Security Now (Audio)

By TWiT

Technology

What's Security Now (Audio) about?

Steve Gibson, the man who coined the term spyware and created the first anti-spyware program, creator of SpinRite and ShieldsUP, discusses the hot topics in security today with Leo Laporte.

Records live every Tuesday at 4:30pm Eastern / 1:30pm Pacific / 20:30 UTC.

4.6

1,561 ratings

Download our free app to listen on your phone

LAST EPISODE

SN 941: We told you so! - N...

09.26.2023

Apple has quietly removed support for Postscript in macOS Ventura over security concerns with the outdated interpreter language. China has formally accused the NSA of hacking and maintaining access to Huawei servers since 2009, based on documents from Edward Snowden. ...

Security Now (Audio) episodes:

09.26.2023 SN 941: We told you so! - NSA hacked Huawei? MS big AI data blunder, ValiDrive update Apple has quietly removed support for Postscript in macOS Ventura over security concerns with the outdated interpreter language. China has formally accused the NSA of hacking and maintaining access to Huawei servers since 2009, based on documents from Edward Snowden. ...
09.19.2023 SN 940: When Hashes Collide - Secure-wipe best practices, browser identity segregation, bye bye Twitter (X) Last week's news about evidence of LastPass vault decryption targeting cryptocurrency keys, and the UK's backing down on its encryption monitoring legislation. How hardware security modules (HSMs) allow cryptographic operations like code signing without exposing private keys. Browser identity segregation ...
09.12.2023 SN 939: LastMess - Online Safety Bill, Microsoft Outlook breach details, auto brand data privacy UK government appears to back down on demands to break encryption in Online Safety Bill Microsoft reveals how China-based hackers acquired secret key used to breach Outlook accounts Multiple flaws allowed key to improperly leave highly secure environment Mozilla research ...
09.05.2023 SN 938: Apple Says No - Topics coming to Android, Apple security research, browser extension vulnerabilities Steve provides an update on ValiDrive, his new freeware utility for testing USB drives. It identifies bogus mass storage drives and performance differences between drives. There has been another sighting of Google's Topics API, this time on Android phones. It ...
08.29.2023 SN 937: The Man in the Middle - WinRAR v6.23, fake flash drives, Voyager2 antenna, Google Topics Picture of the Week: Steve shares a funny "what we say vs what we mean" image about tech support conversations. WinRAR v6.23 fixes: Steve explains that updating to the latest WinRAR is more important than initially thought, with two critical ...
08.22.2023 SN 936: When Heuristics Backfire - OpenSUSE, SanDisk and Western Digital, 8Base, TSSHOCK OpenSUSE goes private. Android to get satellite comms. SanDisk and Western Digital in hot water. You're asking for it: YouTube children's privacy. Whoopsie! 8Base. Where the money is. The TSSHOCK vulnerability. BitForge. A Quantum resilient security key. Removed Chrome extensions ...
08.15.2023 SN 935: "Topics" Arrives - Firefox multi-account containers, DuckDuckGo email alias, satellite crowding Picture of the Week. Security Now!'s 18th birthday! Closing the Loop. Firefox Multi-Account Containers. A question about Full Disk Encryption on SSD's. Should I run SpinRite before I back up my drives to a NAS? Overly complex password rules. DuckDuckGo's ...
08.08.2023 SN 934: Revisiting Global Privacy Control - Voyager 2, MS Security, keyboard acoustic side-channel attacks Picture of the Week. NASA "shouted" at Voyager. Another view of Microsoft. What about this Chinese attack? AI meets Keyboard Acoustic Side-Channel attacks. Closing the Loop. Revisiting Global Privacy Control. Show Notes: https://www.grc.com/sn/SN-934-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download ...
