Security Now (Video)

• Twitter, Google, and Facebook tell Clearview AI to stop stealing your face to catch crooks
• The NIST is testing methods to recover data from smashed smartphones
• Whoa! We get to REMAIN with Security Essentials under Windows 7!
• Microsoft drops a fix for the wallpaper stretch black screen
• Windows 7 users are being told: "You don't have permission to shut down this computer."
• Win10 Firefox users being "reminded" about Edge
• Last week Google closed an Android RCE flaw in the BlueTooth daemon.
• Data Exfiltration Technique of the Week
• CIA Uses Crypto AG to spy on the world
• Chrome 80 appeared last week with its implementation of the updated handling of the optional "SameSite" enforcement cookie property

We invite you to read our show notes at https://www.grc.com/sn/SN-753-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• - L1D Eviction Sampling becomes "CacheOut"
• - Only one final version of Windows?
• - Windows 7 and the Free Software Foundation
• - Windows 7's final patch broke wallpaper stretching
• - RCE Exploit for Windows RDP Gateway Demoed by Researcher
• - Google more than doubles its own bug bounty record
• - The return of Roskomnadzor!
• - Facebook DID get fined, but not by Russia
• - who exactly owns our biometric data?
• - Avast Jumpshot missed the hoop
• - An Update on the WireGuard VPN in the Linux kernel
• - In this week's Best Hack of the New Decade... a little red wagon

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Is Apple actually encrypting our iCloud storage backups?
• 250 Million Microsoft Customer Support Records Exposed Online
• New York state is aiming to ban the use of public funds for Ransomware
• New Muhstik Botnet Attacks Target Tomato Routers
• Chrome under attack from browser extensions
• Firefox under attack from browser extensions
• NIST publishes a new Privacy Framework
• Hacker Leaks More Than 500K Telnet Credentials for IoT Devices
• A Welcome "Micro Patch" for the Windows IE jscript.dll 0-day vulnerability
• SHA-1 is a Shambles.

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

This Week's Stories:

• iPhones join Android in being a Google account security key.
• How much "substantive assistance" did Apple provide in the Pensacola investigation?
• A brand new serious Internet Explorer 0-day
• Giving Windows an additional Edge
• FBI says nation-state actors breached a US city government and a US financial entity by exploiting Pulse Secure VPN servers.
• Critical new Windows Remote Desktop Gateway (RD Gateway) remote code execution vulnerability
• SQRL for Drupal
• Microsoft issues security update to fix "CurveBall" vulnerability

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Windows 7 support dies today, but 1 in 7 PCs are still running it
• Cablehaunt- the remote exploit with the catchy logo that works on ALL cable modems
• US government still wants backdoor access to iPhones
• CheckRain iPhone jailbreak keeps getting better
• How Apple scans your photos for evidence of child abuse
• The sim swapping threat
• Anatomy/timeline of the exploitation of an unpatched VPN bug
• And speaking of patching right away... patch your Firefox browser right now!

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• The Deadly Seven top cybersecurity attacks
• Russia successfully cuts itself off from the rest of the internet.
• Love Wawa? Surprise! Your credit card has been stolen.
• Huge Point of Sale attack on all of Landry's restaurants, including Rainforest Cafe.
• Python 2.7 Reaches End of Life After 20 Years.
• HackerOne's 20 top bug bounty programs
• A proposed standard for making warrant canaries machine-readable
• Xiaomi IoT camera owners can watch other Xiaomi users' video feeds.
• Microsoft is wrong on RDP vulnerability.

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

The best of Security Now from 2019.

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

On this Eve of 2020, we look back over the hacks of the past decade:

• The big news of 2010 was Stuxnet -- Boy did THAT make an impression
• Operation Aurora - the hack that changed Google
• The Sony Playstation Hack
• And then we have... Diginotar
• Edward Snowden
• The Target hack
• The Adobe hack
• Silk Road takedown
• Have I Been Pwned?
• The hack of Sony Pictures
• The hack of Mt. Gox
• Heartbleed
• RowHammer
• Ashley Madison data breach
• SIM swapping
• The Ukraine power grid hacks
• DNC hack
• Yahoo hacks go public
• The Shadow Brokers
• The birth of IoT botnets
• WannaCry / Petya / NotPetya
• Vault7 leaks
• MongoDB exposed
• Equifax
• Coinhive & Cryptojacking
• Meltdown, Spectre, and the CPU side-channel attacks
• Marriott gets hacked
• 2019 - The Year of the Ransomware

We invite you to read our show notes at https://www.grc.com/sn/SN-746-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

This Week's Stories:

• Google turns over 1500 users' location data to catch Milwaukee arsonist
• Android's Messenger app offers its users verified SMS messaging conversations with supporting companies
• US Senate Judiciary Committee threatens Apple and Facebook
• Apple's iOS v13.3 adds support for hardware key dongle authentication in Safari
• Patch Tuesday shuts down a widespread elevation of privilege vulnerability
• Researchers discover prime factor collisions in active RSA certificates
• New Orleans hit by a ransomware attack on Friday the 13th
• Chrome stops displaying "www."
• Google re-enables their Chrome's new code integrity protection feature
• Plundervolt: software-based fault injection attacks against Intel SGX

We invite you to read our show notes at

https://www.grc.com/sn/SN-745-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Microsoft has started forcing feature updates on people who don't want them.
• Bypass to continue obtaining Win7 updates created.
• Microsoft's Project Verona continues moving forward.
• Microsoft's RDP client for iOS is back.
• Avast / AVG in the doghouse.
• Making a mountain out of a VPN molehill.

We invite you to read our show notes at https://www.grc.com/sn/SN-744-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: