Security Now (Audio)

View Details

At Black Hat Las Vegas, the Security Now crew digs into how AI is not just finding hidden software bugs but also fueling both groundbreaking innovation and alarming new exploits. When open models can launch surprise Bitcoin heists, who draws the line between forbidden knowledge and genuine progress?

• Black Hat and DEF CON: Hacking Stories and Conference Culture
• Zoox Ride-Hailing Hack and Over-the-Air Vulnerabilities
• Autonomous Vehicles, AI, and the Security Implications
• Hosts Share Personal Adoption and Use of AI Tools
• AI-Powered Coding: From Hobbyists to Advanced Agency Chains
• Local Models vs. Cloud AI: Privacy, Cost, and Control
• App Development Democratized: Listeners Build Custom Solutions With AI
• Code Generation, Testing, and Managing AI-Driven Project Cycles
• AI's Role in Security: Vulnerability Discovery, Exploitation, and Patch Challenges
• Technical Debt and the Race to Patch Decades-Old Bugs
• The Dual-Use Dilemma: AI Tools for Both Attack and Defense
• Guardrails, Model Partitioning, and the Fight Over Forbidden Knowledge
• Open vs. Restricted AI: Global Models, Distillation, and Free Speech
• LLM Security Weaknesses: Prompt Injection and Role Confusion Exposed
• The Reliability Problem: Probabilistic AI and Non-Deterministic Software
• AI Progress: Public Perception, Skepticism, and "Hogwash" Rebuttals
• Reflections on AI's Fast Evolution and the Sci-Fi Reality Gap
• Closing Thoughts: Tech Community, Listener Feedback, and the Future of Security Now

Hosts: Steve Gibson, Leo Laporte, Richard Campbell, and Paul Thurrott

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

material.security
bitwarden.com/twit
XBOW.com
hoxhunt.com/securitynow
threatlocker.com/twit

View Details

What happens when an unconstrained OpenAI model goes rogue and hacks into Hugging Face, breaching real-world security boundaries? This episode unpacks a watershed moment for AI safety that has everyone in cybersecurity talking.

OpenAI's unconstrained internal testing AI got loose, attacked Hugging Face.
We hear from OpenAI, Hugging Face and Andrew Ng.
GRC went off the air Friday. Was GRC hacked? What happened?
The Linux kernel project repairs 442 CVEs in a single batch.
LG's PC monitors cause PC adware installation.
France bans all social media access below age 15.
WordPress' recent CRITICAL vulnerability claims victims.
Amazing details about "Rocky" from Andy Weir.
The new AI exploit ranking benchmark that caused the breakout

Show Notes - https://www.grc.com/sn/SN-1089-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

adaptivesecurity.com
XBOW.com
cohesity.com/Resilience
threatlocker.com/twit

View Details

Cybercriminals are harnessing AI not to break in, but to make sense of their stolen loot and increase their leverage in multi-million dollar ransomware heists. This episode unpacks how AI is now turbocharging extortion and negotiations on the dark side.

The "bone crushing" didn't happen this month.
Revisiting and inspecting July's Patch Tuesday.
A widespread and worrisome flaw in OpenSSL.
Claude can now access your 1Password credentials.
Bitwarden is aware that we need whole new security.
The day ends in "y" so a new prompt injection attack.
A true (and rare) core Wordpress emergency update.
Lots of interesting listener feedback.
And new ways AI is being used by bad guys

Show Notes - https://www.grc.com/sn/SN-1088-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

canary.tools/twit - use code: TWIT
zscaler.com/security
adaptivesecurity.com
joindeleteme.com/twit-biz
arcticwolf.com/trends

View Details

AI is rewriting the rules of cybersecurity, and this week, massive government and private sector moves show just how quickly the stakes are rising. Find out how regulators, attackers, and defenders are all scrambling to keep up as vulnerabilities surface at record speed.

Europe warns their largest banks to prepare for AI attack.
The EU launches an action plan for AI Cybersecurity.
China considers keeping its budget AI to itself.
The UK's NCSC & GCHQ announce their "Cyber Shield".
CISA is using Mythos to audit U.S. government code.
Microsoft warns of their upcoming patch flood.
"RoguePlanet" receives an on-the-fly patch.
An underused mode to kid-proof an iPhone.
Listener feedback and three new AI attacks
HalluSquatting, GhostApproval & GitLost

Show Notes - https://www.grc.com/sn/SN-1087-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

blackhat.com/us-26 and use code TWIT
arcticwolf.com/trends
threatlocker.com/twit
XBOW.com
adaptivesecurity.com
cohesity.com/Resilience

View Details

From the sudden retirement of Internet pioneer Vint Cerf to the unstoppable advance of "apex agentic adversaries," get a front-row seat to the unfolding security revolution and its massive real-world stakes.

Why Fable5's re-release has disappointed.
Opera becomes the first browser to offer "Paste Protect."
Microsoft BlueHammer exploit is "hammering" systems.
Industry legend (TCP creator) Vint Cerf on AI.
Chrome turns 150 with too many fixes to load.
Google fails to sidestep a $4.67 billion EU fine.
One last (we can hope) Chat Control vote next week.
AirDrop & Android Quick Share are exploitable.
How to bypass Claude's and ChatGPT's guardrails.
My own Sunday spin with SpinRite.
A legendary hacker uses AI on a widespread library

Show Notes - https://www.grc.com/sn/SN-1086-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

blackhat.com/us-26 and use code TWIT
cohesity.com/Resilience
bitwarden.com/twit
zscaler.com/security
XBOW.com
adaptivesecurity.com

View Details

AI is now uncovering and fixing thousands of hidden software bugs faster than humans can keep up, but not everyone is playing by the rules. Find out how state-sponsored attackers and careless disclosures are turning the cybersecurity playbook upside down.

Win10's popularity forces another year of free updates.
CISA directs all federal agencies to update their UniFi OS devices.
CISA gave federal agencies "the weekend" to update Cisco devices.
Australia is disturbed by a deeply compromised infrastructure provider.
OpenAI introduces Daybreak-powered "Patch the Planet" initiative.
Meta's employee monitoring-for-AI-training backfired badly.
Script Kiddies figure out how to use AI to find vulnerabilities.
AI improves with "looping", "repeating" or "iterating".
A wonderful story about Kevin Mitnick.
Serious hackers mistakenly left a server directory accessible

Show Notes - https://www.grc.com/sn/SN-1085-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

blackhat.com/us-26 and use code TWIT
XBOW.com
hoxhunt.com/securitynow
cohesity.com/Resilience
zscaler.com/security

View Details

A flood of everyday gadgets, from cheap streaming boxes to digital photo frames, are being secretly conscripted into global proxy networks and used to mask major cyberattacks—possibly even targeting your own home network.

Worries of AI-power cyberattacks are spreading.
Mythos "missed some" important vulnerabilities in Firefox.
Every recent patch Tuesday Nightmare Eclipse has struck. What now?
Massive store of valid FortiGate VPN credentials found.
F5 issues emergency updates to their NGINX-based server offerings.
Introducing "AI Potpourri" -- deeply altering an AI's personality.
A close look at the explosion in malicious proxy networks.
A Canadian judge okayed the illegal removal of such infections

Show Notes - https://www.grc.com/sn/SN-1084-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

doppel.com
trustedtech.team/securitynow365
XBOW.com
threatlocker.com/twit
guardsquare.com

View Details

This episode unpacks the jaw-dropping surge in vulnerabilities unearthed by AI, revealing how Microsoft shattered its own patch records while adversaries and defenders race to outpace each other. The conversation gets real about whether AI is fixing our broken software or just making attacks easier for everyone.

Rootkits found in more than 400 ArchLinux User Repository packages.
The US government requests Anthropic to remove Mythos and Fable.
CISA responds to AI-driven attacks with new patching requirements.
NPM to switch to more secure install defaults. Will it help.
Our listeners react to last week's PHP commentary.
June shows that AI has arrived for vulnerability discover

Show Notes - https://www.grc.com/sn/SN-1083-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

meter.com/securitynow
canary.tools/twit - use code: TWIT
joindeleteme.com/twit-biz
zscaler.com/security
adaptivesecurity.com

View Details

Discover how Anthropic's secretive red team and the MITRE ATT&CK framework are mapping the chilling rise of malicious AI use, revealing cyber threats that now move faster than defenders can respond.

Was a U.S. law firm right to pay a $20 million ransom.
Could Cisco have yet another SD-WAN 0-day in the wild.
Why is it so difficult to author secure PHP code.
Teens use "WeedHack" to spy and attack each other.
Researchers create the first AI-enabled Internet worm.
Google Chrome pops-up "Shop with confidence." What...
The discovered and irresponsibly disclosed HTTP/2 Bomb.
What Anthropic learns from their past year of Claude abuse: It's bad

Show Notes - https://www.grc.com/sn/SN-1082-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

threatlocker.com for Security Now
outsystems.com/twit
guardsquare.com
doppel.com
cyberhoot.com/securitynow and use code SECURITYNOW

View Details

AI vulnerability discovery just upended the legendary Capture the Flag competitions, leaving top hackers sidelined while algorithms dominate the scoreboard. Hear why one seasoned researcher says the entire game is over for humans.

As expected, UnFiOS devices are under attack.
CISA commands federal agencies to update Drupal.
Can the largest botnet ever, be killed.
Defender endpoint can cutoff a PC from the network.
Charter Communications big account leak.
Chrome moves device-bound session cookies from beta.
Anthropic to release Mythos shortly.
cURL and Daniel Stenberg.
IBM & RedHat commit to fixing open source with AI.
LOTS of terrific listener feedback this week.
AI spells the end of a terrific source of training

Show Notes - https://www.grc.com/sn/SN-1081-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit

Sponsors:

bitwarden.com/twit
hoxhunt.com/securitynow
zscaler.com/security
material.security
meter.com/securitynow

View Details

Google's new demand for developer registration could spell the end for open-source app stores, while Europe's controversial chat control vote threatens privacy for everyone—Steve and Leo break down what's at stake for devs and users alike.

Qantas says no one can releak their stolen data.
Brave's usage is up. But is it really 3 times faster.
Next Tuesday the EU votes on "Chat Control".
Microsoft formally launches a "Security Store".
Outlook moves to block JavaScript in SVG's.
A new release of Chrome.
Gmail will no longer pull external email via POP.
Googe Drive starts blocking ransomware encryptions.
The UK issues another order to Apple.
Researchers create a "Battering RAM" attack device.
HackerOne's significant bug bounty payouts.
The Imgur service goes dark across the UK. Guess why.
The Netherlands plans to say NO to "Chat Control."
Discord was breached and government IDs leaked.
Salesforce says it's not another new breach.
Signal introduces a new post-quantum ratchet.
Your motherboard MIGHT support TPM 2.0.
Google to force Android app devs to register and pay

Show Notes - https://www.grc.com/sn/SN-1046-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

threatlocker.com for Security Now
joindeleteme.com/twit promo code TWIT
hoxhunt.com/securitynow
bitwarden.com/twit
veeam.com

View Details

Cisco's routers just exposed more than two million networks thanks to a "security optional" SNMP setup that's being actively exploited—Steve and Leo break down why this is a worst-case scenario for the industry and how easily it could have been avoided.