08.01.2023 SN 933: TETRA:BURST - Satellite Turla, Android tracker tech, VirusTotal 2023 report, open source in Russia Picture of the Week. Satellite Turla: APT Command and Control in the Sky. OS 17 to further crack down on device fingerprinting. Android to start warning of "unknown trackers". The 7th branch of the US military. Russia criminalizes open source ...
07.25.2023 SN 932: Satellite Insecurity, Part 2 - Apple vs UK, Cyber Resilience Act, Web Environment Integrity Picture of the Week. R.I.P. Kevin Mitnick. Apple says: "Thanks, but we'd rather leave." Web Environment Integrity. Web Analytics under the spotlight. More progress on the IoT security front. The "Expeditionary cyber force". Ransomware payouts being made much less often. ...
07.18.2023 SN 931: Satellite Insecurity, Part 1 - Kaspersky on MS flaw, WormGPT, Bitcoin addresses, Twitter DM change Picture of the Week. Kaspersky on Microsoft's Patch Tuesday. As the worm turns: WormGPT. Microsoft revokes 100+ malicious drivers. MOVEit Update. Does Dun & Bradstreet know you? No Threads for you! (or EU!) All Bitcoin addresses look alike. Twitter changes ...
07.11.2023 SN 930: Rowhammer Indelible Fingerprinting - MOVEit SQLi flaw, China's OpenKylin v1, Firefox 115, Syncthing Picture of the Week. Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software. And as for MOVEit... What's a "Rug Pull" ?? "Avast, ye Matey" China's OpenKylin v1. TootRoot! Firefox 115. Did Russia Disconnect? Use some honey if you ...
06.27.2023 SN 929: Operation Triangulation - DuckDuckBrowse, KasperskyOS Phone, Cyber Force, MOVEit Picture of the Week. Catching Leo up to speed from last week. DuckDuckBrowse. And an updated Tor Browser. Opera, now enhanced with "AI". The KasperskyOS Phone. The cost of doing business in Russia. Slowly turn the wheels of justice. The ...
06.20.2023 SN 928: The Massive MOVEit Maelstrom - Patch Tuesday, SpinRite 7.1, MOVEit Picture of the Week. Patch Tuesday. Does EVERYTHING leak?? Closing the Loop. SpinRite gets version 7.1! The Massive MOVEit Maelstrom. Show Notes: https://www.grc.com/sn/SN-928-Notes.pdf Hosts: Steve Gibson and Jason Howell Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free ...
06.13.2023 SN 927: Scanning the Internet - IoT DDoS rising, who pays for Cryptomining, WWDC security announcements Picture of the Week. Cryptomining Rude Surprise Billing. Musk's Twitter is refusing to pay for Cloud Services. IoT DDoS rapidly rising. H1CA found executing code on client machines. Apple's WWDC Redux. France takes a different approach... Russia: Scanners stay out! ...
06.06.2023 SN 926: Windows Platform Binary Table - OWASP, Tor anti-DoS protection, Mandatory SMB Signing on Win 11 Picture of the Week. Another week of silence from HP. Mandatory "SMB Signing" coming to Windows 11. OWASP. Did Apple help the NSA attack the Kremlin? Kaspersky's analysis of this iPhone attack and compromise. The Trifecta Jackpot! Who wrote that? ...
05.30.2023 SN 925: Brave's Brilliant Off the Record Request - .ZIP TLD, Bitwarden Passkey support, PyPi Picture of the Week. HP = "Huge Pile" The ".ZIP" TLD — What could possibly go wrong? PyPI gets more serious about security AND privacy. "No logs saved anywhere"??? Twitter in the EU? Bitwarden's support for Passkeys. A €1.2 billion ...
05.23.2023 SN 924: VCaaS - Voice Cloning as a Service - HP printer update, KeePass vulnerability, SpinRite bug Picture of the Week. Tracker Follow-Up. Automatic IoT device updating. HP 9020e - error code 83C0000B. Section 230 Stands. The KeePass Vulnerability. Apple joins Samsung, Amazon and Verizon in banning ChatGPT. Google's Privacy Sandbox moves forward. The FBI heavily misused ...
05.16.2023 SN 923: Location Tracker Behavior - Diving deep into Google and Apple's tracker spec, SpinRite update Picture of the Week. SpinRite. Location Tracker Behavior. Formal definitions from the specification. Bluetooth LE devices have MAC addresses and therein lies a problem. All devices are serialized. And now, that "pairing registry". Privacy considerations. Show Notes: https://www.grc.com/sn/SN-923-Notes.pdf Hosts: Steve ...
05.09.2023 SN 922: Detecting Unwanted Location Trackers - Google Passkeys, Chrome lock icon, AI news sites, Vint Cerf Picture of the Week. Google & Passkeys. TP-Link routers DO auto-update. US Marshals Service: Where's the backup?? T-Mobile keeps getting breached. Chrome: No more LOCK icon. Apple's new "Rapid Security Response" system. Elon Musk, making friends wherever he goes... A ...
05.02.2023 SN 921: OSB OMG and Other News! - Age verification, Google Authenticator E2EE, VirusTotal AI, cURL Picture of the Week. The Encryption Debate. Age does matter... Age Verification. WhatsApp: Rather be blocked in UK than weaken security. Exposing Side-Channel Monitoring. Closing the Loop. A new UDP reflection attack vector. Google Authenticator Updated. Does Israel use NSO ...
04.25.2023 SN 920: An End-to-End Encryption Proposal - Wipe those routers, Lockdown Mode, ChatGPT black market Picture of the Week. Lockdown Mode seen succeeding. A growing black market for ChatGPT accounts. Decommissioned Corporate Routers Leak Secrets. Jaguar Tooth: Cisco router vulnerabilities. Security Research Legal Defense Fund. A quick Firefox fix. Kubernetes security audit. Google Chrome zero-day. ...
04.18.2023 SN 919: Forced Entry - Patch Tuesday, Google Assured Open Source Software, WhatsApp Improvements Picture of the Week. Patch Tuesday Review. Risky Business News. Google Assured Open Source Software. WhatsApp Improvements. Bad Security? Go to jail! Forced Entry. Show Notes https://www.grc.com/sn/SN-919-Notes.pdf Hosts: Steve Gibson and Jason Howell Download or subscribe to this show at ...
04.11.2023 SN 918: A Dangerous Interpretation - H26FORGE, Privatized ChatGPT, Mozilla Site Breach Monitor Picture of the Week. Microsoft and Fortra go on the offensive. Can ChatGPT keep a secret? Apple updates their OS's. Wordpress under attack... again. Mozilla's Site Breach Monitor. Another ChatGPT investigation. Samsung handsets reaching EoL. Less access for loan apps. ...
04.04.2023 SN 917: Zombie Software - ChatGPT Ban, Hacking the Pentagon Picture of the Week So... Not an attack, then? AI Overlord Hysteria Italy says NO to ChatGPT It's illegal... How much will that be? The U.S. FDA & medical device security Hack the Pentagon Firefox 3dr-party DLL check-up Microsoft's Extortion? ...
03.28.2023 SN 916: Microsoft's Email Extortion - Pwn2Own, Edge Crypto Wallet Picture of the Week. Synacktiv wins this year's CanSecWest Pwn2Own GitHub: Mistakes happen DDoS for Hire. . .Or Not 144,000 malicious packages published No iPhones For Russian Presidential Staff I NUIT Edge Gets Crypto Microsoft's Email Extortion Show Notes: https://www.grc.com/sn/sn-916-notes.pdf ...
03.21.2023 SN 915: Flying Trojan Horses - Exynos 0-days, TikTok Tick Tock, 90-day TLS cert life, CHESS is safe! Picture of the Week. Multiple Exploitable Samsung 0-Days. A good idea for NPM. The TikTok Tick Tock. Google pushes for 90-day TLS certificate life. CHESS is safe. CISA has begun scanning! Flying Trojan Horses. Show Notes: https://www.grc.com/sn/SN-915-Notes.pdf Hosts: Steve Gibson ...
03.14.2023 SN 914: Sony Sues Quad9 - Polynonce attack, Germany Huawei ban, Plex Media Server defect, Andor review Picture of the Week. Another Malicious Chrome Extension. Germany to join the Huawei & ZTE ban. Putting "phishing" into perspective. The Polynonce attack. Plex's RCE now in CISA's KEV. Sci-Fi: Andor. Sony Sues Quad9. Show Notes: https://www.grc.com/sn/SN-914-Notes.pdf Hosts: Steve Gibson ...
03.07.2023 SN 913: A Fowl Incident - DDoS'ing Fosstodon, Strategic Objective 3.3, CISA's Covert Red-Team Picture of the Week. DDoS'ing Fosstodon. DDoS for Hire takedowns. TikTok Insanity. Illegal Warrantless Surveillance. Strategic Objective 3.3. GitHub Secret Scanning. CISA's Covert Red-Team. What's left? What's old is new again. TCG TPM vulnerabilities. WordPress "All In One SEO". Russia ...
