Security Now (Audio)

By TWiTTechnology

Security Now (Audio) episodes

December 20, 2022SN 902: A Generic WAF Bypass - Pwn2Own Toronto, URSNIF malware, Vivaldi Mastodon support, Bye Bye SHA-1
Picture of the Week.

A malware operation known as URSNIF.

Pwn2Own Toronto 2022.

Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities.

Patch Tuesday.

Another Uber breach?

Elon Botches 'Bot Blockage.

Vivaldi integrates Mastodon in its desktop browser.

5,200 Dutch government warnings.

CIB: "Coordinated Inauthentic Behavior"

GitHub to require 2FA by the end of next year.

Bye bye SHA-1.

WordFence's VERY useful looking WordPress add-on vulnerability database.

Closing The Loop.

SpinRite.

A Generic WAF Bypass.

Show Notes https://www.grc.com/sn/SN-902-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsor:
plextrac.com/twit
1 hr 57 min
December 13, 2022SN 901: Apple Encrypts the Cloud - Chrome Passkeys, Telegram malware, SYNC.com outage, Rackspace lawsuits
Picture of the Week.

Chrome does Passkeys.

SYNC.COM suffered its first outage.

Medibank reboot.

Totally fake cryptocurrency trading platforms.

Malware on Telegram.

Texas gets in on the TikTok banning.

The LastPass class action lawsuit.

Rackspace had a big embarrassing problem.

Rackspace is now facing at least three class action lawsuits.

Another country goes on the offensive.

Closing The Loop.

SpinRite.

Miscellany.

Apple Encrypts the Cloud.

Show Notes https://www.grc.com/sn/SN-901-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
barracuda.com/securitynow
bitwarden.com/twit
expressvpn.com/securitynow
2 hr 24 min
December 06, 2022SN 900: LastPass Again - South Dakota bans TikTok, Anker Eufy Camera debacle, Mozilla yanks trusted root
Picture of the Week.

Don't mess with Australia.

Facebook / Meta fined by Ireland.

REvil's full Medibank dump.

Is nothing sacred?

Mozilla yanks a (no longer) trusted root.

Android Platform Certs Escape.

South Dakota says: No more Tik-Tok.

Albania blames its IT staff.

Good news on the memory safe languages front.

Black Hat USA 2022.

Another Chrome 0-day bites the dust.

Anker's Eufy Camera debacle.

An amazing-looking WiFi-6 router... $119.

Elon really said this.

Closing the Loop.

SpinRite.

LastPass Again.

Show Notes https://www.grc.com/sn/SN-900-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
itpro.tv/securitynow
canary.tools/twit - use code: TWIT
plextrac.com/twit
2 hr 3 min
November 29, 2022SN 899: Freebie Bots & Evil Cameras - iSpoofer no more, Boa server vulnerability, CISA on Mastodon
Picture of the Week.

iSpoof you no more.

Here come the Freebie Bots!

Anatomy of the real-time Cryptocurrency heist.

Lookin' for something to do?

Boa server vulnerability.

The dilemma of closed-source Chinese networking products.

The Cyber Defense Index.

Malicious Docker Hub images.

Since we've been tracking 0-days for a while.

CISA on Mastodon.

Miscellany.

Closing The Loop.

SpinRite.

Show Notes https://www.grc.com/sn/SN-899-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
kolide.com/securitynow
plextrac.com/twit
nordlayer.com/twit
1 hr 59 min
November 22, 2022SN 898: Wi-Peep - FBI purchased Pegasus, Passkey support directory, Quantum decryption deadline, Firefox 107
Picture of the Week.

Firefox v107 was released last Tuesday.

Google settles for a cool $391.5 million.

Red Hat Signing its ZIP file Packages.

The FBI purchased Pegasus for "research and development purposes".

Greece bought Predator for €7 million.

A passkeys support directory.

Quantum decryption deadline.

Attorneys General ask the FTC for online privacy regulation.

Closing The Loop.

SpinRite.

Wi-Peep.

Show Notes https://www.grc.com/sn/SN-898-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
tanium.com/twit
barracuda.com/securitynow
Secureworks.com/twit
2 hr 16 min
November 15, 2022SN 897: Memory-Safe Languages - Shennina Framework, Shufflecake, The Helm, LightSpeed vulnerabilities
Picture of the Week.

Patch Tuesday review.

Shennina Framework - Automating Host Exploitation with AI.

