Security Now (Video)

WiFi 6, Apple vs. FBI, face masks.

• Last Tuesday's Windows patch Tuesday was not the biggest ever, but it was the 3rd largest in Microsoft's history, weighing in with a whopping 111 CVE-tracked bug fixes, 16 of which were rated CRITICAL and all but one of which enabled Remote Code Execution by an attacker.
• The DOJ and FBI again criticize Apple over encryption
• When is a fix not a fix?
• Face masks have thwarted the London police's LFR rollout
• Utah chooses to roll their own contact tracing app
• Everything you need to know about WiFi 6

We invite you to read our show notes at https://www.grc.com/sn/SN-767-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Thunderbolt security flaw, Zoom buys Keybase.

• Why the ThunderSpy Thunderbolt security flaw is such a big deal
• Zoom purchases Keybase to fix encryption
• Firefox 76 released with new features
• But Firefox 76 broke Amazon's Assistant!
• Hallelujah!! Edge moves to silence those annoying notification requests.
• Critical WordPress plugin bugs present on over one million sites
• Critical vBulletin patch
• Samsung has patched a CRITICAL bug affecting the past 6 years of Smartphones
• DefCon and Black Hat 2020 go virtual

We invite you to read our show notes at https://www.grc.com/sn/SN-766-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

China wants to rebuild the Internet.

• China's proposal to rebuild the internet is an authoritarian nightmare
• Bruce Schneier on COVID-19 Contact Tracing Apps
• Political Correctness hits cybersecurity
• DHS's CISA says no to 3rd-party DoH
• "POWER-SUPPLaY: Leaking Data from Air-Gapped Systems by Turning the Power-Supplies Into Speakers"
• An authorization bypass in SaltStack
• Adobe's Big Last Tuesday, Non-Patch Tuesday, Update
• Google has announced its impending clean-up of the Chrome Web Store
• Warning about RDP is not crying wolf

We invite you to read our show notes at https://www.grc.com/sn/SN-765-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Apple/Google Contact Tracing, Best VPNs to protect you.

• Apple/Google Contact Tracing Update
• iOS 0-Day Alert! Update Apple Mail
• Best VPNs to protect you from the Five Eyes
• TypoSquatting attacks
• Vitamin D linked to COVID-19 mortality
• Resource Public Key Infrastructure
• How BGP can break the Internet

We invite you to read our show notes at https://www.grc.com/sn/SN-764-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom Fixes Security, EARN IT is Evil, Tor in Trouble

• Zoom gets big-name help with security fixes
• Google updates Chrome to v81.0.4044.113 to squash a critical flaw
• FTP in Chrome lives another day! Google "undepreciates" FTP.
• Windows Patch Tuesday for April 2020 fixes 113 vulnerabilities
• "Basic Authentication" lives another day! Due to COVID-19, Microsoft and Google will keep "Basic Authentication" around for a little while longer
• EARN IT Act: call your Senator before it is too late!
• Tor Project fires over 1/3 of its staff
• Cloudflare dumps Google's reCAPTCHA

We invite you to read our show notes at https://www.grc.com/sn/SN-763-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Apple+Google Covid Tracker is Secure and RIP John Conway, Creator of The Game of Life

• Apple & Google Virus Contact Tracing: secure and effective
• Zoom gets another Zoom-bombing mitigation... and a Class-Action Lawsuit
• Meanwhile, Zoom has enlisted the aid of Alex Stamos
• Zoom creates a CISO Council
• What's next for Zoom?
• Browser Security News: Chrome 81 and Firefox 75
• Android Apps Again in the Crosshairs
• Sandboxie goes Open Source
• RIP John Conway, creator of Conway's Game of Life

We invite you to read our show notes at https://www.grc.com/sn/SN-762-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Zoom is a security nightmare - from zoombombing to encryption issues, Steve Gibson runs down Zoom's security concerns. Plus, Jitsi is a great alternative!

• Mozilla just patched a pair of CRITICAL 0-days
• Eight security bugs eliminated from Chrome last week
• Safari gets a bunch of very important fixes
• Chrome and Edge join Mozilla in postponing the deprecation of TLS v1.0 and v1.1
• Chrome team reversing themselves on the enforcement of Same Site cookies
• Edge with Vertical Tabs and Smart Copy
• The return of STIR & SHAKEN
• Cloudflare has added Parental Control to their 1.1.1.1 DNS service
• Cloudflare's new service accidentally blocks LGBTQIA+ sites

We invite you to read our show notes at https://www.grc.com/sn/SN-761-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

iOS VPN bug, Coronavirus Folding@Home

• VPN bug in iOS 13.4
• Folding@Home - how to donate your unused CPU cycles to help provide answers to COVID-19.
• RDP and VPN use skyrocketing
• To 'www' or not to 'www'
• Firefox 76 to finally stop assuming "HTTP"
• Google again revises its schedule for Chrome releases
• Microsoft moves to support "Shadow Stacks"
• Cloudflare's 1.1.1.1 DNS is audited by KPMG

We invite you to read our show notes at https://www.grc.com/sn/SN-760-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

This week's stories:

• Two new un-patched 0-days affecting billions of Windows users - here is the fix!
• Mozilla reversed itself on TLS v1.0 and 1.1 deprecation... due to the coronavirus
• A micropatch for Win7 and Server 2008
• Chrome's release schedule has been impacted by the coronavirus
• Avast emergency-disables their internal JavaScript emulator
• CookieThief - "FireSheep evolves for the 21st century"
• PwnToOwn Spring 2020 winners
• Steve's coronavirus journey
• The fixes for RowHammer have not worked

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

This Week's Stories:

• Does Steve have coronavirus? Maybe? He got very sick over the weekend and is still coughing, but he couldn't get tested.
• Mayhem ensues after last week's Patch Tuesday
• List of free technology services during coronavirus, from Adobe to Zoom
• The state of open source vulnerabilities
• The "EARN IT" act is a despicable attack on encryption and freedom of speech. Please call your congressperson and tell them not to support it.
• The SMBGhost Fiasco

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: