Security Now (Video)

This Week's Stories:

• Google turns over 1500 users' location data to catch Milwaukee arsonist
• Android's Messenger app offers its users verified SMS messaging conversations with supporting companies
• US Senate Judiciary Committee threatens Apple and Facebook
• Apple's iOS v13.3 adds support for hardware key dongle authentication in Safari
• Patch Tuesday shuts down a widespread elevation of privilege vulnerability
• Researchers discover prime factor collisions in active RSA certificates
• New Orleans hit by a ransomware attack on Friday the 13th
• Chrome stops displaying "www."
• Google re-enables their Chrome's new code integrity protection feature
• Plundervolt: software-based fault injection attacks against Intel SGX

We invite you to read our show notes at

https://www.grc.com/sn/SN-745-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Microsoft has started forcing feature updates on people who don't want them.
• Bypass to continue obtaining Win7 updates created.
• Microsoft's Project Verona continues moving forward.
• Microsoft's RDP client for iOS is back.
• Avast / AVG in the doghouse.
• Making a mountain out of a VPN molehill.

We invite you to read our show notes at https://www.grc.com/sn/SN-744-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• Everyone can still upgrade to Windows 10 for free with this trick
• HP SSDs fail after 32768 hours
• The EU is not happy about a possible US encryption ban
• US government's formal permission to hack
• 110 nursing homes have been crippled by a ransomware attack
• Firefox is seriously pushing back on tracking signal leakage
• New problems with Windows DLLs
• The StrandHogg vulnerability

We invite you to read our show notes at https://www.grc.com/sn/SN-743-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

• The future of the Linux kernel underneath the Android OS
• Inherent challenges presented by the nature of the Android ecosystem
• VNC users: Time to update!
• A welcome change to Twitter & SMS-based 2FA
• A "foregone conclusion" to law enforcement's strategy to force password divulgence
• Pre-announcement from Microsoft about DNS
• Details of the emerging DoH protocol

We invite you to read our show notes at https://www.grc.com/sn/SN-742-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

• November's Patch Tuesday is the antepenultimate free Windows 7 update
• CheckM8 & https://Checkra.in
• GitHub launches Security Lab to boost open-source security
• Warrantless searches of devices at US borders were just ruled unconstitutional
• Another WhatsApp bug lets hackers quietly install spyware on your device
• ZombieLoad v2
• The ByteCode Alliance
• http://tpm.fail/

We invite you to read our show notes at https://www.grc.com/sn/SN-741-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

• CheckM8 & Checkra.in moves to first public beta
• The case of the misbehaving transducer
• BlueKeep and Microsoft
• BlueKeep and BSODs
• BlueKeep and Marcus Hutchins
• Mozilla on DoH -vs- COMCAST
• Yet another approach for solving the problem of certificate revocation within a more limited scope.

We invite you to read our show notes at https://www.grc.com/sn/SN-740-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

• October's Windows Patch Tuesday BROKE Windows' ability to connect to a significant number of the Internet's websites. Here's how to fix it.
• Chrome 78 disables Code Integrity Check to mitigate "Aw Snap!" crashes.
• "Chrome 78 patches a Chrome 0-day which had been discovered by Kaspersky being exploited in the wild."
• News from the Edge: the first Chromium-based Microsoft Edge Stable Release Candidate.
• Microarchitectural Data Sampling Vulnerabilities.
• Trouble for QNAP NAS devices exposed to the Internet.
• MSP's -- Managed Service Providers -- are a major vector for ransomware delivery.
• Five months after returning a rental car, man still has the remote control.
• Chinese-made drones in the US are being grounded.
• The DNS-over-HTTPS (DoH) controversy.
• BlueKeep-based attacks have finally started, and what we predicted on this podcast has finally happened.

We invite you to read our show notes at https://www.grc.com/sn/SN-739-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories

• 3rd-party antivirus strikes again
• Windows Defender offline scan
• Adobe databases hacked
• Johannesburg hit by ransomware
• Firefox's anti-tracking effectiveness
• Bad new PHP/NGINX RCE being exploited in the wild
• Goodbye SMS (maybe kinda) Hello RCS?
• Forced Password Disclosure

We invite you to read our show notes: https://www.grc.com/sn/SN-738-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

• Pixel 4 Face Unlock is so easy you can do it with your eyes closed!
• Samsung Galaxy S10 and Note 10 fingerprint sensor can be foiled with a $3 screen protector.
• The frenzy to turn CheckM8 into a consumer-friendly iOS jailbreak.
• Steganography finds a new host file format.
• Security display changes are coming to Firefox 70.
• More on Microsoft's open source "ElectionGuard" election security system.
• A potentially serious flaw found in Realtek WiFi drivers.
• Yubikey for local Windows login has been officially released.

We invite you to read our show notes at https://www.grc.com/sn/SN-737-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This week's stories

• A sobering reminder about supply chain attacks
• Facebook's stance on end-to-end encryption raises official protests
• UNIX's Co-Creator Ken Thompson's BSD UNIX Password Has Finally Been Cracked
• Japanese stalker finds idol using reflections in her eyes
• Americans and Digital Knowledge
• OpenPGP being built into Mozilla's Thunderbird eMail client
• Windows 10 Tamper Protection being enabled by default
• CheckM8
  
  We invite you to read our show notes at https://www.grc.com/sn/SN-736-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: