Security Now (Audio)

By TWiTTechnology

Security Now (Audio) episodes

December 12, 2023SN 952: Quantum Computing Breakthrough - The Clear/Deep/Dark Web, Quad 9 victory, Telegram Flaw
The government collection of push notification metadata

Facebook Messenger sets end to end encryption as the default

Iran's Cyber Av3ngers

Cisco's Talos Top 10 cyber security exploits this year

Over 30% of apps are still using a using a vulnerable version the Log4J library

Quad 9 speaks on their legal victory against Sony

What are the "Clear Web", "Dark Web", and "Deep Web"?

A Flaw in Telegram

Xfinity Mobile wants you to accept a root CA, DO NOT

Hardware VPN alternative

A breakthrough in quantum computing

Show Notes - https://www.grc.com/sn/SN-952-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
GO.ACILEARNING.COM/TWIT
lookout.com
bitwarden.com/twit
2 hr 5 min
December 05, 2023SN 951: Revisiting Browser Trust - ICANN RDRS, Beeper Mini, TikTok ban, .meme TLD
How masked domain owners can be unmasked through ICANN's new Registration Data Request Service (RDRS)

WhatsApp's addition of Secret Code for extra privacy protection in Chat Lock

Iranian hackers exploited default passwords in programmable logic controllers at US water facilities

Attempt by Montana to ban TikTok statewide was stalled by a federal judge ruling

Over 1 billion Android devices now have RCS messaging enabled

EU Cyber Resilience Act will improve security of Internet of Things devices sold in the EU

Black Basta ransomware group has netted over $107 million since early 2022

Google's new .meme top-level domain allowing meme-related web properties

CISA's Secure by Design initiative echoes security best practices frequently recommended on the podcast

France plans to ban use of "foreign" end-to-end encrypted messaging apps like Telegram and require use of French app Olvid instead

Concerns raised by industry experts Ivan Ristic and Ryan Hurst about EU's eIDAS 2.0 legislation undermining certificate authority trust

Show Notes - https://www.grc.com/sn/SN-951-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
canary.tools/twit - use code: TWIT
vanta.com/SECURITYNOW
2 hr 11 min
November 28, 2023SN 950: Leo Turns 67 - Fingerprint Security, Do-Not-Track
Adobe Flash Player Updater is (still) desperately trying to update

Veracrypt password security

Firefox moves to 120 with a bunch of very nice new features

Do-Not-Track is back on track

"ownCloud" -or- "PwnCloud" ?

CrushFTP Critical Vulnerability

Bypassing fingerprint authentication

ApacheMQ

TransUnion & Experian both hacked

Show Notes - https://www.grc.com/sn/SN-950-Notes.pdf

Hosts: Steve Gibson and Ant Pruitt

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
paloaltonetworks.com/ot-security-tco
Melissa.com/twit
GO.ACILEARNING.COM/TWIT
2 hr 13 min
November 21, 2023SN 949: Ethernet Turned 50 - Signal funding, X (Twitter) ad fallout, RCS for iPhone, TETRA review
Privacy and Funding Challenges Facing Signal Messaging App

Loss of Advertisers for Twitter After Controversial Tweet by Elon Musk

Ransomware Group Files SEC Complaint Against Breached Company

Europe Opening Up Radio Encryption Standard TETRA for Public Review

Apple Announcing Adoption of RCS Messaging for iPhones

Steve's Progress on Dynamic Code Signing for SpinRite Releases

Removing Suction Cup Barnacles from Windshields

Recommendations for Benchmarking USB Drive Read/Write Speeds

Concerns Over EU's Proposed eIDAS 2.0 QWACs Legislation

Why Protectli Routers Are Preferred for pfSense Setups

Credit Card Security Precautions for Ex-LastPass Users

Origins and Evolution of Ethernet Networking Over 50 Years

Show Notes - https://www.grc.com/sn/SN-949-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
vanta.com/SECURITYNOW
kolide.com/securitynow
securemyemail.com/twit Use Code TWIT
2 hr 13 min
November 14, 2023SN 948: What if a Bit Flipped? - Privacy Badger, Downfall, OpenVPN, Windshield Barnacle, Article 45
Privacy Badger blocks trackers on news sites and prevents browser exposure to unwanted domains like TikTok and Datadog.

No major updates on EU's controversial Article 45 in eIDAS 2.0. Industry pushback continues as implementation would threaten encryption.

Cryptocurrency exchange Poloniex lost $130M in a hot wallet hack, the 14th largest crypto theft.

Decentralized finance platform Raft lost $3.3M due to an exploit.

Crook operated website iotaseed.io to generate wallet seed phrases, then recorded and stole them.

New Intel processor vulnerability called Downfall leaks encryption keys and sensitive data between users on shared systems.

Russia moves to formally ban all VPN use in the country.

Two new flaws found in OpenVPN software, one allowing memory access.

SpinRite development paused as DOS and Windows versions are complete.

Understanding assembly language helps malware analysis and exploit development, but high-level decompilers also useful.

Quantum-safe symmetric cryptography is limited compared to asymmetric crypto.

EU's Article 45 allows transparent decryption and traffic interception, supposedly for security purposes.

"Windshield Barnacle" parking enforcement device uses suction cups and 1000 lbs of force to immobilize vehicles until parking tickets are paid.

Sci-fi book series Aeon 14 by M.D. Cooper offers fun military space opera adventure.

27-year-old theoretical crypto attack now shown practical. Passive network observers can steal SSH RSA keys if faulty signature generated, allowing impersonation.

Show Notes - https://www.grc.com/sn/SN-948-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
kolide.com/securitynow
bitwarden.com/twit
GO.ACILEARNING.COM/TWIT
2 hr 13 min
November 07, 2023SN 947: Article 45 - Citrix Bleed update, Ace Hardware cyberattack, Bitwarden get Passkeys
Microsoft announced storing their Azure keys in an HSM after previously losing control of a private signing key

A quartet of new 0-day vulnerabilities in Exchange Server that Microsoft declined to fix

Apache ActiveMQ servers under attack exploiting a 0-day, with over half of publicly exposed servers vulnerable

Update on the Citrix Bleed vulnerability with evidence of hackers gaining access and post-exploitation activity

CVSS version 4 released with new metrics for better granularity and clarity of vulnerability scores

Ace Hardware suffered a cyberattack impacting servers and systems

Google abandons controversial "Web DRM" proposal to let sites restrict browser extensions

Analysis of "BadCandy" malware infecting vulnerable Cisco routers

Bitwarden password manager adds support for FIDO2 passkeys in browser extension

Rescuing a severely degraded SSD and bringing it back to life with SpinRite

Feedback from listeners on IPv6 adoption, factors for choosing crypto primes, installing Windows 11, and more

The brewing battle in the EU over proposed eIDAS regulation Article 45 that could ban security checks on root certificates and undermine encrypted web traffic

Show Notes - https://www.grc.com/sn/SN-947-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
lookout.com
canary.tools/twit - use code: TWIT
Melissa.com/twit
2 hr 14 min
October 31, 2023SN 946: CitrixBleed - iMessage Contact Key Verification, HackerOne bug bounty news, CISA's Logging Made Easy
What caused last week's connection interruption? Router was rebooting intermittently, but why?

David Redekop of AdamNetworks explained their enterprise network security solution aims to only allow known safe connections, blocking everything else.

iMessage gets Contact Key Verification to confirm new devices added to an account belong to the contact.

Public Interest Research Group asks Microsoft to extend Windows 10 support beyond 2025.

HackerOne breach bounties surpass $300M total payout.

CISA releases free Logging Made Easy toolkit to enhance Windows logging capabilities.

SpinRite 6.1 pre-release 2 published, likely final pre-release with some testing remaining before full launch.

Moving the Internet fully to IPv6 likely won't happen until IPv4 addresses are fully consumed.

