Security Now (Audio)

‌

Episodes

‌

Cybersecurity guru Steve Gibson joins Leo Laporte every Tuesday. Steve and Leo break down the latest cybercrime and hacking stories, offering a deep understanding of what's happening and how to protect yourself and your business. Security Now is a must listen for security professionals every week. Records live every Tuesday at 4:30pm Eastern / 1:30pm Pacific / 21:30 UTC.

Episodes

SN 979: The Angle of the Dangle - "Recall" Recall, IT at the NYT, Private Cloud Compute

CVE-2024-30078 "Recall" has been recalled Matthew Green on Apple's Private Cloud Compute A WGET flaw with a CVSS of 10.0? Thou shall not Resolve! Email @ GRC Downloading email with MailStore Home IT at The New York Times ReMarkable The Angle of the Dangle Show Notes - https://www.grc.com/sn/SN-979-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a...

Jun 19, 2024•2 hr 14 min•Ep 979•Transcript available on Metacast

SN 978: The Rise and Fall of code.microsoft.com - Apple Password Manager, AI Coding

MS on Recall changes Thanks for the "Memory" New York Times (and Wordle) leak Apple's own password manager app DJI drones on the defensive SlashData reveals some interesting developer statistics Are we going to turn programming over to AIs? The Linux Kernel Project goes CVE crazy Email @ GRC Pizza in 2024 Microsoft Recall at work Google Domains to Squarespace DNS migration T2F2-NFC-Dual keys The rise and fall of code.microsoft.com Show Notes - https://www.grc.com/sn/SN-978-Notes.pdf Hosts: Steve...

Jun 12, 2024•2 hr 21 min•Ep 978•Transcript available on Metacast

SN 977: A Large Language Model in Every Pot - Problems With Recall, End of ICQ, Email @ GRC

"Tornado Notes" Email @ GRC Have I Been Pwned? A new "supply chain" attack vector Another CA in the DogHouse ICQ to shutter its service Steve reviews "Dj vu" Hide my email Security in Windows SpinRite update A Large Language Model in Every Pot Show Notes - https://www.grc.com/sn/SN-977-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to...

Jun 05, 2024•2 hr 55 min•Ep 977•Transcript available on Metacast

SN 976: The 50 Gigabyte Privacy Bomb - Google AI Workarounds, Microsoft Recall

The bigger problem with AI Overview https://udm14.com/ -and- https://tenbluelinks.org/ The horses have left the barn VPNs and Firewalls Email @ GRC Extension to fix Google search Passwords and SPAM Fixing motherboard components Vertical tabs in Firefox FritzBox routers Too many PINs More Google search fixes Testing Windows XP The 50 Gigabyte Privacy Bomb Show Notes - https://www.grc.com/sn/SN-976-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/...

May 29, 2024•2 hr 14 min•Ep 976•Transcript available on Metacast

SN 975: 312 Scientists & Researchers Respond - 3 Chrome Zero-Days, Free Laundry

When you're the biggest target... Searching for Search How long will a Windows XP machine survive unprotected on the Internet? Free Laundry VPNs and Firewalls Netgate SG1100 Ad Industry vs. Google Privacy Sandbox Bitwarden and passkeys Token2 passkey dongle 312 Scientists & Researchers Respond Show Notes - https://www.grc.com/sn/SN-975-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT a...

May 22, 2024•2 hr 14 min•Ep 975•Transcript available on Metacast

SN 974: Microsoft's Head in the Clouds - 4-Digit Pins, Long Range Navigation, Microsoft

Picture of the Week. Most to least common 4-digit pins. Enhanced LORAN. Passkeys. Microsoft's Head in the Clouds. Show Notes - https://www.grc.com/sn/SN-974-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.co...

May 15, 2024•2 hr 55 min•Ep 974•Transcript available on Metacast

SN 973: Not So Fast - GPS Vulnerabilites, VPN Flaw

The vulnerability of GPS Is the sky falling on all VPN systems? Multi-user Passkeys, YubiKeys? The iCloud Keychain The UK and Google's Topics Show Notes - https://www.grc.com/sn/SN-973-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, transcripts, and notes (including fixes)...

May 08, 2024•2 hr 24 min•Ep 973•Transcript available on Metacast

SN 972: Passkeys: A Shattered Dream? - IoT Default Passwords, Passkeys

GCHQ: No more default passwords for consumer IoT devices! What happened with Chrome and 3rd-party cookies? Race conditions and multi-threading GM "accidentally" enrolled millions into "OnStar Smart Driver +" program Steve recommends Ryk Brown's "Frontiers Saga" SpinRite update Passkeys: A Shattered Dream? Show Notes - https://www.grc.com/sn/SN-972-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Clu...

May 01, 2024•2 hr 11 min•Ep 972•Transcript available on Metacast

SN 971: Chat (out of) Control - Fuxnet, Android Quarantine, Gentoo

What do you call "Stuxnet on steroids"?? Voyager 1 update Android 15 to quarantine apps Thunderbird & Microsoft Exchange China bans Western encrypted messaging apps Gentoo says "no" to AI Cars collecting diving data Freezing your credit Investopedia Computer Science Abstractions Lazy People vs. Secure Systems Actalis issues free S/MIME certificates PIN Encryption DRAM and GhostRace AT&T Phishing Scam Race Conditions and Multi-core processors An Alternative to the Current Credit System Sp...

Apr 24, 2024•2 hr 16 min•Ep 971•Transcript available on Metacast

SN 970: GhostRace - AT&T Breach Update, Cookie Notices, Router Buttons

An update on the AT&T data breach 340,000 social security numbers leaked Cookie Notice Compliance The GDPR does enforce some transparency Physical router buttons Wifi enabled button pressers Netsecfish disclosure of Dlink NAS vulnerability Chrome bloat SpinRite update GhostRace Show Notes - https://www.grc.com/sn/SN-970-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.t...

Apr 17, 2024•2 hr 53 min•Ep 970•Transcript available on Metacast

SN 969: Minimum Viable Secure Product - Dlink NAS Backdoor, Privnote, Crowdefense

Out-of-support DLink NAS devices contain hard coded backdoor credentials Privnote is not so "Priv" Crowdfense is willing to pay millions Engineers Pinpoint Cause of Voyager 1 Issue, Are Working on Solution SpinRite Update Minimum Viable Secure Product Show Notes - https://www.grc.com/sn/SN-969-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a que...

Apr 10, 2024•2 hr 51 min•Ep 969•Transcript available on Metacast

SN 968: A Cautionary Tale - XZ Outbreak, AT&T Data Breach

A near-Universal (Local) Linux Elevation of Privilege vulnerability TechCrunch informed AT&T of a 5 year old data breach Signal to get very useful cloud backups Telegram to allow restricted incoming HP exits Russia ahead of schedule Advertisers are heavier users of Ad Blockers than average Americans! The Google Incognito Mode Lawsuit Canonical fights malicious Ubuntu store apps Spinrite update A Cautionary Tale Show Notes - https://www.grc.com/sn/SN-968-Notes.pdf Hosts: Steve Gibson and Leo ...

Apr 03, 2024•2 hr 46 min•Ep 968•Transcript available on Metacast

SN 967: GoFetch - Apple vs. DOJ, ".INTERNAL" TLD

Apple vs U.S. DOJ G.M.'s Unbelievably Horrible Driver Data Sharing Ends Super Sushi Samurai Apple has effectively abandoned HomeKit Secure Routers The forthcoming ".INTERNAL" TLD The United Nations vs AI. Telegram now blocked throughout Spain Vancouver Pwn2Own 2024 China warns of incoming hacks Annual Tax Season Phishing Deluge SpinRite update Authentication without a phone Are Passkeys quantum safe? GoFetch: The Unpatchable vulnerability in Apple chips Show Notes - https://www.grc.com/sn/SN-967...

Mar 27, 2024•2 hr 2 min•Ep 967•Transcript available on Metacast

SN 966: Morris The Second - Voyager 1, The Web Turns 35

Voyager 1 update The Web turned 35 and Dad is disappointed Automakers sharing driving data with insurance companies A flaw in Passkey thinking Passkeys vs 2fa Sharing accounts with Passkeys Passkeys vs. Passwords/MFA Workaround to sites that block anonymous email addresses Open Bounty programs on HackerOne Steve on Twitter Ways to disclose bugs publicly Security by obscurity Something you have/know/are vs Passkeys Passkeys vs TOTP Inspecting Chrome extensions Passkey transportability Morris the ...

Mar 20, 2024•2 hr 8 min•Ep 966•Transcript available on Metacast

SN 965: Passkeys vs. 2FA - Unhelpful CERT, VMware patch, Signal 7.0 Beta

VMware needs immediate patching Midnight Blizzard still on the offensive China is quietly "de-American'ing" their networks Signal Version 7.0, now in beta Meta, WhatsApp, and Messenger -meets- the EU's DMA The Change Healthcare cyberattack SpinRite update Telegram's end-to-end encryption KepassXC now supports passkeys Login accelerators Sites start rejecting @duck.com emails Tool to detect chrome extensions change owners Sortest SN title Passkeys vs 2FA Show Notes - https://www.grc.com/sn/SN-965...

Mar 13, 2024•2 hr 23 min•Ep 965•Transcript available on Metacast

SN 964: PQ3 - Voyager 1's fate, Apple's post-quantum iMessage protocol

"Death, Lonely Death" by Doug Muir, about the decades-old Voyager 1 explorer Cory Doctorow's Visions of the Future Humble Book Bundle CTRL-K shortcut for search on a browser Direct bootable image downloading for GRC's servers Closing the loop on compromised emails Taco Bell's passwordless app A solution for Bcrypt's password length limit of 72 bytes Data as the missing piece for law enforcement and privacy advocates The token solution for email-only login Apple's Password Manager Resources on Gi...

Mar 06, 2024•2 hr 12 min•Ep 964•Transcript available on Metacast

SN 963: Web portal? Yes please! - Firefox v123, LockBit Disrupted

Nevada attempts to block Meta's end-to-end encryption for minors. A survey of security breaches Edge's Super-Duper Secure Mode moves into Chrome DoorDash dashes our privacy Avast charged $16.5 million for selling user browsing data No charge for extra logging! European Parliament's IT service has found traces of spyware on the smartphones of its security and defense subcommittee members LockBit RaaS group disrupted Firefox v123 The ScreenConnect Authentication Bypass SpinRite update Introducing ...

Feb 28, 2024•2 hr 5 min•Ep 963•Transcript available on Metacast

SN 962: The Internet Dodged a Bullet - Wyze Breach, Patch Tuesday, KeyTrap

Wyze breach Microsoft patch Tuesday fixes 15 remote code execution flaws Why are there password restrictions? The Canadian Flipper Zero Ban Security on the old internet Using Old Passwords Passwordless login TOTP as a second factor German ISP using default router passwords Email encryption in transit pfSense Tailscale integration DuckDuckGo's email protection integration with Bitwarden The KeyTrap Vulnerability Show Notes - https://www.grc.com/sn/SN-962-Notes.pdf Hosts: Steve Gibson and Leo Lapo...

Feb 21, 2024•2 hr 14 min•Ep 962•Transcript available on Metacast

SN 961: Bitlocker: Chipped or Cracked? - Honeypots, Toothbrush Botnet, Bitlocker Cracked

Toothbrush Botnet "There are too many damn Honeypots!" Remotely accessing your home network securely Going passwordless as an ecommerce site Facebook "old password" reminders Browsers on iOS More UPnP Issues A password for every website? "Free" accounts Keeping phones plugged in Running your own email server in 2024 iOS app sizes SpinRite 6.1 running on an iMac SpinRite update Bitlocker's encryption cracked in minutes Show Notes - https://www.grc.com/sn/SN-961-Notes.pdf Hosts: Steve Gibson and L...

Feb 14, 2024•2 hr 4 min•Ep 961•Transcript available on Metacast

SN 960: Unforeseen Consequences - CISA's "Secure by Design" Initiative, Fastly's BoringSSL

CISA's "Secure by Design" Initiative The GNU C Library Flaw Fastly CDN switches from OpenSSL to BoringSSL Roskomnadzor asserts itself Google updates Android's Password Manager Firefox gets post-quantum crypto Get your TOTP tokens from LastPass Inflated iOS app data LearnDMARC Sync mobile app bug SpinRite and Windows Defender Crypto signing camera Analog hole in digital camera authentication iOS and Google's Topics The gathering of the Stephvens Programmable Logic Controllers SpinRite update Malw...

Feb 07, 2024•2 hr 4 min•Ep 960•Transcript available on Metacast

SN 959: Stamos on "Microsoft Security" - HP Printer Bricking, Mercedes Benz Source Code

iOS to allow native Chromium and Firefox engines. An OS immune to ransomware? HP back in the doghouse over "anti-virus" printer bricking The mother of all breaches New "Thou shall not delete those chats" rules Fewer ransoms are being paid Verified Camera Images More on the $15/month flashlight app What happens when apps change publishers Microsoft hating on Firefox Credit Karma is storing 1GB of data on the iPhone Staying on Windows 7 Sci-Fi recommendations Windows 7 and HSTS sites TOTP codes/se...

Jan 31, 2024•2 hr 17 min•Ep 959•Transcript available on Metacast

SN 958: A Week of News and Listener Views - HSS Breach, CISA's Policing Results

Microsoft's Top Execs' Emails Breached in Sophisticated Russia-Linked APT Attack US Health and Human Services Breached Firefox vs "The Competition" Brave reduces its anti-fingerprinting protections CISA's proactive policing results one year later Longer Life For Samsung Updates Google Incognito Mode "Misunderstanding" Show Doc Not showing images on iOS Safari Generated AI Media Authentication Which computer languages to learn? Flashlight app subscription Google's Privacy Sandbox system Malware a...

Jan 24, 2024•2 hr 15 min•Ep 958•Transcript available on Metacast

SN 957: The Protected Audience API - Hacked Washing Machine, Quantum Crypto Troubles

What would an IoT device look like that HAD been taken over? And speaking of DDoS attacks Trouble in the Quantum Crypto world The Browser Monoculture Question about the Apple backdoor Getting into infosec proton drive vs sync SpinRite update The Protected Audience API Show Notes - https://www.grc.com/sn/SN-957-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You...

Jan 17, 2024•2 hr 45 min•Ep 957•Transcript available on Metacast

SN 956: The Inside Tracks - 23andME Mess, Ukraine Telecom Hack, LastPass

More on Apple's hardware backdoor Russian Hacking of Ukranian cameras Russian hackers were inside Ukraine telecoms giant for months Things are still a mess at 23andMe CoinsPaid was the victim of another cyberattack Crypto Hacking in 2023 Mandiant Twitter scam Defining "cyber warfare" LastPass is making some changes Windows Watch Google settles $5 billion lawsuit Return Oriented Programming Shutting Down Edge Root Certificates Credit freezing SpinRite Update Show Notes - https://www.grc.com/sn/SN...

Jan 10, 2024•2 hr 54 min•Ep 956•Transcript available on Metacast

SN 955: The Mystery of CVE-2023-38606 - SpinRite Update, Nebula Mesh, Apple's Backdoor

SpinRite 6.1 update Pruning Root Certificates A solution to Schrodinger's Bowl DNS Benchmark and anti-virus tools Nebula Mesh SpinRite 7 is coming The Mystery of CVE-2023-38606 Show Notes - https://www.grc.com/sn/SN-955-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page . For 16kbps versions, trans...

Jan 03, 2024•2 hr 53 min•Ep 955•Transcript available on Metacast

SN 954: Best of 2023 - Security Now's Best Moments of 2023

Leo looks back at the year's top security stories of 2023. Steve's Next Password Manager After the LastPass Hack CHESS is Safe Here Come the Fake AI-generated "News" Sites How Bad Guys Use Satellites Microsoft's "Culture of Toxic Obfuscation" Steve announces his commitment to SN Apple Says No NSA's Decade of Huawei Hacking ValiDrive announcement Host: Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/club...

Dec 26, 2023•2 hr 37 min•Ep 954•Transcript available on Metacast

SN 953: Active Listening - KOSA, Cloudflare's Numbers, SpinRite Update

Child protection legislation in the US Meta pushes back on the $200 billion FTC fine for COPPA violation Age verification on the internet Google moving from 3rd party cookies to topics A look at Cloudflare's metrics SpinRite update Cox Media admits that it spys on you Show Notes - https://www.grc.com/sn/SN-953-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You...

Dec 20, 2023•2 hr•Ep 953•Transcript available on Metacast

SN 952: Quantum Computing Breakthrough - The Clear/Deep/Dark Web, Quad 9 victory, Telegram Flaw

The government collection of push notification metadata Facebook Messenger sets end to end encryption as the default Iran's Cyber Av3ngers Cisco's Talos Top 10 cyber security exploits this year Over 30% of apps are still using a using a vulnerable version the Log4J library Quad 9 speaks on their legal victory against Sony What are the "Clear Web", "Dark Web", and "Deep Web"? A Flaw in Telegram Xfinity Mobile wants you to accept a root CA, DO NOT Hardware VPN alternative A breakthrough in quantum...

Dec 13, 2023•2 hr 5 min•Ep 952•Transcript available on Metacast

SN 951: Revisiting Browser Trust - ICANN RDRS, Beeper Mini, TikTok ban, .meme TLD

How masked domain owners can be unmasked through ICANN's new Registration Data Request Service (RDRS) WhatsApp's addition of Secret Code for extra privacy protection in Chat Lock Iranian hackers exploited default passwords in programmable logic controllers at US water facilities Attempt by Montana to ban TikTok statewide was stalled by a federal judge ruling Over 1 billion Android devices now have RCS messaging enabled EU Cyber Resilience Act will improve security of Internet of Things devices s...

Dec 06, 2023•2 hr 11 min•Ep 951•Transcript available on Metacast