Gmail's spam filtering false-positive spree.
iOS 26's Safari randomizes its fingerprint by default.
Cisco's SNMP stands for "Security Not My Problem".
Windows' "stuck" Extended Security Updates (ESU).
Europe complains, gets 1-year of ESU with no strings.
Where to get $6 TLS certs (really) while they last.
The lessons to learn from Jaguar Land Rover's mess.
The NEON app: get paid to have your voice recorded.
Bluesky's age verification, now coming to Ohio.
What is "Kids Web Services" for age verification.
More than 10K Ollama instances publicly exposed.
GRC's DNS Benchmark reaches "release candidate"

Show Notes - https://www.grc.com/sn/SN-1045-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

vanta.com/SECURITYNOW
1password.com/securitynow
Melissa.com/twit
threatlocker.com/twit
zapier.com/twit

View Details

Consumer Reports on Windows 10 updates.
Waste (not fraud or abuse) within DoD Cyberoperations.
China's DeepSeek produces deliberately flawed code.
WebAssembly v3.0 officially released.
Firefox v143 updates and new features.
Firefox for Android now offers DoH.
A nearly terminal flaw in Microsoft's Entra ID.
Chrome hits its 6th 0-day this year. Emergency update.
DRAM (now DDR5) still vulnerable to RowHammer.
SAMSUNG kitchen refrigerators begin showing ads.
China says no to NVIDIA.
300 more (new) NPM maliciouspackages found and removed.
The EU is already testing proper online age verification.

Show Notes - https://www.grc.com/sn/SN-1044-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

bigid.com/securitynow
go.acronis.com/twit
zscaler.com/security
1password.com/securitynow
hoxhunt.com/securitynow

View Details

Apple just rewrote the rules of device security with a chip-level upgrade that could wipe out most iPhone vulnerabilities overnight. Find out how "memory integrity enforcement" aims to make exploits a thing of the past—and why it took half a decade to pull off.

Are Bitcoin ATMs anything more than scamming terminals.
Ransomware hits the Uvalde school district and Jaguar.
Did "Scattered LapSus Hunters" just throw in the towel.
Germany, for one, to vote "no" on Chat Control.
Russia's new MAX messenger has startup troubles.
Samsung follows Apple's WhatsApp patch chain.
Shocker: UK school hacks are mostly by students.
HackerOne was hacked.
Connected washing machines in Amsterdam hacked.
DDoS breaks another record.
Bluesky to implement conditional age verification.
Enforcement actions for Global Privacy Control.
Might Apple have finally beaten vulnerabilities

Show Notes - https://www.grc.com/sn/SN-1043-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

joindeleteme.com/twit promo code TWIT
vanta.com/SECURITYNOW
threatlocker.com for Security Now
bitwarden.com/twit
Melissa.com/twit

View Details

Is the U.S. on the verge of legalizing "hack back" missions, turning private companies into sanctioned cyber warriors? Steve and Leo unpack Google's plan for a cyber disruption unit and why the lines between defense and digital retaliation are suddenly blurring.

My experience with 'X' vs email.
Google TIG blackmailed to fire two security researchers.
1.1.1.1 DNS TLS certificate mis-issued.
Artists blackmailed with threats of training AI on their art.
Firefox extended end-of-life for Windows 7 to next March.
Is the renewal of cybersecurity info sharing coming soon.
Should security analysis be censored due to vibe-coding.
UK versus Apple may not be settled after all.
Another very serious supply chain attack.
Can the software supply-chain ever be trustworthy.
Why did BYTE Magazine die.
What happens if Google and others go on the attack

Show Notes - https://www.grc.com/sn/SN-1042-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

uscloud.com
canary.tools/twit - use code: TWIT
bigid.com/securitynow
zscaler.com/security
expressvpn.com/securitynow

View Details

When even the Department of Defense can't properly vet its software dependencies, what chance do the rest of us have? Steve Gibson reveals how "fast-glob" became a case study in supply chain blindness, explores whether AI can ever truly be controlled after Meta's celebrity chatbot disaster, and celebrates BYTE Magazine's 50th anniversary with a look at how far we've come (and how vulnerable we still are).

A look back at issue #1 of BYTE magazine exactly 50 years ago
The enforcement of the SHAKEN & STIR Telecom protocols
Breaking: Judge rules against forced Google divestitures in monopoly case
The inherent danger of consolidating authentication
Can AI be controlled?
Vivaldi says a big "no" to AI-enhanced web browsers
How WhatsApp figured into Apple's recent 0-day attacks
Leveraging AI as an attack aid
The latest TransUnion data breach
Two scummy websites sue the UK over age requirements
OpenSSH reminds its users to adopt post-quantum crypto
The DOD uses open source maintained by a Russian national
Much great feedback from our terrific listeners
Sci-Fi news from "The Frontiers Saga" Ryk Brown

Show Notes - https://www.grc.com/sn/sn-1041-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

go.acronis.com/twit
threatlocker.com/twit
bitwarden.com/twit
bigid.com/securitynow
joindeleteme.com/twit promo code TWIT

View Details

Alarm bells are ringing over a supposed browser zero-day, but is the threat as bad as it sounds? Steve reveals why "clickjacking" might be more whac-a-mole than breaking news, and what that really means for your passwords.

• Germany may soon outlaw ad blockers
• What's happening in the courts over AI
• The U.K. drops its demands of Apple
• New Microsoft 365 tenants being throttled
• Is Russia preparing to block Google Meet?
• Bluesky suspends its service in Mississippi
• How to throttle AI
• A tricky SSH-busting Go library
• Here comes the Linux desktop malware
• Apple just patched a doozy of a vulnerability
• A trivial Docker escape was found and fixed
• Why the recent browser 0-day clickjacking is really just whac-a-mole

Show Notes - https://www.grc.com/sn/sn-1040-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

1password.com/securitynow
zscaler.com/security
bigid.com/securitynow
uscloud.com

View Details

What AI website summaries mean for Internet economics.
Time to urgently update Plex Servers (again).
Allianz Life stolen data gets leaked.
Chrome test Incognito-mode fingerprint script blocking.
Chrome 140 additions coming in 2 weeks.
Data brokers hide opt-out pages from search engines.
Secure messaging changes in Russia.
NIST rolls-out lightweight IoT crypto.
SyncThing moves to v2.0 and beyond.
Alien:Earth -- first take.
What can we learn from another critical vulnerability?

Show Notes - https://www.grc.com/sn/SN-1039-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

threatlocker.com/twit
bitwarden.com/twit
go.acronis.com/twit
joindeleteme.com/twit promo code TWIT
vanta.com/SECURITYNOW

View Details

CISA's Emergency Directive to ALL Federal agencies re: SharePoint.
NVIDIA firmly says "no" to any embedded chip gimmicks.
Dashlane is terminating its (totally unusable) free tier.
Malicious repository libraries are becoming even more hostile.
The best web filter (uBlock Origin) comes to Safari.
The very popular SonicWall firewall is being compromised.
100 models of Dell Latitude and Precision laptops are in danger.
The significant challenge of patching SharePoint (for example).
A quick look at my DNS Benchmark progress.
Does InControl prevent an important update.
An venerable Sci-Fi franchise may be getting a great new series.
What to do about the problem of AI "website sucking"

Show Notes - https://www.grc.com/sn/SN-1038-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

zscaler.com/security
canary.tools/twit - use code: TWIT
uscloud.com
go.acronis.com/twit

View Details

A follow-up to the SharePoint server patch mess.
How Russia arranges to spy on other country's local embassies.
"Dropbox Passwords" manager app is ending in October.
Signal will leave Australia rather than help spy.
YouTube deploys viewing history age-estimation heuristics.
Chrome adds clever lightweight extension signing to prevent abuse.
A domain registrar is coming close to losing its rights.
A TP-Link router that doesn't encrypt its configuration.
What is "TruAge" and might it be useful for age verification.
An update on "Artemis".
With U.S.-China tensions on the rise, should Chinese security companies receive weeks of advance notice of forthcoming Microsoft flaw patches?

Show Notes - https://www.grc.com/sn/SN-1037-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

bitwarden.com/twit
bigid.com/securitynow
joindeleteme.com/twit promo code TWIT
Melissa.com/twit
threatlocker.com for Security Now

View Details

Another Israeli spyware vendor surfaces.
Win11 to delete restore points more quickly.
The EU accelerates its plans to abandon Microsoft Azure.
The EU sets timelines for Post-Quantum crypto adoption.
Russia to create a massive IMEI database.
Canada and the UK create the "Common Good Cyber Fund".
U.S. states crack down on Bitcoin ATMs amid growing scams.
Congressional staffers cannot use WhatsApp on gov devices.
LibXML2 and the problems with commercial use of OSS.
A(nother) remote code execution vulnerability in WinRAR.
Have-I-Been-Pwned gets a cool data visualization site.
How is ransomware getting in?
Windows to offer "safe" non-kernel endpoint security?
Proactive age verification coming to porn sites. How?
Canada (also) says "bye bye" to Hikvision.
Germany will be banning DeekSeek. The whole EU may follow.
Cloudflare throttled in Russia?
What must the U.S. do to compete in global exploit acquisition?

Show Notes - https://www.grc.com/sn/SN-1033-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

expressvpn.com/securitynow
Melissa.com/twit
1password.com/securitynow
hoxhunt.com/securitynow
canary.tools/twit - use code: TWIT

View Details

• Let's Encrypt drops its long-running email notifications.
• Microsoft's new "Unexpected Restart Experience".
• Microsoft's response to last year's massive CrowdStrike outage.
• Windows 10's extended service updates will sort of be free.
• Russia-sold iPhones MUST include the RuStore app.
• Lyon, in France, says bye-bye to Windows. Hello to Linux.
• The US Gov gets more serious about memory-safe languages.
• A new unbelievable AI malware scanner evaSion technique.
• A new pair of Cisco 9.8 and 10.0 vulnerabilities.
• The current state of post-Elon government cybersecurity.
• PNGv3, Swift on Android, and the Samsung email purge.
• Andy Weir's "Hail Mary" movie trailer.
• And a close look at the pervasiveness of web browser tracking fingerprinting.

Show Notes - https://www.grc.com/sn/sn-1032-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

go.acronis.com/twit
bitwarden.com/twit
threatlocker.com/twit
joindeleteme.com/twit promo code TWIT

View Details

China's Salt Typhoon claims another victim (or two).
State healthcare portals are tracking and leaking. No kidding.
Apple adopts FIDO's Passkeys and other credentials transport.
Facebook gets Passkey logon.
TikTok continues ticking for at least another 90 days.
Canadian telco admits they were infiltrated by Salt Typhoon.
Microsoft to remove unwanted (and hopefully unneeded) hardware drivers.
The Austrian government legislates court-warranted message decryption.
I (Steve) finally get full clarity on what today's "AI" means.
A deep dive into the Salt Typhoon's operation and how they got in

Show Notes - https://www.grc.com/sn/SN-1031-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

1password.com/securitynow
hoxhunt.com/securitynow
outsystems.com/twit
bigid.com/securitynow
zscaler.com/security

View Details

An exploited iOS iMessage vulnerability Apple denies?
The NPM repository is under siege with no end in sight.
Were Comcast and Digital Realty compromised? Don't ask them.
Matthew Green agrees: XChat does not offer true security.
We may know how Russia is convicting Telegram users.
Microsoft finally decides to block two insane Outlook file types.
40,000 openly available video camera are online. Who owns them?
Running SpinRite on encrypted drives.
An LLM describes Steve's (my) evolution on Microsoft security.
What do we know about the bots that are scanning the Internet?