Open source projects struggle with costly code signing certificates.

Deep dive into CitrixBleed vulnerability allowing authentication bypass.

Show Notes - https://www.grc.com/sn/SN-946-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
cs.co/twit
bitwarden.com/twit
vanta.com/SECURITYNOW
2 hr 2 min
October 24, 2023SN 945: The Power of Privilege - New cURL vulnerabilities, CVSS 10.0 Cisco Nightmare, So long VBScript!
How fake drives continue to be sold on Amazon despite negative reviews

Microsoft is discontinuing support for the VBScript language

The 30-year old NTLM authentication protocol will eventually be removed from Windows

Two new vulnerabilities found in cURL

A new Cisco router vulnerability rated CVSS 10.0 was used to hack over 40,000 devices

Debate over whether "lib" should rhyme with "vibe" or "air"

Instructions for accessing the SpinRite 6.1 pre-release version

Feedback on passkey exportability and server IP address encryption

A listener asks if ransomware can encrypt already encrypted files

How Privacy Badger un-rewrites Google's search result links

The NSA and CISA warn about the power of privilege and the dangers of account misconfigurations like privilege creep, elevated service account permissions, and non-essential use of elevated accounts

Show Notes - https://www.grc.com/sn/SN-945-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
drata.com/twit
joindeleteme.com/twit promo code TWIT
canary.tools/twit - use code: TWIT
2 hr 11 min
October 17, 2023SN 944: Abusing HTTP/2 Rapid Reset - Passkeys, ValiDrive follow-up, 2FA apps, pre-release Spinrite
ValiDrive release follow-up

Passkeys exportability and phishing risk

Passkeys for device verification like SSH keys

Possibility of hobby browsers vs. production browsers

Availability of SpinRite 6.1 pre-release

Filling drives with crypto noise using VeraCrypt

Steve and Leo's favorite OTP apps

Google Docs link rewriting could be to prevent referrer leakage

Abusing HTTP/2 Rapid Reset

Show notes: https://www.grc.com/sn/SN-944-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
Melissa.com/twit
cs.co/twit
bitwarden.com/twit
2 hr 26 min
October 10, 2023SN 943: The Top 10 Cybersecurity Misconfigurations - MACE Act Passed, Brave Layoffs, 23andMe Breached
Steve announces the release of his new freeware utility ValiDrive for detecting fake drive capacities.

23andMe claims a recent data breach exposed customer info due to credential stuffing attacks.

Key stats from Microsoft's 2023 Digital Defense Report on cyberattacks, including increased attacks on open source software, growth in business email compromise, and more password attacks.

Brave lays off 9% of its staff amid the tough economic climate, despite its efforts to diversify revenue with new search features.

Google Docs exports replace links with tracking redirects, enabling Google to monitor clicked links from exported documents.

The MOVEit breach impacted Sony, exposing employee and family data.

Firefox 118 now supports Encrypted ClientHello for hiding site requests from network surveillance.

Google will provide 7 years of updates for its new Pixel phones, up from 5 years previously.

The MACE Act passed overwhelmingly in Congress, allowing agencies more flexibility in cybersecurity hiring.

Median dwell time for ransomware dropped to less than 1 day, with human-driven attacks deploying it faster.

Steve digs into the top 10 cybersecurity misconfigurations outlined in the new NSA/CISA advisory.

Show notes: https://www.grc.com/sn/SN-943-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
GO.ACILEARNING.COM/TWIT
drata.com/twit
lookout.com
2 hr 12 min

About Security Now (Audio)

From the publisher's feed

Cybersecurity guru Steve Gibson joins Leo Laporte every Tuesday. Steve and Leo break down the latest cybercrime and hacking stories, offering a deep understanding of what's happening and how to protect yourself and your business. Security Now is a must listen for security professionals every week.

You can join Club TWiT for $10 per month and get ad-free audio and video feeds for all our shows plus everything else the club offers...or get just this podcast ad-free for $5 per month.