Security Now (Video)

Zoom Fixes Security, EARN IT is Evil, Tor in Trouble

• Zoom gets big-name help with security fixes
• Google updates Chrome to v81.0.4044.113 to squash a critical flaw
• FTP in Chrome lives another day! Google "undepreciates" FTP.
• Windows Patch Tuesday for April 2020 fixes 113 vulnerabilities
• "Basic Authentication" lives another day! Due to COVID-19, Microsoft and Google will keep "Basic Authentication" around for a little while longer
• EARN IT Act: call your Senator before it is too late!
• Tor Project fires over 1/3 of its staff
• Cloudflare dumps Google's reCAPTCHA

We invite you to read our show notes at https://www.grc.com/sn/SN-763-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Apple+Google Covid Tracker is Secure and RIP John Conway, Creator of The Game of Life

• Apple & Google Virus Contact Tracing: secure and effective
• Zoom gets another Zoom-bombing mitigation... and a Class-Action Lawsuit
• Meanwhile, Zoom has enlisted the aid of Alex Stamos
• Zoom creates a CISO Council
• What's next for Zoom?
• Browser Security News: Chrome 81 and Firefox 75
• Android Apps Again in the Crosshairs
• Sandboxie goes Open Source
• RIP John Conway, creator of Conway's Game of Life

We invite you to read our show notes at https://www.grc.com/sn/SN-762-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom is a security nightmare - from zoombombing to encryption issues, Steve Gibson runs down Zoom's security concerns. Plus, Jitsi is a great alternative!

• Mozilla just patched a pair of CRITICAL 0-days
• Eight security bugs eliminated from Chrome last week
• Safari gets a bunch of very important fixes
• Chrome and Edge join Mozilla in postponing the deprecation of TLS v1.0 and v1.1
• Chrome team reversing themselves on the enforcement of Same Site cookies
• Edge with Vertical Tabs and Smart Copy
• The return of STIR & SHAKEN
• Cloudflare has added Parental Control to their 1.1.1.1 DNS service
• Cloudflare's new service accidentally blocks LGBTQIA+ sites

We invite you to read our show notes at https://www.grc.com/sn/SN-761-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

iOS VPN bug, Coronavirus Folding@Home

• VPN bug in iOS 13.4
• Folding@Home - how to donate your unused CPU cycles to help provide answers to COVID-19.
• RDP and VPN use skyrocketing
• To 'www' or not to 'www'
• Firefox 76 to finally stop assuming "HTTP"
• Google again revises its schedule for Chrome releases
• Microsoft moves to support "Shadow Stacks"
• Cloudflare's 1.1.1.1 DNS is audited by KPMG

We invite you to read our show notes at https://www.grc.com/sn/SN-760-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

This week's stories:

• Two new un-patched 0-days affecting billions of Windows users - here is the fix!
• Mozilla reversed itself on TLS v1.0 and 1.1 deprecation... due to the coronavirus
• A micropatch for Win7 and Server 2008
• Chrome's release schedule has been impacted by the coronavirus
• Avast emergency-disables their internal JavaScript emulator
• CookieThief - "FireSheep evolves for the 21st century"
• PwnToOwn Spring 2020 winners
• Steve's coronavirus journey
• The fixes for RowHammer have not worked

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Does Steve have coronavirus? Maybe? He got very sick over the weekend and is still coughing, but he couldn't get tested.
• Mayhem ensues after last week's Patch Tuesday
• List of free technology services during coronavirus, from Adobe to Zoom
• The state of open source vulnerabilities
• The "EARN IT" act is a despicable attack on encryption and freedom of speech. Please call your congressperson and tell them not to support it.
• The SMBGhost Fiasco

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Microsoft, Google, LogMeIn & Cisco offer limited-time free use of telecommuting Tools
• Hack the Pentagon!
• The Android security dilemma
• AMD processors get some unwelcome but necessary side-channel attack scrutiny
• Intel also has some serious new trouble on its hands
• SETI@home shuts down its distributed computing project after 21 years
• Critical PPP daemon flaw opens most Linux systems to remote hackers
• FuzzBench: fuzzer benchmarking as a service

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Lets Encrypt hits 1 BILLION certs
• Pakistan passes Internet censorship law
• Clearview AI breach: clients and searches stolen
• Swiss government submits criminal complaint over CIA Crypto spying scandal
• Ghostcat - (Apache) Tomcat Users: Update NOW!
• Revisiting OCSP Must Staple
• Kr00k: serious WiFi vulnerability affecting more than a billion devices

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Security News:

• More Windows 10 lost profile pain
• A micropatch for the jscript.dll problem
• Coming in the next Feature Release (Win10 2004): optional device driver updates
• A new attack on 4G LTE and 5G
• Starting today: DoH by default on Firefox
• A new next-generation WebAssembly sandbox is coming first to Linux and Mac and then to Windows
• Chrome was just updated to close a 0-day attack
• Safari will only trust certificates with a validity of 398 days or less

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

TWiT Audience Survey- ENDS FEBRUARY 19TH!!!

• It's time for TWiT's annual audience survey and we want to hear from you! It only takes five minutes.
• Please visit twit.tv/survey and let us know what you think.
• There's no sign-up form and we don't track you. Your feedback helps us make TWiT even better."

This Week's Stories

• How to fix the Windows 7 "You don't have permission to shut down this computer." error
• Win10's "One Button PC Reset" fails after KB4524244.
• And, also... "The new disappearing User Profile problem" (Desktop and all user data)
• The popular "GDPR Cookie Consent" Wordpress plugin had a critical flaw
• Whoa! The average tenure of a CISO is just 26 months due to high stress and burnout
• Microsoft's "ElectionGuard" being used for the first time today!
• IoT lightbulb vulnerabilities are not such a joke, after all.
• SweynTooth Vulnerabilities: a set of more than 12 newly discovered vulnerabilities across a wide range of Bluetooth devices, many of which will never be updated, which allow for, among other things, full device compromise.

We invite you to read our show notes at https://www.grc.com/sn/SN-754-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: