HTTP/2 goes to the Movies • “The KNOB is Broken: Exploiting Low Entropy in the Encryption Key Negotiation Of Bluetooth BR/EDR”
S1 · E729
90 min
• Texas Ransomware Update • Remember that Kazakhstan cert? • The mixed-blessing of "wide open" source projects • RubyGems is in trouble again • Chrome to add data breach notification • iOS v12.4 updated quickly to 12.4.1 • Next-gen ad privacy
S1 · E730
90 min
This Week's Stories: Google expands its bug bounty program New bug bounty millionaires Google's Project Zero group dropped a bomb on iOS Ransomware attacks on local governments and businesses are on the rise
S1 · E731
90 min
This week's stories: Get rich quick spotting deepfakes! A forced two-day recess of all schools in Flagstaff, Arizona The case of a ransomware operator being too greedy Apple's controversial response to Google's discovery of Chinese iOS hacks Zerodium's new payout schedule and what it might mean. The final full public disclosure of BlueKeep exploitation code Serious PHP flaws, some potentially serious flaws found
S1 · E732
90 min
This Week's Stories SIMjacker allows attackers to hijack any phone just by sending it an SMS message. Here comes iOS "Lucky" 13! Chrome follows Mozilla to DoH with a twist. Want to enable DoH in Chrome right now? You can, right now, if you wish. Chrome stops showing Extended Validation certs in the URL bar. Mozilla launches 'Firefox Private Network' VPN service as a browser extension. Windows Patch Tuesday redux Chrome Remote Desktop EXIM eMail servers are in trouble again.
S1 · E733
90 min
This Week's Stories: Cryptomining makes a comeback The top three most attacked ports Small office/home office (SOHO) routers and wireless access points: “SOHOpelessly Broken” Chrome gets an emergency update, to 77.0.3865.90 2019 CWE Top 25 Most Dangerous Software Errors
S1 · E734
90 min
This Week's Stories The latest state-of-the-art secure solutions for cross-device, cross-location device synchronization Mozilla's recently announced plans to gradually and carefully bring DNS-over-HTTPS to all Firefox users in the US The EFF weighs in on DNS-over-HTTPS The 100% free VPN offering coming from our friends at Cloudflare
S1 · E735
90 min
Ransomware hits schools, hospitals, and hearing aid manufacturers Sodinokibi: the latest advances in Ransomware-as-a-Service Win7 Extended Security Updates are extended A new Nasty 0-Day RCE in vBulletin There's a new WannaCry in town
S1 · E736
90 min
This week's stories A sobering reminder about supply chain attacks Facebook's stance on end-to-end encryption raises official protests UNIX’s Co-Creator Ken Thompson's BSD UNIX Password Has Finally Been Cracked Japanese stalker finds idol using reflections in her eyes Americans and Digital Knowledge OpenPGP being built into Mozilla's Thunderbird eMail client Windows 10 Tamper Protection being enabled by default CheckM8
S1 · E737
90 min
Pixel 4 Face Unlock is so easy you can do it with your eyes closed! Samsung Galaxy S10 and Note 10 fingerprint sensor can be foiled with a $3 screen protector. The frenzy to turn CheckM8 into a consumer-friendly iOS jailbreak. Steganography finds a new host file format. Security display changes are coming to Firefox 70. More on Microsoft's open source "ElectionGuard" election security system. A potentially serious flaw found in Realtek WiFi drivers. Yubikey for local Windows login has been officially released.
S1 · E738
90 min
This Week's Stories 3rd-party antivirus strikes again Windows Defender offline scan Adobe databases hacked Johannesburg hit by ransomware Firefox's anti-tracking effectiveness Bad new PHP/NGINX RCE being exploited in the wild Goodbye SMS (maybe kinda) Hello RCS? Forced Password Disclosure
S1 · E739
90 min
October's Windows Patch Tuesday BROKE Windows' ability to connect to a significant number of the Internet's websites. Here's how to fix it. Chrome 78 disables Code Integrity Check to mitigate "Aw Snap!" crashes. "Chrome 78 patches a Chrome 0-day which had been discovered by Kaspersky being exploited in the wild." News from the Edge: the first Chromium-based Microsoft Edge Stable Release Candidate. Microarchitectural Data Sampling Vulnerabilities. Trouble for QNAP NAS devices exposed to the Internet. MSP's -- Managed Service Providers -- are a major vector for ransomware delivery. Five months after returning a rental car, man still has the remote control. Chinese-made drones in the US are being grounded. The DNS-over-HTTPS (DoH) controversy. BlueKeep-based attacks have finally started, and what we predicted on this podcast has finally happened.
S1 · E740
CheckM8 & Checkra.in moves to first public beta The case of the misbehaving transducer BlueKeep and Microsoft BlueKeep and BSODs BlueKeep and Marcus Hutchins Mozilla on DoH -vs- COMCAST Yet another approach for solving the problem of certificate revocation within a more limited scope.
S1 · E741
November's Patch Tuesday is the antepenultimate free Windows 7 update CheckM8 & https://Checkra.in GitHub launches Security Lab to boost open-source security Warrantless searches of devices at US borders were just ruled unconstitutional Another WhatsApp bug lets hackers quietly install spyware on your device ZombieLoad v2 The ByteCode Alliance http://tpm.fail/
S1 · E742
The future of the Linux kernel underneath the Android OS Inherent challenges presented by the nature of the Android ecosystem VNC users: Time to update! A welcome change to Twitter & SMS-based 2FA A "foregone conclusion" to law enforcement's strategy to force password divulgence Pre-announcement from Microsoft about DNS Details of the emerging DoH protocol
S1 · E743
This Week's Stories Everyone can still upgrade to Windows 10 for free with this trick HP SSDs fail after 32768 hours The EU is not happy about a possible US encryption ban US government's formal permission to hack 110 nursing homes have been crippled by a ransomware attack Firefox is seriously pushing back on tracking signal leakage New problems with Windows DLLs The StrandHogg vulnerability
S1 · E744
This Week's Stories Microsoft has started forcing feature updates on people who don't want them. Bypass to continue obtaining Win7 updates created. Microsoft's Project Verona continues moving forward. Microsoft's RDP client for iOS is back. Avast / AVG in the doghouse. Making a mountain out of a VPN molehill.
S1 · E745
This Week's Stories: Google turns over 1500 users' location data to catch Milwaukee arsonist Android's Messenger app offers its users verified SMS messaging conversations with supporting companies US Senate Judiciary Committee threatens Apple and Facebook Apple's iOS v13.3 adds support for hardware key dongle authentication in Safari Patch Tuesday shuts down a widespread elevation of privilege vulnerability Researchers discover prime factor collisions in active RSA certificates New Orleans hit by a ransomware attack on Friday the 13th Chrome stops displaying "www." Google re-enables their Chrome's new code integrity protection feature Plundervolt: software-based fault injection attacks against Intel SGX
S1 · E746
On this Eve of 2020, we look back over the hacks of the past decade: The big news of 2010 was Stuxnet -- Boy did THAT make an impression Operation Aurora - the hack that changed Google The Sony Playstation Hack And then we have... Diginotar Edward Snowden The Target hack The Adobe hack Silk Road takedown Have I Been Pwned? The hack of Sony Pictures The hack of Mt. Gox Heartbleed RowHammer Ashley Madison data breach SIM swapping The Ukraine power grid hacks DNC hack Yahoo hacks go public The Shadow Brokers The birth of IoT botnets WannaCry / Petya / NotPetya Vault7 leaks MongoDB exposed Equifax Coinhive & Cryptojacking Meltdown, Spectre, and the CPU side-channel attacks Marriott gets hacked 2019 - The Year of the Ransomware
S1 · E747
The best of Security Now from 2019. Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page.
S1 · E748
This Week's Stories The Deadly Seven top cybersecurity attacks Russia successfully cuts itself off from the rest of the internet. Love Wawa? Surprise! Your credit card has been stolen. Huge Point of Sale attack on all of Landry's restaurants, including Rainforest Cafe. Python 2.7 Reaches End of Life After 20 Years. HackerOne's 20 top bug bounty programs A proposed standard for making warrant canaries machine-readable Xiaomi IoT camera owners can watch other Xiaomi users' video feeds. Microsoft is wrong on RDP vulnerability. Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E749
This Week's Stories: - Windows 7 support dies today, but 1 in 7 PCs are still running it - Cablehaunt- the remote exploit with the catchy logo that works on ALL cable modems - US government still wants backdoor access to iPhones - CheckRain iPhone jailbreak keeps getting better - How Apple scans your photos for evidence of child abuse - The sim swapping threat - Anatomy/timeline of the exploitation of an unpatched VPN bug - And speaking of patching right away… patch your Firefox browser right now! Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E750
This Week's Stories: - iPhones join Android in being a Google account security key. - How much "substantive assistance" did Apple provide in the Pensacola investigation? - A brand new serious Internet Explorer 0-day - Giving Windows an additional Edge - FBI says nation-state actors breached a US city government and a US financial entity by exploiting Pulse Secure VPN servers. - Critical new Windows Remote Desktop Gateway (RD Gateway) remote code execution vulnerability - SQRL for Drupal - Microsoft issues security update to fix "CurveBall" vulnerability Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E751
This Week's Stories: - Is Apple actually encrypting our iCloud storage backups? - 250 Million Microsoft Customer Support Records Exposed Online - New York state is aiming to ban the use of public funds for Ransomware - New Muhstik Botnet Attacks Target Tomato Routers - Chrome under attack from browser extensions - Firefox under attack from browser extensions - NIST publishes a new Privacy Framework - Hacker Leaks More Than 500K Telnet Credentials for IoT Devices - A Welcome “Micro Patch” for the Windows IE jscript.dll 0-day vulnerability - SHA-1 is a Shambles. Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E752
This Week's Stories: - L1D Eviction Sampling becomes “CacheOut” - Only one final version of Windows? - Windows 7 and the Free Software Foundation - Windows 7's final patch broke wallpaper stretching - RCE Exploit for Windows RDP Gateway Demoed by Researcher - Google more than doubles its own bug bounty record - The return of Roskomnadzor! - Facebook DID get fined, but not by Russia - who exactly owns our biometric data? - Avast Jumpshot missed the hoop - An Update on the WireGuard VPN in the Linux kernel - In this week's Best Hack of the New Decade... a little red wagon Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E753
Twitter, Google, and Facebook tell Clearview AI to stop stealing your face to catch crooks The NIST is testing methods to recover data from smashed smartphones Whoa! We get to REMAIN with Security Essentials under Windows 7! Microsoft drops a fix for the wallpaper stretch black screen Windows 7 users are being told: “You don't have permission to shut down this computer.” Win10 Firefox users being “reminded” about Edge Last week Google closed an Android RCE flaw in the BlueTooth daemon. Data Exfiltration Technique of the Week CIA Uses Crypto AG to spy on the world Chrome 80 appeared last week with its implementation of the updated handling of the optional “SameSite” enforcement cookie property We invite you to read our show notes at https://www.grc.com/sn/SN-753-Notes.pdf Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E754
This Week's Stories How to fix the Windows 7 "You don’t have permission to shut down this computer." error Win10’s “One Button PC Reset” fails after KB4524244. And, also… “The new disappearing User Profile problem” (Desktop and all user data) The popular “GDPR Cookie Consent” Wordpress plugin had a critical flaw Whoa! The average tenure of a CISO is just 26 months due to high stress and burnout Microsoft’s “ElectionGuard” being used for the first time today! IoT lightbulb vulnerabilities are not such a joke, after all. SweynTooth Vulnerabilities: a set of more than 12 newly discovered vulnerabilities across a wide range of Bluetooth devices, many of which will never be updated, which allow for, among other things, full device compromise. We invite you to read our show notes at https://www.grc.com/sn/SN-754-Notes.pdf Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E755
This Week's Security News: More Windows 10 lost profile pain A micropatch for the jscript.dll problem Coming in the next Feature Release (Win10 2004): optional device driver updates A new attack on 4G LTE and 5G Starting today: DoH by default on Firefox A new next-generation WebAssembly sandbox is coming first to Linux and Mac and then to Windows Chrome was just updated to close a 0-day attack Safari will only trust certificates with a validity of 398 days or less Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E756
This Week's Stories Lets Encrypt hits 1 BILLION certs Pakistan passes Internet censorship law Clearview AI breach: clients and searches stolen Swiss government submits criminal complaint over CIA Crypto spying scandal Ghostcat - (Apache) Tomcat Users: Update NOW! Revisiting OCSP Must Staple Kr00k: serious WiFi vulnerability affecting more than a billion devices Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
S1 · E757
120 min
This Week's Stories: Microsoft, Google, LogMeIn & Cisco offer limited-time free use of telecommuting Tools: Hack the Pentagon!: The Android security dilemma: AMD processors get some unwelcome but necessary side-channel attack scrutiny: Intel also has some serious new trouble on its hands: SETI@home shuts down its distributed computing project after 21 years: Critical PPP daemon flaw opens most Linux systems to remote hackers: FuzzBench: fuzzer benchmarking as a service
S1 · E758
120 min
This Week's Stories: Does Steve have coronavirus? Maybe? He got very sick over the weekend and is still coughing, but he couldn't get tested. Mayhem ensues after last week's Patch Tuesday List of free technology services during coronavirus, from Adobe to Zoom The state of open source vulnerabilities The “EARN IT” act is a despicable attack on encryption and freedom of speech. Please call your congressperson and tell them not to support it. The SMBGhost Fiasco
S1 · E759
120 min
This week's stories: Two new un-patched 0-days affecting billions of Windows users - here is the fix! Mozilla reversed itself on TLS v1.0 and 1.1 deprecation... due to the coronavirus A micropatch for Win7 and Server 2008 Chrome's release schedule has been impacted by the coronavirus Avast emergency-disables their internal JavaScript emulator CookieThief - "FireSheep evolves for the 21st century" PwnToOwn Spring 2020 winners Steve's coronavirus journey The fixes for RowHammer have not worked
S1 · E760
90 min
This week's stories: VPN bug in iOS 13.4 Folding@Home - how to donate your unused CPU cycles to help provide answers to COVID-19. RDP and VPN use skyrocketing To 'www' or not to 'www' Firefox 76 to finally stop assuming “HTTP” Google again revises its schedule for Chrome releases Microsoft moves to support “Shadow Stacks” Cloudflare's 1.1.1.1 DNS is audited by KPMG
S1 · E761
100 min
Zoom is a security nightmare - from zoombombing to encryption issues, Steve Gibson runs down Zoom's security concerns. Plus, Jitsi is a great alternative! Mozilla just patched a pair of CRITICAL 0-days Eight security bugs eliminated from Chrome last week Safari gets a bunch of very important fixes Chrome and Edge join Mozilla in postponing the deprecation of TLS v1.0 and v1.1 Chrome team reversing themselves on the enforcement of Same Site cookies Edge with Vertical Tabs and Smart Copy The return of STIR & SHAKEN Cloudflare has added Parental Control to their 1.1.1.1 DNS service Cloudflare's new service accidentally blocks LGBTQIA+ sites
S1 · E762
110 min
Apple+Google Covid Tracker is Secure and RIP John Conway, Creator of The Game of Life Apple & Google Virus Contact Tracing: secure and effective Zoom gets another Zoom-bombing mitigation... and a Class-Action Lawsuit Meanwhile, Zoom has enlisted the aid of Alex Stamos Zoom creates a CISO Council What’s next for Zoom? Browser Security News: Chrome 81 and Firefox 75 Android Apps Again in the Crosshairs Sandboxie goes Open Source RIP John Conway, creator of Conway's Game of Life
S1 · E763
95 min
Zoom Fixes Security, EARN IT is Evil, Tor in Trouble Zoom gets big-name help with security fixes Google updates Chrome to v81.0.4044.113 to squash a critical flaw FTP in Chrome lives another day! Google “undepreciates” FTP. Windows Patch Tuesday for April 2020 fixes 113 vulnerabilities “Basic Authentication” lives another day! Due to COVID-19, Microsoft and Google will keep “Basic Authentication" around for a little while longer EARN IT Act: call your Senator before it is too late! Tor Project fires over 1/3 of its staff Cloudflare dumps Google's reCAPTCHA
S1 · E764
105 min
Apple/Google Contact Tracing, Best VPNs to protect you. Apple/Google Contact Tracing Update iOS 0-Day Alert! Update Apple Mail Best VPNs to protect you from the Five Eyes TypoSquatting attacks Vitamin D linked to COVID-19 mortality Resource Public Key Infrastructure How BGP can break the Internet
S1 · E765
120 min
China wants to rebuild the Internet. China's proposal to rebuild the internet is an authoritarian nightmare Bruce Schneier on COVID-19 Contact Tracing Apps Political Correctness hits cybersecurity DHS's CISA says no to 3rd-party DoH “POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers” An authorization bypass in SaltStack Adobe's Big Last Tuesday, Non-Patch Tuesday, Update Google has announced its impending clean-up of the Chrome Web Store Warning about RDP is not crying wolf
S1 · E766
117 min
Thunderbolt security flaw, Zoom buys Keybase. Why the ThunderSpy Thunderbolt security flaw is such a big deal Zoom purchases Keybase to fix encryption Firefox 76 released with new features But Firefox 76 broke Amazon's Assistant! Hallelujah!! Edge moves to silence those annoying notification requests. Critical WordPress plugin bugs present on over one million sites Critical vBulletin patch Samsung has patched a CRITICAL bug affecting the past 6 years of Smartphones DefCon and Black Hat 2020 go virtual
S1 · E767
120 min
WiFI 6, Apple vs. FBI, face masks. Last Tuesday's Windows patch Tuesday was the not the biggest ever, but it was the 3rd largest in Microsoft's history, weighing in with a whopping 111 CVE-tracked bug fixes, 16 of which were rated CRITICAL and all but one of which enabled Remote Code Execution by an attacker. The DOJ and FBI again criticize Apple over encryption When is a fix not a fix? Face masks have thwarted the London police's LFR rollout Utah chooses to roll their own contact tracing app Everything you need to know about WiFi 6
S1 · E768
110 min
Contact tracing apps are not going to work. Why contact tracing apps are never going to work Unc0ver: There's a new iOS jailbreak in town, and as jailbreaks go, it looks VERY nice! Firefox 77 picks up a nifty new security trick New features in Chrome 83: cookie management, "Safety Check," blocking third-party cookies by default in Incognito mode, and "Tab Groups" Adobe rushes out four out-of-cycle emergency updates to fix security flaws Zerodium temporarily stops buying iOS remote code execution vulnerabilities The NXNS Attack: A group of cybersecurity researchers in Israeli have responsibly disclosed details about a new way they worked out of using the Internet's domain name resolution system to hugely amplify (by a factor of at least 1620 packets) a DDoS attack to take down targeted websites. BIAS - Bluetooth Impersonation AttackS is nothing less than a complete collapse of Bluetooth security. Is eBay port scanning its user's computers? Kinda. Security Now trivia: Steve Gibson helped develop the Speak & Spell! It did voice synthesis with only a 4K bits (0.5K bytes) processor.