02.28.2023 SN 912: The NSA @ Home - LastPass hack details, Signal says no to UK, more PyPI troubles, QNAP bug bounty Picture of the Week. Windows 11? ... anyone? As Plain as Ever. Edge's new built-in VPN? LastPass Incident Update. Signal says NO to the UK. More PyPI troubles. The QNAP bug bounty program. SpinRite. The NSA @ Home. Show Notes: ...
02.21.2023 SN 911: A Clever Regurgitator - GoneDaddy, Section 230, NPM malware, Hyundai Kia mess, Meta Verified GoneDaddy, Section 230, NPM malware, Hyundai Kia mess, Meta Verified Picture of the Week. GoneDaddy. Section 230. No Blue, No SMS-based 2FA. Bitwarden gets Argon. "Meta Verified". Emsisoft Fake Code Signing. Attacks breaking records. More Mirai. NPM malware. Patch Tuesday. ...
02.14.2023 SN 910: Ascon - Malicious ChatGPT Use, Google Security Key Giveaway, OTPAuth Picture of the Week ESXiArgs follow-up ChatGPT's Malicious Use Google Security Key Giveaway Brave goes HTTPS-by-default 1Password Makes Another Passkeys Move Russian Patriotic Hackers Amazon to FINALLY Secure Its AWS S3 Instances More Anti-Chinese Camera Removals Microsoft to embed Adobe ...
02.07.2023 SN 909: How ESXi Fell - EU Internet Surveillance, QNAP returns, .DEV is always HTTPS Picture of the Week. The European Union's Internet Surveillance Proposal. 30,000 patient records online? .DEV is always HTTPS! Google changes Chrome's release strategy. Russia shoots the messenger. A fool and his Crypto... QNAP is back. CVSS severity discrepancy. Closing the ...
01.31.2023 SN 908: Data Operand Independent Timing - Old Android apps, Kevin Rose, iOS 6.3 and FIDO, Hive hacked Android to start blocking old and unsafe apps. Microsoft to block Internet sourced Excel add-ins. An example of saying "no" even when it may hurt. Hacked Wormhole funds on the move. Kevin Rose Hacked. Facebook will be moving more users ...
01.24.2023 SN 907: Credential Reuse - iOS 16.3, ChatGPT creates malware, Bitwarden acquires Passwordless.dev Picture of the Week. PayPal Credential Stuffing. iOS 16.3 : Cloud encryption for all. InfoSecurity Magazine: "ChatGPT Creates Polymorphic Malware". CheckPoint Research: OPWNAI : Cybercriminals Starting to Use ChatGPT. "Meta" fined for the third time. Bitwarden acquires "Passwordless.dev". Closing the ...
01.17.2023 SN 906: The Rule of Two - Norton Lifelock Data Breach, Chromium and Rust, LastPass Picture of the Week About Password Iterations EBC or CB Norton Lifelock Troubles Chrome Follows Microsoft and Firefox Chromium is Beginning to Rust BYOVD and Windows Defender Failures Closing the Loop (feedback) The Rule of Two Show notes: https://www.grc.com/sn/sn-906-notes.pdf Hosts: ...
01.10.2023 SN 905: 1 - LastPass Aftermath, LastPass vault de-obfuscator, LastPass iteration count folly Picture of the Week. LastPass Aftermath. LastPass Vault De-Obfuscator. What more do we know this week regarding LastPass? The most alarming discovery by listeners. Understanding the scale of GPU-enhanced password cracking. On the true strength of passwords. Feedback from listeners ...
01.03.2023 SN 904: Leaving LastPass - How LastPass failed, Steve's next password manager, how to protect yourself Picture of the Week. SpinRite. Leaving LastPass. Is there reason for concern? Well known password cracker Jeremi Gosney's LastPass rant. Steve shares his plan regarding LastPass. What is Steve's next password manager? What should LastPass users do to protect themselves? ...
12.27.2022 SN 903: Security Now Best of 2022 - The best moments from throughout the year Anatomy of a Log4j Exploit. Will Russia Disconnect? FCC Says Kaspersky Labs is a National Security Threat. Lenovo UEFI Firmware Troubles. That "Passkeys" Thing. Dis-CONTI-nued: The End of Conti? Steve's Take on the LastPass Breach. Hosts: Steve Gibson and Leo ...
12.20.2022 SN 902: A Generic WAF Bypass - Pwn2Own Toronto, URSNIF malware, Vivaldi Mastodon support, Bye Bye SHA-1 Picture of the Week. A malware operation known as URSNIF. Pwn2Own Toronto 2022. Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities. Patch Tuesday. Another Uber breach? Elon Botches 'Bot Blockage. Vivaldi integrates Mastodon in its desktop browser. ...
12.13.2022 SN 901: Apple Encrypts the Cloud - Chrome Passkeys, Telegram malware, SYNC.com outage, Rackspace lawsuits Picture of the Week. Chrome does Passkeys. SYNC.COM suffered its first outage. Medibank reboot. Totally fake cryptocurrency trading platforms. Malware on Telegram. Texas gets in on the TikTok banning. The LastPass class action lawsuit. Rackspace had a big embarrassing problem. ...
12.06.2022 SN 900: LastPass Again - South Dakota bans TikTok, Anker Eufy Camera debacle, Mozilla yanks trusted root Picture of the Week. Don't mess with Australia. Facebook / Meta fined by Ireland. REvil's full Medibank dump. Is nothing sacred? Mozilla yanks a (no longer) trusted root. Android Platform Certs Escape. South Dakota says: No more Tik-Tok. Albania blames ...
11.29.2022 SN 899: Freebie Bots & Evil Cameras - iSpoofer no more, Boa server vulnerability, CISA on Mastodon Picture of the Week. iSpoof you no more. Here come the Freebie Bots! Anatomy of the real-time Cryptocurrency heist. Lookin' for something to do? Boa server vulnerability. The dilemma of closed-source Chinese networking products. The Cyber Defense Index. Malicious Docker ...
11.22.2022 SN 898: Wi-Peep - FBI purchased Pegasus, Passkey support directory, Quantum decryption deadline, Firefox 107 Picture of the Week. Firefox v107 was released last Tuesday. Google settles for a cool $391.5 million. Red Hat Signing its ZIP file Packages. The FBI purchased Pegasus for "research and development purposes". Greece bought Predator for €7 million. A ...
11.15.2022 SN 897: Memory-Safe Languages - Shennina Framework, Shufflecake, The Helm, LightSpeed vulnerabilities Picture of the Week. Patch Tuesday review. Shennina Framework - Automating Host Exploitation with AI. GitHub's welcome new feature. Three LightSpeed vulnerabilities. Shufflecake: Plausible deniability encrypted Linux volumes. Australia has decided to get proactive! Apple's iOS 16.1.1 everyone file sharing ...
11.08.2022 SN 896: Something for Everyone - Dropbox breach, cyber bank heists, Russia goes Linux, OpenSSL flaw update Picture of the Week. A minor Dropbox breach. OpenSSL follow-up. FTC sued and settled with a repeated offender. $1.2 billion in reported ransomware payments during 2021. Akamai's Q3 Threat Report. Initial Access Brokerages. How do today's bank heists work? De-Fi ...
11.01.2022 SN 895: After 20 years in GCHQ - Stranger Strings, PayPal passkeys, new TCP/IP RCE in Windows Picture of the Week. Windows driver blocklist to be updated next Tuesday. More Microsoft shenanigans. An upcoming OpenSSL CRITICAL vulnerability update -- get ready! A new TCP/IP RCE in Windows. A study of malicious CVE proof of concept exploits in ...
10.25.2022 SN 894: Data Breach Responsibility - Firefox 106, KataOS and Sparrow, banking malware, CVSS 9.8 update Picture of the Week. Firefox 106 is out. Google's Open Source IoT KataOS and Sparrow. This Week in CryptoCurrency Craziness. New Windows 0-day bypasses executable security checks. Apple's 9th 0-day of the year bites the dust. The evolutionary demise of ...
10.18.2022 SN 893: Password Change Automation - Windows Update RSS, malicious kernal drivers, Signal SMS/MMS, ZimaBoard Picture of the Week. Microsoft "Won't Fix". Malicious Kernel Drivers. Microsoft has finally added an RSS feed for Windows Updates! Passkeys [dot] Dev. Largest DDoS attack. Signal will be dropping its SMS/MMS support. Brute-force protection for Windows local admin accounts. ...
10.11.2022 SN 892: Source Port Randomization - Targeted Malware, Uber CSO Guilty Picture of the Week. Breach of Customer Information Meta-targeted Malware Uber's Chief Security Officer Found Guilty More Cryptocurrency Chaos The UK to drop GDPR Summer Internship with the NSA Many Incident Responders are Stressed Out Microsoft's newest dual 0-day Exchange ...

Older episodes