Security Now (Video)

China wants to rebuild the Internet.

• China's proposal to rebuild the internet is an authoritarian nightmare
• Bruce Schneier on COVID-19 Contact Tracing Apps
• Political Correctness hits cybersecurity
• DHS's CISA says no to 3rd-party DoH
• "POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers"
• An authorization bypass in SaltStack
• Adobe's Big Last Tuesday, Non-Patch Tuesday, Update
• Google has announced its impending clean-up of the Chrome Web Store
• Warning about RDP is not crying wolf

We invite you to read our show notes at https://www.grc.com/sn/SN-765-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Apple/Google Contact Tracing, Best VPNs to protect you.

• Apple/Google Contact Tracing Update
• iOS 0-Day Alert! Update Apple Mail
• Best VPNs to protect you from the Five Eyes
• TypoSquatting attacks
• Vitamin D linked to COVID-19 mortality
• Resource Public Key Infrastructure
• How BGP can break the Internet

We invite you to read our show notes at https://www.grc.com/sn/SN-764-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom Fixes Security, EARN IT is Evil, Tor in Trouble

• Zoom gets big-name help with security fixes
• Google updates Chrome to v81.0.4044.113 to squash a critical flaw
• FTP in Chrome lives another day! Google "undepreciates" FTP.
• Windows Patch Tuesday for April 2020 fixes 113 vulnerabilities
• "Basic Authentication" lives another day! Due to COVID-19, Microsoft and Google will keep "Basic Authentication" around for a little while longer
• EARN IT Act: call your Senator before it is too late!
• Tor Project fires over 1/3 of its staff
• Cloudflare dumps Google's reCAPTCHA

We invite you to read our show notes at https://www.grc.com/sn/SN-763-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Apple+Google Covid Tracker is Secure and RIP John Conway, Creator of The Game of Life

• Apple & Google Virus Contact Tracing: secure and effective
• Zoom gets another Zoom-bombing mitigation... and a Class-Action Lawsuit
• Meanwhile, Zoom has enlisted the aid of Alex Stamos
• Zoom creates a CISO Council
• What's next for Zoom?
• Browser Security News: Chrome 81 and Firefox 75
• Android Apps Again in the Crosshairs
• Sandboxie goes Open Source
• RIP John Conway, creator of Conway's Game of Life

We invite you to read our show notes at https://www.grc.com/sn/SN-762-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom is a security nightmare - from zoombombing to encryption issues, Steve Gibson runs down Zoom's security concerns. Plus, Jitsi is a great alternative!

• Mozilla just patched a pair of CRITICAL 0-days
• Eight security bugs eliminated from Chrome last week
• Safari gets a bunch of very important fixes
• Chrome and Edge join Mozilla in postponing the deprecation of TLS v1.0 and v1.1
• Chrome team reversing themselves on the enforcement of Same Site cookies
• Edge with Vertical Tabs and Smart Copy
• The return of STIR & SHAKEN
• Cloudflare has added Parental Control to their 1.1.1.1 DNS service
• Cloudflare's new service accidentally blocks LGBTQIA+ sites

We invite you to read our show notes at https://www.grc.com/sn/SN-761-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

iOS VPN bug, Coronavirus Folding@Home

• VPN bug in iOS 13.4
• Folding@Home - how to donate your unused CPU cycles to help provide answers to COVID-19.
• RDP and VPN use skyrocketing
• To 'www' or not to 'www'
• Firefox 76 to finally stop assuming "HTTP"
• Google again revises its schedule for Chrome releases
• Microsoft moves to support "Shadow Stacks"
• Cloudflare's 1.1.1.1 DNS is audited by KPMG

We invite you to read our show notes at https://www.grc.com/sn/SN-760-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

This week's stories:

• Two new un-patched 0-days affecting billions of Windows users - here is the fix!
• Mozilla reversed itself on TLS v1.0 and 1.1 deprecation... due to the coronavirus
• A micropatch for Win7 and Server 2008
• Chrome's release schedule has been impacted by the coronavirus
• Avast emergency-disables their internal JavaScript emulator
• CookieThief - "FireSheep evolves for the 21st century"
• PwnToOwn Spring 2020 winners
• Steve's coronavirus journey
• The fixes for RowHammer have not worked

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Does Steve have coronavirus? Maybe? He got very sick over the weekend and is still coughing, but he couldn't get tested.
• Mayhem ensues after last week's Patch Tuesday
• List of free technology services during coronavirus, from Adobe to Zoom
• The state of open source vulnerabilities
• The "EARN IT" act is a despicable attack on encryption and freedom of speech. Please call your congressperson and tell them not to support it.
• The SMBGhost Fiasco

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Microsoft, Google, LogMeIn & Cisco offer limited-time free use of telecommuting Tools
• Hack the Pentagon!
• The Android security dilemma
• AMD processors get some unwelcome but necessary side-channel attack scrutiny
• Intel also has some serious new trouble on its hands
• SETI@home shuts down its distributed computing project after 21 years
• Critical PPP daemon flaw opens most Linux systems to remote hackers
• FuzzBench: fuzzer benchmarking as a service

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Lets Encrypt hits 1 BILLION certs
• Pakistan passes Internet censorship law
• Clearview AI breach: clients and searches stolen
• Swiss government submits criminal complaint over CIA Crypto spying scandal
• Ghostcat - (Apache) Tomcat Users: Update NOW!
• Revisiting OCSP Must Staple
• Kr00k: serious WiFi vulnerability affecting more than a billion devices

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: