Security Now (Video)

This Week's Security News:

• More Windows 10 lost profile pain
• A micropatch for the jscript.dll problem
• Coming in the next Feature Release (Win10 2004): optional device driver updates
• A new attack on 4G LTE and 5G
• Starting today: DoH by default on Firefox
• A new next-generation WebAssembly sandbox is coming first to Linux and Mac and then to Windows
• Chrome was just updated to close a 0-day attack
• Safari will only trust certificates with a validity of 398 days or less

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

TWiT Audience Survey- ENDS FEBRUARY 19TH!!!

• It's time for TWiT's annual audience survey and we want to hear from you! It only takes five minutes.
• Please visit twit.tv/survey and let us know what you think.
• There's no sign-up form and we don't track you. Your feedback helps us make TWiT even better."

This Week's Stories

• How to fix the Windows 7 "You don't have permission to shut down this computer." error
• Win10's "One Button PC Reset" fails after KB4524244.
• And, also... "The new disappearing User Profile problem" (Desktop and all user data)
• The popular "GDPR Cookie Consent" Wordpress plugin had a critical flaw
• Whoa! The average tenure of a CISO is just 26 months due to high stress and burnout
• Microsoft's "ElectionGuard" being used for the first time today!
• IoT lightbulb vulnerabilities are not such a joke, after all.
• SweynTooth Vulnerabilities: a set of more than 12 newly discovered vulnerabilities across a wide range of Bluetooth devices, many of which will never be updated, which allow for, among other things, full device compromise.

We invite you to read our show notes at https://www.grc.com/sn/SN-754-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

• Twitter, Google, and Facebook tell Clearview AI to stop stealing your face to catch crooks
• The NIST is testing methods to recover data from smashed smartphones
• Whoa! We get to REMAIN with Security Essentials under Windows 7!
• Microsoft drops a fix for the wallpaper stretch black screen
• Windows 7 users are being told: "You don't have permission to shut down this computer."
• Win10 Firefox users being "reminded" about Edge
• Last week Google closed an Android RCE flaw in the BlueTooth daemon.
• Data Exfiltration Technique of the Week
• CIA Uses Crypto AG to spy on the world
• Chrome 80 appeared last week with its implementation of the updated handling of the optional "SameSite" enforcement cookie property

We invite you to read our show notes at https://www.grc.com/sn/SN-753-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• - L1D Eviction Sampling becomes "CacheOut"
• - Only one final version of Windows?
• - Windows 7 and the Free Software Foundation
• - Windows 7's final patch broke wallpaper stretching
• - RCE Exploit for Windows RDP Gateway Demoed by Researcher
• - Google more than doubles its own bug bounty record
• - The return of Roskomnadzor!
• - Facebook DID get fined, but not by Russia
• - who exactly owns our biometric data?
• - Avast Jumpshot missed the hoop
• - An Update on the WireGuard VPN in the Linux kernel
• - In this week's Best Hack of the New Decade... a little red wagon

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Is Apple actually encrypting our iCloud storage backups?
• 250 Million Microsoft Customer Support Records Exposed Online
• New York state is aiming to ban the use of public funds for Ransomware
• New Muhstik Botnet Attacks Target Tomato Routers
• Chrome under attack from browser extensions
• Firefox under attack from browser extensions
• NIST publishes a new Privacy Framework
• Hacker Leaks More Than 500K Telnet Credentials for IoT Devices
• A Welcome "Micro Patch" for the Windows IE jscript.dll 0-day vulnerability
• SHA-1 is a Shambles.

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

This Week's Stories:

• iPhones join Android in being a Google account security key.
• How much "substantive assistance" did Apple provide in the Pensacola investigation?
• A brand new serious Internet Explorer 0-day
• Giving Windows an additional Edge
• FBI says nation-state actors breached a US city government and a US financial entity by exploiting Pulse Secure VPN servers.
• Critical new Windows Remote Desktop Gateway (RD Gateway) remote code execution vulnerability
• SQRL for Drupal
• Microsoft issues security update to fix "CurveBall" vulnerability

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Windows 7 support dies today, but 1 in 7 PCs are still running it
• Cablehaunt- the remote exploit with the catchy logo that works on ALL cable modems
• US government still wants backdoor access to iPhones
• CheckRain iPhone jailbreak keeps getting better
• How Apple scans your photos for evidence of child abuse
• The sim swapping threat
• Anatomy/timeline of the exploitation of an unpatched VPN bug
• And speaking of patching right away... patch your Firefox browser right now!

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• The Deadly Seven top cybersecurity attacks
• Russia successfully cuts itself off from the rest of the internet.
• Love Wawa? Surprise! Your credit card has been stolen.
• Huge Point of Sale attack on all of Landry's restaurants, including Rainforest Cafe.
• Python 2.7 Reaches End of Life After 20 Years.
• HackerOne's 20 top bug bounty programs
• A proposed standard for making warrant canaries machine-readable
• Xiaomi IoT camera owners can watch other Xiaomi users' video feeds.
• Microsoft is wrong on RDP vulnerability.

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

The best of Security Now from 2019.

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

On this Eve of 2020, we look back over the hacks of the past decade:

• The big news of 2010 was Stuxnet -- Boy did THAT make an impression
• Operation Aurora - the hack that changed Google
• The Sony Playstation Hack
• And then we have... Diginotar
• Edward Snowden
• The Target hack
• The Adobe hack
• Silk Road takedown
• Have I Been Pwned?
• The hack of Sony Pictures
• The hack of Mt. Gox
• Heartbleed
• RowHammer
• Ashley Madison data breach
• SIM swapping
• The Ukraine power grid hacks
• DNC hack
• Yahoo hacks go public
• The Shadow Brokers
• The birth of IoT botnets
• WannaCry / Petya / NotPetya
• Vault7 leaks
• MongoDB exposed
• Equifax
• Coinhive & Cryptojacking
• Meltdown, Spectre, and the CPU side-channel attacks
• Marriott gets hacked
• 2019 - The Year of the Ransomware

We invite you to read our show notes at https://www.grc.com/sn/SN-746-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.