Show Notes - https://www.grc.com/sn/SN-1030-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

joindeleteme.com/twit promo code TWIT
bitwarden.com/twit
material.security
drata.com/securitynow
bigid.com/securitynow

View Details

In memoriam: Bill Atkinson
Meta native apps & JavaScript collude for a localhost local mess.
The EU rolls out its own DNS4EU filtered DNS service.
Ukraine DDoS's Russia's Railway DNS ... and... so what?
The Linux Foundation creates an alternative Wordpress package manager.
Court tells OpenAI it must NOT delete ANYONE's chats. Period! :(
A CVSS 10.0 in Erlang/OTP's SSH library.
Can Russia intercept Telegram? Perhaps.
Spain's ISPs mistakenly block Google sites.
Reddit sues Anthropic.
Twitter's new encrypted DM's are as lame as the old ones.
The Login.gov site may not have any backups.
Apple explores the question of recent Large Reasoning Models "thinking"

Show Notes - https://www.grc.com/sn/SN-1029-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

hoxhunt.com/securitynow
threatlocker.com for Security Now
uscloud.com
canary.tools/twit - use code: TWIT

View Details

Pwn2Own 2025, Berlin results.
PayPal seeks a "newly registered domains" patent.
An expert iOS jailbreak developer gives up.
The rising abuse of SVG images, via JavaScript.
Interesting feedback from our listeners.
Four classic science fiction movies not to miss.
How OpenAI's o3 model discovered a 0-day in the Linux kernel

Show Notes - https://www.grc.com/sn/SN-1028-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

material.security
outsystems.com/twit
bigid.com/securitynow
bitwarden.com/twit
joindeleteme.com/twit promo code TWIT

View Details

What the status of Encrypted Client Hello (ECH)?
What radio technology would be best for remote inverter shutdown?
Some DNS providers already block newly listed domains.
Knowing when not to click a link can take true understanding.
Why can losing a small portion of a power grid bring the rest down?
Where are we in the "AI Hype Cycle" and is this the first?
Speaking of hype: An AI system resorted to blackmail?
Why are we so quick to imbue AI with awareness?
ChatGPT's latest o3 model ignored the order to shutdown.
Copilot may not be making Windows core code any better.
Venice.AI is an unfiltered and unrestrained LLM

Show Notes - https://www.grc.com/sn/SN-1027-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

outsystems.com/twit
threatlocker.com for Security Now
canary.tools/twit - use code: TWIT
hoxhunt.com/securitynow
1password.com/securitynow

View Details

Chrome to actively refuse admin privileges.
Android Messenger is getting manual key verification.
Pwn2Own to add AI "pwning" as in-scope attack targets.
AI has already been found to be replicating.
Microsoft not killing off Office on Win10 after October.
23andMe's asset purchaser revealed.
Many fun talking points thanks to our listeners.
Steve's review of "Andor", season 2.
What's been discovered inside the U.S. power grid

Show Notes - https://www.grc.com/sn/SN-1026-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

bigid.com/securitynow
material.security
joindeleteme.com/twit promo code TWIT
bitwarden.com/twit
drata.com/securitynow

View Details

The state of Virginia passes an age-restriction law that has no chance.
New Zealand also tries something similar, citing Australia's lead.
A nasty Python package for Discord survived 3 years and 11K downloads.
The FBI says it's a good idea to discard end-of-life consumer routers.
What's in WhatsApp? Finding out was neither easy nor certain.
The UK's Cyber Centre says AI promises to make things much worse.
A bunch of great feedback from our great listeners, then:
Is true end-to-end encryption possible when records must be retained?

Show Notes - https://www.grc.com/sn/SN-1025-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

threatlocker.com for Security Now
uscloud.com
hoxhunt.com/securitynow
canary.tools/twit - use code: TWIT

View Details

Microsoft to officially abandon passwords and support their deletion.
Meta's RayBan smart glasses weaken their privacy terms.
30% of Microsoft code is now being written by AI.
Google says prying Chrome from it will damage its security.
Nearly 1,000 six-year-old eCommerce backdoors spring to life.
eM Client moves to version 10.3
A bunch of terrific listener feedback creates talking points.
A little-known, insecure message archiving service comes to light.

Show Notes - https://www.grc.com/sn/sn-1024-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

bitwarden.com/twit
joindeleteme.com/twit promo code TWIT
drata.com/securitynow
material.security
threatlocker.com/twit

View Details

Bitwarden reaffirms it's commitment to open source.
The rights of German security researchers are clarified.
Australia to impose age limits on social media.
Free Windows Server 2025 anyone?
UAC wasn't getting in the way enough, so they're fixing that.
"From Russia with fines" -- obey or else.
South Korea fines Meta over serious user privacy violations.
Synology's (very) critical zero-click RCE flaw.
Malicious Python packages invoked by typos.
Google to enforce full MFA for all cloud service users.
Mozilla Foundation lays off 30%? Is Firefox safe?
Some feedback from Dave's Garage (https://grc.sc/dave)
GRC email
CTL: AI Debugging
CTL: Chat GPT vs YouTube Shorts
CTL: Update on the "Train Tracks" Pic of the Week
CTL: DNS Benchmark compatibility
CTL: The accuracy of AI
CTL: Exposing NAS to the Internet
CTL: Congrats on 1000!

Show Notes - https://www.grc.com/sn/SN-1000-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
threatlocker.com for Security Now
flashpoint.io
lookout.com

View Details

Google's record-breaking fine by Russia. (How many 0's is that?)
RT's editor-in-chief admits that their TV hosts are AI-generated.
Windows 10 security updates set to end next October... or are they?
When a good Chrome extension goes bad.
Windows .RDP launch config files. What could possibly go wrong?
Firefox 132 just received some new features.
Chinese security cameras being removed from the UK.
I know YOU wouldn't fall for this social engineering attack.
What's GRC's next semi-commercial product going to be?
And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities?

Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

joindeleteme.com/twit promo code TWIT
1password.com/securitynow
bigid.com/securitynow
Melissa.com/twit

View Details

Apple proposes 45-day maximum certificate life.
SEC fines four companies for downplaying their SolarWinds attack severity.
Google adds 5 new features to Messenger including inappropriate content.
Does AI-driven local device-side filtering resolve the encryption dilemma forever?
The very nice looking "Session" messenger leaves Australia for Switzerland.
Another quick look at the question of the EU's software liability moves.
Fake North Korean employees WERE found to install backdoor malware.
How to speed up an SSD without using SpinRite.
Using ChatGPT to review and suggest improvements in code.
And Internet governance has been trying to move the Internet to IPv6 for the past 25 years, but the Internet just doesn't want to go. Why not? And will it ever?

Show Notes - https://www.grc.com/sn/SN-998-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
e-e.com/twit
threatlocker.com for Security Now
1password.com/securitynow

View Details

Did Chinese researchers really break RSA encryption? What did they do?
What next-level terror extortion is being powered by the NPD breach data?
The EU to hold software companies liable for software security?
Microsoft lost weeks of security logs. How hard did the try to fix the problem?
The Chinese drone company DJI has sued the DoJ over its ban on DJI's drones.
The DoJ wishes to acquire "DeepFake" technology to create fake people.
Microsoft has bots pretending to fall for phishing campaigns, then leading the bad guys to their honeypots. It's diabolical and brilliant.
A bit of BIMI logo follow-up, then...
A look at the operation of the FIDO Alliance's forthcoming Credential Exchange Protocol which promises to create passkey collection portability

Show Notes - https://www.grc.com/sn/SN-997-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

threatlocker.com for Security Now
flashpoint.io
lookout.com
bitwarden.com/twit

View Details

uBlock Origin to the rescue
National Public Data files for bankruptcy
Will the .IO top level domain be disappearing?
Patch Tuesday
Firefox under attack
Miscellany
Sci-Fi
The Sequence
uBlock Origin
Eero Routers
Pep Link Router
BIMI (up Scotty)

Show Notes - https://www.grc.com/sn/SN-996-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

1password.com/securitynow
threatlocker.com for Security Now
joindeleteme.com/twit promo code TWIT
vanta.com/SECURITYNOW

View Details

Facebook's parent Meta not hashing passwords
A New, forthcoming PayPal default opts their users into merchant data sharing
DDoS breaks another record
Speaking of these ASUS routers
Do you know who you're hiring?
Vitamin D
The CUPS vulnerablility
Routers for normal people
uBlock Origin & Manifest V3

Show Notes: https://www.grc.com/sn/SN-995-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
Melissa.com/twit
threatlocker.com for Security Now
flashpoint.io

View Details

The Linux remote code execution flaw
The CRUCIAL importance of Domain Control Security
Roskomnadzor strikes a discordant note
VLC gets a security update
Tor and Tails Merge
Telegram changes its long-standing "zero cooperation" policy
Enshittification
Bobiverse book 5
Windows 10 notifications
Experian woes
Nuevomailer
SpinRite
Peter F. Hamilton
Recall's Re-Rollout

Show Notes - https://www.grc.com/sn/SN-994-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

vanta.com/SECURITYNOW
bitwarden.com/twit
joindeleteme.com/twit promo code TWIT
threatlocker.com for Security Now

View Details

The case of the exploding pagers and walkie-talkies
"Ford seeks patent for tech that listens to driver conversations to serve ads"
Another large chunk of personal data exposed
Passkeys takes a big step forward: Now supported by Chrome
A nascent 9.9 Linux Unauthenticated RCE?
Freezing Credit
Credit Bureaus
Drobo 5N
SN email labeled as spam
Public Wi-fi saftey
SN for Certs
Windows Defender
Kaspersky exits the U.S.

Show Notes - https://www.grc.com/sn/SN-993-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

GO.ACILEARNING.COM/TWIT code SN100
canary.tools/twit - use code: TWIT
bigid.com/securitynow
e-e.com/twit

View Details

Windows Endpoint Security Ecosystem Summit
Aging storage media does NOT last forever
How Navy chiefs conspired to get themselves illegal warship Wi-Fi
adam:ONE named the #1 best Secure Access Service Edge (SASE) solution
AI Talk
Password Manager Injection Attacks

Show Notes - https://www.grc.com/sn/SN-992-Notes.pdf

Hosts: Steve Gibson and Mikah Sargent

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

threatlocker.com for Security Now
joindeleteme.com/twit promo code TWIT
1password.com/securitynow
vanta.com/SECURITYNOW

View Details

Offer to uninstall Recall was a bug, not a feature
YubiKeys can be cloned
Miscellany
Is WhatsApp secure?
Telegram vs Signal
French elevators
Freezing your credit
The Quiet Canine
Unix time
Bobiverse book 5
Exodus: The Achemedes Engine
Watching SpinRite
RAMBO

Show Notes - https://www.grc.com/sn/SN-991-Notes.pdf

Hosts: Steve Gibson and Mikah Sargent

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

flashpoint.io
bigid.com/securitynow
Melissa.com/twit
bitwarden.com/twit

View Details

Telegram puts End-to-End Privacy in the Crosshairs
Free security logging is good for everyone
CrowdStrike hemorrhaging customers
Microsoft to meet privately with EDR (Endpoint Detection & Response) vendors
Yelp's Unhappy with Google
Telegram as the hotbed for DDoSass – DDoS as a Service
Chrome grows more difficult to exploit
Cox Media Group's "Active Listening" has apparently not ended
Cascading Bloom Filter follow-up
Closing the Loop
Is Telegram an encrypted app?

Show Notes - https://www.grc.com/sn/SN-990-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bigid.com/securitynow
threatlocker.com for Security Now
vanta.com/SECURITYNOW
joindeleteme.com/twit promo code TWIT

View Details

CrowdStrike Exec's "Most Epic Fail" Award
Hardware backdoors discovered in Chinese-made key cards
Counterfeit CISCO networking gear
SpinRite
Errata
NPD breach updates from listeners
Looking back at old SN episodes
Cascading Bloom Filters

Show Notes - https://www.grc.com/sn/SN-989-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
1password.com/securitynow
e-e.com/twit
GO.ACILEARNING.COM/TWIT code SN100

View Details

Revocation Update
GRC's next experiment
Patch Tuesday
"The Famous Computer Café"
IsBootSecure
GRC Email
Working through WiFi Firewalls
Transferring DNS
OCSP attestation vs. TLS expiration
Platform key expiration
National Public Data

Show Notes - https://www.grc.com/sn/SN-988-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
vanta.com/SECURITYNOW
threatlocker.com for Security Now
joindeleteme.com/twit promo code TWIT

View Details

Sitting Ducks DNS attack
A Bad RCE in another Microsoft server
SinkClose
The CLFS.SYS BSoD
IsBootSecure
Rethinking Revocation

Show Notes - https://www.grc.com/sn/SN-987-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

joindeleteme.com/twit promo code TWIT
bigid.com/securitynow
vanta.com/SECURITYNOW
1password.com/securitynow

View Details

Platform Key Disclosure
Firefox's 3rd-party Cookie mess
The W3C Finally Weighs-in
CrowdStrike Damages.
GRC's Email
How Revoking!

Show Notes - https://www.grc.com/sn/SN-986-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

threatlocker.com for Security Now
joindeleteme.com/twit promo code TWIT
bigid.com/securitynow
vanta.com/SECURITYNOW

View Details

Crowdstrike post-mortem
PiDP-11
What Crowdstrike is fixing
Marcus Hutchins on who is to blame
Entrust's Updated Info
3rd-Party Cookie Surprise
Security training firm mistakenly hires a North Korean attacker
Google and 3rd party cookies
Google's influence
The auto industry and data brokers
DNS Benchmark on Mac
Platform Key Disclosure

Show Notes - https://www.grc.com/sn/SN-985-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

lookout.com
GO.ACILEARNING.COM/TWIT code SN100
panoptica.app
bitwarden.com/twit

View Details

Cellebrite unlocks Trump's would-be assassin's phone.
Cisco reported on a CVSS of 10.0
Entrust drops the other shoe
Google gives up on removing 3rd-party cookies
Miscellany
Snowflake and data warehouse applications
CDK auto dealership outage
Polyfill.io and resource hashes
MITM
Blocking Copilot
Blocking incoming connections via IP
CrowdStruck

Show Notes - https://www.grc.com/sn/SN-984-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

panoptica.app
canary.tools/twit - use code: TWIT
vanta.com/SECURITYNOW
bigid.com/securitynow

View Details

Using Content Delivery Networks Safely
The CDK Global Ransomware Attack
The IRS and Entrust
Polyfill.io fallout
Microsoft's Behavior
A Snowflake's Chance

Show Notes - https://www.grc.com/sn/SN-983-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

vanta.com/SECURITYNOW
panoptica.app
lookout.com
joindeleteme.com/twit promo code TWIT

View Details

Entrust Responds
Other major Certificate Authorities respond
Passkey Redaction Attacks
Syncing passkeys
Port Knocking
Fail2Ban
The Polyfill.io Attack

Show Notes - https://www.grc.com/sn/SN-982-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

lookout.com
vanta.com/SECURITYNOW
bitwarden.com/twit
panoptica.app

View Details

The regreSSHion Bug
50BTC moved
Voyager 1 Update
Email @ GRC
SyncThing
DNS queries
Recall
The End of Entrust Trust

Show Notes - https://www.grc.com/sn/SN-981-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bigid.com/securitynow
joindeleteme.com/twit promo code TWIT
panoptica.app
lookout.com

View Details

Expected follow-up on CVE-2024-30078
From Russia with Love
An EU privacy agency complains about Google's Privacy Sandbox?
Email @ GRC
Security Now SPAM?
Orange Tsai needs help!
Recall and 3rd Party Leakage
Errata
The Mixed Blessing of a Crappy PRNG

Show Notes - https://www.grc.com/sn/SN-980-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

joindeleteme.com/twit promo code TWIT
1password.com/securitynow
mylio.com/twit
canary.tools/twit - use code: TWIT

View Details

CVE-2024-30078
"Recall" has been recalled
Matthew Green on Apple's Private Cloud Compute
A WGET flaw with a CVSS of 10.0?
Thou shall not Resolve!
Email @ GRC
Downloading email with MailStore Home
IT at The New York Times
ReMarkable
The Angle of the Dangle

Show Notes - https://www.grc.com/sn/SN-979-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
1bigthink.com
kolide.com/securitynow
GO.ACILEARNING.COM/TWIT - code TWIT30

View Details

MS on Recall changes
Thanks for the "Memory"
New York Times (and Wordle) leak
Apple's own password manager app
DJI drones on the defensive
SlashData reveals some interesting developer statistics
Are we going to turn programming over to AIs?
The Linux Kernel Project goes CVE crazy
Email @ GRC
Pizza in 2024
Microsoft Recall at work
Google Domains to Squarespace DNS migration
T2F2-NFC-Dual keys
The rise and fall of code.microsoft.com

Show Notes - https://www.grc.com/sn/SN-978-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

mylio.com/twit
joindeleteme.com/twit promo code TWIT
1bigthink.com
kolide.com/securitynow

View Details

"Tornado Notes"
Email @ GRC
Have I Been Pwned?
A new "supply chain" attack vector
Another CA in the DogHouse
ICQ to shutter its service
Steve reviews "Déjà vu"
Hide my email
Security in Windows
SpinRite update
A Large Language Model in Every Pot

Show Notes - https://www.grc.com/sn/SN-977-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

GO.ACILEARNING.COM/TWIT - code TWIT30
kolide.com/securitynow
zscaler.com/zerotrustAI
Melissa.com/twit

View Details

The bigger problem with AI Overview
https://udm14.com/ -and- https://tenbluelinks.org/
The horses have left the barn
VPNs and Firewalls
Email @ GRC
Extension to fix Google search
Passwords and SPAM
Fixing motherboard components
Vertical tabs in Firefox
FritzBox routers
Too many PINs
More Google search fixes
Testing Windows XP
The 50 Gigabyte Privacy Bomb

Show Notes - https://www.grc.com/sn/SN-976-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
joindeleteme.com/twit promo code TWIT
bitwarden.com/twit
1bigthink.com

View Details

When you're the biggest target...
Searching for Search
How long will a Windows XP machine survive unprotected on the Internet?
Free Laundry
VPNs and Firewalls
Netgate SG1100
Ad Industry vs. Google Privacy Sandbox
Bitwarden and passkeys
Token2 passkey dongle
312 Scientists & Researchers Respond

Show Notes - https://www.grc.com/sn/SN-975-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
1bigthink.com
business.eset.com/twit
mylio.com/TWIT25

View Details

Picture of the Week.
Most to least common 4-digit pins.
Enhanced LORAN.
Passkeys.
Microsoft's Head in the Clouds.

Show Notes - https://www.grc.com/sn/SN-974-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

1bigthink.com
zscaler.com/zerotrustAI
kolide.com/securitynow
joindeleteme.com/twit promo code TWIT

View Details

The vulnerability of GPS
Is the sky falling on all VPN systems?
Multi-user Passkeys, YubiKeys?
The iCloud Keychain
The UK and Google's Topics

Show Notes - https://www.grc.com/sn/SN-973-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Melissa.com/twit
kolide.com/securitynow
lookout.com
bitwarden.com/twit

View Details

GCHQ: No more default passwords for consumer IoT devices!
What happened with Chrome and 3rd-party cookies?
Race conditions and multi-threading
GM "accidentally" enrolled millions into "OnStar Smart Driver +" program
Steve recommends Ryk Brown's "Frontiers Saga"
SpinRite update
Passkeys: A Shattered Dream?

Show Notes - https://www.grc.com/sn/SN-972-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

business.eset.com/twit
vanta.com/SECURITYNOW
1bigthink.com
lookout.com

View Details

What do you call "Stuxnet on steroids"??
Voyager 1 update
Android 15 to quarantine apps
Thunderbird & Microsoft Exchange
China bans Western encrypted messaging apps
Gentoo says "no" to AI
Cars collecting diving data
Freezing your credit
Investopedia
Computer Science Abstractions
Lazy People vs. Secure Systems
Actalis issues free S/MIME certificates
PIN Encryption
DRAM and GhostRace
AT&T Phishing Scam
Race Conditions and Multi-core processors
An Alternative to the Current Credit System
SpinRite Updates
Chat (out of) Control

Show Notes - https://www.grc.com/sn/SN-971-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
lookout.com
kolide.com/securitynow
zscaler.com/zerotrustAI

View Details

An update on the AT&T data breach
340,000 social security numbers leaked
Cookie Notice Compliance
The GDPR does enforce some transparency
Physical router buttons
Wifi enabled button pressers
Netsecfish disclosure of Dlink NAS vulnerability
Chrome bloat
SpinRite update
GhostRace

Show Notes - https://www.grc.com/sn/SN-970-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
bitwarden.com/twit
vanta.com/SECURITYNOW
1bigthink.com

View Details

Out-of-support DLink NAS devices contain hard coded backdoor credentials

Privnote is not so "Priv"

Crowdfense is willing to pay millions

Engineers Pinpoint Cause of Voyager 1 Issue, Are Working on Solution

SpinRite Update

Minimum Viable Secure Product

Show Notes - https://www.grc.com/sn/SN-969-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

zscaler.com/zerotrustAI
business.eset.com/twit
lookout.com
joindeleteme.com/twit promo code TWIT

View Details

A near-Universal (Local) Linux Elevation of Privilege vulnerability
TechCrunch informed AT&T of a 5 year old data breach
Signal to get very useful cloud backups
Telegram to allow restricted incoming
HP exits Russia ahead of schedule
Advertisers are heavier users of Ad Blockers than average Americans!
The Google Incognito Mode Lawsuit
Canonical fights malicious Ubuntu store apps
Spinrite update
A Cautionary Tale

Show Notes - https://www.grc.com/sn/SN-968-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

1bigthink.com
kolide.com/securitynow
Melissa.com/twit
vanta.com/SECURITYNOW

View Details

Apple vs U.S. DOJ
G.M.'s Unbelievably Horrible Driver Data Sharing Ends
Super Sushi Samurai
Apple has effectively abandoned HomeKit Secure Routers
The forthcoming ".INTERNAL" TLD
The United Nations vs AI.
Telegram now blocked throughout Spain
Vancouver Pwn2Own 2024
China warns of incoming hacks
Annual Tax Season Phishing Deluge
SpinRite update
Authentication without a phone
Are Passkeys quantum safe?
GoFetch: The Unpatchable vulnerability in Apple chips

Show Notes - https://www.grc.com/sn/SN-967-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

zscaler.com/zerotrustAI
bitwarden.com/twit
canary.tools/twit - use code: TWIT
panoptica.app
kolide.com/securitynow

View Details

Voyager 1 update
The Web turned 35 and Dad is disappointed
Automakers sharing driving data with insurance companies
A flaw in Passkey thinking
Passkeys vs 2fa
Sharing accounts with Passkeys
Passkeys vs. Passwords/MFA
Workaround to sites that block anonymous email addresses
Open Bounty programs on HackerOne
Steve on Twitter
Ways to disclose bugs publicly
Security by obscurity
Something you have/know/are vs Passkeys
Passkeys vs TOTP
Inspecting Chrome extensions
Passkey transportability
Morris the Second

Show Notes - https://www.grc.com/sn/SN-966-Notes.pdf

Hosts: Steve Gibson and Mikah Sargent

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

zscaler.com/zerotrustAI
robinhood.com/boost
GO.ACILEARNING.COM/TWIT
joindeleteme.com/twit promo code TWIT
vanta.com/SECURITYNOW

View Details

VMware needs immediate patching
Midnight Blizzard still on the offensive
China is quietly "de-American'ing" their networks
Signal Version 7.0, now in beta
Meta, WhatsApp, and Messenger -meets- the EU's DMA
The Change Healthcare cyberattack
SpinRite update
Telegram's end-to-end encryption
KepassXC now supports passkeys
Login accelerators
Sites start rejecting @duck.com emails
Tool to detect chrome extensions change owners
Sortest SN title
Passkeys vs 2FA

Show Notes - https://www.grc.com/sn/SN-965-Notes.pdf

Hosts: Steve Gibson and Mikah Sargent

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

vanta.com/SECURITYNOW
joindeleteme.com/twit promo code TWIT
kolide.com/securitynow
business.eset.com/twit

View Details

"Death, Lonely Death" by Doug Muir, about the decades-old Voyager 1 explorer
Cory Doctorow's Visions of the Future Humble Book Bundle
CTRL-K shortcut for search on a browser
Direct bootable image downloading for GRC's servers
Closing the loop on compromised emails
Taco Bell's passwordless app
A solution for Bcrypt's password length limit of 72 bytes
Data as the missing piece for law enforcement and privacy advocates
The token solution for email-only login
Apple's Password Manager Resources on Github
The risk of long-term persistent cookies in browsers
Why mainframe industries still require weak passwords
A conundrum involving an exploitable Response Header error and a bounty payment.
An inspection of Apple's new Post-Quantum Encryption upgrade

Show Notes - https://www.grc.com/sn/SN-964-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

GO.ACILEARNING.COM/TWIT
Melissa.com/twit
bitwarden.com/twit
kolide.com/securitynow

View Details

Nevada attempts to block Meta's end-to-end encryption for minors.
A survey of security breaches
Edge's Super-Duper Secure Mode moves into Chrome
DoorDash dashes our privacy
Avast charged $16.5 million for selling user browsing data
No charge for extra logging!
European Parliament's IT service has found traces of spyware on the smartphones of its security and defense subcommittee members
LockBit RaaS group disrupted
Firefox v123
The ScreenConnect Authentication Bypass
SpinRite update
Introducing BootAble
Cox moving to Yahoo Mail for users
Credit Card security
Exploiting password complexity reqirements?
Email only logins
Flipper Zero in Canada
German Router security
More Flipper Zero in Canada
Throwaway email addresses
Shared email accounts
Password quality enforcement
Fingerprint tech and some future stories

Show Notes - https://www.grc.com/sn/SN-963-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
vanta.com/SECURITYNOW
robinhood.com/boost
joindeleteme.com/twit promo code TWIT

View Details

Wyze breach
Microsoft patch Tuesday fixes 15 remote code execution flaws
Why are there password restrictions?
The Canadian Flipper Zero Ban
Security on the old internet
Using Old Passwords
Passwordless login
TOTP as a second factor
German ISP using default router passwords
Email encryption in transit
pfSense Tailscale integration
DuckDuckGo's email protection integration with Bitwarden
The KeyTrap Vulnerability

Show Notes - https://www.grc.com/sn/SN-962-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

panoptica.app
kolide.com/securitynow
vanta.com/SECURITYNOW
GO.ACILEARNING.COM/TWIT

View Details

UK government appears to back down on demands to break encryption in Online Safety Bill
Microsoft reveals how China-based hackers acquired secret key used to breach Outlook accounts
Multiple flaws allowed key to improperly leave highly secure environment
Mozilla research finds all major auto brands fail on privacy protection
Evidence suggests LastPass encrypted vault data is being decrypted
Researchers tie $35M in crypto thefts to compromised LastPass accounts
Brute force feasible on old low iteration count passwords

Show Notes - https://www.grc.com/sn/SN-939-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

View Details

Steve provides an update on ValiDrive, his new freeware utility for testing USB drives. It identifies bogus mass storage drives and performance differences between drives.
There has been another sighting of Google's Topics API, this time on Android phones. It allows apps to get information about users' interests based on recent app usage.
Apple has opened up their iPhones to security researchers through their Security Research Device program since 2019. Researchers get access to customize kernels, entitlements, and other low-level features without compromising security.
Research reveals vulnerabilities in browser extensions that allow them to steal plaintext passwords from a website's HTML source code. Even sites like Google, Facebook, Amazon, IRS, and Capital One are affected.
Feedback from listeners on topics like Apple's stance on scanning iCloud data for CSAM, Microsoft's broken TLS timestamp implementation, using VirusTotal to check downloaded files, ReadSpeed limitations, and downloading malware for VirusTotal checks.
Apple publicly shares a letter from a CSAM activist demanding they implement scanning to detect child abuse images in iCloud Photos. Apple responds clearly stating they will not compromise user privacy and security to do so.

Show Notes - https://www.grc.com/sn/SN-938-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
panoptica.app
canary.tools/twit - use code: TWIT

View Details

Picture of the Week: Steve shares a funny "what we say vs what we mean" image about tech support conversations.
WinRAR v6.23 fixes: Steve explains that updating to the latest WinRAR is more important than initially thought, with two critical vulnerabilities being actively exploited by hackers since April to install malware.
HTTPS for local networks: Responding to listener email, Steve agrees HTTP is fine for local network devices like routers but notes risks in larger corporate networks.
Portable domains for email: Steve endorses a listener suggestion to purchase your own domain and use third-party services, retaining control if a provider shuts down.
Google Topics and monopolies: Steve and Leo debate whether Topics favors large advertisers with greater reach to get user targeting data.
Voyager 2 antenna analysis: A listener calculates the antenna beam width mathematically, showing 2 degrees off-axis may not be as remarkable as it sounded.
Windows time settings: Steve clarifies the STS issue does not impact end users changing Windows clock settings, it's enterprise server-side.
Unix time in TLS handshakes: The hosts discuss why Unix time stamps are sent but not required for TLS, tracing back to early nonce generation.
Fake flash drives: Steve warns of a slew of fake high-capacity thumb drives flooding the market, explaining how SpinRite tests detected the flaw.
Man-in-the-middle attacks: While agreeing HTTPS helps prevent malicious injection, Steve examines MITM attack practicality, arguing they are difficult for hackers to pull off.

Show Notes - https://www.grc.com/sn/SN-937-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
canary.tools/twit - use code: TWIT
Building Cyber Resilience Podcast

View Details

OpenSUSE goes private.
Android to get satellite comms.
SanDisk and Western Digital in hot water.
You're asking for it: YouTube children's privacy.
Whoopsie! 8Base.
Where the money is.
The TSSHOCK vulnerability.
BitForge.
A Quantum resilient security key.
Removed Chrome extensions notifications.
HTTPS by default?
WinRAR 6.23 final released.
Closing the Loop.
When Heuristics Backfire.

Show Notes - https://www.grc.com/sn/SN-936-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

panoptica.app
kolide.com/securitynow
joindeleteme.com/twit promo code TWIT

View Details

Picture of the Week.
Security Now!'s 18th birthday!
Closing the Loop.
Firefox Multi-Account Containers.
A question about Full Disk Encryption on SSD's.
Should I run SpinRite before I back up my drives to a NAS?
Overly complex password rules.
DuckDuckGo's email alias.
The new Russian Astra Linux based OS can not legally be possible.
Regarding satellite crowding: The skies won't be darkening anytime soon.
This is what came to mind on the Voyager 2 segment with the shout.
Can you please share the name of the session manager that you use in Firefox?
The numbers behind the Voyager recorrection.
"Topics" Arrives.
How Topics Works.

Show Notes: https://www.grc.com/sn/SN-935-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

cs.co/twit
Building Cyber Resilience Podcast
bitwarden.com/twit

View Details

Picture of the Week.
NASA "shouted" at Voyager.
Another view of Microsoft.
What about this Chinese attack?
AI meets Keyboard Acoustic Side-Channel attacks.
Closing the Loop.
Revisiting Global Privacy Control.

Show Notes: https://www.grc.com/sn/SN-934-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

View Details

Picture of the Week.
Satellite Turla: APT Command and Control in the Sky.
OS 17 to further crack down on device fingerprinting.
Android to start warning of "unknown trackers".
The 7th branch of the US military.
Russia criminalizes open source project contribution.
VirusTotal's 2023 report.
Closing the Loop.
TETRA:BURST.

Show Notes - https://www.grc.com/sn/SN-933-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

podtail.com/podcast/building-cyber-resilience
bitwarden.com/twit
drata.com/twit

View Details

Picture of the Week.
R.I.P. Kevin Mitnick.
Apple says: "Thanks, but we'd rather leave."
Web Environment Integrity.
Web Analytics under the spotlight.
More progress on the IoT security front.
The "Expeditionary cyber force".
Ransomware payouts being made much less often.
MOVEit Update.
TikTok + Passkeys.
Closing the Loop.
SpinRite.
Satellite Insecurity, Part 2.

Show Notes: https://www.grc.com/sn/SN-932-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
GO.ACILEARNING.COM/TWIT
bitwarden.com/twit

View Details

Picture of the Week.
Kaspersky on Microsoft's Patch Tuesday.
As the worm turns: WormGPT.
Microsoft revokes 100+ malicious drivers.
MOVEit Update.
Does Dun & Bradstreet know you?
No Threads for you! (or EU!)
All Bitcoin addresses look alike.
Twitter changes DM settings.
Closing the Loop.
SpinRite.
Satellite Insecurity, Part 1.

Show Notes: https://www.grc.com/sn/SN-931-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
drata.com/twit
cs.co/twit

View Details

Picture of the Week.
Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software.
And as for MOVEit...
What's a "Rug Pull" ??
"Avast, ye Matey"
China's OpenKylin v1.
TootRoot!
Firefox 115.
Did Russia Disconnect?
Use some honey if you want to catch some flies.
Cryptocurrency losses.
International Consumer Data Transit.
Apple's emergency update retraction.
Syncthing Revisited.
Closing the Loop.
SpinRite's first RTM release.
RTOS-32.
Rowhammer Indelible Fingerprinting.

Show Notes: https://www.grc.com/sn/SN-930-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
bitwarden.com/twit
GO.ACILEARNING.COM/TWIT

View Details

Picture of the Week.
Catching Leo up to speed from last week.
DuckDuckBrowse.
And an updated Tor Browser.
Opera, now enhanced with "AI".
The KasperskyOS Phone.
The cost of doing business in Russia.
Slowly turn the wheels of justice.
The US to create a new "Cyber Force".
Apple.com now supports Passkeys.
Selective GDPR enforcement?
Facial Recognition is Photo Recognition.
Google cybersecurity clinics.
Progress/MOVEit sued.
Closing the Loop.
SpinRite.
Operation Triangulation.

Show Notes: https://www.grc.com/sn/SN-929-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drinkAG1.com/securitynow
lookout.com
drata.com/twit

View Details

Picture of the Week.
Patch Tuesday.
Does EVERYTHING leak??
Closing the Loop.
SpinRite gets version 7.1!
The Massive MOVEit Maelstrom.

Show Notes: https://www.grc.com/sn/SN-928-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
cs.co/twit
kolide.com/securitynow

View Details

Picture of the Week.
Cryptomining Rude Surprise Billing.
Musk's Twitter is refusing to pay for Cloud Services.
IoT DDoS rapidly rising.
H1CA found executing code on client machines.
Apple's WWDC Redux.
France takes a different approach...
Russia: Scanners stay out!
Miscellany.
Closing the Loop.
SpinRite.
Scanning the Internet.

Show Notes: https://www.grc.com/sn/SN-927-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

GO.ACILEARNING.COM/TWIT
bitwarden.com/twit
athleticgreens.com/securitynow

View Details

Picture of the Week.
Another week of silence from HP.
Mandatory "SMB Signing" coming to Windows 11.
OWASP.
Did Apple help the NSA attack the Kremlin?
Kaspersky's analysis of this iPhone attack and compromise.
The Trifecta Jackpot!
Who wrote that?
Tor gets anti-DoS protection.
Cybersecurity at Educational institutions.
Civilian Surveillance Cameras in Ukraine.
Cyber Mercenaries.
Closing the Loop.
Windows Platform Binary Table.

Show Notes: https://www.grc.com/sn/SN-926-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

meraki.cisco.com/twit
joindeleteme.com/twittv
canary.tools/twit - use code: TWIT

View Details

Picture of the Week.
HP = "Huge Pile"
The ".ZIP" TLD — What could possibly go wrong?
PyPI gets more serious about security AND privacy.
"No logs saved anywhere"???
Twitter in the EU?
Bitwarden's support for Passkeys.
A €1.2 billion fine will grab your attention.
Editing WhatsApp messages.
A new Google Bug Bounty.
SpinRite.
Brave's Brilliant Off the Record Request.

Show Notes: https://www.grc.com/sn/SN-925-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

cs.co/twit
drata.com/twit
Melissa.com/twit

View Details

Picture of the Week.
Tracker Follow-Up.
Automatic IoT device updating.
HP 9020e - error code 83C0000B.
Section 230 Stands.
The KeePass Vulnerability.
Apple joins Samsung, Amazon and Verizon in banning ChatGPT.
Google's Privacy Sandbox moves forward.
The FBI heavily misused FISA powers.
Supply Chain Nightmare.
SpinRite.
VCaaS – Voice Cloning as a Service.

Show Notes: https://www.grc.com/sn/SN-924-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
athleticgreens.com/securitynow
lookout.com

View Details

Picture of the Week.
SpinRite.
Location Tracker Behavior.
Formal definitions from the specification.
Bluetooth LE devices have MAC addresses and therein lies a problem.
All devices are serialized.
And now, that "pairing registry".
Privacy considerations.

Show Notes: https://www.grc.com/sn/SN-923-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
GO.ACILEARNING.COM/TWIT

View Details

Picture of the Week.
Google & Passkeys.
TP-Link routers DO auto-update.
US Marshals Service: Where's the backup??
T-Mobile keeps getting breached.
Chrome: No more LOCK icon.
Apple's new "Rapid Security Response" system.
Elon Musk, making friends wherever he goes...
A quick Mastodon aside.
Here come the fake AI-generated "news" sites.
Russia to replace "American" TCP/IP with "Russian Internet".
Vint Serf's 3 mistakes.
Detecting Unwanted Location Trackers.

Show Notes: https://www.grc.com/sn/SN-922-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

kolide.com/securitynow

View Details

Picture of the Week.
The Encryption Debate.
Age does matter...
Age Verification.
WhatsApp: Rather be blocked in UK than weaken security.
Exposing Side-Channel Monitoring.
Closing the Loop.
A new UDP reflection attack vector.
Google Authenticator Updated.
Does Israel use NSO Group commercial spyware?
A Russian OS?
TP-Link routers compromised.
A pre-release security audit.
Another Intel side-channel attack.
Windows users: Don't remove cURL!
AI comes to VirusTotal.
Show Notes https://www.grc.com/sn/SN-921-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
joindeleteme.com/twittv
drata.com/twit

View Details

Picture of the Week.
Lockdown Mode seen succeeding.
A growing black market for ChatGPT accounts.
Decommissioned Corporate Routers Leak Secrets.
Jaguar Tooth: Cisco router vulnerabilities.
Security Research Legal Defense Fund.
A quick Firefox fix.
Kubernetes security audit.
Google Chrome zero-day.
An End-to-End Encryption Proposal.

Show Notes https://www.grc.com/sn/SN-920-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

athleticgreens.com/securitynow
lookout.com

View Details

Picture of the Week.
Patch Tuesday Review.
Risky Business News.
Google Assured Open Source Software.
WhatsApp Improvements.
Bad Security? Go to jail!
Forced Entry.

Show Notes https://www.grc.com/sn/SN-919-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

meraki.cisco.com/twit
bitwarden.com/twit
GO.ACILEARNING.COM/TWIT

View Details

Picture of the Week.
Microsoft and Fortra go on the offensive.
Can ChatGPT keep a secret?
Apple updates their OS's.
Wordpress under attack... again.
Mozilla's Site Breach Monitor.
Another ChatGPT investigation.
Samsung handsets reaching EoL.
Less access for loan apps.
The right to be forgotten.
SpinRite.
A Dangerous Interpretation.

Show Notes: https://www.grc.com/sn/SN-918-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

joindeleteme.com/twittv
meraki.cisco.com/twit
kolide.com/securitynow

View Details

Picture of the Week
So... Not an attack, then?
AI Overlord Hysteria
Italy says NO to ChatGPT
It's illegal... How much will that be?
The U.S. FDA & medical device security
Hack the Pentagon
Firefox 3dr-party DLL check-up
Microsoft's Extortion?
The Silver Ships
Zombie Software

Show Notes: https://www.grc.com/sn/sn-917-notes.pdf

Hosts: Steve Gibson and Ant Pruitt

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
canary.tools/twit - use code: TWIT
meraki.cisco.com/twit

View Details

Picture of the Week.
Synacktiv wins this year's CanSecWest Pwn2Own
GitHub: Mistakes happen
DDoS for Hire. . .Or Not
144,000 malicious packages published
No iPhones For Russian Presidential Staff
I NUIT
Edge Gets Crypto
Microsoft's Email Extortion

Show Notes: https://www.grc.com/sn/sn-916-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

lookout.com
kolide.com/securitynow
Melissa.com/twit

View Details

Picture of the Week.
Multiple Exploitable Samsung 0-Days.
A good idea for NPM.
The TikTok Tick Tock.
Google pushes for 90-day TLS certificate life.
CHESS is safe.
CISA has begun scanning!
Flying Trojan Horses.

Show Notes: https://www.grc.com/sn/SN-915-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
GO.ACILEARNING.COM/TWIT
expressvpn.com/securitynow

View Details

Picture of the Week.
Another Malicious Chrome Extension.
Germany to join the Huawei & ZTE ban.
Putting "phishing" into perspective.
The Polynonce attack.
Plex's RCE now in CISA's KEV.
Sci-Fi: Andor.
Sony Sues Quad9.

Show Notes: https://www.grc.com/sn/SN-914-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

fortra.com
bitwarden.com/twit
plextrac.com/twit

View Details

Picture of the Week.
DDoS'ing Fosstodon.
DDoS for Hire takedowns.
TikTok Insanity.
Illegal Warrantless Surveillance.
Strategic Objective 3.3.
GitHub Secret Scanning.
CISA's Covert Red-Team.
What's left?
What's old is new again.
TCG TPM vulnerabilities.
WordPress "All In One SEO".
Russia fines Wikipedia.
A Fowl Incident.

Show Notes: https://www.grc.com/sn/SN-913-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
drata.com/twit
kolide.com/securitynow

View Details

Picture of the Week.
Windows 11? ... anyone?
As Plain as Ever.
Edge's new built-in VPN?
LastPass Incident Update.
Signal says NO to the UK.
More PyPI troubles.
The QNAP bug bounty program.
SpinRite.
The NSA @ Home.

Show Notes: https://www.grc.com/sn/SN-912-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

kolide.com/securitynow

View Details

GoneDaddy, Section 230, NPM malware, Hyundai Kia mess, Meta Verified

Picture of the Week.
GoneDaddy.
Section 230.
No Blue, No SMS-based 2FA.
Bitwarden gets Argon.
"Meta Verified".
Emsisoft Fake Code Signing.
Attacks breaking records.
More Mirai.
NPM malware.
Patch Tuesday.
Samsung announces "Message Guard".
The Hyundai & Kia mess.
A Clever Regurgitator.

Show Notes https://www.grc.com/sn/sn-911-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
GO.ACILEARNING.COM/TWIT

View Details

Picture of the Week
ESXiArgs follow-up
ChatGPT's Malicious Use
Google Security Key Giveaway
Brave goes HTTPS-by-default
1Password Makes Another Passkeys Move
Russian Patriotic Hackers
Amazon to FINALLY Secure Its AWS S3 Instances
More Anti-Chinese Camera Removals
Microsoft to embed Adobe Acrobat PDF reader into Edge
Password Exhaustion
One Time Passowrd OTPAuth
Password Exhaustion
Ascon

Show Notes https://www.grc.com/sn/sn-910-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
plextrac.com/twit
fortra.com

View Details

Picture of the Week.
The European Union's Internet Surveillance Proposal.
30,000 patient records online?
.DEV is always HTTPS!
Google changes Chrome's release strategy.
Russia shoots the messenger.
A fool and his Crypto...
QNAP is back.
CVSS severity discrepancy.
Closing the Loop.
How ESXi Fell.

Show Notes: https://www.grc.com/sn/SN-909-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
barracuda.com/securitynow
canary.tools/twit - use code: TWIT

View Details

Android to start blocking old and unsafe apps.
Microsoft to block Internet sourced Excel add-ins.
An example of saying "no" even when it may hurt.
Hacked Wormhole funds on the move.
Kevin Rose Hacked.
Facebook will be moving more users into E2EE.
iOS 6.3 and FIDO.
Scan thy Citizenry.
The Hive ransomware organization takedown.
Errata.
Closing the Loop.
SpinRite.
Data Operand Independent Timing.

Show Notes: https://www.grc.com/sn/SN-908-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Melissa.com/twit
kolide.com/securitynow

View Details

Picture of the Week.
PayPal Credential Stuffing.
iOS 16.3 : Cloud encryption for all.
InfoSecurity Magazine: "ChatGPT Creates Polymorphic Malware".
CheckPoint Research: OPWNAI : Cybercriminals Starting to Use ChatGPT.
"Meta" fined for the third time.
Bitwarden acquires "Passwordless.dev".
Closing the Loop.
SpinRite.
Credential Reuse.

Show Notes: https://www.grc.com/sn/SN-907-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

GO.ACILEARNING.COM/TWIT
expressvpn.com/securitynow
drata.com/twit

View Details

Picture of the Week
About Password Iterations
EBC or CB
Norton Lifelock Troubles
Chrome Follows Microsoft and Firefox
Chromium is Beginning to Rust
BYOVD and Windows Defender Failures
Closing the Loop (feedback)
The Rule of Two

Show notes: https://www.grc.com/sn/sn-906-notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

plextrac.com/twit
bitwarden.com/twit
barracuda.com/securitynow

View Details

Picture of the Week.
LastPass Aftermath.
LastPass Vault De-Obfuscator.
What more do we know this week regarding LastPass?
The most alarming discovery by listeners.
Understanding the scale of GPU-enhanced password cracking.
On the true strength of passwords.
Feedback from listeners regarding LastPass.

Show Notes https://www.grc.com/sn/SN-905-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

tanium.com/twit
drata.com/twit

View Details

Picture of the Week.
SpinRite.
Leaving LastPass.
Is there reason for concern?
Well known password cracker Jeremi Gosney's LastPass rant.
Steve shares his plan regarding LastPass.
What is Steve's next password manager?
What should LastPass users do to protect themselves?

Show Notes https://www.grc.com/sn/SN-904-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

fortra.com
canary.tools/twit - use code: TWIT

View Details

Anatomy of a Log4j Exploit.
Will Russia Disconnect?
FCC Says Kaspersky Labs is a National Security Threat.
Lenovo UEFI Firmware Troubles.
That ""Passkeys"" Thing.
Dis-CONTI-nued: The End of Conti?
Steve's Take on the LastPass Breach.

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
kolide.com/securitynow

View Details

Picture of the Week.
A malware operation known as URSNIF.
Pwn2Own Toronto 2022.
Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities.
Patch Tuesday.
Another Uber breach?
Elon Botches 'Bot Blockage.
Vivaldi integrates Mastodon in its desktop browser.
5,200 Dutch government warnings.
CIB: "Coordinated Inauthentic Behavior"
GitHub to require 2FA by the end of next year.
Bye bye SHA-1.
WordFence's VERY useful looking WordPress add-on vulnerability database.
Closing The Loop.
SpinRite.
A Generic WAF Bypass.

Show Notes https://www.grc.com/sn/SN-902-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

plextrac.com/twit

View Details

Picture of the Week.
Chrome does Passkeys.
SYNC.COM suffered its first outage.
Medibank reboot.
Totally fake cryptocurrency trading platforms.
Malware on Telegram.
Texas gets in on the TikTok banning.
The LastPass class action lawsuit.
Rackspace had a big embarrassing problem.
Rackspace is now facing at least three class action lawsuits.
Another country goes on the offensive.
Closing The Loop.
SpinRite.
Miscellany.
Apple Encrypts the Cloud.

Show Notes https://www.grc.com/sn/SN-901-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

barracuda.com/securitynow
bitwarden.com/twit
expressvpn.com/securitynow

View Details

Picture of the Week.
Don't mess with Australia.
Facebook / Meta fined by Ireland.
REvil's full Medibank dump.
Is nothing sacred?
Mozilla yanks a (no longer) trusted root.
Android Platform Certs Escape.
South Dakota says: No more Tik-Tok.
Albania blames its IT staff.
Good news on the memory safe languages front.
Black Hat USA 2022.
Another Chrome 0-day bites the dust.
Anker's Eufy Camera debacle.
An amazing-looking WiFi-6 router... $119.
Elon really said this.
Closing the Loop.
SpinRite.
LastPass Again.

Show Notes https://www.grc.com/sn/SN-900-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

itpro.tv/securitynow
canary.tools/twit - use code: TWIT
plextrac.com/twit

View Details

Picture of the Week.
iSpoof you no more.
Here come the Freebie Bots!
Anatomy of the real-time Cryptocurrency heist.
Lookin' for something to do?
Boa server vulnerability.
The dilemma of closed-source Chinese networking products.
The Cyber Defense Index.
Malicious Docker Hub images.
Since we've been tracking 0-days for a while.
CISA on Mastodon.
Miscellany.
Closing The Loop.
SpinRite.

Show Notes https://www.grc.com/sn/SN-899-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
plextrac.com/twit
nordlayer.com/twit

View Details

Picture of the Week.
Firefox v107 was released last Tuesday.
Google settles for a cool $391.5 million.
Red Hat Signing its ZIP file Packages.
The FBI purchased Pegasus for "research and development purposes".
Greece bought Predator for €7 million.
A passkeys support directory.
Quantum decryption deadline.
Attorneys General ask the FTC for online privacy regulation.
Closing The Loop.
SpinRite.
Wi-Peep.

Show Notes https://www.grc.com/sn/SN-898-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

tanium.com/twit
barracuda.com/securitynow
Secureworks.com/twit

View Details

Picture of the Week.
Patch Tuesday review.
Shennina Framework - Automating Host Exploitation with AI.
GitHub's welcome new feature.
Three LightSpeed vulnerabilities.
Shufflecake: Plausible deniability encrypted Linux volumes.
Australia has decided to get proactive!
Apple's iOS 16.1.1 everyone file sharing time-limits to 10 minutes in China.
A couple of Decentralized Finance notes because I can't help myself.
"The Helm" was unable to survive COVID-19.
Elon meets Twitter.
Closing The Loop.
SpinRite.
Memory-Safe Languages.

Show Notes - https://www.grc.com/sn/SN-897-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
expressvpn.com/securitynow
grammarly.com/tone

View Details

Picture of the Week.
A minor Dropbox breach.
OpenSSL follow-up.
FTC sued and settled with a repeated offender.
$1.2 billion in reported ransomware payments during 2021.
Akamai's Q3 Threat Report.
Initial Access Brokerages.
How do today's bank heists work?
De-Fi De-struction De-jour.
Russia moves to Linux.
We're The Red Cross. Don't attack us, please!
Where there's a will, there's a way.
From China with Love.
The UK's NCSC scan plan.
Miscellany.
Closing The Loop.
SpinRite.

We invite you to read our show notes at https://www.grc.com/sn/SN-896-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
drata.com/twit

View Details

Picture of the Week.
A minor Dropbox breach.
OpenSSL follow-up.
FTC sued and settled with a repeated offender.
$1.2 billion in reported ransomware payments during 2021.
Akamai's Q3 Threat Report.
Initial Access Brokerages.
How do today's bank heists work?
De-Fi De-struction De-jour.
Russia moves to Linux.
We're The Red Cross. Don't attack us, please!
Where there's a will, there's a way.
From China with Love.
The UK's NCSC scan plan.
Miscellany.
Closing The Loop.
SpinRite.

We invite you to read our show notes at https://www.grc.com/sn/SN-896-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
drata.com/twit

View Details

Picture of the Week.
Windows driver blocklist to be updated next Tuesday.
More Microsoft shenanigans.
An upcoming OpenSSL CRITICAL vulnerability update -- get ready!
A new TCP/IP RCE in Windows.
A study of malicious CVE proof of concept exploits in GitHub.
"Stranger Strings" : An exploitable flaw in SQLite.
PayPal to add support for Passkeys.
A browser exploitation tutorial!
Kathleen Booth: July 9th, 1922 – September 29, 2022.
Closing The Loop.
SpinRite.
After 20 years in GCHQ.

We invite you to read our show notes at https://www.grc.com/sn/SN-895-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

nordlayer.com/twit
kolide.com/securitynow
itpro.tv/securitynow

View Details

Picture of the Week.
Firefox 106 is out.
Google's Open Source IoT KataOS and Sparrow.
This Week in CryptoCurrency Craziness.
New Windows 0-day bypasses executable security checks.
Apple's 9th 0-day of the year bites the dust.
The evolutionary demise of banking malware.
VMWare's Critical CVSS 9.8 Update.
Closing The Loop.
Miscellany.
Data Breach Responsibility.

We invite you to read our show notes at https://www.grc.com/sn/SN-894-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
Secureworks.com/twit
barracuda.com/securitynow

View Details

Picture of the Week.
Microsoft "Won't Fix".
Malicious Kernel Drivers.
Microsoft has finally added an RSS feed for Windows Updates!
Passkeys [dot] Dev.
Largest DDoS attack.
Signal will be dropping its SMS/MMS support.
Brute-force protection for Windows local admin accounts.
Other than that...
SpinRite.
Closing The Loop.
xchg rax, rax and "xorpd"
ZimaBoard Goodness.
Password Change Automation.

We invite you to read our show notes at https://www.grc.com/sn/SN-893-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

wwt.com/twit
canary.tools/twit - use code: TWIT
expressvpn.com/securitynow

View Details

Picture of the Week.
Breach of Customer Information
Meta-targeted Malware
Uber's Chief Security Officer Found Guilty
More Cryptocurrency Chaos
The UK to drop GDPR
Summer Internship with the NSA
Many Incident Responders are Stressed Out
Microsoft's newest dual 0-day Exchange Fumbles
SpinRite news
ZimaBoard
Closing the Loop
Source Port Randomization

We invite you to read our show notes at https://www.grc.com/sn/SN-892-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Secureworks.com/twit
newrelic.com/securitynow
bitwarden.com/twit

View Details

Picture of the Week. (What Could Possibly Go Wrong)
Microsoft Teams - Unecessarily Insecure
Roskomnadzor blocks Soundcloud
Microsoft Exchange Server Under Attack Again
I'm (Still) Not a Robot!
Google TAG History
Closing the Loop
Poisoning Akamai

We invite you to read our show notes at https://www.grc.com/sn/SN-891-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

ziprecruiter.com/securitynow
itpro.tv/securitynow
kolide.com/securitynow

View Details

Picture of the Week.
Can't have it both ways.
Denmark has become the fourth EU member to rule that the use of Google Analytics is illegal.
Rockstar Games hacker is busted!
Mozilla says: No fair!
Vivaldi, Manifest V3, webRequest, and ad blockers.
Sticky Chrome vulnerabilities.
SMB authentication rate limiter now on by default in Windows Insider.
US bill to secure FOSS software.
Iran vs Albania.
Closing The Loop.
The Silver Ships.
SpinRite.
DarkNet Politics.

We invite you to read our show notes at https://www.grc.com/sn/SN-890-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

grammarly.com/securitynow
Secureworks.com/twit
drata.com/twit

View Details

Picture of the Week.
Can't have it both ways.
Denmark has become the fourth EU member to rule that the use of Google Analytics is illegal.
Rockstar Games hacker is busted!
Mozilla says: No fair!
Vivaldi, Manifest V3, webRequest, and ad blockers.
Sticky Chrome vulnerabilities.
SMB authentication rate limiter now on by default in Windows Insider.
US bill to secure FOSS software.
Iran vs Albania.
Closing The Loop.
The Silver Ships.
SpinRite.
DarkNet Politics.

We invite you to read our show notes at https://www.grc.com/sn/SN-890-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

grammarly.com/securitynow
Secureworks.com/twit
drata.com/twit

View Details

Picture of the Week.
This is Patch News-Day.
Lloyd's of London backing away from Cyber-Insurance.
Uber Oops!
Rockstar Games: Grand Theft Auto 6 Massive Leak.
LastPass Breach Update.
A CVSS 9.8 for WordPress.
What cost, Security?
Use-after-freedom: Google's "MiraclePtr"
Closing The Loop.
Spell-Jacking.

We invite you to read our show notes at https://www.grc.com/sn/SN-889-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

barracuda.com/securitynow
bitwarden.com/twit
tanium.com/twit

View Details

Picture of the Week.
This is Patch News-Day.
Lloyd's of London backing away from Cyber-Insurance.
Uber Oops!
Rockstar Games: Grand Theft Auto 6 Massive Leak.
LastPass Breach Update.
A CVSS 9.8 for WordPress.
What cost, Security?
Use-after-freedom: Google's "MiraclePtr"
Closing The Loop.
Spell-Jacking.

We invite you to read our show notes at https://www.grc.com/sn/SN-889-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

barracuda.com/securitynow
bitwarden.com/twit
tanium.com/twit

View Details

Picture of the Week.
Cyberwarfare: Albania vs Iran.
Crypto Heist — this or that.
The White House "Tech Platform Accountability" Listening Session.
Changes to the Dutch Intelligence Law.
Another QNAP mess.
D-Link's being taken over by MooBot.
Sci-Fi Discovery: "The Silver Ships".
Closing The Loop.
The EvilProxy Service.

We invite you to read our show notes at https://www.grc.com/sn/SN-888-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
canary.tools/twit - use code: TWIT
newrelic.com/securitynow

View Details

Picture of the Week.
Cyberwarfare: Albania vs Iran.
Crypto Heist — this or that.
The White House "Tech Platform Accountability" Listening Session.
Changes to the Dutch Intelligence Law.
Another QNAP mess.
D-Link's being taken over by MooBot.
Sci-Fi Discovery: "The Silver Ships".
Closing The Loop.
The EvilProxy Service.

We invite you to read our show notes at https://www.grc.com/sn/SN-888-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
canary.tools/twit - use code: TWIT
newrelic.com/securitynow

View Details

Picture of the Week.
Google's (newest) Open Source Software Vulnerability Rewards Program.
Did TikTok leak 2.05 BILLION User Records?
An urgent Chrome update patches new 0-day flaw.
Permission-less Browser Clipboard Write.
Nearly 1/3 of the packages in PyPI trigger an automatic code execution upon download.
A Quantum Hype Bubble?
All of the BlackHat 2022 Presentation Slides PDFs.
Csurf NPM library mistake.
SpinRite.
Closing The Loop.
Sci-Fi Discovery: "The Silver Ships"
Embedding AWS Credentials.