GitHub's welcome new feature.

Three LightSpeed vulnerabilities.

Shufflecake: Plausible deniability encrypted Linux volumes.

Australia has decided to get proactive!

Apple's iOS 16.1.1 everyone file sharing time-limits to 10 minutes in China.

A couple of Decentralized Finance notes because I can't help myself.

"The Helm" was unable to survive COVID-19.

Elon meets Twitter.

Closing The Loop.

SpinRite.

Memory-Safe Languages.

Show Notes - https://www.grc.com/sn/SN-897-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
bitwarden.com/twit
expressvpn.com/securitynow
grammarly.com/tone
1 hr 51 min
November 08, 2022SN 896: Something for Everyone - Dropbox breach, cyber bank heists, Russia goes Linux, OpenSSL flaw update
Picture of the Week.

A minor Dropbox breach.

OpenSSL follow-up.

FTC sued and settled with a repeated offender.

$1.2 billion in reported ransomware payments during 2021.

Akamai's Q3 Threat Report.

Initial Access Brokerages.

How do today's bank heists work?

De-Fi De-struction De-jour.

Russia moves to Linux.

We're The Red Cross. Don't attack us, please!

Where there's a will, there's a way.

From China with Love.

The UK's NCSC scan plan.

Miscellany.

Closing The Loop.

SpinRite.

We invite you to read our show notes at https://www.grc.com/sn/SN-896-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
canary.tools/twit - use code: TWIT
drata.com/twit
1 hr 55 min
November 01, 2022SN 895: After 20 years in GCHQ - Stranger Strings, PayPal passkeys, new TCP/IP RCE in Windows
Picture of the Week.

Windows driver blocklist to be updated next Tuesday.

More Microsoft shenanigans.

An upcoming OpenSSL CRITICAL vulnerability update -- get ready!

A new TCP/IP RCE in Windows.

A study of malicious CVE proof of concept exploits in GitHub.

"Stranger Strings" : An exploitable flaw in SQLite.

PayPal to add support for Passkeys.

A browser exploitation tutorial!

Kathleen Booth: July 9th, 1922 – September 29, 2022.

Closing The Loop.

SpinRite.

After 20 years in GCHQ.

We invite you to read our show notes at https://www.grc.com/sn/SN-895-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
nordlayer.com/twit
kolide.com/securitynow
itpro.tv/securitynow
2 hr 2 min
October 25, 2022SN 894: Data Breach Responsibility - Firefox 106, KataOS and Sparrow, banking malware, CVSS 9.8 update
Picture of the Week.

Firefox 106 is out.

Google's Open Source IoT KataOS and Sparrow.

This Week in CryptoCurrency Craziness.

New Windows 0-day bypasses executable security checks.

Apple's 9th 0-day of the year bites the dust.

The evolutionary demise of banking malware.

VMWare's Critical CVSS 9.8 Update.

Closing The Loop.

Miscellany.

Data Breach Responsibility.

We invite you to read our show notes at https://www.grc.com/sn/SN-894-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
drata.com/twit
Secureworks.com/twit
barracuda.com/securitynow
1 hr 58 min
October 18, 2022SN 893: Password Change Automation - Windows Update RSS, malicious kernal drivers, Signal SMS/MMS, ZimaBoard
Picture of the Week.

Microsoft "Won't Fix".

Malicious Kernel Drivers.

Microsoft has finally added an RSS feed for Windows Updates!

Passkeys [dot] Dev.

Largest DDoS attack.

Signal will be dropping its SMS/MMS support.

Brute-force protection for Windows local admin accounts.

Other than that...

SpinRite.

Closing The Loop.

xchg rax, rax and "xorpd"

ZimaBoard Goodness.

Password Change Automation.

We invite you to read our show notes at https://www.grc.com/sn/SN-893-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.
Sponsors:
wwt.com/twit
canary.tools/twit - use code: TWIT
expressvpn.com/securitynow
2 hr 1 min

About Security Now (Audio)

From the publisher's feed

Cybersecurity guru Steve Gibson joins Leo Laporte every Tuesday. Steve and Leo break down the latest cybercrime and hacking stories, offering a deep understanding of what's happening and how to protect yourself and your business. Security Now is a must listen for security professionals every week.

You can join Club TWiT for $10 per month and get ad-free audio and video feeds for all our shows plus everything else the club offers...or get just this podcast ad-free for $5 per month.