What do we learn from January's record breaking 0-day critical Patch Tuesday? Microsoft to "force-install" a new Outlook into all Windows 10 and 11 desktops? GoDaddy required to get much more serious about its hosting security. More age verification enforcement is coming, including globally. What another instance of a widely exposed management interface teaches us. DJI drone's official firmware update lifts geofencing for unrestricted flight. CISA's efforts pay off with MUCH improved critical in...
Jan 22, 2025•3 hr 7 min•Ep 1009•Transcript available on Metacast Meta winds down 3rd-party content filtering. Is encryption soon to follow? Taking over abandoned Command & Control server domains (strictly for research purposes only). IoT devices to get the "Cyber Trust Mark" Will anyone notice or care? "SyncThing" receives a (blessedly infrequent) update. Government email is not using encryption? Really? Email relaying prevents point-to-point end-to-end encryption and authentication. Just because Let's Encrypt doesn't support email doesn't mean it's impos...
Jan 15, 2025•3 hr 50 min•Ep 1008•Transcript available on Metacast The consequences of Internet content restriction. The measured risks of 3rd-party browser extensions. The consequences of SonicWall's unpatched 9.8 firewall severity. The incredible number of still-unencrypted email servers. SonicWall vulnerability patching Shadowserver Foundation & eMail Encryption Salt Typhoon Evicted HIPAA gets a long-needed cybersecurity upgrade. The EU standardizes on USB-C for power charging. What? Believe it or not, a CATCHA you solve by playing DOOM. And... what I le...
Jan 08, 2025•3 hr 47 min•Ep 1007•Transcript available on Metacast Leo revisits some of the year's top Security Now segments of 2024. 956. Apple's Hardware Backdoor: Steve reflects on the previous week's 'The Mystery of CVE-2023-38606' deep-dive. Did Apple deliberately designed a secure backdoor? 960. Unforeseen Consequences of Google's 3rd-party Cookie Cutoff: As Google moves to phase out third-party cookies, the advertising industry scrambles to find new ways to track users, potentially leading to more intrusive methods like requiring users to create accounts...
Dec 23, 2024•3 hr 33 min•Ep 1006•Transcript available on Metacast Is AI the Wizard of Oz? Or is it more? Microsoft's long standing effective MFA login bypass. Is TPM 2.0 not required after all for Windows 11? Meet 14 North Korean IT workers who made $88 million from the West. Android updates its Bluetooth tracking with anti-tracking. The NPM package manager repository has had 540,000 malicious packages discovered hiding in plain sight. The AskWoody site remains alive, well, and terrific. My iPhone is linked to Windows and it's wonderful. Yay. How has email bee...
Dec 18, 2024•2 hr 25 min•Ep 1005•Transcript available on Metacast This week, Steve and Leo discuss the recent 'Salt Typhoon' hack of U.S. telecom providers by China, TPM 2.0 requirement for Windows 11, Microsoft's newly hacked Windows activation system, Apple patenting AI facial and body recognition, and much more. Steve also shares an intriguing conversation he had with the ChatGPT 4o AI system while working on an update to GRC's DNS Benchmark tool. All telecom providers have been hacked and may still not be safe to use. So now the government is recommending ...
Dec 11, 2024•3 hr 33 min•Ep 1004•Transcript available on Metacast Steve Gibson and Leo Laporte discuss Microsoft's clarification about AI training data usage, a fascinating breakthrough in understanding autonomous vehicle vulnerabilities, and an urgent call for help from the Tor Network. The show culminates in an in-depth exploration of NASA's incredible Voyager 1 mission, which continues to communicate with Earth from nearly a light-day away despite increasing technical challenges. Microsoft clarifies they are NOT using customer data from Office apps to train...
Dec 04, 2024•2 hr 18 min•Ep 1003•Transcript available on Metacast What's the new "nearest neighbor" attack and how do you defend against it? Let's Encrypt just turned 10. What changes has it wrought? Now the Coast Guard is worried about Chinese built ship-to-shore cranes. Pakistan becomes the first country to block Bluesky. There's a new way to get Git repos "swatted" and removed. Who's to blame for Palo Alto Networks' serious new 0-day vulnerabilities? If you have any of these six D-Link VPN routers, unplug them immediately! It turns out that VPN apps are aga...
Nov 27, 2024•3 hr 32 min•Ep 1002•Transcript available on Metacast How Microsoft lured the US Government into a far deeper and expensive dependency upon its cybersecurity solutions. Gmail to offer native throwaway email aliases like Apple and Mozilla. Russia to ban several additional hosting companies and give its big Internet disconnect switch another test. Russia uses a diabolical Windows flaw to attack Ukrainians. The value of old Security Now episodes. TrueCrypt's successor. Using Cloudflare's Tunnel service for remote network access. How to make a local se...