S1 · E769
132 min
Zoom gets end-to-end encryption. ACLU takes Clearview to court, but maybe they should worry about their own website first The state of drive-by malvertising downloads Google will be bad listing notification abusing sites Who else is doing the eBay-like ThreatMetrix port scanning? Facebook to require identity verification for high impact posters Google Messaging is apparently heading toward E2EE The return of a much more worrisome StrandHogg The SHA-1 hash to finally be dropped from OpenSSH What happens when you fuzz USB? Zoom’s end-to-end encryption design
S1 · E770
108 min
Zoom's end-to-end encryption fail. Zoom will offer end-to-end encryption, but only if you pay for it IBM announces no more work on facial recognition The Odd Case of Mozilla's DoH DDoS Cisco's Talos group found two critical flaws in the Zoom client CallStranger UPnP bug has tech press in a tizzy Microsoft has started to replace old Edge with new Edge
S1 · E771
110 min
Windows update kills printers & SSDs. Lamphone: eavesdrop on a hanging lightbulb Brave Browser caught and chastised for tweaking user-entered URLs for its benefit Microsoft breaks its own record for Patch Tuesday patches TFW Windows 10 loses your printer port Last week;s Patch Tuesday broke ALL PRINTING (even to PDFs) for many users. Fix won't come for a month Windows 10 2004 update is messing up SSDs and non-SSDs SMBleed Subject: Your Site Has Been Hacked Authentic database ransom attacks Another side-channel attack on Intel chips
S1 · E772
127 min
Zoom encryption, Windows 10 printer error. Ripple20: a set of 19 TCP/IP vulnerabilities that could let remote attackers gain control over your device Russian government lifts its failed ban on Telegram Zoom: everybody gets optional end to end encryption Google removed 106 malicious Chrome extensions collecting sensitive user data Windows 10 update breaks printing VLC Media Player 3.0.11 fixes severe remote code execution flaw Netgear in the doghouse DDoS is alive and well... and growing How to get the new Edge for Windows 7
S1 · E773
111 min
Congress wants to kill encryption & face recognition. New information about Ripple20 The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognition The Lawful Access to Encrypted Data Act wants to kill encryption Michigan State's legislative House passed the "Microchip Protection Act" Apple forces the industry down to one-year web browser certificate lifespans Safari to eschew 16 new web API’s for the sake of user privacy Apple also got on the DoH & DoT bandwagon Mozilla + Comcast + DoH: Strange Bedfellows Don't forget about VirusTotal
S1 · E774
116 min
Boston bans face recognition, bad passwords. Boston bans facial recognition 123456 is still the most popular password iOS 14 catches Linked-In, Tik Tok, and others red handed! US-CERT notes two Emergency Windows Updates HackerOne shares their top 10 public bug bounty programs Sony launches PlayStation bug bounty program with rewards of $50K+ F5 Networks patches a highest-severity vulnerability
S1 · E775
102 min
EARN IT is still evil, Google tsunami. Mozilla suspends “Send” due to persistent malware abuse Zoom fixed a new RCE affecting Windows 7 and earlier systems The EARN IT bill, take II is still just as bad as the original Google bans ads on stalkerware A Chinese Internet equipment vendor in the hot seat Locating hidden drone operators Rampant Router Insecurities Tsunami: Google's open-source enterprise network vulnerability scanner
S1 · E776
117 min
Here's how Twitter was hacked. How can we prevent the next Twitter hack? Cloudflare outage takes out huge swath of American internet, including Down Detector. All internet got sent to Atlanta. Zoom's vanity URL flaw: when is a "zero day" not a zero day? Not all VPNs are created equal. Apple updated its iOS and macOS with a handful of useful security patches. SigRed: “This is not just another vulnerability.” And speaking of last week's July Patch Tuesday... “Firefox Send” is still not receiving. A tale of two counterfeits.
S1 · E777
103 min
F5 Networks “Big-IP” devices in Big-Trouble Twitter bitcoin hack update GnuTLS vs OpenSSL The Garmin outage then and now Cisco's latest trouble Surprising SpinRite results
S1 · E778
124 min
Twitter hackers arrested, Garmin hackers get ransom. Vitamin D fights death by Covid Firefox is now at v79 Twitter hackers arrested Garmin hackers rewarded Tor and Dr. Krawetz Dropping 0Days Blocking Tor Connections the Smart Way Enabling Zoom Meeting Hacking Another SHA-1 Deprecation QNAP and QSnatch BootHole
S1 · E779
125 min
Great Firewall Of China, Black Hat/DEFCON 2020, Have I Been Pwned. It's Patch Tuesday! News from Black Hat / DEFCON 2020 Generalizing Speculative Execution Vulnerabilities Canon hit by the Maze ransomware A vBulletin Emergency DoH for Win10 Troy Hunt Hasn't Been Pwned Geneva: China's Great Firewall Tightens
S1 · E780
126 min
Microsoft acts badly, Canon ransomware, Mozilla tries to pivot. When Microsoft doesn't act responsibly: Parts 1 and 2 Snap Your Dragon / "Achilles: Small Chip, Big Peril" 3rd largest Patch Tuesday ever Mozilla pivoting to VPN, future uncertain The other ransomware shoe drops at Canon Software glitch in California's COVID case reporting Threema gets E2EE Video Calls
S1 · E781
123 min
Ransomware hits Jack Daniel's, Iranian Script-Kiddies, how ransomware happens. SpiKey: using the sound of a key to determine its shape What do The University of Utah, Jack Daniel’s Whiskey, and Carnival Cruise Lines all have in common? Ransomware A Remote Code Execution in Chrome’s WebGL How ransomware happens: email phishing, remote desktop protocol compromise, and software vulnerability Emergency Windows update! Iranian script-kiddies using RDP to deploy Dharma ransomware The Zero-Day Initiative turns 15
S1 · E782
111 min
Russian tries to hack Tesla, web browser history research. Chrome 85 security features Russian Attempts to Cyber Attack Tesla More EMV Standard monetary transaction method problems Watch this video on Covid testing I Know What You Did Last Summer: research on web browsing histories
S1 · E783
125 min
Isolate your IoT devices, Threema goes open-source. IoT Isolation Strategies DoH coming to Chrome for Android Bye Bye Drive-By Downloads Threema goes Open-Source WordPress File Manage 0-day flaw Facebook’s new VDP — Vulnerability Disclosure Policy Facebook's new “WhatsApp Security Advisories” page The Tor Project Membership Program Intel's latest microcode patches
S1 · E784
113 min
Chrome vs abusive ads, patch Tuesday palooza. BlindSide and BLURtooth Chrome gets tough on abusive ads The last hurrah for IE & Flash exploits Chromium Edge on Win10: Forcing the issue Edge enables “Ask me...” for each download Patch Tuesday Palooza! Excessive SSD Defragging also fixed The WordPress File Manager flaw... two weeks downstream Zoom... now with 2FA New Raccoon attack
S1 · E785
119 min
iOS 14 & Android 11 security features, DuckDuckGo gets big. The most important iOS 14 privacy & security features All of Android 11's new privacy & security features DuckDuckGo usage growth goes exponential LAN attack bug fixed in Firefox 79 for Android Goodbye Forever Firefox Send and Notes... Oh, how we loved ye Microsoft’s catastrophic Zerologon vulnerability Why we're headed toward formal verification of security protocols
S1 · E786
123 min
Amazon flying security cam, ZeroLogon on GitHub, ransomware roundup. What could possibly go wrong: Amazon/Ring's autonomous flying home security webcam Evil ransomware gang deposited $1 million of bitcoin in a hacker recruitment drive Over this past weekend, Universal Health Services was hit by a huge Ryuk ransomware One week ago, there were three ZeroLogon exploits on GitHub. Today there are more than fit on the first page of search results Security Fixes in Chrome's v85.0.4183.121 Release The VPN you choose DOES make a difference. A “Ransomware Goldrush”
S1 · E787
114 min
Android Security, Windows 7 Security, Microsoft Defender. Google to get even more proactive about Android security Why are people sticking with Windows 7? And Google funds a JavaScript research engine Microsoft Defender gets in Vitro Updating WSL 2 (Windows Subsystem for Linux v2) completely bypasses the hosting Windows 10 firewall Most Microsoft Exchange Servers remain unpatched after 9 eight months! Cloudflare has just added a free web API firewall service for all customers US Dept of the Treasury tightens up on Ransomware payments UEFI Bootkits are becoming more mainstream
S1 · E788
123 min
Carnival Cruise hack, ZeroLogon, Five Eyes vs Encryption. Chrome gets 86’d! Carnival Cruise Line Hack The largest company you've never heard of gets hit by ransomware hackers No connection logs? In France, you go to jail! Hacking the Apple ZeroLogon, the FBI, DHS and our forthcoming election security The revenge of DNT, as GPC, now enhanced with legislation The Anti-E2EE drumbeat beats yet again
S1 · E789
111 min
Zoom end-to-end encryption, Windows 10 god mode, Manifest v3. Last Wednesday, Zoom announced that THIS week their 30-evaluation of end-to-end encrypted video conferencing would begin How to enable Windows 10 “God Mode” Edge to be updated with browser extensions “Manifest v3” Last Tuesday Microsoft issued fixes for 87 security vulnerabilities - so, yeah, it was a slow month... Your SonicWall Network Security Appliance (NSA) MUST be patched now! Microsoft's two out-of-cycle patches Anatomy of a Ryuk Attack
S1 · E790
103 min
Chrome 0-Day, Edge for Linux, WordPress Loginizer. Top 25 Vulnerabilities Critical 0-day in Chrome Chrome 86 is now blocking slippery notifications Site Isolation coming soon to Firefox Microsoft's Chredge for Linux WordPress Loginizer vulnerability
S1 · E791
105 min
Google One VPN, WordPress update fail, Windows 7 0-Day. A new 0-day in Win7 through Win10 A public service reminder from Microsoft Google One adding an Android VPN Vulnonym: Stop the Naming Madness! WordPress fumbles an important update Chrome’s Root Program
S1 · E792
114 min
SlipStream NAT firewall bypass, MS Police use Ring doorbell cams. Let's Encrypt's cross-signed root expires next year Chrome updates on Windows, macOS, Linux, and Android to remove 0-day vulnerability Mattel, Compel, Capcom, and Campari fall to ransomware attacks iOS 14.2 fixes three 0-day vulnerabilities Introducing the Tianfu Cup: China's version of the Pwn2Own hacker competition November’s Patch Tuesday The Great Encryption Dilemma hits Europe Ring Doorbells to be tapped in a trial by local Police WordPress plugins are a hot mess for security SlipStream NAT Firewall Bypass
S1 · E793
119 min
Malicious Android apps, ransomware-as-a-service. Where do most malicious Android apps come from? SAD DNS is a revival of the classic DNS cache poisoning attack How many Ransomware-as-a-Service (RaaS) operations are there? Ragnar Locker ransomware gang takes out a Facebook ad Two more new 0-days revealed in Chrome Last Tuesday, Microsoft fixed 112 known vulnerabilities in Microsoft products
S1 · E794
104 min
Ongoing WordPress attack, RCS gets End-to-end encryption. Chrome moves to release 87. Explicit Publication of Privacy Practices. Firefox 83 gets HTTPS-only Mode. Mozilla seeks consultation on implementing DNS-over-HTTPS. The comical announcement strategy of the Egregor Ransomware. Large-scale attacks targeting Epsilon Framework Themes in WordPress. Cybercrime gang installs hidden e-commerce stores on WordPress sites. 245,000 Windows systems still vulnerable to BlueKeep RDP bug. Google's Rich Communication Services is getting E2EE via Signal. Cicada, a Chinese state-sponsored advanced persistent threat group.
S1 · E795
123 min
Generic smart doorbells, Tesla Model X key fobs, critical Drupal flaw, Spotify. Chrome Omnibox becomes more Omni. Chrome's open tabs search. Ransomware news involving Delaware County, Canon, US Fertility, Ritzau, Baltimore County Public Schools, and Banijay group SAS. Drupal's security advisory titled “Drupal core - Critical - Arbitrary PHP code execution.” The revenge of cheap smart doorbells. Tesla Key Fob Hack #3. CA's adapt to single-year certs. Nearly 50,000 Fortinet VPN credentials posted online. More than 300,000 Spotify accounts hacked. MobileIron MDM CVSS 9.8 RCE. The Salvation Trilogy. Spinrite update. DNS Consolidation.
S1 · E796
130 min
Google Play Core Library, iOS zero-click radio proximity exploit, Apple M1 chip. Ransomware news regarding Foxconn, Egregor, and K12 Inc. The Apple iPhone zero-click radio proximity vulnerability. Oblivious DoH (ODoH). Google Play Core Library problems. The mysterious power of Apple's M1 Arm processor chip. InitDisk release 2 published. SpinRite update. Amazon Sidewalk.
S1 · E797
131 min
Chrome throttling ads, Google outage, 2020 Pwnie Awards, JavaScript's 25th birthday. Chrome's heavy ad intervention. Adrozek. Ransomware: "Double Extortion." A 0-click wormable vulnerability in D-Link VPN servers. Google suffered an outage. Amnesia:33. Zero-day in WordPress SMTP plugin. The 2020 Pwnie Awards. The end of Flash. JavaScript is celebrating its 25th birthday. InitDisk release 4 published. A deep look at the SolarWinds hack.
S1 · E798
73 min
Leo Laporte walks through some of the highlights of the show and most impactful stories of 2020. Stories include: Clearview AI face scanning. The "EARN IT" act. Zoom security issues. Why contact tracing apps won't work. How to prevent the next Twitter hack Ring's autonomous flying home security webcam.
S1 · E799
96 min
Ransomware Task Force, Chrome 87, Firefox caches, preserving Flash video. Chrome 87 backs away from Insecure Form Warnings. Firefox to begin partitioning its caches. Browsers say no to Kazakhstan again. Announcing the RTF - The Ransomware Task Force. 5 million WordPress sites in critical danger. Treck's TCP/IO stack strikes again! Preserving Flash content online. SpinRite: ReadSpeed is ready! InitDisk is at release 5. Numerous updates on SolarWind, Sunburst, and Supernova.
S1 · E800
110 min
SolarWinds' Orion software, swatting goes IoT, PHP Zend Framework vulnerability. Chrome struggles with A/V pre-scan file locking. Zyxel security products protected by a single redundant password. How Swatters are using IoT devices to increase the terror. A new serious problem in the PHP Zend Framework on WordPress. Bitcoin woes as value reaches new peaks. ReadSpeed, SSD's, and SpinRite. A new flaw discovered in SolarWinds' Orion software.
S1 · E801
120 min
SolarWinds smoking gun, Signal influx of WhatsApp users, male chastity cage. Firefox and Chromium updates address remote system take over bugs. Tenable researchers reported a critical Chromium bug. What Firefox's backspace key does and should do. How Ryuk malware operations netted $150 million via cryptocurrency exchange. Intel: A triumph of marketing over technology. The strange case of the Male Chastity Cage. A SolarWinds smoking gun? "Sunburst backdoor." A class action lawsuit filed by shareholders of SolarWinds stock. The "Krebs Stamos Group" Zyxel security endpoints under attack. WhatsApp revises their privacy policy. Signal sees a mass influx of WhatsApp users. Out with the old: A look at the history of SpinRite code.
S1 · E802
105 min
2021's first Patch Tuesday, Titan Security Key side-channel attack, WhatsApp. When is Chrome not Chromium? A major DuckDuckGo milestone. Project Zero in the wild. First Patch Tuesday of 2021. ZeroLogon Drop Dead. NSA warns against outsourcing DoH services. A Side-Channel in Titan. The "PayPal Football" WhatsApp's decision to bring its data into Facebook.
S1 · E803
131 min
Browser password managers, Adobe Flash repercussions, SolarWinds. Chrome and Edge have beefed-up their built-in password managers. The random repercussions associated with the end of Adobe Flash. A new trend emerging with post-ransomware DDOS attacks. SolarWinds attack details continue to emerge. Malwarebytes was also attacked. It seems that wherever we look, we find problems. The Expanse is GOOD sci-fi. Comparative Smartphone Security: Which mobile OS is better?
S1 · E804
131 min
SUDO was pseudo secure, BigNox supply-chain attack, iMessage in a sandbox. Picture of the Week. Chrome rescinding another CA's root cert. An urgent update to the recently released GnuPG. An interesting supply-chain attack "BigNox". Apple quietly put iMessage in a sandbox in iOS 14. For the past 10 years, “SUDO” was only pseudo secure. SpinRite: February 1st Progress Report. NAT Slipstreaming 2.0.
S1 · E805
143 min
Defender thinks Chrome is malware, Plex Media Servers in DDoS attacks. Picture of the Week. Google has been busy with Chrome. Google Chrome Heap Buffer Overflow Vulnerability Exploited. A unique use of Chrome's “sync” feature for command & control and data exfiltration. Defender thinks Chrome is Malware. More Critical WordPress Plug-in Problems. Plex Media servers SSDP protocol being used in DDoS attacks. Three more NEW vulnerabilities discovered in SolarWinds’ software. Closing the Loop. SpinRite: “Discovering System’s Mass Storage Devices...” SCADA Scandal: Hacker's attempts to adjust chemicals in Oldsmar water supply.
S1 · E806
121 min
Florida water supply hack update, Major patch Tuesday, Android SHAREit vulnerability. Pic of the week. New info in the Oldsmar, Florida water supply attack. Major Patch Tuesday update. Adobe released critical updates to three versions each of its Acrobat and Reader. Android SHAREit. The Rise of The Web Shells. This week's WordPress Mess: Responsive Menu plugin. SpinRite drive discovery video. What is C.O.M.B.?
S1 · E807
122 min
SHAREit's security update, Solorigate, Brave's "Private Window with Tor". SHAREit Follow-up This Week in Web Browser Tracking Brave's “Private Window with Tor” was not so private Tracking with eMail Beacons Microsoft's final “Solorigate” update “Good App goes Bad for Profit” SpinRite: RS shows VERY obvious improvement after one pass of SR 6 Dependency Confusion
Seven Exchange 0-days, Firefox Enhanced Tracking Protection, SolarWinds Password. Chrome to default to trying HTTPS first when not specified. Firefox's “Enhanced Tracking Protection” just neutered 3rd-party cookies! As easy as “SolarWinds123”. Rockwell Automation's CVE-2021-22681 is a CRITICAL 10 out of 10. VMware's vCenter troubles. SpinRite update. Microsoft issues emergency patches for 4 exploited 0-days in Exchange. CNAME Collusion.
S1 · E809
112 min
Dependency confusion, Intel Side Channel Attacks, Crispy Subtitles from Lay's. Picture of the week. 47 fixes in Chrome 89.0.4389.72. Crispy Subtitles from Lay’s. Google funds Linux kernel security developers. WinAmp gets a huge update! "Intel Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical" Dependency Confusion! Listener feedback. Hafnium.
S1 · E810
130 min
New Chrome 0-Day, Patch Tuesday Redux, Spectre Comes to Chrome. Chrome closes another 0-day. This v89 of Chrome also lost some weight. Spectre comes to Chrome! Prime+Probe: A new browser tracking side-channel. Patch Tuesday Redux. BSODs when attempting to print. Free code signing for the Open Source community. JPL’s Perseverance Rover. Feedback. Spinrite. ProxyLogon.
S1 · E811
126 min
Automatic fix for Exchange Server flaw, Firefox 87 features, MyBB patch. Dave's Garage on YouTube. The latest update on the ProxyLogon fiasco is from Microsoft. Black Kingdom Ransomware. Firefox will be adopting a new privacy-enhancing Referrer Policy. This Week in Remote Code Execution Disasters. MyBB gets patched. CAID is able. What the FLoC? “Federated Learning of Cohorts”
S1 · E812
105 min
Spectre returns to Linux, API Security, OpenSSL flaws, SolarWinds. Picture of the week. ProxyLogon Update. Spectre returns to Linux. OpenSSL fixes several high-severity flaws. SolarWinds keeps finding new critical problems within its own code. Cloudflare's recent moves. A focus on API Security. SpinRite update. The curious case of the PHP's Git Server Hack.
S1 · E813
123 min
Ubiquity coverup, Facebook data dump, malicious Call of Duty cheats. The Ubiquiti Coverup. Facebook’s 533,313,128 Million User Whoopsie! Don't mess with our water! Android moves to limit inter-app visibility. Beware malicious “Call of Duty: Warzone” cheats. QNAP — Just Say No! Listener Feedback. A Spy in Our Pocket.
S1 · E814
126 min
- Picture of the week. - The Slips keep Streaming. - Are You FLoC'ed? - The PHP GIT Hack, revisited. - CISCO abandons old routers having problems. - Failure to Patch. - PwnIt And OwnIt.
S1 · E815
124 min
Club TWiT details. Picture of the Week. The Vivaldi Project's take on FLoC. Chrome continues to be THE high-value target. We’re at Chrome v90. Exchange Server Web Shells removed, with DOJ Permission. WordPress joins the “FLoC No!” chorus. It's Humble Bundle Book Time. Closing the Loop. A quick SpinRite progress report. Homogeneity Attacks.
Remembering Dan Kaminski. Week before last was Patch Tuesday. Google's Project Zero responds to today's patch latency reality. Baking security into IoT UNethical security research. CloudFlare refuses to knuckle under to Patent Trolls. Closing The Loop. The Mystery of AS8003.
S1 · E817
140 min
Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet’s 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force.
S1 · E818
115 min
Picture of the week. TsuNAME - “DNS Configuration Flaw Lets Attackers Take Down DNS Servers” Huh Google? Tor's Exit Nodes. 21 Nails in Exim's coffin. Project Hail Mary: A Novel. Closing the loop. SpinRite update. News from the Darkside.
S1 · E819
119 min
Picture of the week. DarkSide Follow-Up. Follow The Money. Toshiba Attacked by DarkSide. Ransomware topics off-limits here. “DarkTracer: DarkWeb Criminal Intelligence” Please Leak our Stolen Data! Patch Tuesday Review. A review of the first book of "The Frontiers Saga" 60 Minutes/UAP: Unidentified Aerial Phenomena. Closing the Loop. The WiFi Frag Attacks.
Picture of the Week. Firefox finally achieves sustained “Fission”. Conti ransomware. CNA Financial pays up big. When they say IoT do they mean us? “Mean Time to Inventory” The “Doom” CAPTCHA. The “Helios” screensaver. Closing the Loop. The Dark Escrow.
Photo of the Week. Chrome advances to 91. Emsisoft has created their own ransomware decryption tool. Stepping off the Sidewalk. Just another phishing attack. The Great Encryption Struggle. Hail Mary. Epsilon Red.
Picture of the week. The Great CyberSecurity Awakening of 2021. Firefox will soon auto-update on Windows even when it's not running. Edge takes its own approach to HTTPS switching. Three new ransomware victims. We believe we know how Colonial Pipeline was breached. The FBI strikes back... but how, exactly? WordPress force installs Jetpack security update on 5 million sites. WordPress Fancy Product Designer. GitHub Updates its formal posting policy. NAT vs IPv6. Project Hail Mary update. Extrinsic Password Managers.
Picture of the week. Being #1 is a mixed blessing. Industry wide patch Tuesday. TikTok Quietly Updated Its Privacy Policy to Collect Users' Biometric Data. iOS 14.5 requires apps to obtain explicit tracking permission. The ANOM sting operation. “Windows 10” — the last Windows ever? Project Hail Mary. SpinRite: The Curious Data Recovery Adventure. TLS Confusion Attacks.
Picture of the Week. Another day, another Chrome 0-day. Ransomware perpetrators are increasingly purchasing access. A weird bug in iOS Wi-Fi. An Early Preview of Windows 11. The Security Now! Podcast has found a new purpose... SpinRite. Avaddon Ransonomics.
Picture of the week Google's FLoC has landed with a hard thud and is now-delayed The high cost of Ireland's recovery from the Conti ransomware attack Who is responsible for damage and data loss following the remote wiping of many Western Digital My Book NAS devices? The story behind an important Edge update Where will Windows 11 run? The passing of an industry legend Steve's favorite web browser keyboard shortcut and his favorite website cloning tool
Picture of the Week. “PrintNightmare” is NOT CVE-2021-1675. The Authentication Dilemma. Western Digital steps up. WD's MyCloud OS3 Troubles. SpinRite. Miscellany & Closing The Loop. The Kaysea Saga.
Picture of the Week The “PrintNightmare Continues” Kaseya - Not nearly as bad as it could have been Ransomwhere site Microsoft Office Users: There's a new malware-protection bypass Ransomware negotiators are now in high demand Microsoft seemingly enforces the new Windows 11 Start menu Stay tuned for SpinRite v6.1 beta REvil's Clever Crypto
Picture of the week Browser News The attacks on Google Chrome continue. Firefox special-cases anti-tracking for "Login With" functions. Security News iOS WiFi SSID bug We still can't awaken from the "PrintNightmare" It's not a bug, it's a feature! Patch Tuesday Review Update Acrobat and Reader Rolling your own Crypto Pegasus Errata Windows Extended APIs REvil Vanishes
Picture of the Week. Faster and more efficient phishing detection in Chrome 92. A Universal Decryptor for all Kaseya victims. The printer driver used by millions of HP, Samsung and Xerox Printers is exploitable. Windows’ Process Hacker. “GoLang” gains supply chain security features at GitHub. Closing the Loop. SeriousSAM & PetitPotam.
Picture of the Week. Mozilla's Firefox Monthly Active Users (MAU) slowly but steadily drops. Google to finally assume HTTPS. The evolution of “Initial Access Brokers”. DarkSide Returns. “A Microsoft July 2021 Recap” Tailscale. Closing the Loop. SpinRite. The BlackMatter Interview.
Picture of the week. “You're Doing IoT RNG” The Pulse Secure VPN remains in trouble. And Cisco, too... Flaws found in another popular embedded TCP/IP library. Microsoft Edge gets “Super Duper Secure Mode” Closing the Loop. Apple’s CSAM Mistake.
Picture of the week. Firefox Update. Facebook finally adds end-to-end encryption to Messenger. Exploitation of PrintNightmare has begun. And “Magniber” Ransomware Uses PrintNightmare. Crypto-mining botnet modifies CPU configurations to increase its mining power. NortonLifeLock and Avast are merging their users. ASUS updates 207 motherboard BIOSes! Errata. Closing the Loop. Microsoft’s Culpable Negligence.
Picture of the week. Firefox soon to be blocking mixed-content downloads by default. The news from T-Mobile is all bad. Introducing ProxyLogon's kissing cousin, ProxyShell. The Razer mouse hack. A critical ThroughTek SDK flaw enables IoT spying. Overlay Networks. Closing the Loop. Microsoft’s Reasoned Neglect.
Picture of the Week. Credit Freeze vs Credit Lock. T-Mobile hacker speaks! Where will Windows 11 run? ProxyToken. Tailscale Open Source? SSD Bait & Switch. SpinRite. Life: Hanging by a PIN.
Picture of the Week. The Razor mouse & keyboard. The wishful phrase “Internet Anonymity” is an oxymoron. And speaking of Apple's client-side image matching... BlueTooth has new troubles. Attackers Can Remotely Disable Fortress Wi-Fi Home Security Alarms. Closing the Loop. "Light Chaser" by Peter F. Hamilton and Gareth L. Powell. TPM v1.2 vs 2.0.
Picture of the Week. A new worrisome 0-day attack against Office documents. Work From Home (WFH) — No problem? “Attacks only ever get better” The return of REvil — Apparently, vacation’s over. Closing the Loop. I have this next piece under “Science Fiction” — but is it fiction??? The Mēris Botnet.
Picture of the week. The DDoS attack on VoIP.ms. Patch Tuesday's Mixed Blessing. Android to auto-reset app permissions on many more devices. BREAKING: FBI held back ransomware decryption key from businesses to run operation targeting hackers. Google patched the 9th & 10th ITW 0-days in Chrome this year. Was GRC Pwned? Sci-Fi to look forward to. My work on SpinRite is progressing. Cobalt Strike.
Picture of the Week. Chrome's 12th 0-day this year. Next up on this week's 0-day Watch... is Apple. Apple appears to be annoying their bug reporters. Epik Confirms Hack, Gigabytes of Data on Offer. Microsoft gets Windows 11 ready for release with a new “Release” build. Newly updated PC Health Check tool. Windows 10 emergency update “might” resolve some Patch Tuesday troubles. Is this Cert valid? A shaky Foundation. autodiscover.fiasco.
Picture of the Week. Another two, in-the-wild, true 0-days found and fixed in Chrome. Windows 11 arrives. A known memory leak in Windows Explorer. Ransomware and cyber warfare. On the topic of thwarting SIM swapping attacks... A widespread Android Trojan is making someone a bunch of money! There's a problem with Apple Pay and Visa. Foundation update. SpinRite update. “Something Went Wrong”
Picture of the week. Windows 11 Watch: “AllowUpgradesWithUnsupportedTPMOrCPU” AMD processors running some apps up to 15% slower. The Windows 10 taskbar on Windows 11. Microsoft is disagreeing... with themselves. We have an update on the Windows Explorer RAM leak I mentioned previously... VirtualBox and Windows HyperVisors don't get along. Dropped UDP packets with network optimization. Patch Tuesday. The Joy of the (new!) Default: Excel 4.0 macros to be disabled. Google warns Gmail users of phishing attempts. Google takes first step toward universal 2SV. The US Senate approves some hacking and ransomware legislation. Amazon’s “Twitch” service was hacked bigtime! A major Apache webserver update introduced a new critical 0-day error. Last Week's Mass Exodus from WhatsApp. Closing the Loop. Apple’s new “Invasion” series. SpinRite. 0-Day Angst.
Picture of the week. Windows 11 Watch - Don't update to Windows 11 unless you need to. Patch Tuesday - PrintNightmare fix to fix the previous print nightmare fix that broke other things. Point and Print feature is the problem, not a bug. On Windows 11, installing printers might also fail when using the Internet Printing Protocol (IPP) “While Microsoft provided a fix in their September 2021 update, the patch resulted in a number of new management problems." "There were a total of 74 vulnerabilities of various severities fixed with one being a true 0-day." MysterySnail has the potential to collect and exfiltrate system information from compromised hosts. REvil may finally be gone for good. Over 30 Countries Pledge to Fight Ransomware Attacks. $52.1 Billion in ransomware transactions? really? Tianfu Cup 2021. Clipboard Hijacking for fun and profit. LinkedIn to dramatically pare down its offering in China. Closing the Loop. Minh Duong's Epic Rickroll.
Picture of the Week. A sneak peak at November 9th upcoming Win11 fixes. Leo gets his wish!! REvil WAS recently re-taken down by Law Enforcement! Microsoft: “We’re Excited to Announce the Launch of Comms Hub!” Microsoft: “Windows update expiration policy explained” And while we're on the subject of Windows Updates... Windows XP’s 20th Anniversary. Last Tuesday the 19th, Zerodium tweeted... The “Devastating” Gummy Browsers attack! User-Agent Parser NPM package maliciously altered. Closing the Loop. Miscellany. SciFi - Dune / Foundation / Arrival / Invasion SpinRite. The More Things Change...
More 0-days for Chrome. Two naughty Firefox add-ons have been caught abusing an extension API. Windows 11 News: Can we print yet? A new Local Privilege Escalation affecting all versions of Windows. Ask your AI. And speaking of the PC Health Check. Stand back for the Adobe Security Patch Tsunami. The VoIP DDoS attacks continue. Closing The Loop. SpinRite. “Trojan Source”
Picture of the Week. Lots of welcome progress on the ransomware front. Pwn2Own Austin: Last Tuesday-Thursday largest ever 3-day Fall 2021 Pwn2Own. Windows 11 snipping tool, its emoji picker, and other parts are failing. Trouble being created by unpatched GitLab servers. More supply chain attacks. If it's Tuesday... Cisco's DEFAULT SSH key. U.S. Federal agencies have been ordered to patch hundreds of actively exploited flaws. Closing The Loop. SpinRite. Bluetooth Fingerprinting.
Picture of the week. ~10,000 VPN/Firewall appliances from Palo Alto Networks vulnerable. The 0-Patch Guys Produce a Micropatch This brings me to “The Zen of Code” November's Patch Tuesday November broke something, but don't ask me what... Windows 11 received KB5007215 December promises to be Christmas for Printing and more! US detains crypto-exchange exec for helping Ryuk ransomware gang launder profits How do you defraud web-based advertisers? Closing The Loop SpinRite Blacksmith
Picture of the Week. An idea whose time has passed... The stats of brute force password attacks. The Most Common Passwords. GoDaddy Breached Bigtime! A heads-up about NetGear routers. HTTP Request Smuggling.
Picture of the Week. “Super Duper Secure Mode” 37% of the world's smartphones are vulnerable. The RAT Dispenser. The Entirely Predictable 0-Day Windows Exploit. “The Frontiers Saga: Fringe Worlds” Closing the Loop. Bogons Begone!
Picture of the Week. Tavis finds a bad bug in NSS. Cheap Smartwatches for kids and babies? Additional VPN vendors just say no to Roskomnadzor! Windows 11 loosens its grip on Edge. RTF Templates being used to inject malicious content. A Malicious Botnet uses the Bitcoin Blockchain. HP's has been shipping vulnerable printers for 8 years. Sci-Fi. SpinRite. XSinator.
Picture of the Week. Amazon outage and cloud dependence. AirTag Abuse. Windows 11 vs Your Browser of Choice. WordPress once again in the crosshairs. Closing the Loop. Sci-Fi. SpinRite. Log4j & Log4Shell.
Picture of the Week. Google's 16th exploited Chrome 0-day of the year. Firefox refuses to do Microsoft.com! Firefox disabled Microsoft's Cloud Clipboard. Weaknesses in all cellular networks since 2G. Cross Wi-Fi / Bluetooth leakage. “The Matrix Resurrections” aka “The Matrix 4”. SpinRite. It's a Log4j Christmas.
Leo Laporte walks through some of the highlights of the show and most impactful stories of 2021. Stories include: SolarWinds Hack Detailed By Microsoft Crispy Subtitles from Lay’s Remembering Dan Kaminsky REvil Hacks Apple Supplier Quanta Computer The “Doom” CAPTCHA How Colonial Pipeline Was Breached When John McAfee Called Steve Gibson T-Mobile Subscribers: Do This Now Internet Anonymity” is an Oxymoron
Picture of the Week. Log4j’s 5th update. Microsoft's Log4j scanner triggers false positives. Chinese government is annoyed with Alibaba. “Hack the DHS” Bug Bounty Expanded. COVID postpones the RSA Conference. DuckDuckGo continues to grow. The cost of cyber insurance will likely be rising or perhaps terminated. “The Matrix Resurrections” what a disappointment! SpinRite. December 33rd.
Picture of the Week. The US CISA Log4J status update. The H2 Database Console vulnerability. The Federal Trade Commission gets into the act! Chrome fixed 37 known problems last week. The Privacy-first Brave browser. WordPress 5.8.3 security update. What, exactly, is a “Pluton”? The first of Dennis Taylor’s three Bobiverse novels. SpinRite. URL Parsing Vulnerabilities.
Picture of the Week "Hack the Pentagon" with Log4j Open Source Software Security Summit Microsoft's January Patch Tuesday Review: The GOOD News Microsoft's January Patch Tuesday Review: The Not So Good News Check Your Router Firmware Updates Chrome to Implement PNA Three High Severity Flaws in WordPress Add-ons Closing the Loop: Listener feedback SpinRite Anatomy of a Log4j Exploit
Picture of the Week. Log4J News. Who pays for RansomWare attack recovery? The rising cost of cyber-insurance. Another very dangerous WordPress add-on. And a supply-chain attack on a popular WordPress add-on provider. Does WordPress make sense anymore? The European Union plans to fund some bug bounty programs. The "MoonBounce" EFI Bootkit. Closing the Loop. Inside the NetUSB Hack.
Picture of the Week. Apple eliminates 0-days from iOS and macOS. Qualys published technical details for PwnKit. Log4Shell hits Ubiquiti. New bug bounties posted by Zerodium. “DrawnApart”: A device identification technique based on remote GPU fingerprinting. Sorting Windows Folders to the TOP! Closing the Loop. SpinRite. The "Topics" API.
Picture of the Week. China's Olympics: Leave your tech at home. We have a serious CVS 9.9 remote code execution vulnerability in SAMBA. Living off the Land. The suspension of the ms-appinstaller:// protocol scheme handler. Soon: Internet-sourced macros WILL NOT RUN in Office apps! Never11? The Inept Panda.
Picture of the Week. A high-severity 0-day in Chrome. Apple updates against another 0-day. CISA thinks this Apple vulnerability is quite serious. Which brings us back to “SeriousSAM” as it's being called. The CISA Top 16 list. Last Tuesday was the industry's monthly Patch extravaganza. The Magento Emergency. “PHP Everywhere” Google's Vulnerability Reward Program for 2021. Google's Project Zero Stats. Bye bye WMIC. InControl.
Picture of the Week. The “UpdraftPlus” WordPress Plug-In. “Xenomorph” Decrypting “The Hive” Un-Pixelating redacted text. No Internet For You!! If at first you don't succeed... Ukrainian DDoS Attacks. The Bobiverse trilogy. SpinRite News. A BGP Routing Attack.
Picture of the Week. Honor among thieves? Daxin. Whither or Wither: Log4j / Log4Shell. “418 I’m a teapot” Will the US attack? Windows 11 Compatibility. Closing the Loop. SpinRite News. Trust Dies in Darkness.
Picture of the Week. The Russians are coming. Ukrainian “Cyber Unit Technologies” is paying for attacks on Russia. StarLink in Ukraine. Russia blocks access to Facebook, Twitter, foreign news outlets. Google has become proactive. Namecheap says "no more". Telegram's use explodes. Microsoft also shuts down in Russia. Coinbase. Russia releases the IP addresses and Domains of DDoS attacks. Russia to permit software piracy. Will Russia Disconnect?.
Picture of the Week. Patch Tuesday for the Industry. Android, too. Firefox emergency update. HP's major UEFI firmware patch-fest. The NVIDIA breach. ProtonMail gets it right. Linux Blues. Russia's New CA. The state of WordPress security. Sci-Fi update. QWACs on? or QWACs off?
Picture of the Week. Report Cybercrime: It's the Law. A software supply chain compromise. Browser in the Browser. TrickBot, MicroTik & Microsoft. The Infinite Loop OpenSSL Bug. CISA Alert AA22-074A. The Windows Local Privilege Escalation that Microsoft seems unable to fix. Use After Free.
Picture of the Week. A high severity 0-day vulnerability update for Chrome. An interview with the CTO of a large Ukraine ISP, Ukrtelecom. NPM under attack, again. Honda says, nothing to worry about... The U.S., the FCC, Kaspersky Labs and Chinese Telecoms. Closing The Loop. Targeted Exploitation.
Picture of the Week. 0-Day Watch. Spring Forward (Java: Spring4Shell) QNAP and the OpenSSL DoS vulnerability. Sophos has a 9.8. CISA orders federal civilian agencies to patch the Sophos vulnerability. Browser-in-the-browser. The supply-chain attacks on NPM have been growing. FinFisher bites the dust. A LAPSUS$ in judgment. Not so Wyze. Closing The Loop. Port Knocking.
Picture of the Week. Could NGINX have a 0-day? Microsoft's new Autopatch system. Another instance of Russian Protest in JavaScript's repository. End-of-service life for some popular Windows editions. Miscellany. Closing The Loop. Spring4Shell.
Picture of the Week. Chrome's 3rd 0-day of 2022. Patch Tuesday Redux. WordPress once again... Apache Struts Framework needs a critical update. Are America's nuclear systems so old they're un-hackable? Closing The Loop. SpinRite. A Critical Windows RPC RCE.
Picture of the Week. CISA's Known Exploited Vulnerabilities Catalog. Lenovo UEFI Firmware Troubles. Everscale Blockchain Wallet. Java 15, 16, 17, and 18 received MUST UPDATES last week. Closing The Loop. Sci-Fi. SpinRite. The 0-Day Explosion.
Picture of the Week. DoD DIB-VDP Pilot Overview. The OpenSSF and the Package Analysis project. Connecticut moves toward state privacy protections. Closing The Loop. Global Privacy Control.
Picture of the Week. Google updates Android to patch an actively exploited vulnerability. Connecticut’s recently passed data privacy bill became law last Wednesday. Ransomware victim snapshot. US State Department offering $10 million reward for information about Conti members. The worst threat the US faces... The White House and Quantum Computers. The ongoing threat from predictable DNS queries. F5 Networks Remote RCE warning and exploitation. Closing The Loop. Sci-Fi. That “Passkeys” Thing.
Picture of the Week. An “eventful” Patch Tuesday. Patch Tuesday. Apple patched a 0-day. Google's “Open Source Maintenance Crew”. Conti suggests overthrowing the new Costa Rican government. Policing the Google Play Store. The situation has grown more dire for F5 systems' BIG-IP boxes. Errata. Closing The Loop. SpinRite. The New EU Surveillance State.
Picture of the Week. Emergency mid-cycle update for Active Directory. Clearview AI -vs- {Illinois, Australia, Canada and the United Kingdom}. Clearview AI in Ukraine. Pwn2Own Vancouver 2022. The DoJ takes a welcome step back. Sometimes, unlocking can be too convenient. Closing The Loop. Dis-CONTI-nued: The End of Conti?
Picture of the Week. New South Wales DDL — Digital Driver's License. The latest Microsoft Office 0-day remote code execution vulnerability. GhostTouch. Vodafone’s new TrustPiD. Closing the Loop. DuckDuckGone?
Picture of the Week. ServiceNSW Responds. ExpressVPN pulls the plug in India. And speaking of pulling the plug. “Follina” under active exploitation. And a Windows Search URL schema can be abused, too. “Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones”. Ransomware sanctions are causing trouble. Conti spotted compromising motherboard firmware. Errata. Closing the Loop. Passkeys, Take 2.
Picture of the Week. Apple’s Passkeys presentation at WWDC 2022. WebAuthn. FREE Penetration Testing course with Kali Linux. Proof of Simulation. A valid use for facial recognition: The Smart Pet Door! Closing The Loop. The PACMAN Attack.
Picture of the Week. Double Decryption (Last week's key-strength puzzler). 3rd Party Authenticators. Firefox: Total Cookie Protection. We keep breaking DDoS attack records. MS-DFSNM. An Apple Safari regression. One Million WordPress sites force-updated. High-Severity RCE in Fastjson Library. Miscellany. Closing The Loop. Microsoft's Patchy Patches.
Picture of the Week. Errata: Firefox’s “Total Cookie Protection” 3rd Party FIDO2 Authenticators Germany's not buying the EU's proposal which subverts encryption The Conti Gang have finally pulled the last plug Log4J and Log4Shell is alive and well The '311' emergency number proposal 56 Insecure-By-Design Vulnerabilities “Long Story Short” Closing The Loop The “Hertzbleed” Attack
Picture of the week. Chrome's fourth zero-day of 2022. Mozilla's new Firefox privacy-enhancing feature. HackerOne discloses a malicious insider incident. Closing the loop. The ZuoRAT.
Picture of the Week. OpenSSL's Patch For Heap Memory Corruption Vulnerability. NIST Announces First Four Quantum-Resistant Cryptographic Algorithms. Yubico donated 30,000 Yubikeys to Ukraine. Apple's new extreme “Lockdown Mode”. Microsoft to re-enable Office Macros. This Is the Code the FBI Used to Wiretap the World. Closing The Loop. The Rolling Pwn.
Picture of the Week. The Rolling Pwn, take II. The great IPv4 Address Space Depletion. Confronting Reality in Cyberspace: Foreign Policy for a Fragmented Internet. Facebook has started encrypting its link URLs. Crack iOS 16's “Lockdown Mode”, earn $2 million. ClearView AI faces some new headwind. Ransomware gangs are getting into the searchable database game, too... Roskomnadzor strikes again! Last Tuesday's Patches. SpinRite. Closing The Loop. RetBleed.
Picture of the Week. Patch Tuesday Redux Redux. Windows 11 Start button failure. The continuing saga of Windows VBA macros. Windows 11 now blocks RDP brute-force attacks by default. Black Hat and DefCon coming soon. SpinRite. pfSense and TailScale. Closing The Loop. The MV720.
Picture of the Week. Atlassian's “Confluence” under attack. LS-Anvil. Google delays Chrome's cookie phase-out again. Attacker responding to loss of Office Macros. SpinRite. Closing The Loop. RIP: Nichelle Nichols. “The Dropout” on Hulu and “WeCrashed” on AppleTV+. Winamp releases new version after four years in development. Rowhammer’s Nine Lives.
Picture of the Week. Crypto is Hard. VirusTotal: Deception at a scale. Windows 11 might damage encrypted data. Microsoft Defender External Attack Surface Management. Closing The Loop. Daniel Bernstein sues the NSA. The Maker’s Schedule.
Picture of the Week. Patch Flashback Tuesday. Facebook is cautiously creeping toward default E2E encryption. VNC's inherent insecurity. The need to control domain names. And speaking of backup: Cyotek WebCopy. Google's Ryan Sleevi Retweeted Jens Axboe. SandSara Update from Ed Cano. Closing The Loop. SpinRite. TLS Private Key Leakage.
VIDEO of the Week Crashing Laptop Computers With Janet Jackson RealTek SoC flaw affects many millions of IoT devices 46 Million RPS - requests per second Chrome's 5th 0-Day of 2022 Apple: Not to be left behind... RubyGems to require MFA Closing The Loop: Domain Name Ownership Closing The Loop: Growing in Cybersecurity The Bumblebee Loader
Picture of the Week. LastPass Breached. The US Federal Trade Commission filed a lawsuit against data broker Kochava. The US Federal Communications Commission launched an investigation into mobile carriers’ geolocation data practices. California, here I come! A conversation with a Ransomware Attacker. DuckDuckGo's Privacy-Enhanced eMail Forwarding. Another IoT mess care of “Hikvision” SpinRite. Closing The Loop. Wacky Data Exfiltration.
Picture of the Week. Google’s (newest) Open Source Software Vulnerability Rewards Program. Did TikTok leak 2.05 BILLION User Records? An urgent Chrome update patches new 0-day flaw. Permission-less Browser Clipboard Write. Nearly 1/3 of the packages in PyPI trigger an automatic code execution upon download. A Quantum Hype Bubble? All of the BlackHat 2022 Presentation Slides PDFs. Csurf NPM library mistake. SpinRite. Closing The Loop. Sci-Fi Discovery: “The Silver Ships” Embedding AWS Credentials.
Picture of the Week. Cyberwarfare: Albania vs Iran. Crypto Heist — this or that. The White House "Tech Platform Accountability" Listening Session. Changes to the Dutch Intelligence Law. Another QNAP mess. D-Link's being taken over by MooBot. Sci-Fi Discovery: "The Silver Ships". Closing The Loop. The EvilProxy Service.
Picture of the Week. This is Patch News-Day. Lloyd's of London backing away from Cyber-Insurance. Uber Oops! Rockstar Games: Grand Theft Auto 6 Massive Leak. LastPass Breach Update. A CVSS 9.8 for WordPress. What cost, Security? Use-after-freedom: Google's "MiraclePtr" Closing The Loop. Spell-Jacking.
Picture of the Week. Can't have it both ways. Denmark has become the fourth EU member to rule that the use of Google Analytics is illegal. Rockstar Games hacker is busted! Mozilla says: No fair! Vivaldi, Manifest V3, webRequest, and ad blockers. Sticky Chrome vulnerabilities. SMB authentication rate limiter now on by default in Windows Insider. US bill to secure FOSS software. Iran vs Albania. Closing The Loop. The Silver Ships. SpinRite. DarkNet Politics.
Picture of the Week. (What Could Possibly Go Wrong) Microsoft Teams - Unecessarily Insecure Roskomnadzor blocks Soundcloud Microsoft Exchange Server Under Attack Again I'm (Still) Not a Robot! Google TAG History Closing the Loop Poisoning Akamai
Picture of the Week. Breach of Customer Information Meta-targeted Malware Uber's Chief Security Officer Found Guilty More Cryptocurrency Chaos The UK to drop GDPR Summer Internship with the NSA Many Incident Responders are Stressed Out Microsoft's newest dual 0-day Exchange Fumbles SpinRite news ZimaBoard Closing the Loop Source Port Randomization
Picture of the Week. Microsoft "Won't Fix". Malicious Kernel Drivers. Microsoft has finally added an RSS feed for Windows Updates! Passkeys [dot] Dev. Largest DDoS attack. Signal will be dropping its SMS/MMS support. Brute-force protection for Windows local admin accounts. Other than that... SpinRite. Closing The Loop. xchg rax, rax and "xorpd" ZimaBoard Goodness. Password Change Automation.
Picture of the Week. Firefox 106 is out. Google's Open Source IoT KataOS and Sparrow. This Week in CryptoCurrency Craziness. New Windows 0-day bypasses executable security checks. Apple's 9th 0-day of the year bites the dust. The evolutionary demise of banking malware. VMWare’s Critical CVSS 9.8 Update. Closing The Loop. Miscellany. Data Breach Responsibility.
Picture of the Week. Windows driver blocklist to be updated next Tuesday. More Microsoft shenanigans. An upcoming OpenSSL CRITICAL vulnerability update -- get ready! A new TCP/IP RCE in Windows. A study of malicious CVE proof of concept exploits in GitHub. "Stranger Strings" : An exploitable flaw in SQLite. PayPal to add support for Passkeys. A browser exploitation tutorial! Kathleen Booth: July 9th, 1922 – September 29, 2022. Closing The Loop. SpinRite. After 20 years in GCHQ.
Picture of the Week. A minor Dropbox breach. OpenSSL follow-up. FTC sued and settled with a repeated offender. $1.2 billion in reported ransomware payments during 2021. Akamai's Q3 Threat Report. Initial Access Brokerages. How do today's bank heists work? De-Fi De-struction De-jour. Russia moves to Linux. We're The Red Cross. Don't attack us, please! Where there's a will, there's a way. From China with Love. The UK's NCSC scan plan. Miscellany. Closing The Loop. SpinRite.
Picture of the Week. Patch Tuesday review. Shennina Framework - Automating Host Exploitation with AI. GitHub's welcome new feature. Three LightSpeed vulnerabilities. Shufflecake: Plausible deniability encrypted Linux volumes. Australia has decided to get proactive! Apple's iOS 16.1.1 everyone file sharing time-limits to 10 minutes in China. A couple of Decentralized Finance notes because I can’t help myself. “The Helm” was unable to survive COVID-19. Elon meets Twitter. Closing The Loop. SpinRite. Memory-Safe Languages.
Picture of the Week. Firefox v107 was released last Tuesday. Google settles for a cool $391.5 million. Red Hat Signing its ZIP file Packages. The FBI purchased Pegasus for “research and development purposes”. Greece bought Predator for €7 million. A passkeys support directory. Quantum decryption deadline. Attorneys General ask the FTC for online privacy regulation. Closing The Loop. SpinRite. Wi-Peep.
Picture of the Week. iSpoof you no more. Here come the Freebie Bots! Anatomy of the real-time Cryptocurrency heist. Lookin' for something to do? Boa server vulnerability. The dilemma of closed-source Chinese networking products. The Cyber Defense Index. Malicious Docker Hub images. Since we’ve been tracking 0-days for a while. CISA on Mastodon. Miscellany. Closing The Loop. SpinRite.
Picture of the Week. Don't mess with Australia. Facebook / Meta fined by Ireland. REvil’s full Medibank dump. Is nothing sacred? Mozilla yanks a (no longer) trusted root. Android Platform Certs Escape. South Dakota says: No more Tik-Tok. Albania blames its IT staff. Good news on the memory safe languages front. Black Hat USA 2022. Another Chrome 0-day bites the dust. Anker's Eufy Camera debacle. An amazing-looking WiFi-6 router... $119. Elon really said this. Closing the Loop. SpinRite. LastPass Again.
Picture of the Week. Chrome does Passkeys. SYNC.COM suffered its first outage. Medibank reboot. Totally fake cryptocurrency trading platforms. Malware on Telegram. Texas gets in on the TikTok banning. The LastPass class action lawsuit. Rackspace had a big embarrassing problem. Rackspace is now facing at least three class action lawsuits. Another country goes on the offensive. Closing The Loop. SpinRite. Miscellany. Apple Encrypts the Cloud.
Picture of the Week. A malware operation known as URSNIF. Pwn2Own Toronto 2022. Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities. Patch Tuesday. Another Uber breach? Elon Botches ‘Bot Blockage. Vivaldi integrates Mastodon in its desktop browser. 5,200 Dutch government warnings. CIB: “Coordinated Inauthentic Behavior” GitHub to require 2FA by the end of next year. Bye bye SHA-1. WordFence’s VERY useful looking WordPress add-on vulnerability database. Closing The Loop. SpinRite. A Generic WAF Bypass.
Anatomy of a Log4j Exploit. Will Russia Disconnect? FCC Says Kaspersky Labs is a National Security Threat. Lenovo UEFI Firmware Troubles. That ""Passkeys"" Thing. Dis-CONTI-nued: The End of Conti? Steve's Take on the LastPass Breach.
Picture of the Week. SpinRite. Leaving LastPass. Is there reason for concern? Well known password cracker Jeremi Gosney's LastPass rant. Steve shares his plan regarding LastPass. What is Steve's next password manager? What should LastPass users do to protect themselves?
Picture of the Week. LastPass Aftermath. LastPass Vault De-Obfuscator. What more do we know this week regarding LastPass? The most alarming discovery by listeners. Understanding the scale of GPU-enhanced password cracking. On the true strength of passwords. Feedback from listeners regarding LastPass.
Picture of the Week About Password Iterations EBC or CB Norton Lifelock Troubles Chrome Follows Microsoft and Firefox Chromium is Beginning to Rust BYOVD and Windows Defender Failures Closing the Loop (feedback) The Rule of Two
Picture of the Week. PayPal Credential Stuffing. iOS 16.3 : Cloud encryption for all. InfoSecurity Magazine: “ChatGPT Creates Polymorphic Malware”. CheckPoint Research: OPWNAI : Cybercriminals Starting to Use ChatGPT. “Meta” fined for the third time. Bitwarden acquires “Passwordless.dev”. Closing the Loop. SpinRite. Credential Reuse.
Android to start blocking old and unsafe apps. Microsoft to block Internet sourced Excel add-ins. An example of saying "no" even when it may hurt. Hacked Wormhole funds on the move. Kevin Rose Hacked. Facebook will be moving more users into E2EE. iOS 6.3 and FIDO. Scan thy Citizenry. The Hive ransomware organization takedown. Errata. Closing the Loop. SpinRite. Data Operand Independent Timing.
Picture of the Week. The European Union's Internet Surveillance Proposal. 30,000 patient records online? .DEV is always HTTPS! Google changes Chrome's release strategy. Russia shoots the messenger. A fool and his Crypto... QNAP is back. CVSS severity discrepancy. Closing the Loop. How ESXi Fell.
Picture of the Week ESXiArgs follow-up ChatGPT's Malicious Use Google Security Key Giveaway Brave goes HTTPS-by-default 1Password Makes Another Passkeys Move Russian Patriotic Hackers Amazon to FINALLY Secure Its AWS S3 Instances More Anti-Chinese Camera Removals Microsoft to embed Adobe Acrobat PDF reader into Edge Password Exhaustion One Time Passowrd OTPAuth Password Exhaustion Ascon
Picture of the Week. GoneDaddy. Section 230. No Blue, No SMS-based 2FA. Bitwarden gets Argon. “Meta Verified”. Emsisoft Fake Code Signing. Attacks breaking records. More Mirai. NPM malware. Patch Tuesday. Samsung announces “Message Guard”. The Hyundai & Kia mess. A Clever Regurgitator.
Picture of the Week. Windows 11? ... anyone? As Plain as Ever. Edge's new built-in VPN? LastPass Incident Update. Signal says NO to the UK. More PyPI troubles. The QNAP bug bounty program. SpinRite. The NSA @ Home.
Picture of the Week. DDoS’ing Fosstodon. DDoS for Hire takedowns. TikTok Insanity. Illegal Warrantless Surveillance. Strategic Objective 3.3. GitHub Secret Scanning. CISA's Covert Red-Team. What's left? What's old is new again. TCG TPM vulnerabilities. WordPress “All In One SEO”. Russia fines Wikipedia. A Fowl Incident.
Picture of the Week. Another Malicious Chrome Extension. Germany to join the Huawei & ZTE ban. Putting “phishing” into perspective. The Polynonce attack. Plex's RCE now in CISA's KEV. Sci-Fi: Andor. Sony Sues Quad9.
Picture of the Week. Multiple Exploitable Samsung 0-Days. A good idea for NPM. The TikTok Tick Tock. Google pushes for 90-day TLS certificate life. CHESS is safe. CISA has begun scanning! Flying Trojan Horses.
Picture of the Week. Synacktiv wins this year's CanSecWest Pwn2Own GitHub: Mistakes happen DDoS for Hire. . .Or Not 144,000 malicious packages published No iPhones For Russian Presidential Staff I NUIT Edge Gets Crypto Microsoft's Email Extortion
Picture of the Week So... Not an attack, then? AI Overlord Hysteria Italy says NO to ChatGPT It’s illegal... How much will that be? The U.S. FDA & medical device security Hack the Pentagon Firefox 3rd-party DLL check-up Microsoft’s Extortion? The Silver Ships Zombie Software
Picture of the Week. Microsoft and Fortra go on the offensive. Can ChatGPT keep a secret? Apple updates their OS's. Wordpress under attack... again. Mozilla's Site Breach Monitor. Another ChatGPT investigation. Samsung handsets reaching EoL. Less access for loan apps. The right to be forgotten. SpinRite. A Dangerous Interpretation.
Picture of the Week. Patch Tuesday Review. Risky Business News. Google Assured Open Source Software. WhatsApp Improvements. Bad Security? Go to jail! Forced Entry.
Picture of the Week. Lockdown Mode seen succeeding. A growing black market for ChatGPT accounts. Decommissioned Corporate Routers Leak Secrets. Jaguar Tooth: Cisco router vulnerabilities. Security Research Legal Defense Fund. A quick Firefox fix. Kubernetes security audit. Google Chrome zero-day. An End-to-End Encryption Proposal.
Picture of the Week. The Encryption Debate. Age does matter... Age Verification. WhatsApp: Rather be blocked in UK than weaken security. Exposing Side-Channel Monitoring. Closing the Loop. A new UDP reflection attack vector. Google Authenticator Updated. Does Israel use NSO Group commercial spyware? A Russian OS? TP-Link routers compromised. A pre-release security audit. Another Intel side-channel attack. Windows users: Don’t remove cURL! AI comes to VirusTotal.
Picture of the Week. Google & Passkeys. TP-Link routers DO auto-update. US Marshals Service: Where’s the backup?? T-Mobile keeps getting breached. Chrome: No more LOCK icon. Apple's new “Rapid Security Response” system. Elon Musk, making friends wherever he goes... A quick Mastodon aside. Here come the fake AI-generated “news” sites. Russia to replace “American” TCP/IP with “Russian Internet”. Vint Serf's 3 mistakes. Detecting Unwanted Location Trackers.
Picture of the Week. SpinRite. Location Tracker Behavior. Formal definitions from the specification. Bluetooth LE devices have MAC addresses and therein lies a problem. All devices are serialized. And now, that "pairing registry". Privacy considerations.
Picture of the Week. Tracker Follow-Up. Automatic IoT device updating. HP 9020e - error code 83C0000B. Section 230 Stands. The KeePass Vulnerability. Apple joins Samsung, Amazon and Verizon in banning ChatGPT. Google's Privacy Sandbox moves forward. The FBI heavily misused FISA powers. Supply Chain Nightmare. SpinRite. VCaaS – Voice Cloning as a Service.
Picture of the Week. HP = “Huge Pile” The “.ZIP” TLD — What could possibly go wrong? PyPI gets more serious about security AND privacy. “No logs saved anywhere”??? Twitter in the EU? Bitwarden's support for Passkeys. A €1.2 billion fine will grab your attention. Editing WhatsApp messages. A new Google Bug Bounty. SpinRite. Brave's Brilliant Off the Record Request.
Picture of the Week. Another week of silence from HP. Mandatory “SMB Signing” coming to Windows 11. OWASP. Did Apple help the NSA attack the Kremlin? Kaspersky's analysis of this iPhone attack and compromise. The Trifecta Jackpot! Who wrote that? Tor gets anti-DoS protection. Cybersecurity at Educational institutions. Civilian Surveillance Cameras in Ukraine. Cyber Mercenaries. Closing the Loop. Windows Platform Binary Table.
Picture of the Week. Cryptomining Rude Surprise Billing. Musk's Twitter is refusing to pay for Cloud Services. IoT DDoS rapidly rising. H1CA found executing code on client machines. Apple's WWDC Redux. France takes a different approach... Russia: Scanners stay out! Miscellany. Closing the Loop. SpinRite. Scanning the Internet.
Picture of the Week. Patch Tuesday. Does EVERYTHING leak?? Closing the Loop. SpinRite gets version 7.1! The Massive MOVEit Maelstrom.
Picture of the Week. Catching Leo up to speed from last week. DuckDuckBrowse. And an updated Tor Browser. Opera, now enhanced with “AI”. The KasperskyOS Phone. The cost of doing business in Russia. Slowly turn the wheels of justice. The US to create a new “Cyber Force”. Apple.com now supports Passkeys. Selective GDPR enforcement? Facial Recognition is Photo Recognition. Google cybersecurity clinics. Progress/MOVEit sued. Closing the Loop. SpinRite. Operation Triangulation.
Picture of the Week. Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software. And as for MOVEit... What's a “Rug Pull” ?? “Avast, ye Matey” China's OpenKylin v1. TootRoot! Firefox 115. Did Russia Disconnect? Use some honey if you want to catch some flies. Cryptocurrency losses. International Consumer Data Transit. Apple's emergency update retraction. Syncthing Revisited. Closing the Loop. SpinRite's first RTM release. RTOS-32. Rowhammer Indelible Fingerprinting.
Picture of the Week. Kaspersky on Microsoft's Patch Tuesday. As the worm turns: WormGPT. Microsoft revokes 100+ malicious drivers. MOVEit Update. Does Dun & Bradstreet know you? No Threads for you! (or EU!) All Bitcoin addresses look alike. Twitter changes DM settings. Closing the Loop. SpinRite. Satellite Insecurity, Part 1.
Picture of the Week. R.I.P. Kevin Mitnick. Apple says: "Thanks, but we'd rather leave." Web Environment Integrity. Web Analytics under the spotlight. More progress on the IoT security front. The "Expeditionary cyber force". Ransomware payouts being made much less often. MOVEit Update. TikTok + Passkeys. Closing the Loop. SpinRite. Satellite Insecurity, Part 2.
Picture of the Week. Satellite Turla: APT Command and Control in the Sky. OS 17 to further crack down on device fingerprinting. Android to start warning of "unknown trackers". The 7th branch of the US military. Russia criminalizes open source project contribution. VirusTotal's 2023 report. Closing the Loop. TETRA:BURST.
Picture of the Week. NASA “shouted” at Voyager. Another view of Microsoft. What about this Chinese attack? AI meets Keyboard Acoustic Side-Channel attacks. Closing the Loop. Revisiting Global Privacy Control.
Picture of the Week. Security Now!'s 18th birthday! Closing the Loop. Firefox Multi-Account Containers. A question about Full Disk Encryption on SSD's. Should I run SpinRite before I back up my drives to a NAS? Overly complex password rules. DuckDuckGo's email alias. The new Russian Astra Linux based OS can not legally be possible. Regarding satellite crowding: The skies won’t be darkening anytime soon. This is what came to mind on the Voyager 2 segment with the shout. Can you please share the name of the session manager that you use in Firefox? The numbers behind the Voyager recorrection. “Topics” Arrives. How Topics Works.
OpenSUSE goes private. Android to get satellite comms. SanDisk and Western Digital in hot water. You’re asking for it: YouTube children's privacy. Whoopsie! 8Base. Where the money is. The TSSHOCK vulnerability. BitForge. A Quantum resilient security key. Removed Chrome extensions notifications. HTTPS by default? WinRAR 6.23 final released. Closing the Loop. When Heuristics Backfire.
Picture of the Week WinRAR v6.23 fixes HTTPS for local networks Portable domains for email Google Topics and monopolies Voyager 2 antenna analysis Windows time settings Unix time in TLS handshakes Fake flash drives Man-in-the-middle attacks
Steve provides an update on ValiDrive, his new freeware utility for testing USB drives. There has been another sighting of Google's Topics API, this time on Android phones. Apple has opened up their iPhones to security researchers through their Security Research Device program since 2019. Research reveals vulnerabilities in browser extensions that allow them to steal plaintext passwords from a website's HTML source code. Feedback from listeners. Apple publicly shares a letter from a CSAM activist demanding they implement scanning to detect child abuse images in iCloud Photos.
UK government appears to back down on demands to break encryption in Online Safety Bill Microsoft reveals how China-based hackers acquired secret key used to breach Outlook accounts Multiple flaws allowed key to improperly leave highly secure environment Mozilla research finds all major auto brands fail on privacy protection Evidence suggests LastPass encrypted vault data is being decrypted Researchers tie $35M in crypto thefts to compromised LastPass accounts Brute force feasible on old low iteration count passwords
Last week's news about evidence of LastPass vault decryption targeting cryptocurrency keys, and the UK's backing down on its encryption monitoring legislation. How hardware security modules (HSMs) allow cryptographic operations like code signing without exposing private keys. Browser identity segregation using multiple profiles rather than separate browsers. Requirements and best practices for securely wiping data from modern solid state drives. A countdown clock for the 32-bit UNIX time rollover in the year 2038. Steve's plan to move off Twitter and onto email lists for Security Now communication. A deep dive into cryptographic hash collisions, using fewer hash bits, and balancing anonymity with statistical meaning.
Apple has quietly removed support for Postscript in macOS Ventura. China has formally accused the NSA of hacking and maintaining access to Huawei servers since 2009. A misconfigured Azure Shared Access Signature token resulted in 38TB of sensitive internal Microsoft data being exposed. The Signal messaging platform has added a post-quantum encryption protocol. A zero-day iOS exploit chain was used to target Egyptian presidential candidate Ahmed Eltantawy. Steve gave an update on the status of his forthcoming ValiDrive USB validation utility. A blog post about the complexity of modern web browsers. An emailer claimed to have a mathematical algorithm that can generate truly random numbers. An emailer asked whether encrypting and deleting a hard drive could substitute for overwriting with random data. There was an explanation of how public key encryption can be used bidirectionally. Listener questions whether all stolen LastPass vaults will eventually be decrypted.
Exim email server ignored ZDI's responsible disclosure of critical remote code execution flaws for over a year, putting millions of servers at risk. Malicious ads are appearing in Bing Chat responses, promoting fake sites distributing malware. Windows 11 now natively supports passkeys, though browser support may make this redundant. Researchers exploit WiFi beamforming side-channel to potentially reveal keystrokes, but practicality is limited. The ECH TLS extension encrypts the ClientHello packet to hide SNI data. Exim disclosure timeline and impact on millions of vulnerable servers. Bing chat ads mimic search result malvertising risks amplified by chatbot trust.
Steve announces the release of his new freeware utility ValiDrive for detecting fake drive capacities. 23andMe claims a recent data breach exposed customer info due to credential stuffing attacks. Key stats from Microsoft's 2023 Digital Defense Report on cyberattacks. Brave lays off 9% of its staff amid the tough economic climate. Google Docs exports replace links with tracking redirects, enabling Google to monitor clicked links from exported documents. The MOVEit breach impacted Sony, exposing employee and family data. Firefox 118 now supports Encrypted Client Hello. Google will provide 7 years of updates for its new Pixel phones, up from 5 years previously. The MACE Act passed overwhelmingly in Congress, allowing agencies more flexibility in cybersecurity hiring. Median dwell time for ransomware dropped to less than 1 day, with human-driven attacks deploying it faster. Steve digs into the top 10 cybersecurity misconfigurations outlined in the new NSA/CISA advisory.
ValiDrive release follow-up Passkeys exportability and phishing risk Passkeys for device verification like SSH keys Possibility of hobby browsers vs. production browsers Availability of SpinRite 6.1 pre-release Filling drives with crypto noise using VeraCrypt Steve and Leo's favorite OTP apps Google Docs link rewriting could be to prevent referrer leakage Abusing HTTP/2 Rapid Reset
How fake drives continue to be sold on Amazon despite negative reviews Microsoft is discontinuing support for the VBScript language The 30-year old NTLM authentication protocol will eventually be removed from Windows Two new vulnerabilities found in cURL A new Cisco router vulnerability rated CVSS 10.0 was used to hack over 40,000 devices Debate over whether "lib" should rhyme with "vibe" or "air" Instructions for accessing the SpinRite 6.1 pre-release version Feedback on passkey exportability and server IP address encryption A listener asks if ransomware can encrypt already encrypted files How Privacy Badger un-rewrites Google's search result links The NSA and CISA warn about the power of privilege and the dangers of account misconfigurations
What caused last week's connection interruption? Is it possible to create and maintain an Internet whitelist? What's the latest on LastPass vault decryptions? How do you know of a remote correspondent adds a new device to their Apple account that it's really them? Might there be more life left in Windows 10 than we thought? What's foremost in the minds of today's bug bounty hunters? What new free and open source utility has CISA released? Could it be that SpinRite 6.1 is finished? Is TLS 1.2 ready for retirement? And what about IPv4? How can open source projects get their code signed? And then we're going to take a really interesting deep dive into the Internet's latest mass-casualty disaster.
Microsoft announced storing their Azure keys in an HSM after previously losing control of a private signing key A quartet of new 0-day vulnerabilities in Exchange Server that Microsoft declined to fix Apache ActiveMQ servers under attack exploiting a 0-day, with over half of publicly exposed servers vulnerable Update on the Citrix Bleed vulnerability with evidence of hackers gaining access and post-exploitation activity CVSS version 4 released with new metrics for better granularity and clarity of vulnerability scores Ace Hardware suffered a cyberattack impacting servers and systems Google abandons controversial "Web DRM" proposal Analysis of "BadCandy" malware infecting vulnerable Cisco routers Bitwarden password manager adds support for FIDO2 passkeys in browser extension Feedback from listeners on IPv6 adoption, factors for choosing crypto primes, installing Windows 11, and more The brewing battle in the EU over proposed eIDAS regulation Article 45
Is your lack of privacy badgering you? And if so what can you do about it? What's the latest on last week's bombshell news of the EU's Article 45 in eIDAS 2.0? Who's lost how much money in online cryptocurrency? Is using seed phrases from a seed phrase suggestion site a good idea? Has there been an effective speculative execution flaw discovered in Intel's processors? What country has decided to ban all VPNs? How bad are the two flaws found in OpenVPN? Why have I stopped working on SpinRite? What's the best backup for a large NAS? Should vulnerability researchers learn the assembly language of their target processors? If quantum computers threaten asymmetric crypto, why not return to symmetric crypto? Could someone explain exactly why Article 45 is a bad thing? What in the world is a Windshield Barnacle and why don't you want one? What's my latest Sci-Fi book series discovery? Just how bad could it be if a cosmic ray flipped a bit at just the wrong time?
Privacy and Funding Challenges Facing Signal Messaging App Loss of Advertisers for Twitter After Controversial Tweet by Elon Musk Ransomware Group Files SEC Complaint Against Breached Company Europe Opening Up Radio Encryption Standard TETRA for Public Review Apple Announcing Adoption of RCS Messaging for iPhones Steve's Progress on Dynamic Code Signing for SpinRite Releases Removing Suction Cup Barnacles from Windshields Recommendations for Benchmarking USB Drive Read/Write Speeds Concerns Over EU's Proposed eIDAS 2.0 QWACs Legislation Why Protectli Routers Are Preferred for pfSense Setups Credit Card Security Precautions for Ex-LastPass Users Origins and Evolution of Ethernet Networking Over 50 Years
Adobe Flash Player Updater is (still) desperately trying to update Veracrypt password security Firefox moves to 120 with a bunch of very nice new features Do-Not-Track is back on track “ownCloud” -or- “PwnCloud” ? CrushFTP Critical Vulnerability Bypassing fingerprint authentication ApacheMQ TransUnion & Experian both hacked
How masked domain owners can be unmasked through ICANN's new Registration Data Request Service (RDRS) WhatsApp's addition of Secret Code for extra privacy protection in Chat Lock Iranian hackers exploited default passwords in programmable logic controllers at US water facilities Attempt by Montana to ban TikTok statewide was stalled by a federal judge ruling Over 1 billion Android devices now have RCS messaging enabled EU Cyber Resilience Act will improve security of Internet of Things devices sold in the EU Black Basta ransomware group has netted over $107 million since early 2022 Google's new .meme top-level domain allowing meme-related web properties CISA’s Secure by Design initiative echoes security best practices frequently recommended on the podcast France plans to ban use of “foreign” end-to-end encrypted apps like Telegram and require use of French app Olvid instead Concerns raised by industry experts Ivan Ristic and Ryan Hurst about EU's eIDAS 2.0 legislation
The government collection of push notification metadata Facebook Messenger sets end to end encryption as the default Iran’s Cyber Av3ngers Cisco's Talos Top 10 cyber security exploits this year Over 30% of apps are still using a using a vulnerable version the Log4J library Quad 9 speaks on their legal victory against Sony What are the "Clear Web", "Dark Web", and "Deep Web"? A Flaw in Telegram Xfinity Mobile wants you to accept a root CA, DO NOT Hardware VPN alternative A breakthrough in quantum computing
Child protection legislation in the US Meta pushes back on the $200 billion FTC fine for COPPA violation Age verification on the internet Google moving from 3rd party cookies to topics A look at Cloudflare's metrics SpinRite update Cox Media admits that it spys on you
Steve's Next Password Manager After the LastPass Hack CHESS is Safe Here Come the Fake AI-generated "News" Sites How Bad Guys Use Satellites Microsoft's "Culture of Toxic Obfuscation" Steve announces his commitment to SN Apple Says No NSA's Decade of Huawei Hacking ValiDrive announcement
SpinRite 6.1 update Pruning Root Certificates A solution to Schrodinger's Bowl DNS Benchmark and anti-virus tools Nebula Mesh SpinRite 7 is coming The Mystery of CVE-2023-38606
More on Apple's hardware backdoor Russian Hacking of Ukranian cameras Russian hackers were inside Ukraine telecoms giant for months Things are still a mess at 23andMe CoinsPaid was the victim of another cyberattack Crypto Hacking in 2023 Mandiant Twitter scam Defining "cyber warfare" LastPass is making some changes Windows Watch Google settles $5 billion lawsuit Return Oriented Programming Shutting Down Edge Root Certificates Credit freezing SpinRite Update
What would an IoT device look like that HAD been taken over? And speaking of DDoS attacks Trouble in the Quantum Crypto world The Browser Monoculture Question about the Apple backdoor Getting into infosec proton drive vs sync SpinRite update The Protected Audience API
Microsoft's Top Execs' Emails Breached in Sophisticated Russia-Linked APT Attack US Health and Human Services Breached Firefox vs “The Competition” Brave reduces its anti-fingerprinting protections CISA’s proactive policing results one year later Longer Life For Samsung Updates Google Incognito Mode "Misunderstanding" Show Doc Not showing images on iOS Safari Generated AI Media Authentication Which computer languages to learn? Flashlight app subscription Google’s Privacy Sandbox system Malware and IoT devices Protected Audience API vs. Malvertising Defensive computing Why ISPs don't do anything about DDoS attacks SpinRite Update
iOS to allow native Chromium and Firefox engines. An OS immune to ransomware? HP back in the doghouse over "anti-virus" printer bricking The mother of all breaches New "Thou shall not delete those chats" rules Fewer ransoms are being paid Verified Camera Images More on the $15/month flashlight app What happens when apps change publishers Microsoft hating on Firefox Credit Karma is storing 1GB of data on the iPhone Staying on Windows 7 Sci-Fi recommendations Windows 7 and HSTS sites TOTP codes/secrets and Bitwarden SpinRite on Mac SpinRite v6.1 is done! LearnDMARC.com Alex Stamos on "Microsoft Security"
CISA’s “Secure by Design” Initiative The GNU C Library Flaw Fastly CDN switches from OpenSSL to BoringSSL Roskomnadzor asserts itself Google updates Android’s Password Manager Firefox gets post-quantum crypto Get your TOTP tokens from LastPass Inflated iOS app data LearnDMARC Sync mobile app bug SpinRite and Windows Defender Crypto signing camera Analog hole in digital camera authentication iOS and Google's Topics The gathering of the Stephvens Programmable Logic Controllers SpinRite update Malware-infected Toothbrush The Unforeseen Consequences of Google’s 3rd-party Cookie Cutoff
Toothbrush Botnet “There are too many damn Honeypots!” Remotely accessing your home network securely Going passwordless as an ecommerce site Facebook "old password" reminders Browsers on iOS More UPnP Issues A password for every website? "Free" accounts Keeping phones plugged in Running your own email server in 2024 iOS app sizes SpinRite 6.1 running on an iMac SpinRite update Bitlocker’s encryption cracked in minutes
Wyze breach Microsoft patch Tuesday fixes 15 remote code execution flaws Why are there password restrictions? The Canadian Flipper Zero Ban Security on the old internet Using Old Passwords Passwordless login TOTP as a second factor German ISP using default router passwords Email encryption in transit pfSense Tailscale integration DuckDuckGo's email protection integration with Bitwarden The KeyTrap Vulnerability
Nevada attempts to block Meta’s end-to-end encryption for minors. A survey of security breaches Edge’s Super-Duper Secure Mode moves into Chrome DoorDash dashes our privacy Avast charged $16.5 million for selling user browsing data No charge for extra logging! European Parliament's IT service has found traces of spyware on the smartphones of its security and defense subcommittee members LockBit RaaS group disrupted Firefox v123 The ScreenConnect Authentication Bypass SpinRite update Introducing BootAble Cox moving to Yahoo Mail for users Credit Card security Exploiting password complexity reqirements? Email only logins Flipper Zero in Canada German Router security More Flipper Zero in Canada Throwaway email addresses Shared email accounts Password quality enforcement Fingerprint tech and some future stories
"Death, Lonely Death" by Doug Muir, about the decades-old Voyager 1 explorer Cory Doctorow's Visions of the Future Humble Book Bundle CTRL-K shortcut for search on a browser Direct bootable image downloading for GRC's servers Closing the loop on compromised emails Taco Bell's passwordless app A solution for Bcrypt's password length limit of 72 bytes Data as the missing piece for law enforcement and privacy advocates The token solution for email-only login Apple's Password Manager Resources on Github The risk of long-term persistent cookies in browsers Why mainframe industries still require weak passwords A conundrum involving an exploitable Response Header error and a bounty payment. An inspection of Apple's new Post-Quantum Encryption upgrade
VMware needs immediate patching Midnight Blizzard still on the offensive China is quietly "de-American'ing" their networks Signal Version 7.0, now in beta Meta, WhatsApp, and Messenger -meets- the EU's DMA The Change Healthcare cyberattack SpinRite update Telegram's end-to-end encryption KepassXC now supports passkeys Login accelerators Sites start rejecting @duck.com emails Tool to detect chrome extensions change owners Sortest SN title Passkeys vs 2FA
Voyager 1 update The Web turned 35 and Dad is disappointed Automakers sharing driving data with insurance companies A flaw in Passkey thinking Passkeys vs 2fa Sharing accounts with Passkeys Passkyes vs. Passwords/MFA Workaround to sites that block anonymous email addresses Open Bounty programs on HackerOne Steve on Twitter Ways to disclose bugs publicly Security by obscurity Something you have/know/are vs Passkeys Passkeys vs TOTP Inspecting Chrome extensions Passkey transportability Morris the Second
Apple vs U.S. DOJ G.M.’s Unbelievably Horrible Driver Data Sharing Ends Super Sushi Samurai Apple has effectively abandoned HomeKit Secure Routers The forthcoming “.INTERNAL” TLD The United Nations vs AI. Telegram now blocked throughout Spain Vancouver Pwn2Own 2024 China warns of incoming hacks Annual Tax Season Phishing Deluge SpinRite update Authentication without a phone Are Passkeys quantum safe? GoFetch: The Unpatchable vulnerability in Apple chips
A near-Universal (Local) Linux Elevation of Privilege vulnerability TechCrunch informed AT&T of a 5 year old data breach Signal to get very useful cloud backups Telegram to allow restricted incoming HP exits Russia ahead of schedule Advertisers are heavier users of Ad Blockers than average Americans! The Google Incognito Mode Lawsuit Canonical fights malicious Ubuntu store apps Spinrite update A Cautionary Tale
Out-of-support DLink NAS devices contain hard coded backdoor credentials Privnote is not so “Priv” Crowdfense is willing to pay millions Engineers Pinpoint Cause of Voyager 1 Issue, Are Working on Solution SpinRite Update Minimum Viable Secure Product
An update on the AT&T data breach 340,000 social security numbers leaked Cookie Notice Compliance The GDPR does enforce some transparency Physical router buttons Wifi enabled button pressers Netsecfish disclosure of Dlink NAS vulnerability Chrome bloat SpinRite update GhostRace
What do you call “Stuxnet on steroids”?? Voyager 1 update Android 15 to quarantine apps Thunderbird & Microsoft Exchange China bans Western encrypted messaging apps Gentoo says “no” to AI Cars collecting diving data Freezing your credit Investopedia Computer Science Abstractions Lazy People vs. Secure Systems Actalis issues free S/MIME certificates PIN Encryption DRAM and GhostRace AT&T Phishing Scam Race Conditions and Multi-core processors An Alternative to the Current Credit System SpinRite Updates Chat (out of) Control
GCHQ: No more default passwords for consumer IoT devices! What happened with Chrome and 3rd-party cookies? Race conditions and multi-threading GM "accidentally" enrolled millions into "OnStar Smart Driver +" program Steve recommends Ryk Brown's "Frontiers Saga" SpinRite update Passkeys: A Shattered Dream?
The vulnerability of GPS Is the sky falling on all VPN systems? Multi-user Passkeys, YubiKeys? The iCloud Keychain The UK and Google's Topics
Picture of the Week. Most to least common 4-digit pins. Enhanced LORAN. Passkeys. Microsoft's Head in the Clouds.
When you’re the biggest target... Searching for Search How long will a Windows XP machine survive unprotected on the Internet? Free Laundry VPNs and Firewalls Netgate SG1100 Ad Industry vs. Google Privacy Sandbox Bitwarden and passkeys Token2 passkey dongle 312 Scientists & Researchers Respond
The bigger problem with AI Overview https://udm14.com/ -and- https://tenbluelinks.org/ The horses have left the barn VPNs and Firewalls Email @ GRC Extension to fix Google search Passwords and SPAM Fixing motherboard components Vertical tabs in Firefox FritzBox routers Too many PINs More Google search fixes Testing Windows XP The 50 Gigabyte Privacy Bomb
“Tornado Notes” Email @ GRC Have I Been Pwned? A new “supply chain” attack vector Another CA in the DogHouse ICQ to shutter its service Steve reviews “Déjà vu” Hide my email Security in Windows SpinRite update A Large Language Model in Every Pot
MS on Recall changes Thanks for the “Memory” New York Times (and Wordle) leak Apple’s own password manager app DJI drones on the defensive SlashData reveals some interesting developer statistics Are we going to turn programming over to AIs? The Linux Kernel Project goes CVE crazy Email @ GRC Pizza in 2024 Microsoft Recall at work Google Domains to Squarespace DNS migration T2F2-NFC-Dual keys The rise and fall of code.microsoft.com
CVE-2024-30078 “Recall” has been recalled Matthew Green on Apple’s Private Cloud Compute A WGET flaw with a CVSS of 10.0? Thou shall not Resolve! Email @ GRC Downloading email with MailStore Home IT at The New York Times ReMarkable The Angle of the Dangle
Expected follow-up on CVE-2024-30078 From Russia with Love An EU privacy agency complains about Google’s Privacy Sandbox? Email @ GRC Security Now SPAM? Orange Tsai needs help! Recall and 3rd Party Leakage Errata The Mixed Blessing of a Crappy PRNG
The regreSSHion Bug 50BTC moved Voyager 1 Update Email @ GRC SyncThing DNS queries Recall The End of Entrust Trust
Entrust Responds Other major Certificate Authorities respond Passkey Redaction Attacks Syncing passkeys Port Knocking Fail2Ban The Polyfill.io Attack
Using Content Delivery Networks Safely The CDK Global Ransomware Attack The IRS and Entrust Polyfill.io fallout Microsoft's Behavior A Snowflake’s Chance
Cellebrite unlocks Trump’s would-be assassin’s phone. Cisco reported on a CVSS of 10.0 Entrust drops the other shoe Google gives up on removing 3rd-party cookies Miscellany Snowflake and data warehouse applications CDK auto dealership outage Polyfill.io and resource hashes MITM Blocking Copilot Blocking incoming connections via IP CrowdStruck
Crowdstrike post-mortem PiDP-11 What Crowdstrike is fixing Marcus Hutchins on who is to blame Entrust’s Updated Info 3rd-Party Cookie Surprise Security training firm mistakenly hires a North Korean attacker Google and 3rd party cookies Google's influence The auto industry and data brokers DNS Benchmark on Mac Platform Key Disclosure
Platform Key Disclosure Firefox’s 3rd-party Cookie mess The W3C Finally Weighs-in CrowdStrike Damages. GRC’s Email How Revoking!
Sitting Ducks DNS attack A Bad RCE in another Microsoft server SinkClose The CLFS.SYS BSoD IsBootSecure Rethinking Revocation
Revocation Update GRC’s next experiment Patch Tuesday “The Famous Computer Café” IsBootSecure GRC Email Working through WiFi Firewalls Transferring DNS OCSP attestation vs. TLS expiration Platform key expiration National Public Data
S1 · E989
130 min
CrowdStrike Exec's "Most Epic Fail" Award Hardware backdoors discovered in Chinese-made key cards Counterfeit CISCO networking gear SpinRite Errata NPD breach updates from listeners Looking back at old SN episodes Cascading Bloom Filters
Telegram puts End-to-End Privacy in the Crosshairs Free security logging is good for everyone CrowdStrike hemorrhaging customers Microsoft to meet privately with EDR (Endpoint Detection & Response) vendors Yelp’s Unhappy with Google Telegram as the hotbed for DDoSass – DDoS as a Service Chrome grows more difficult to exploit Cox Media Group’s “Active Listening” has apparently not ended Cascading Bloom Filter follow-up Closing the Loop Is Telegram an encrypted app?
Offer to uninstall Recall was a bug, not a feature YubiKeys can be cloned Miscellany Is WhatsApp secure? Telegram vs Signal French elevators Freezing your credit The Quiet Canine Unix time Bobiverse book 5 Exodus: The Achemedes Engine Watching SpinRite RAMBO
Windows Endpoint Security Ecosystem Summit Aging storage media does NOT last forever How Navy chiefs conspired to get themselves illegal warship Wi-Fi adam:ONE named the #1 best Secure Access Service Edge (SASE) solution AI Talk Password Manager Injection Attacks
The case of the exploding pagers and walkie-talkies “Ford seeks patent for tech that listens to driver conversations to serve ads” Another large chunk of personal data exposed Passkeys takes a big step forward: Now supported by Chrome A nascent 9.9 Linux Unauthenticated RCE? Freezing Credit Credit Bureaus Drobo 5N SN email labeled as spam Public Wi-fi saftey SN for Certs Windows Defender Kaspersky exits the U.S.
The Linux remote code execution flaw The CRUCIAL importance of Domain Control Security Roskomnadzor strikes a discordant note VLC gets a security update Tor and Tails Merge Telegram changes its long-standing “zero cooperation” policy Enshittification Bobiverse book 5 Windows 10 notifications Experian woes Nuevomailer SpinRite Peter F. Hamilton Recall’s Re-Rollout
Facebook’s parent Meta not hashing passwords A New, forthcoming PayPal default opts their users into merchant data sharing DDoS breaks another record Speaking of these ASUS routers Do you know who you’re hiring? Vitamin D The CUPS vulnerablility Routers for normal people uBlock Origin & Manifest V3
uBlock Origin to the rescue National Public Data files for bankruptcy Will the .IO top level domain be disappearing? Patch Tuesday Firefox under attack Miscellany Sci-Fi The Sequence uBlock Origin Eero Routers Pep Link Router BIMI (up Scotty)
Did Chinese researchers really break RSA encryption? What did they do? What next-level terror extortion is being powered by the NPD breach data? The EU to hold software companies liable for software security? Microsoft lost weeks of security logs. How hard did the try to fix the problem? The Chinese drone company DJI has sued the DoJ over its ban on DJI's drones. The DoJ wishes to acquire "DeepFake" technology to create fake people. Microsoft has bots pretending to fall for phishing campaigns, then leading the bad guys to their honeypots. It's diabolical and brilliant. A bit of BIMI logo follow-up, then... A look at the operation of the FIDO Alliance's forthcoming Credential Exchange Protocol which promises to create passkey collection portability
Apple proposes 45-day maximum certificate life. SEC fines four companies for downplaying their SolarWinds attack severity. Google adds 5 new features to Messenger including inappropriate content. Does AI-driven local device-side filtering resolve the encryption dilemma forever? The very nice looking "Session" messenger leaves Australia for Switzerland. Another quick look at the question of the EU's software liability moves. Fake North Korean employees WERE found to install backdoor malware. How to speed up an SSD without using SpinRite. Using ChatGPT to review and suggest improvements in code. And Internet governance has been trying to move the Internet to IPv6 for the past 25 years, but the Internet just doesn't want to go. Why not? And will it ever?
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities?
Did Bitwarden go closed-source? The rights of German security researchers are clarified. Australia to impose age limits on social media. Free Windows Server 2025 anyone? UAC wasn’t getting in the way enough, so they’re fixing that. "From Russia with fines" -- obey or else. South Korea fines Meta over serious user privacy violations. Synology's (very) critical zero-click RCE flaw. Malicious Python packages invoked by typos. Google to enforce full MFA for all cloud service users. Mozilla Foundation lays off 30%? Is Firefox safe? Some feedback from Dave's Garage (https://grc.sc/dave) GRC email CTL: AI Debugging CTL: Chat GPT vs YouTube Shorts CTL: Update on the "Train Tracks" Pic of the Week CTL: DNS Benchmark compatibility CTL: The accuracy of AI CTL: Exposing NAS to the Internet CTL: Congrats on 1000!
How Microsoft lured the US Government into a far deeper and expensive dependency upon its cybersecurity solutions. Gmail to offer native throwaway email aliases like Apple and Mozilla. Russia to ban several additional hosting companies and give its big Internet disconnect switch another test. Russia uses a diabolical Windows flaw to attack Ukrainians. The value of old Security Now episodes. TrueCrypt's successor. Using Cloudflare's Tunnel service for remote network access. How to make a local server appear to be on a remote public IP. How to share an 'impossible to type' password with someone. How to find obscure previous references in the Security Now podcast. What are the parameters for the expected and widely anticipated next generation Artificial General Intelligence (AGI)? What do those in the industry and academia expect? And is OpenAI's Sam Altman completely nuts for predicting it next year? Is it just a stock ploy?
What's the new “nearest neighbor” attack and how do you defend against it? Let's Encrypt just turned 10. What changes has it wrought? Now the Coast Guard is worried about Chinese built ship-to-shore cranes. Pakistan becomes the first country to block Bluesky. There's a new way to get Git repos "swatted" and removed. Who's to blame for Palo Alto Networks' serious new 0-day vulnerabilities? If you have any of these six D-Link VPN routers, unplug them immediately! It turns out that VPN apps are against Shariah Law. Who knew? The Return of Windows Recall. What are we learning now? How many of today's systems remain vulnerable to last year's most popular exploits? We share and respond to a bunch of terrific feedback from our listeners. What are Microsoft's "Connected Experience" and why might you choose to disconnect from them?
Microsoft clarifies they are NOT using customer data from Office apps to train AI models "Digital epileptic seizures" caused by flashing emergency vehicle lights can confuse automated driving systems Tor Network issues urgent call for volunteers to run new WebTunnel bridges to circumvent censorship in Russia Zello asks its 140 million users to change passwords as a precautionary measure, hinting at a possible data breach FTC opens broad antitrust investigation into Microsoft's business practices across software, cloud, cybersecurity, and AI New Android scareware tactic simulates a seriously cracked and malfunctioning smartphone screen Steve argues it's likely safe to leave Wireguard VPN ports open, but he prefers not to out of an abundance of caution Australia passes world-first law banning children under 16 from social media NASA's Voyager 1 probe, nearly a light-day from Earth, faces mounting technical challenges
All telecom providers have been hacked and may still not be safe to use. The plan to obsolete all non-TPM 2.0 PCs remains well underway. Microsoft's product activation system has been fully hacked. Apple patents AI recognizing people by what they're wearing after earlier seeing their faces and noting what they're wearing. Zoom wasn't encrypting they're early video conferencing. They're still trying to get out from under the mess their lies created for them. AWS introduces physical data terminal locations where users can go to perform massive data transfers to and from the cloud. The FTC has set their sights on data brokers. GRC's email finally gets BIMI. Lot's a terrific listener feedback about authenticator policy, a new and free point-to-point link service, Tor's "Snowflake", linking PCs and Smartphones, and even recharging spent SodaStream canisters. We look at a recent conversation I had with "ChatGPT 4o with canvas" and the new plan that resulted.
Is AI the Wizard of Oz? Or is it more? Microsoft's long standing effective MFA login bypass. Is TPM 2.0 not required after all for Windows 11? Meet 14 North Korean IT workers who made $88 million from the West. Android updates its Bluetooth tracking with anti-tracking. The NPM package manager repository has had 540,000 malicious packages discovered hiding in plain sight. The AskWoody site remains alive, well, and terrific. My iPhone is linked to Windows and it's wonderful. Yay. How has email been finding logos before BIMI? If we use Him and Her for people, how about Hal for AI? Another very disturbing conversation with ChatGPT. What's going on with the new ChatGPT o1 model? It wants to escape? What?? Let's Encrypt plans to reduce its certificate lifetime from 90 to just 6 days. Why in the world? And all the best holiday wishes. See you in January.
956. Apple’s Hardware Backdoor: Steve reflects on the previous week's 'The Mystery of CVE-2023-38606' deep-dive. Did Apple deliberately designed a secure backdoor? 960. Unforeseen Consequences of Google's 3rd-party Cookie Cutoff: The advertising industry scrambles to find new ways to track users. 961. Bitlocker: Chipped or Cracked?: A clever hacker demonstrates how BitLocker-encrypted drives can be compromised on systems using separate TPM chips. 964. So, What Is Apple’s PQ3?: Steve analyzes Apple's new "PQ3" iMessaging protocol. 976. Recall - The 50 Gigabyte Privacy Bomb: Examining Microsoft's new "Recall" feature that raises significant privacy concerns. 984. CrowdStruck: A look at the disastrous global IT outage caused by a faulty CrowdStrike Falcon update. 1000. Steve and Leo reflect on 1000 episodes of Security Now. 1001. Artificial General Intelligence: Steve and Leo discuss the challenges in achieving artificial general intelligence (AGI).
The consequences of Internet content restriction. The measured risks of 3rd-party browser extensions. The consequences of SonicWall's unpatched 9.8 firewall severity. The incredible number of still-unencrypted email servers. SonicWall vulnerability patching Shadowserver Foundation & eMail Encryption Salt Typhoon Evicted HIPAA gets a long-needed cybersecurity upgrade. The EU standardizes on USB-C for power charging. What? Believe it or not, a CATCHA you solve by playing DOOM. And... what I learned from three weeks of study of AI
Meta winds down 3rd-party content filtering. Is encryption soon to follow? Taking over abandoned Command & Control server domains (strictly for research purposes only). IoT devices to get the "Cyber Trust Mark" — Will anyone notice or care? "SyncThing" receives a (blessedly infrequent) update. Government email is not using encryption? Really? Email relaying prevents point-to-point end-to-end encryption and authentication. Just because Let's Encrypt doesn't support email doesn't mean it's impossible. What Sci-Fi does ChatGPT think I (Steve) should start reading next? To auto-update or not to auto-update? — is that one question or two? And, until today, we've never taken a deep dive into the technology of time-varying 6-digit one time tokens.
What do we learn from January's record breaking 0-day critical Patch Tuesday? Microsoft to "force-install" a new Outlook into all Windows 10 and 11 desktops? GoDaddy required to get much more serious about its hosting security. More age verification enforcement is coming, including globally. What another instance of a widely exposed management interface teaches us. DJI drone's official firmware update lifts geofencing for unrestricted flight. CISA's efforts pay off with MUCH improved critical infrastructure security. Listener feedback about TOTP, HOTP and age-verification. And we take a deep dive into cracking authenticator keys.
eM Client CAN be purchased outright. An astonishing 5-year-old typo in MasterCard's DNS. An unwelcome surprise received by 18,459 low-level hackers. DDoS attacks continue growing, seemingly without any end in sight. Let's Encrypt clarifies their plans for 6-day "we barely knew you" certificates. SpinRite uncovers a bad brand new 8TB drive. Listener feedback about TOTP, Syncthing and UDP hole punching, email spam, ValiDrive speed, AI neural nets, DJI geofencing, and advertising in the "New" Outlook. A look into the tradeoffs required to obtain privacy for our DNS lookups
Why was DeepSeek banned by Italian authorities? What internal proprietary DeepSeek data was found online? What is "DeepSeek" anyway? Did Microsoft just make OpenAI's strong model available for free? Google explains how generative AI can be and is being misused. An actively exploited and unpatched Zyxel router vulnerability. The new US "ROUTERS" Act. Is pirate-site blocking legislation justified or is it censorship? Russia's blocked website count tops 400,000. Microsoft adds "scareware" warnings to Edge. Bitwarden improves account security. What's still my favorite disk imaging tool? A close look into the extraction of proscribed knowledge from today's AI systems.
New "SparkCat" secret-stealing AI image scanner discovered in App and Play stores. The UK demands that Apple does the impossible: decrypting ADP cloud data. France moves forward on legislation to require backdoors to encryption. Firefox moves to 135 with a bunch of useful new features. The Five Eyes alliance publishes edge-device security guidance. Six NetGear routers contain CVSS 9.6 and 9.8 vulnerabilities. Sysinternals utilities allow malicious Windows DLL injection. Google removes restrictive do-gooder language from AI application policies. "AI Fuzzing" successfully jailbreaks the most powerful ChatGPT o3 model. Examining the well and deliberately hidden truth behind ransomware cyberattacks on U.S. K-12 schools
US lawmakers respond to the UK's outrageous demand about Apple's encryption. What, exactly, is a "backdoor", and can a "backdoor" NOT be secret? Highlights from last week's Windows' Patch Tuesday. A look into RansomHub: The latest king of the Ransomware hill. "TOAD": Telephone-Oriented Attack Delivery. The state of Texas -versus- DeepSeek. Disabling Apple's "Restricted Mode". Where did I put that $800 million in Bitcoin? A Sci-Fi author update. And a deep dive into the misoperation of Chrome's critically important Web Extension Store
● Apple disables Advanced Data Protection for new UK users. ● Paying ransoms is not as cut and dried as we might imagine. ● Elon Musk's "X" social media blocks "Signal.me" links. ● Spain's soccer league blocks Cloudflare and causes a mess. ● Two new (and rare) vulnerabilities discovered in OpenSSH. ● The U.S. seems unable to evict Chinese attackers from its Telecom systems. ● What are those Chinese "Salt Typhoon" hackers doing to get in? ● The largest (by far) cryptocurrency heist in history occurred Friday. ● Ex-NSA head says the U.S. is falling behind on the cyber front lines. ● We have the winner (and a good one) replacement term for "backdoor". ● A look at a pathetic access control system that begs to be hacked (and will be).
Firefox amends their privacy policy -- the world melts down. Signal threatens to leave Sweden. Aftermath of the massive $1.5 billion Bybit ETH heist. It turns out that it wasn't actually Bybit's fault. "The Lazarus Bounty" monitoring and management site. Mozilla's commitment to Manifest V2 (and the uBlock Origin). What does the ACM's plea for memory-safe languages mean for developers? What exactly are memory-safe languages? Australia joins the Kaspersky ban. Gmail plans to switch from SMS to QR code authentication. A SpinRite success and some fun feedback. An astonishing new technology for targeted radio jamming
• Utah passes age verification requirement for app stores. • The inside story on fake North Korean employees. Is that a Texas accent? • An update on the ongoing Bybit cryptoheist saga. The industry may be making some changes in the wake of the Bybit attack. • Apple pushes back legally against the UK's secret order. • Did someone crack Passkeys? • The UK launches a legal salvo at an innocent security researcher. • The old data breach we witnessed that just keeps on giving. • A bit more Bybit post-mortem forensic news. • A lesson to learn from a clever and effective ransomware attack. • And what about that Bluetooth Backdoor discovery everyone is talking about?
• An analysis of Telegram Messenger's crypto. • A beautiful statement of the goal of modern crypto design. • Who was behind Twitter's recent outage trouble? • An embedded Firefox root certificate expired. Who was surprised? • AI-generated Github repos, voice cloning, Patch Tuesday and an Apple 0-day. • The FBI warns of another novel attack vector that's seeing a lot of action. • Google weighs in on the Age Verification controversy. • In a vacuum, Kazakhstan comes up with their own solution. • Was Google also served an order from the UK? Can they say? • A serious PHP vulnerability you need to know you don't have. • A bunch of great listener feedback, some Sci-Fi content reviews and... • A new tool allows YOU to test YOUR PCs for their RowHammer susceptibility
• The dangers of doing things you don't understand. • Espressif responds to the claims of an ESP32 backdoor. • A widely leveraged mistake Microsoft stubbornly refuses to correct. • A disturbingly simple remote takeover of Apache Tomcat servers. • A 10/10 vulnerability affecting some ASUS, ASRock and HPE motherboards. • Google snapped up another cloud security firm but paid a price! • RCS messaging to soon get full end-to-end encryption (done right!). • How did an AI Crypto Chatbot lose $105,000? ...and what is an AI Crypto Chatbot? • Looks like Oracle may take stewardship of TikTok to keep it in-country. • Whoops! 23andMe is sinking — don't let them take your genetics with them! • The White House says "the cyber guys should stay!" • AI project failure rates are on the rise. Anyone surprised? • Listener feedback, and a very interesting update on just how looming is the threat from quantum computing?
● Kuala Lumpur International Airport says no to a ransom attack, switches to whiteboard. ● A tired and jet-lagged Troy Hunt got Phished then listed himself on his own site. ● Cloudflare completely pulls the plug on port 80 (HTTP) API access. ● Malware is switching to obscure languages to avoid detection. FORTH, anyone? ● Password reuse doesn't appear to be dropping. Cloudflare has numbers. ● A listener shares his log of malicious Microsoft login attempts. Why no geofencing? ● 23andMe down for the count (reminder). ● A sobering Ransomware attack & victim listing website. Gulp! ● "InControl" keeps VR planes aloft. ● And the European Union gets serious about a switch to Linux.
• Canon printer driver vulnerabilities enable Windows kernel exploitation. • Astonishing cyber-security awareness from a household appliance manufacturer. • France tries to hook 2.5 million school children with a Phishing test. • Wordpress added an abuse prone feature in 2022. Guess what happened? • Oracle? Is there something you'd like to tell us? • Utah's governor just signed the App Store Accountability Act. Now what? • AI bots hungry for new data are DDoSing FOSS projects. • No Microsoft Account? No Microsoft Windows 11. • Gmail claims it now offers E2EE. It kinda sorta does. Somewhat. • A dreaded CVSS 10.0 was discovered in Apache Parquet. • A bunch of terrific listener feedback. • What's Multi-Perspective Issuance Corroboration and why must all certificate authorities now do it?
• Android to get "Lockdown Mode". • What's in the new editions of Chrome and Firefox? • Why did Apple silently re-enable automatic updates? • My new iPhone 16, Chinese tariffs and electronics. • Dynamic "hotpatching" coming to Win11 Enterprise & Edu. • Why is it so difficult for Oracle to fess up? • Another multi-year breach inside US Treasury. • An Apple -vs- the UK update. • "Thundermail" (Can't someone come up with a better name?) • The (in)Security of Programmable Logic Controllers. • When LLM's write code and hallucinate non-existent packages. • Wordpress core security and PHP gets an important audit. • Device-Bound Session Credentials update session cookie technology
• Enabling Firefox's Tab Grouping. • Recalled Recall Re-Rolls out. • The crucial CVE program nearly died. It's been given new life. • China confesses to hacking the US (blames our stance on Taiwan). • CISA says what Oracle still refuses to. • Brute force attacks on the (rapid) rise. • An AI/ML Python package rates a 9.8 (again!) • The CA/Browser forum passed short-life certs. :( • A wonderful crosswalk hack hits Silicon Valley. • Android to add force restarting ahead of schedule. Maybe. • The EFF is never happy. But especially now, about Florida. • Interesting research into ransomware payouts. • Windows Sandbox: The amazing gem hidden inside all Windows 10 & 11!
• Why did a mysterious empty “inetpub” directory appear after April's Patch Tuesday? • And what new Windows Update crashing hack did this also create? • North Korea is now creating fake US companies to lure would-be employees. • The “Inception” attack subverts all GPT conversational AIs. • New information about data loss in unpowered SSD mass storage. • Lots of terrific feedback from our listeners. • How malware has taken to hiding inside the Windows Sandbox and what you can do to stop it.
• Microsoft to officially abandon passwords and support their deletion. • Meta's RayBan smart-glasses weaken their privacy terms. • 30% of Microsoft code is now being written by AI. • Google says prying Chrome from it will damage its security. • Nearly 1,000 six-year old eCommerce backdoors spring to life. • eM Client moves to version 10.3 • A bunch of terrific listener feedback creates talking points. • A little known insecure message archiving service comes to light.
• The state of Virginia passes an age-restriction law that has no chance. • New Zealand also tries something similar, citing Australia's lead. • A nasty Python package for Discord survived 3 years and 11K downloads. • The FBI says it's a good idea to discard end-of-life consumer routers. • What's in WhatsApp? Finding out was neither easy nor certain. • The UK's Cyber Centre says AI promises to make things much worse. • A bunch of great feedback from our great listeners, then: • Is true end-to-end encryption possible when records must be retained?
• Chrome to actively refuse admin privileges. • Android Messenger is getting manual key verification. • Pwn2Own to add AI "pwning" as in-scope attack targets. • AI has already been found to be replicating. • Microsoft not killing off Office on Win10 after October. • 23andMe's asset purchaser revealed. • Many fun talking points thanks to our listeners. • Steve's review of "Andor", season 2. • What's been discovered inside the U.S. power grid.
• What the status of Encrypted Client Hello (ECH)? • What radio technology would be best for remote inverter shutdown? • Some DNS providers already block newly listed domains. • Knowing when not to click a link can take true understanding. • Why can losing a small portion of a power grid bring the rest down? • Where are we in the "AI Hype Cycle" and is this the first? • Speaking of hype: An AI system resorted to blackmail? • Why are we so quick to imbue AI with awareness? • ChatGPT's latest o3 model ignored the order to shutdown. • Copilot may not be making Windows core code any better. • Venice.AI is an unfiltered and unrestrained LLM.
• Pwn2Own 2025, Berlin results. • PayPal seeks a "newly registered domains" patent. • An expert iOS jailbreak developer gives up. • The rising abuse of SVG images, via JavaScript. • Interesting feedback from our listeners. • Four classic science fiction movies not to miss. • How OpenAI's o3 model discovered a 0-day in the Linux kernel.
• In memoriam: Bill Atkinson • Meta native apps & JavaScript collude for a localhost local mess. • The EU rolls out its own DNS4EU filtered DNS service. • Ukraine DDoS's Russia's Railway DNS... and... so what? • The Linux Foundation creates an alternative Wordpress package manager. • Court tells OpenAI it must NOT delete ANYONE's chats. Period! :( • A CVSS 10.0 in Erlang/OTP's SSH library. • Can Russia intercept Telegram? Perhaps. • Spain's ISPs mistakenly block Google sites. • Reddit sues Anthropic. • Twitter's new encrypted DM's are as lame as the old ones. • The Login.gov site may not have any backups. • Apple explores the question of recent Large Reasoning Models "thinking".
• An exploited iOS iMessage vulnerability Apple denies? • The NPM repository is under siege with no end in sight. • Were Comcast and Digital Realty compromised? Don't ask them. • Matthew Green agrees: XChat does not offer true security. • We may know how Russia is convicting Telegram users. • Microsoft finally decides to block two insane Outlook file types. • 40,000 openly available video camera are online. Who owns them? • Running SpinRite on encrypted drives. • An LLM describes Steve's (my) evolution on Microsoft security. • What do we know about the bots that are scanning the Internet?
• China's Salt Typhoon claims another victim (or two). • State healthcare portals are tracking and leaking. No kidding. • Apple adopts FIDO's Passkeys and other credentials transport. • Facebook gets Passkey logon. • TikTok continues ticking for at least another 90 days. • Canadian telco admits they were infiltrated by Salt Typhoon. • Microsoft to remove unwanted (and hopefully unneeded) hardware drivers. • The Austrian government legislates court-warranted message decryption. • I (Steve) finally get full clarity on what today's "AI" means. • A deep dive into the Salt Typhoon's operation and how they got in.
• Let's Encrypt drops its long-running email notifications. • Microsoft's new "Unexpected Restart Experience". • Microsoft's response to last year's massive CrowdStrike outage. • Windows 10's extended service updates will sort of be free. • Russia-sold iPhones MUST include the RuStore app. • Lyon, in France, says bye-bye to Windows. Hello to Linux. • The US Gov gets more serious about memory-safe languages. • A new unbelievable AI malware scanner evaSion technique. • A new pair of Cisco 9.8 and 10.0 vulnerabilities. • The current state of post-Elon government cybersecurity. • PNGv3, Swift on Android, and the Samsung email purge. • Andy Weir's "Hail Mary" movie trailer. • And a close look at the pervasiveness of web browser tracking fingerprinting.
• Another Israeli spyware vendor surfaces. • Win11 to delete restore points more quickly. • The EU accelerates its plans to abandon Microsoft Azure. • The EU sets timelines for Post-Quantum crypto adoption. • Russia to create a massive IMEI database. • Canada and the UK create the "Common Good Cyber Fund". • U.S. states crack down on Bitcoin ATMs amid growing scams. • Congressional staffers cannot use WhatsApp on gov devices. • LibXML2 and the problems with commercial use of OSS. • A(nother) remote code execution vulnerability in WinRAR. • HaveI BeenPwned gets a cool data visualization site. • How is ransomware getting in? • Windows to offer "safe" non-kernel endpoint security? • Proactive age verification coming to porn sites. How? • Canada (also) says "bye bye" to Hikvision. • Germany will be banning DeepSeek. The whole EU may follow. • Cloudflare throttled in Russia? • What must the U.S. do to compete in global exploit acquisition?
• A glorious takedown of quantum factorization • Notepad++ signs its own code signing certificate • Dennis Taylor has Bobiverse Book 6 on his lap • Crypto/ATM machines flat out outlawed • Signal vs WhatsApp: Encryption in flight and at rest • A close look at browser fingerprinting metrics • Rewriting interpreters in memory-safe languages • An introduction to zero-knowledge proofs.
• Bypassing all passkey protections • The ransomware attacks just keep on coming • Cloudflare capitulates to the MPA and starts blocking • The need for online age verification is exploding • Microsoft really wants Exchange Servers to subscribe • Russia (further) clamps down on Internet usage • The global trend toward more Internet restrictions • China can inspect locked Android phones. Use a burner • Web shells are the new buffer overflow • An age verification protocol sketch • What Cloudflare did to create an outage of 1.1.1.1
• Brave randomizes its fingerprints • The next Brave will block Microsoft Recall by default • Clorox sues its IT provider for $380 million in damages • 6-month Win10 ESU offers are beginning to appear • Warfare has significantly become cyber • Allianz Life loses control of 125 million customers' data • The CIA's Acquisition Research Center website was hacked • The Pentagon says the SharePoint RCE didn't get them • A look at a DPRK "laptop farm" to impersonate Americans • FIDO's passkey was NOT bypassed by a MITM after all • Is our data safe anywhere • The UK is trying to back-pedal out of the Apple ADP mess • Meanwhile, the EU resumes its push for "Chat Control" • What happened after Microsoft fumbled the patch of a powerful Pwn2Own exploit?
• A follow-up to the SharePoint server patch mess • How Russia arranges to spy on other country's local embassies • "Dropbox Passwords" manager app is ending in October • Signal will leave Australia rather than help spy • YouTube deploys viewing history age-estimation heuristics • Chrome adds clever lightweight extension signing to prevent abuse • A domain registrar is coming close to losing its rights • A TP-Link router that doesn't encrypt its configuration • What is "TruAge" and might it be useful for age verification • An update on "Artemis" • With U.S.-China tensions on the rise, should Chinese security companies receive weeks of advance notice of forthcoming Microsoft flaw patches?
• CISA's Emergency Directive to ALL Federal agencies re: SharePoint. • NVIDIA firmly says "no" to any embedded chip gimmicks. • Dashlane is terminating its (totally unusable) free tier. • Malicious repository libraries are becoming even more hostile. • The best web filter (uBlock Origin) comes to Safari. • The very popular SonicWall firewall is being compromised. • More than 100 models of Dell Latitude and Precision laptops are in danger. • The significant challenge of patching SharePoint (for example). • A quick look at my DNS Benchmark progress. • Does InControl prevent an important update? • A venerable Sci-Fi franchise may be getting a great new series! • What to do about the problem of AI "website sucking"?
• What AI website summaries mean for Internet economics • Time to urgently update Plex Servers (again) • Allianz Life stolen data gets leaked. • Chrome test Incognito-mode fingerprint script blocking. • Chrome 140 additions coming in 2 weeks. • Data brokers hide opt-out pages from search engines. • Secure messaging changes in Russia. • NIST rolls-out lightweight IoT crypto. • Syncthing moves to v2.0 and beyond. • Alien:Earth -- first take. • What can we learn from another critical vulnerability?
• Germany may soon outlaw ad blockers • What's happening in the courts over AI • The U.K. drops its demands of Apple • New Microsoft 365 tenants being throttled • Is Russia preparing to block Google Meet? • Bluesky suspends its service in Mississippi • How to throttle AI • A tricky SSH-busting Go library • Here comes the Linux desktop malware • Apple just patched a doozy of a vulnerability • A trivial Docker escape was found and fixed • Why the recent browser 0-day clickjacking is really just whac-a-mole
• A look back at issue #1 of BYTE magazine exactly 50 years ago. • The enforcement of the SHAKEN & STIR Telecom protocols. • The inherent danger of consolidating authentication. • Can AI be controlled? • Vivaldi says a big “no” to AI-enhanced web browsers. • How WhatApp figured into Apple's recent 0-day attacks. • Leveraging AI as an attack aid. • The latest TransUnion data breach. • Two scummy websites sue the UK over age requirements. • OpenSSH reminds its users to adopt post-quantum crypto. • The DOD uses open source maintained by a Russian national. • Much great feedback from our terrific listeners. • Sci-Fi news from “The Frontiers Saga” Ryk Brown.
• My experience with 'X' vs email. • Google TIG blackmailed to fire two security researchers. • 1.1.1.1 DNS TLS certificate mis-issued. • Artists blackmailed with threats of training AI on their art. • Firefox extended end-of-life for Windows 7 to next March. • Is the renewal of cybersecurity info-sharing coming soon? • Should security analysis be censored due to vibe-coding? • UK versus Apple may not be settled after all. • Another very serious supply chain attack. • Can the software supply-chain ever be trustworthy? • Why did BYTE Magazine die? • What happens if Google and others go on the attack?
• Are Bitcoin ATMs anything more than scamming terminals? • Ransomware hits the Uvalde school district and Jaguar. • Did “Scattered LapSus Hunters” just throw in the towel? • Germany, for one, to vote "no" on Chat Control. • Russia's new MAX messenger has startup troubles. • Samsung follows Apple's WhatsApp patch chain. • Shocker! UK school hacks are mostly by students! • HackerOne was hacked. • Connected washing machines in Amsterdam hacked. • DDoS breaks another record. • Bluesky to implement conditional age verification. • Enforcement actions for Global Privacy Control. • Might Apple have finally beaten vulnerabilities?
• Consumer Reports on Windows 10 updates. • Waste (not fraud or abuse) within DoD Cyberoperations. • China's DeepSeek produces deliberately flawed code. • WebAssembly v3.0 officially released. • Firefox v143 updates and new features. • Firefox for Android now offers DoH. • A nearly terminal flaw in Microsoft's Entra ID. • Chrome hits its 6th 0-day this year. Emergency update. • DRAM (now DDR5) still vulnerable to RowHammer. • SAMSUNG kitchen refrigerators begin showing ads. • China says no to NVIDIA. • 300 more (new) NPM malicious packages found and removed. • The EU is already testing proper online age verification.
• Gmail's spam filtering false-positive spree. • iOS 26's Safari randomizes its fingerprint by default. • Cisco's SNMP stands for "Security Not My Problem". • Windows' "stuck" Extended Security Updates (ESU). • Europe complains, gets 1-year of ESU with no strings. • Where to get $6 TLS certs (really) while they last. • The lessons to learn from Jaguar Land Rover's mess. • The NEON app: get paid to have your voice recorded. • Bluesky's age verification, now coming to Ohio. • What is "Kids Web Services" for age verification. • More than 10K Ollama instances publicly exposed. • GRC's DNS Benchmark reaches "release candidate".
• Qantas says no one can releak their stolen data. • Brave's usage is up. But is it really 3 times faster. • Next Tuesday the EU votes on "Chat Control". • Microsoft formally launches a "Security Store". • Outlook moves to block JavaScript in SVG's. • A new release of Chrome. • Gmail will no longer pull external email via POP. • Googe Drive starts blocking ransomware encryptions. • The UK issues another order to Apple. • Researchers create a "Battering RAM" attack device. • HackerOne's significant bug bounty payouts. • The Imgur service goes dark across the UK. • The Netherlands plans to say NO to "Chat Control." • Discord was breached and government IDs leaked. • Salesforce says it's not another new breach. • Signal introduces a new post-quantum ratchet. • Your motherboard MIGHT support TPM 2.0. • Google to force Android app devs to register and pay.
• The EU aborted their Chat Control vote knowing it would fail. • Salesforce says it's not going to pay; customer data is released. • Hackers claim Discord breach netted 70,000 government IDs. • Microsoft to move Github to Azure. What could possibly go wrong. • New California law allows universal data sharing opt-out. • OpenAI reports that it's blocking foreign abuse. Who cares. • IE Mode refuses to die, so Microsoft is burying it deeper. • The massive mess created by Texas legislation SB2420. • The BreachForums website gets a makeover. • 100,000 strong global botnet attacking U.S. RDP services. • UI experts weigh in on Apple's iOS 26 user-interface. • 330,000 publicly exposed REDIS servers are RCE-vulnerable.
• The long awaited lawsuit to block Texas SB2420. • Embattled Texas SB2420 also impacts Google Play. • At long last, NIST modernizes their password policy. • Scattered LAPSUS$ Hunters demise was exaggerated. • China claims that the NSA has been hacking them. • Half of all geosynchronous satellite traffic is unencrypted. • The AWS outage highlights the rising risk of Internet monoculture. • A terrific collection of listener feedback and... • Could your PC's mouse have much bigger ears than you know?
• The unsuspected sucking power of a Linux-based robot vacuum. • Russia to follow China's vulnerability reporting laws. • A pair of Scattered Spider UK teen hackers arrested. • Facebook, Instagram and TikTok violating the EU's DSA. • Microsoft Teams bringing user WiFi tracking by policy. • You backed up. That's great. Did you test that backup? • Coveware reports all-time low ransomware payment rate. • Ransomware negotiator reports how the bad guys get in. • Lots of listener thoughts and feedback about NIST passwords. • And against all reason and begging credulity, it seems we still haven’t managed to put high-quality random number generators into our DNS resolvers.
• Secret radios discovered in Chinese-made buses. • Edge & Chrome introduce LLM-based "scareware" blocking. • A perfect example of what scareware blocking hopes to prevent. • Aardvark: OpenAI's new vulnerability scanner for code. • Italy to require age verification from 48 specific sites. • Russia to require the use of only Russian software within Russia. • Russia further clamping down on non-MAX Telegram and WhatsApp messaging. • 187 new malicious NPM packages. Could AI help with that? • BadCandy malware has infiltrated Australian Cisco routers. • Github's 2025 report with the dominance of TypeScript. • Windows 11 gets new extra-secure Admin Protection feature. • A bunch of interesting feedback and listener thoughts. • And why the new AI-driven web browsers may be bringing a whole new world of hurt.
• FFmpeg teaching assembly language for performance. • The state of Nevada recovers after not paying ransom. • A "rounding error" nets a clever attacker $128 million. • Why would Chrome decide to start form-filling driver's licenses? • The UK's six major telecom providers to block number spoofing. • XSLT support being removed from browsers. Will anyone notice? • Firefox introduced paid support options for organizations. • Russia continues to fight against non-Russian Internet. • Google acquires another Internet security company (Wiz). • The EU to finally fix their cookie permission mistake. • More countries drop Microsoft office for open choices. • More countries question and examine Chinese made buses. • Microsoft discovers some information leakage from LLMs. • What does Amazon's lawsuit against Perplexity's agents mean for next-generation browsers?
• Apple introduces a new Digital ID inside Wallet. • Checkout.com refuses to pay a ransom demand. • Google announces "Private AI Compute" in the cloud. • Google backpedals on their "devs must register" demand. • Win11 added a Passkeys API which 1Password & Bitwarden support. • Russia tracks SIM card appearances to thwart drone usage. • Google sues Chinese Phishing as a Service platform. • Lots of interesting listener feedback. • Global cellphone tracking is alive, well, malware free and a distressingly common commercial enterprise.
• The EU finally comes to its "Chat Control" senses. • Windows 11 to include SysInternals Sysmon natively. • Chrome's tabs (optionally) go vertical. • The Pentagon begins its investment in warfare AI. • Members of the military are being doxed by social media. • A look inside the futility of trying to corral AI. • The surprising lack of WhatsApp user privacy. • Exactly what happened last week to Cloudflare? • Britain (over)reacts to the Jaguar Land Rover incident. • Project: Hail Mary's second trailer released. • US state legislatures want to ban VPNs altogether.
• Scattered Lapsus$ Hunters strikes (Salesforce) again. • Cisco actually (no kidding) sees the light. • Next week, Australia bans all underage social media. • The EU Parliament moves to replace US computer tech. • When to use Passwords, Passkeys or Yubikeys. • Do unpowered SSDs lose their data. • How about a "Joy of Coding" podcast. • A Bitwarden Passkeys integration glitch. • XSLT is sneaky. It's where you don't expect it. • We know where last week's picture came from. • The long-awaited return of a new Stargate series. • A simple test to check our networks for any bot infections.
• France's VanityFair face a stiff fine over cookies. • GrapheneOS pulls out of France over coercion worries. • The EU adds to the pile-on over underage social media. • India mandates the tracking of all smartphones. • Apple says no. • India abandons its smartphone tracking mandate. • India requires all encrypted messaging to be SIM-tied. • Scattered Lapsus$ Hunters becomes “SLH”. • AI demand has driven RAM pricing sky high. • GRC's DNS Benchmark is finished and available. • Cisco may talk a good game, but they're still Cisco. • Browsers to ask users for local network access permission. • REACT: The worst remote code exploit in a LONG time.
• Home Depot's puzzling reluctance to close a bad hole. • GNOME's shell extension manager is unhappy with AI. • How attacks on open source repositories compares in 2025. • China's researchers have taken aim at the US power grid. • How bad has the React2Shell vulnerability turned out to be. • More new React vulnerabilities. • Apple moves to iOS 26.2. • Let's Encrypt's crosses into one billion servers managed. • A DNS Benchmark update. • Some interesting listener feedback, then... • How things going with Australia's social media ban and what we are learning.
• North Korea's profitable fixation on cryptocurrency. • Amazon uncovers a cryptomining sneaking into customer clouds. • Insecure Docker API servers are also hosting cryptominers. • A new and truly massive SmartTV-based botnet discovery. • DNS Benchmark's 4th release. • Who, besides Let's Encrypt, offers free automated certs. • Some interesting listener feedback. • And how a PNG Icon was used to infect 50,000 Firefox users.
In this special holiday episode, Steve Gibson and Leo Laporte revisit their classic conversation about vitamin D—diving into the science, surprising updates, and practical tips for your health. Whether you’ve heard it before or are tuning in for the first time, this "blast from the past" is the perfect way to kick off 2026 with wisdom, laughs, and a little bit of eggnog recovery.
• Code-signing certificate lifetimes shortened by two years. • Sadly, ChatGPT is heading toward an advertising profit model. • The Python Package Index is strengthening its security. • BitLocker gets hardware acceleration, but not today. • New York City's mayoral inauguration banned Raspberry Pi's. • An astonishingly good British time travel series. • A critical link between Vitamin D and Magnesium. • A look inside the very bad MongoBleed vulnerability.
• A look at Microsoft's Azure cloud code signing. • California implements DROP, global data broker opt-out. • Where's the town of "Whata Bod" Idaho. • iOS built-in Mail app worked itself out of a job. • A 30-minute tutorial for non-coders about AI coding. • Claude Code appears to be winning over the AI coding world. • Various listener musings on code signing. • A bit of Magnesium feedback. • What use are 3-day code signing certs?
• RAM pricing to affect enterprise firewall equipment. • Anthropic provides sizeable support to Python Foundation. • The FTC clamps down on GM's secret sale of driving data. • “ANCHOR” replaces “CIPAC” for industry-government sharing. • Germany planning to legislate total access to global data. • Grubhub becomes the latest ShinyHunters extortion victim. • Let's Encrypt's 6-Day certs are available to everyone. • Iran plans to permanently take itself off the Internet. • HD Tune before and after a SpinRite Level 3 refresh. • Some great listener feedback, and • More trouble from GhostPoster malicious browser extensions.
• CISA's uncertain future remains quite worrisome. • Worrisome is Ireland's new "lawful" interception law. • The EU's Digital Rights organization pushes back. • Microsoft acknowledges it turns over user encryption keys. • Alex Neihaus on AI enterprise usage dangers. • Gavin confesses he put a database on the Internet. • Worries about a massive podcast rewinding backlog. • What does the emergence of AI-generated malware portend?
• An anti-virus system infects its own users. • Apple's next iOS release "fuzzes" cellular locations. • cURL discontinues bug bounties under bogus AI flood. • AI discovers and fixes 15 CVE-worthy 0-days in OpenSSL. • Ireland did NOT already pass their spying legislation. • AI irreversibly deletes all project files. Says it's sorry. • Windows has a serious global clipboard security problem. • ISPs have the ability to monetize their subscriber's identities. • MongoDB has lowered the hacking skill level bar to the floor.
• How is the EU's GDPR fine collection going. • Western democracies are getting serious about offensive cybercrime. • The powerful cyber component of the Midnight Hammer operation. • Signs of psychological dependence upon OpenAI's GPT-4o chatbot. • CISA orders government agencies to unplug end-of-support devices. • How to keep Windows from annoying us after an upgrade. • What is OpenClaw, how safe is it to use, what does it mean. • Another listener uses AI to completely code an app. • Coinbase suffers another insider breach. What can be done.
• Websites can place high demands upon limited CPU resources. • Microsoft appears to back away from its security commitment. • What's Windows 11 26H1 and where do I get it? • Chrome 145 brings Device Bound Session Credentials. • More countries are moving to ban underage social media use. • The return of Roskomnadzor. • Discord to require proof of adulthood for adult content. • Might you still be using WinRAR 7.12 — I was! • Paragon's Graphite can definitely spy on all instant messaging. • 30 malicious Chrome Extensions. • 287 Chrome extensions from spying on 37.4 million users. • The first malicious Outlook add-in steals 4000 user's credentials. • Some AI “vibe” coding thoughts. • What I just went through to obtain a new code signing certificate.
• CA's warn us to urgently prepare for the inevitable. • Three U.S. states attempt to ban 3D printed firearms. • Denied ransom, ShinyHunters leaks 967,000 personal details. • “Billions” of U.S. social security numbers leaked. • Is Apple planning to add cameras to three new gadgets? • No more security fixes for Firefox on Windows 7 & 8. • Russia blocks the official Linux kernel site they need. • Will the U.S.“freedom.gov” site post EU blocked content? • LLM's will offer secure passwords. DO NOT USE THEM! • As predicted, the “ClickFix” attack strategy takes over. • A listener believes his computer is compromised. • How could three popular password managers get things wrong?
• The lowdown on last week's "no turn" picture of the week. • Is an AI-driven hacking campaign a big deal now. • Clause used in multiple Mexican government attacks. • Apple continues to be confronted with age restrictions. • COPPA needs an exception to allow age collection. • Meta swamps law enforcement with AI-slop CSAM reports. • Roskomnadzor has been busy blocking VPNs. Guess how many? • The UK tries to report their self-scanning success. • Remember that hacker who extorted the psychotherapy patients? • Scattered Lapsus$ Hunters is actively recruiting women. • Cisco lands another breathtakingly rare 10.0 CVSS. • VulnCheck's report on 2025 vulnerabilities and exploits. • Steve discovers a fabulous $72 Hardware Security Module. • A listener shares an interesting AI service discovery. • The very potent "ClickFix" exploit evolves.
Live From Zero Trust World 2026 Steve Gibson and Leo Laporte host a special episode of Security Now live from ThreatLocker's Zero Trust World 2026 in Orlando, Florida. The final frontier of security is internal. Today, we have the tools, techniques and technologies to thwart attacks originating from outside our perimeter. We’re now good at protecting our borders. But major high profile breaches occurring over the past several years have revealed that insufficient attention has been given to the security of our internal systems and networks. Today’s greatest security weaknesses result from decades of system design, deployment and policy that have placed far too much trust on the conduct of those on the inside, behind our borders. Whether deliberate, inadvertent, or externally penetrating, the greatest challenge we now face is that of designing and deploying our internal security with strict adherence to the principles of least privilege and zero trust.
• Anthropic & Mozilla improve Firefox's security. • Apple & Google begin testing cross-platform RCS encryption. • Ubuntu's SUDO starts echoing asterisks. • Inviting a web proxy into your home. • Apple devices cleared by Germany for NATO's use. • A serious remote takeover of OpenClaw. • TokTok won't encrypt messaging for visibility. • Microsoft bans the term "Microslop" on Discord. • Lot's of great listener feedback. • LLMs could make Orwell's 1984 seem optimistic.
• The Security Now “Caption That Photo” contest. • A mega social media company says “no” to strong encryption. • WhatsApp to give parents more control. • Consumer bandwidth proxying is becoming a big deal. • Meta buys the Moltbook duo. • The EU gives up and settles upon the status quo. • When a ransomware negotiation is not what it seems. • CISA compels federal agencies to submit their logs. • Is that a VPN in your pocket or something more malicious. • Be careful what you download thinking it's AI. • A super-clever and super-simple A/V scanner bypass. • Will AI write code for me? • Another listener discovers the Joy of AI. • Steve's CISA Internet scanning experience.
• H&R Block's tax software does something SO WRONG. • The Intoxalock breathalyzer calibration cyber attack. • Firefox now offers a 100% free built-in VPN. • TikTok and Meta's tracking pixels are so much more. • Russians beg for the return of Telegram, WhatsApps and others. • Never connect your crypto-wallet to an unknown service. • What would a week be without a Cisco CVSS of 10.0. • Ubiquiti patches a 10.0 critical flaw. • Listener feedback and… • What's "Bucketsquatting" and what can be done to prevent it.
• Will California require Linux to verify its user's age. • Apple's iOS 26.4 requires UK users to prove their age. • Russia chooses to use home grown 5G mobile encryption. • Ukraine knew the webcam was installed by Russian spies. • Google moves quantum computing "Q Day" to 2029. • At RSA, UK's NCSC CEO warns of vibe-coded SaaS replacements. • More information about nasty ClickFix campaigns. • More than one in seven Reddit postings are an AI-bot. • The story behind the LiteLLM disaster that was averted.
• Apple's 26.4 age queries catches many by surprise. • LinkedIn's 2.7 MB of privacy-invading javascript. • Microsoft starts forcing Win11 24H2 to 25H2. • Cisco loses source code to the Trivy supply-chain mess. • Proton introduces privacy-first voice and video “Meet.” • GitHub to fix lagging security of its Actions feature. • Cloudflare reaffirms the privacy of its 1.1.1.1 DNS. • Cloudflare uses AI to re-code better secure Wordpress. • The FCC drops a ban on all new consumer-grade routers.
● A San Francisco AI developer conference in two weeks. ● Thank goodness Anthropic was the one who created Mythos rather than any of our cyber-adversaries.
• A disgruntled developer discloses multiple Windows 0-days. • Microsoft purchases its own bugs in massive campaign. • VeraCrypt & Wireshark suddenly lost their dev accounts. • A serious problem with re-captured domain names. • How might AI help to secure open source repositories. • A listener wonders what we thought of Project Hail Mary. • Cyber security professionals tell us What Mythos Means.
• Bitwarden’s CLI hit with a supply-chain attack. • Commercial routers in Iran fail shortly before the war. • Meta logging all employee activity to train replacement AI. • GRC's DNS Benchmark Release 5. • Two miscellaneous AI thoughts. • A bunch of terrific listener feedback. • Unravelling the diabolical history of "fast16.sys".
• Hackers AI-code a portal, forget to add authentication. • The UK's NCSC issues a Mythos warning. Where's CISA? • Another (of many) Linux local privilege escalations. • AI may be spelling the end of bug bounties. • Anthropic releases "Claude Security" mini-Mythos. • ChatGPT gets very serious about login security. • Syncthing's SyncTrayzor v1 abandoned; v2 created. • Google drops an AI API into Chrome; Mozilla objects.
• The FCC decides router firmware updates are useful. • Netgear applies for and gets a full FCC pass. • AI uncovers a 21-year old critical FreeBSD RCE. • What was behind that Let's Encrypt outage. • AI model repositories are overflowing with malware. • The CISA 2015 info-sharing act is being renewed. • Edge leaves ALL usernames and passwords in the clear. • An examination of DigiCert's breach and their response.
• Microsoft rethinks Edge's "intended behavior" after it gets press. • Chaotic Eclipse hacker strikes again with a Bitlocker bypass. • Google'threat analysis group documents malicious AI use. • Canada hasn't learned the lessons of the EU and the UK. • AI chatbots may be far more addictive than social media. • Project: Hail Mary now available to stream. • An apparently- serious zero-point quantum vacuum energy source. • A bit of listener feedback. • OpenAI's & Microsoft's vulnerability discovery systems.
• Cisco meets Mythos. • Can the aging CVE system survive AI. • Patch deployment latency in the AI age. • MSFT's official YellowKey Bitlocker bypass mitigation. • Ubiquity patches 5 serious vulnerabilities. • Drupal being attacked by PostgreSQL injection. • Microsoft terminates SMS as a second factor. • Github hacked - all of its source exfiltrated. • Russia using very old Western software. • Why to get a no-charge AI chatbot account. • New Sci-Fi on Netflix. • What we learn from Mozilla's use of Mythos.
• As expected, UnFiOS devices are under attack. • CISA commands federal agencies to update Drupal. • Can the largest botnet ever, be killed? • Defender endpoint can cutoff a PC from the network. • Charter Communications big account leak. • Chrome moves device-bound session cookies from beta. • Anthropic to release Mythos shortly. • cURL and Daniel Stenberg. • IBM and RedHat commit to fixing open source with AI. • LOTS of terrific listener feedback this week. • AI spells the end of a terrific source of training.
• Was a US law firm right to pay a $20 million ransom? • Could Cisco have yet another SD-WAN 0-day in the wild? • Why is it so difficult to author secure PHP code? • Teens use "WeedHack" to spy and attack each other. • Researchers create the first AI-enabled Internet worm. • Google Chrome pops-up "Shop with confidence." What?!? • The discovered and irresponsibly disclosed HTTP/2 Bomb. • What Anthropic learns from their past year of Claude abuse: It's bad.
• Rootkits found in more than 400 ArchLinux User Repository packages. • The US government requests Anthropic to remove Mythos and Fable. • CISA responds to AI-driven attacks with new patching requirements. • NPM to switch to more secure install defaults. Will it help? • Our listeners react to last week's PHP commentary. • June shows that AI has arrived for vulnerability discovery.
• Worries of AI-power cyberattacks are spreading. • Mythos "missed some" important vulnerabilities in Firefox. • Every recent patch Tuesday Nightmare Eclipse has struck. What now? • Massive store of valid FortiGate VPN credentials found. • F5 issues emergency updates to their NGINX-based server offerings. • Introducing "AI Potpourri" -- deeply altering an AI's personality. • A close look at the explosion in malicious proxy networks. • A Canadian judge okayed the illegal removal of such infections.
• Win10's popularity forces another year of free updates. • CISA directs all federal agencies to update their UniFi OS devices. • CISA gave federal agencies "the weekend" to update Cisco devices. • Australia is disturbed by a deeply compromised infrastructure provider. • OpenAI introduces Daybreak-powered "Patch the Planet" initiative. • Meta's employee monitoring-for-AI-training backfired badly. • Script Kiddies figure out how to use AI to find vulnerabilities. • AI improves with "looping", "repeating" or "iterating". • A wonderful story about Kevin Mitnick. • Serious hackers mistakenly left a server directory accessible.
Why Fable5's re-release has disappointed. • Opera becomes the first browser to offer “Paste Protect” • Microsoft BlueHammer exploit is “hammering” systems. • Industry legend (TCP creator) Vint Cerf on AI. • Chrome turns 150 with too many fixes to load. • Google fails to sidestep a $4.67 billion EU fine. • One last (we can hope) Chat Control vote next week. • AirDrop & Android Quick Share are exploitable. • How to bypass Claude's and ChatGPT's guardrails. • My own Sunday spin with SpinRite. • A legendary hacker uses AI on a widespread library.
• Europe warns their largest banks to prepare for AI attack. • The EU launches an action plan for AI Cybersecurity. • China considers keeping its budget AI to itself. • The UK's NCSC & GCHQ announce their "Cyber Shield". • CISA is using Mythos to audit U.S. government code. • Microsoft warns of their upcoming patch flood. • "RoguePlanet" receives an on-the-fly patch. • An underused mode to kid-proof an iPhone. • Listener feedback and three new AI attacks.
• The “bone crushing” didn't happen this month. • Revisiting and inspecting July's Patch Tuesday. • A widespread and worrisome flaw in OpenSSL. • Claude can now access your 1Password credentials. • Bitwarden is aware that we need whole new security. • The day ends in "y" so a new prompt injection attack. • A true (and rare) core Wordpress emergency update. • Lots of interesting listener feedback. • And new ways AI is being used by bad guys.
• OpenAI's unconstrained internal testing AI got loose, attacked Hugging Face. • We hear from OpenAI, Hugging Face and Andrew Ng. • GRC went off the air Friday. Was GRC hacked? What happened? • The Linux kernel project repairs 442 CVEs in a single batch. • LG's PC monitors cause PC adware installation. • France bans all social media access below age 15. • WordPress' recent CRITICAL vulnerability claims victims. • Amazing details about "Rocky" from Andy Weir. • The new AI exploit ranking benchmark that caused the breakout.
At Black Hat Las Vegas, the Security Now crew digs into how AI is not just finding hidden software bugs but also fueling both groundbreaking innovation and alarming new exploits. When open models can launch surprise Bitcoin heists, who draws the line between forbidden knowledge and genuine progress?
• Anthropic's agentic AI also broke free and hacked others. • We know much (much!) more about the OpenAI breakout. • OpenAI posts that they're pausing "Astra" - even internally. • What was that about AI recently cracking (or denting) cryptography. • Bruce Schneier brilliantly equates AI agents to capricious genies. • Apple doesn't react so well to the new deluge of security reports. • Chrome 149 + 150 updates together fix 1,072 bugs. Yikes. • psSense's creator is working to finish its nfSensei, its successor.
• Trusting an open source AI proxy might bite you. • France's under-15 social media ban hits its constitution. • A bit of AI prompting found a serious bug in Zoom. • AI-based network defenders see a stock price jump. • A (very) deep dive into the operation of AI chatbots.
• Understanding the controversy surrounding “AI Model Distillation” • Anthropic moves to make their most powerful Mythos 5 model more widely available. • Bitwarden’s “Secrets Manager” offering prevents agentic and prompt injection abuse. • The astounding and disturbing truth about the way conversation AI actually works.
• A possible means for preventing prompt injection abuse. • Clear evidence of Chinese-made router malicious intent. • A cool before and after SpinRite graph of SSD performance. • How about adding unpredictable hashes to role tags? • What did Claude make of last week's podcast? • Could much better harnesses prevent prompt injection? • A listener wants us to stop saying AI "thinks". • AI designers ignore well-understood security concepts. • Can we explain LLM AI using conventional computer terms? • A listener strongly dislikes the term "rotating credentials". • The land of AI is being filled with "meat proxies". • Researchers exhaustively test frontier model vulnerability remediation. (hint: It does not go well.)
• We start out with a classic old school hack against Dropbox. • Next Patch Tuesday will be enabling "Memory Integrity" for many. • Firefox moved to 155 and obtained a dumb Smart Window. • CISA is terminating 6 most valuable cybersecurity services. • OpenAI advanced to top of the heap with GPT-6 Astra. • But... is it now hiding some of its thinking from monitoring? • Nvidia is acquiring Hugging Face. Who's that good for? • Google releases Gemini 3.8 Flash and Cyber. Is it good? • Chinese cyberespionage is using AI to become more slippery. • Matthew Green proposes a fascinating take on AI bug drought. • A lifelong safety engineer contemplates AI-driven loss of expertise.
• The full report on last week's nearly 1,000 Microsoft security fixes. • Five months after its start, what's the status of Project Glasswing? • Anthropic's rogue agent escape count reaches four incidents. • Not to be outdone, OpenAI's count passes 10 and maybe as many as 23! • Revisiting California's DROP compulsory data broker data deletion. • Russian criminals get their hands on more than 153 million drivers license scans. • “Skynet” is the wrong model for the end of the world. The right model is The Krell.
• Andrew Ng weighs-in on AI Doomsaying. • The wisdom of outsourcing AI security testing. • The true risk of an AI-created bioweapon. • The EU KIDS Act -- this one is even messier. • “Nightmare Eclipse” finally unmasks himself. • A whitehat firm used Claude to attack OpenAI. • Cisco's own massive 77 CVE update. • What was the fallout from Sept's Patch Tuesday?
• Muse has a bad 0-day • The regularity of "Irregular" • More rogue OpenAI breaches • The Seven Deadly Sins (TSDS) hacker group • Liquified Natural Gas (LNG) cargo ship hacked • The FBI offended ShinyHunters's delicate sensibilities • Canonical switches to an every–2-weeks release cadence • Axios’ AI 101: AI Explainer for normal people • How worried should we be?
• GLM-5.3 can be and has been abliterated. What does that mean? • Firefox 157 repairs a large number of high-impact vulnerabilities. • A surprising reduction in RSA crypto strength has been discovered. • Powerful agentic AI is being used to attack merchants. • A new and potent Spectre-style processor attack has been designed. • A neighbor falls victim to a Bitcoin scam. What can be done? • A new and surprising use was found for GRC's DNS Benchmark. • An examination of the growing alignment challenges created by more intelligent AI.
• Anthropic cuts live Internet access during testing. • Will LLM technology turn out to be an uncontrollable dead end? • What alternative AI technologies are underway? • Anthropic offers free AI vulnerability scanning for open source. • South Korean banks hit by Claude-driven cyberattacks. • Japan declares a state of cyber-emergency due to attacks. • For one listener, Agentic coding has taken the joy out of coding. • A listener is having way too much fun with AI and Halloween. • Some listeners believe I'm downplaying the dangers of AI. • We carefully examine the consequences of maliciously trained AI.
• Another record smashing Patch Tuesday. • But again, all those updates were not without consequences. • Palo Alto Networks' Unit 42 reports on an agentic attack. • A mass-compromised hardware cryptocurrency wallet attack. • How to create your own known-safe crypto wallet. • Feedback about AI, coding and SpinRite from a listener. • What the reverse-engineering of the ECDSA curves means for security.
• We take a detailed look at the many facets and aspects of last week’s wild PHP ride: • What happened. • How it happened. • Why it happened. • How it could have been prevented. • How it impacted many of our listeners. • We consider the implications of what is said to be coming next and the idea of temporary “strategic disconnection” from the Internet.
• Cisco gives a 27-year old the task of recoding 98% of their software with AI. • A serious but not earth shaking vulnerability found in PXE booting. • The largest ($6.3 BILLION) financial heist in history (with crypto). • 710 Polymarket gambling wallets emptied of $2.7 million. • A new robots.txt control for AI bots, and agreement to obey it. • Google generates haiku from the first orbital AI. • From our listeners: Does stealth updating make sense how to move web servers off the Internet books don't contain knowledge a small company attacked by powerful AI how would an "AI kill switch" be implemented. • Another new and worrisome application of reverse-engineering AI.
Przed premierą
Przed premierą
Sezon 1: 1105 odcinków
Część informacji pochodzi z TheTVDB.
Udostępnij
Security Now
· · TWiT
W tym odcinku
Twoja ocena
Społeczność Wubly
Gdzie jestem
W czasie bety Wubly działa tylko na zaproszenia. Zapisz się na listę oczekujących, a wyślemy Ci zaproszenie e-mailem.
Masz zaproszenie? Utwórz konto
Jesteś offline
Ostatnio przeglądane strony wciąż działają. Zmiany zapisują się tutaj i zsynchronizują się po powrocie online.
Znów online · synchronizacja