Nov 20, 2024•2 hr 27 min•Ep 1001•Transcript available on Metacast Bitwarden reaffirms it's commitment to open source. The rights of German security researchers are clarified. Australia to impose age limits on social media. Free Windows Server 2025 anyone? UAC wasn't getting in the way enough, so they're fixing that. "From Russia with fines" -- obey or else. South Korea fines Meta over serious user privacy violations. Synology's (very) critical zero-click RCE flaw. Malicious Python packages invoked by typos. Google to enforce full MFA for all cloud service user...
Nov 13, 2024•2 hr 18 min•Ep 1000•Transcript available on Metacast Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial produc...
Nov 06, 2024•2 hr 53 min•Ep 999•Transcript available on Metacast Apple proposes 45-day maximum certificate life. SEC fines four companies for downplaying their SolarWinds attack severity. Google adds 5 new features to Messenger including inappropriate content. Does AI-driven local device-side filtering resolve the encryption dilemma forever? The very nice looking "Session" messenger leaves Australia for Switzerland. Another quick look at the question of the EU's software liability moves. Fake North Korean employees WERE found to install backdoor malware. How ...
Oct 30, 2024•3 hr 54 min•Ep 998•Transcript available on Metacast Did Chinese researchers really break RSA encryption? What did they do? What next-level terror extortion is being powered by the NPD breach data? The EU to hold software companies liable for software security? Microsoft lost weeks of security logs. How hard did the try to fix the problem? The Chinese drone company DJI has sued the DoJ over its ban on DJI's drones. The DoJ wishes to acquire "DeepFake" technology to create fake people. Microsoft has bots pretending to fall for phishing campaigns, t...
Oct 23, 2024•2 hr 19 min•Ep 997•Transcript available on Metacast uBlock Origin to the rescue National Public Data files for bankruptcy Will the .IO top level domain be disappearing? Patch Tuesday Firefox under attack Miscellany Sci-Fi The Sequence uBlock Origin Eero Routers Pep Link Router BIMI (up Scotty) Show Notes - https://www.grc.com/sn/SN-996-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to ...
Oct 16, 2024•3 hr 32 min•Ep 996•Transcript available on Metacast Facebook's parent Meta not hashing passwords A New, forthcoming PayPal default opts their users into merchant data sharing DDoS breaks another record Speaking of these ASUS routers Do you know who you're hiring? Vitamin D The CUPS vulnerablility Routers for normal people uBlock Origin & Manifest V3 Show Notes: https://www.grc.com/sn/SN-995-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TW...
Oct 09, 2024•3 hr 35 min•Ep 995•Transcript available on Metacast The Linux remote code execution flaw The CRUCIAL importance of Domain Control Security Roskomnadzor strikes a discordant note VLC gets a security update Tor and Tails Merge Telegram changes its long-standing "zero cooperation" policy Enshittification Bobiverse book 5 Windows 10 notifications Experian woes Nuevomailer SpinRite Peter F. Hamilton Recall's Re-Rollout Show Notes - https://www.grc.com/sn/SN-994-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https:/...
Oct 02, 2024•2 hr 16 min•Ep 994•Transcript available on Metacast The case of the exploding pagers and walkie-talkies "Ford seeks patent for tech that listens to driver conversations to serve ads" Another large chunk of personal data exposed Passkeys takes a big step forward: Now supported by Chrome A nascent 9.9 Linux Unauthenticated RCE? Freezing Credit Credit Bureaus Drobo 5N SN email labeled as spam Public Wi-fi saftey SN for Certs Windows Defender Kaspersky exits the U.S. Show Notes - https://www.grc.com/sn/SN-993-Notes.pdf Hosts: Steve Gibson and Leo Lap...
Sep 25, 2024•2 hr 27 min•Ep 993•Transcript available on Metacast Windows Endpoint Security Ecosystem Summit Aging storage media does NOT last forever How Navy chiefs conspired to get themselves illegal warship Wi-Fi adam:ONE named the #1 best Secure Access Service Edge (SASE) solution AI Talk Password Manager Injection Attacks Show Notes - https://www.grc.com/sn/SN-992-Notes.pdf Hosts: Steve Gibson and Mikah Sargent Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You ca...
Sep 18, 2024•2 hr 24 min•Ep 992•Transcript available on Metacast Offer to uninstall Recall was a bug, not a feature YubiKeys can be cloned Miscellany Is WhatsApp secure? Telegram vs Signal French elevators Freezing your credit The Quiet Canine Unix time Bobiverse book 5 Exodus: The Achemedes Engine Watching SpinRite RAMBO Show Notes - https://www.grc.com/sn/SN-991-Notes.pdf Hosts: Steve Gibson and Mikah Sargent Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can sub...
Sep 11, 2024•2 hr 20 min•Ep 991•Transcript available on Metacast Telegram puts End-to-End Privacy in the Crosshairs Free security logging is good for everyone CrowdStrike hemorrhaging customers Microsoft to meet privately with EDR (Endpoint Detection & Response) vendors Yelp's Unhappy with Google Telegram as the hotbed for DDoSass DDoS as a Service Chrome grows more difficult to exploit Cox Media Group's "Active Listening" has apparently not ended Cascading Bloom Filter follow-up Closing the Loop Is Telegram an encrypted app? Show Notes - https://www.grc....
Sep 04, 2024•2 hr 9 min•Ep 990•Transcript available on Metacast CrowdStrike Exec's "Most Epic Fail" Award Hardware backdoors discovered in Chinese-made key cards Counterfeit CISCO networking gear SpinRite Errata NPD breach updates from listeners Looking back at old SN episodes Cascading Bloom Filters Show Notes - https://www.grc.com/sn/SN-989-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Secur...
Aug 28, 2024•2 hr 10 min•Ep 989•Transcript available on Metacast Revocation Update GRC's next experiment Patch Tuesday "The Famous Computer Caf" IsBootSecure GRC Email Working through WiFi Firewalls Transferring DNS OCSP attestation vs. TLS expiration Platform key expiration National Public Data Show Notes - https://www.grc.com/sn/SN-988-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security No...
Aug 21, 2024•2 hr 14 min•Ep 988•Transcript available on Metacast Sitting Ducks DNS attack A Bad RCE in another Microsoft server SinkClose The CLFS.SYS BSoD IsBootSecure Rethinking Revocation Show Notes - https://www.grc.com/sn/SN-987-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (including fixes), visit Steve's ...
Aug 14, 2024•2 hr 18 min•Ep 987•Transcript available on Metacast Platform Key Disclosure Firefox's 3rd-party Cookie mess The W3C Finally Weighs-in CrowdStrike Damages. GRC's Email How Revoking! Show Notes - https://www.grc.com/sn/SN-986-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (including fixes), visit Steve...
Aug 07, 2024•2 hr 2 min•Ep 986•Transcript available on Metacast Crowdstrike post-mortem PiDP-11 What Crowdstrike is fixing Marcus Hutchins on who is to blame Entrust's Updated Info 3rd-Party Cookie Surprise Security training firm mistakenly hires a North Korean attacker Google and 3rd party cookies Google's influence The auto industry and data brokers DNS Benchmark on Mac Platform Key Disclosure Show Notes - https://www.grc.com/sn/SN-985-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . G...
Jul 31, 2024•3 hr 30 min•Ep 985•Transcript available on Metacast Cellebrite unlocks Trump's would-be assassin's phone. Cisco reported on a CVSS of 10.0 Entrust drops the other shoe Google gives up on removing 3rd-party cookies Miscellany Snowflake and data warehouse applications CDK auto dealership outage Polyfill.io and resource hashes MITM Blocking Copilot Blocking incoming connections via IP CrowdStruck Show Notes - https://www.grc.com/sn/SN-984-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/securi...
Jul 24, 2024•2 hr 27 min•Ep 984•Transcript available on Metacast Using Content Delivery Networks Safely The CDK Global Ransomware Attack The IRS and Entrust Polyfill.io fallout Microsoft's Behavior A Snowflake's Chance Show Notes - https://www.grc.com/sn/SN-983-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (incl...
Jul 17, 2024•2 hr 7 min•Ep 983•Transcript available on Metacast Entrust Responds Other major Certificate Authorities respond Passkey Redaction Attacks Syncing passkeys Port Knocking Fail2Ban The Polyfill.io Attack Show Notes - https://www.grc.com/sn/SN-982-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (includin...
Jul 10, 2024•2 hr 57 min•Ep 982•Transcript available on Metacast The regreSSHion Bug 50BTC moved Voyager 1 Update Email @ GRC SyncThing DNS queries Recall The End of Entrust Trust Show Notes - https://www.grc.com/sn/SN-981-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.c...
Jul 03, 2024•2 hr 28 min•Ep 981•Transcript available on Metacast Expected follow-up on CVE-2024-30078 From Russia with Love An EU privacy agency complains about Google's Privacy Sandbox? Email @ GRC Security Now SPAM? Orange Tsai needs help! Recall and 3rd Party Leakage Errata The Mixed Blessing of a Crappy PRNG Show Notes - https://www.grc.com/sn/SN-980-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a questi...
Jun 26, 2024•2 hr 4 min•Ep 980•Transcript available on Metacast 