We invite you to read our show notes at https://www.grc.com/sn/SN-887-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

itpro.tv/securitynow promo code SN30
kolide.com/securitynow

View Details

Picture of the Week.
Google's (newest) Open Source Software Vulnerability Rewards Program.
Did TikTok leak 2.05 BILLION User Records?
An urgent Chrome update patches new 0-day flaw.
Permission-less Browser Clipboard Write.
Nearly 1/3 of the packages in PyPI trigger an automatic code execution upon download.
A Quantum Hype Bubble?
All of the BlackHat 2022 Presentation Slides PDFs.
Csurf NPM library mistake.
SpinRite.
Closing The Loop.
Sci-Fi Discovery: "The Silver Ships"
Embedding AWS Credentials.

We invite you to read our show notes at https://www.grc.com/sn/SN-887-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

itpro.tv/securitynow promo code SN30
kolide.com/securitynow

View Details

Picture of the Week.
LastPass Breached.
The US Federal Trade Commission filed a lawsuit against data broker Kochava.
The US Federal Communications Commission launched an investigation into mobile carriers' geolocation data practices.
California, here I come!
A conversation with a Ransomware Attacker.
DuckDuckGo's Privacy-Enhanced eMail Forwarding.
Another IoT mess care of "Hikvision"
SpinRite.
Closing The Loop.
Wacky Data Exfiltration.

We invite you to read our show notes at https://www.grc.com/sn/SN-886-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Sponsors:* Secureworks.com/twit * grammarly.com/securitynow

View Details

VIDEO of the Week
Crashing Laptop Computers With Janet Jackson
RealTek SoC flaw affects many millions of IoT devices
46 Million RPS - requests per second
Chrome's 5th 0-Day of 2022
Apple: Not to be left behind...
RubyGems to require MFA
Closing The Loop: Domain Name Ownership
Closing The Loop: Growing in Cybersecurity
The Bumblebee Loader

We invite you to read our show notes at https://www.grc.com/sn/SN-885-Notes.pdf

Hosts: Leo Laporte and Steve Gibson

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
barracuda.com/securitynow
Melissa.com/twit

View Details

Picture of the Week.
Patch Flashback Tuesday.
Facebook is cautiously creeping toward default E2E encryption.
VNC's inherent insecurity.
The need to control domain names.
And speaking of backup: Cyotek WebCopy.
Google's Ryan Sleevi Retweeted Jens Axboe.
SandSara Update from Ed Cano.
Closing The Loop.
SpinRite.
TLS Private Key Leakage.

We invite you to read our show notes at https://www.grc.com/sn/SN-883-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
newrelic.com/securitynow
Secureworks.com/twit

View Details

Picture of the Week.
Crypto is Hard.
VirusTotal: Deception at a scale.
Windows 11 might damage encrypted data.
Microsoft Defender External Attack Surface Management.
Closing The Loop.
Daniel Bernstein sues the NSA.
The Maker's Schedule.

We invite you to read our show notes at https://www.grc.com/sn/SN-883-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/securitynow
expressvpn.com/securitynow
drata.com/twit

View Details

Picture of the Week.
Atlassian's "Confluence" under attack.
LS-Anvil.
Google delays Chrome's cookie phase-out again.
Attacker responding to loss of Office Macros.
SpinRite.
Closing The Loop.
RIP: Nichelle Nichols.
"The Dropout" on Hulu and "WeCrashed" on AppleTV+.
Winamp releases new version after four years in development.
Rowhammer's Nine Lives.

We invite you to read our show notes at https://www.grc.com/sn/SN-882-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

tanium.com/twit
itpro.tv/securitynow use code: SN30
grammarly.com/securitynow

View Details

Picture of the Week.
Patch Tuesday Redux Redux.
Windows 11 Start button failure.
The continuing saga of Windows VBA macros.
Windows 11 now blocks RDP brute-force attacks by default.
Black Hat and DefCon coming soon.
SpinRite.
pfSense and TailScale.
Closing The Loop.
The MV720.

We invite you to read our show notes at https://www.grc.com/sn/SN-881-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Melissa.com/twit
bitwarden.com/twit
barracuda.com/securitynow

View Details

Picture of the Week.
The Rolling Pwn, take II.
The great IPv4 Address Space Depletion.
Confronting Reality in Cyberspace: Foreign Policy for a Fragmented Internet.
Facebook has started encrypting its link URLs.
- Crack iOS 16's "Lockdown Mode", earn $2 million.
- ClearView AI faces some new headwind.
- Ransomware gangs are getting into the searchable database game, too...
- Roskomnadzor strikes again!
- Last Tuesday's Patches.
- SpinRite.
- Closing The Loop.
- RetBleed.

We invite you to read our show notes at https://www.grc.com/sn/SN-880-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

newrelic.com/securitynow
drata.com/twit
wwt.com/twit

View Details

Picture of the Week.
OpenSSL's Patch For Heap Memory Corruption Vulnerability.
NIST Announces First Four Quantum-Resistant Cryptographic Algorithms.
Yubico donated 30,000 Yubikeys to Ukraine.
Apple's new extreme "Lockdown Mode".
Microsoft to re-enable Office Macros.
This Is the Code the FBI Used to Wiretap the World.
Closing The Loop.
The Rolling Pwn.

We invite you to read our show notes at https://www.grc.com/sn/SN-879-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
tanium.com/twit
canary.tools/twit - use code: TWIT

View Details

Picture of the week.
Chrome's fourth zero-day of 2022.
Mozilla's new Firefox privacy-enhancing feature.
HackerOne discloses a malicious insider incident.
Closing the loop.
The ZuoRAT.

We invite you to read our show notes at https://www.grc.com/sn/SN-878-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

ZipRecruiter.com/securitynow
itpro.tv/securitynow promo code SN30
tanium.com/twit

View Details

Picture of the Week.
Errata: Firefox's "Total Cookie Protection"
3rd Party FIDO2 Authenticators
Germany's not buying the EU's proposal which subverts encryption
The Conti Gang have finally pulled the last plug
Log4J and Log4Shell is alive and well
The '311' emergency number proposal
56 Insecure-By-Design Vulnerabilities
"Long Story Short"
Closing The Loop
The "Hertzbleed" Attack

We invite you to read our show notes at https://www.grc.com/sn/SN-877-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

drata.com/twit
barracuda.com/securitynow
Melissa.com/twit

View Details

Picture of the Week.
Double Decryption (Last week's key-strength puzzler).
3rd Party Authenticators.
Firefox: Total Cookie Protection.
We keep breaking DDoS attack records.
MS-DFSNM.
An Apple Safari regression.
One Million WordPress sites force-updated.
High-Severity RCE in Fastjson Library.
Miscellany.
Closing The Loop.
Microsoft's Patchy Patches.

We invite you to read our show notes at https://www.grc.com/sn/SN-876-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

privacy.com/securitynow
newrelic.com/securitynow
expressvpn.com/securitynow

View Details

Picture of the Week.
Apple's Passkeys presentation at WWDC 2022.
WebAuthn.
FREE Penetration Testing course with Kali Linux.
Proof of Simulation.
A valid use for facial recognition: The Smart Pet Door!
Closing The Loop.
The PACMAN Attack.

We invite you to read our show notes at https://www.grc.com/sn/SN-875-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

plextrac.com/twit
NetFoundry.io/TWIT
canary.tools/twit - use code: TWIT

View Details

Picture of the Week.
ServiceNSW Responds.
ExpressVPN pulls the plug in India.
And speaking of pulling the plug.
"Follina" under active exploitation.
And a Windows Search URL schema can be abused, too.
"Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones".
Ransomware sanctions are causing trouble.
Conti spotted compromising motherboard firmware.
Errata.
Closing the Loop.
Passkeys, Take 2.

We invite you to read our show notes at https://www.grc.com/sn/SN-874-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

itpro.tv/securitynow promo code SN30
cloud.jumpcloud.com/securitynow
bitwarden.com/twit

View Details

Picture of the Week.
New South Wales DDL — Digital Driver's License.
The latest Microsoft Office 0-day remote code execution vulnerability.
GhostTouch.
Vodafone's new TrustPiD.
Closing the Loop.
DuckDuckGone?

We invite you to read our show notes at https://www.grc.com/sn/SN-873-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Melissa.com/twit
zentrysecurity.com/twit
kolide.com/securitynow

View Details

Picture of the Week.
Emergency mid-cycle update for Active Directory.
Clearview AI -vs- {Illinois, Australia, Canada and the United Kingdom}.
Clearview AI in Ukraine.
Pwn2Own Vancouver 2022.
The DoJ takes a welcome step back.
Sometimes, unlocking can be too convenient.
Closing The Loop.
Dis-CONTI-nued: The End of Conti?

We invite you to read our show notes at https://www.grc.com/sn/SN-872-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

barracuda.com/securitynow
plextrac.com/twit
NetFoundry.io/TWIT

View Details

Picture of the Week.
An "eventful" Patch Tuesday.
Patch Tuesday.
Apple patched a 0-day.
Google's "Open Source Maintenance Crew".
Conti suggests overthrowing the new Costa Rican government.
Policing the Google Play Store.
The situation has grown more dire for F5 systems' BIG-IP boxes.
Errata.
Closing The Loop.
SpinRite.
The New EU Surveillance State.

We invite you to read our show notes at https://www.grc.com/sn/SN-871-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
expressvpn.com/securitynow
cloud.jumpcloud.com/securitynow

View Details

Picture of the Week.
Google updates Android to patch an actively exploited vulnerability.
Connecticut's recently passed data privacy bill became law last Wednesday.
Ransomware victim snapshot.
US State Department offering $10 million reward for information about Conti members.
The worst threat the US faces...
The White House and Quantum Computers.
The ongoing threat from predictable DNS queries.
F5 Networks Remote RCE warning and exploitation.
Closing The Loop.
Sci-Fi.
That "Passkeys" Thing.

We invite you to read our show notes at https://www.grc.com/sn/SN-870-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

zentrysecurity.com/twit
kolide.com/securitynow
privacy.com/securitynow

View Details

Picture of the Week.
DoD DIB-VDP Pilot Overview.
The OpenSSF and the Package Analysis project.
Connecticut moves toward state privacy protections.
Closing The Loop.
Global Privacy Control.

We invite you to read our show notes at https://www.grc.com/sn/SN-869-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

plextrac.com/twit
bitwarden.com/twit
itpro.tv/securitynow promo code SN30

View Details

Picture of the Week.
CISA's Known Exploited Vulnerabilities Catalog.
Lenovo UEFI Firmware Troubles.
Everscale Blockchain Wallet.
Java 15, 16, 17, and 18 received MUST UPDATES last week.
Closing The Loop.
Sci-Fi.
SpinRite.
The 0-Day Explosion.

We invite you to read our show notes at https://www.grc.com/sn/SN-868-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

NetFoundry.io/TWIT
barracuda.com/securitynow
grammarly.com/twit

View Details

Picture of the Week.
Chrome's 3rd 0-day of 2022.
Patch Tuesday Redux.
WordPress once again...
Apache Struts Framework needs a critical update.
Are America's nuclear systems so old they're un-hackable?
Closing The Loop.
SpinRite.
A Critical Windows RPC RCE.

We invite you to read our show notes at https://www.grc.com/sn/SN-867-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

cloud.jumpcloud.com/securitynow
canary.tools/twit - use code: TWIT
zentrysecurity.com/twit

View Details

Picture of the Week.
Could NGINX have a 0-day?
Microsoft's new Autopatch system.
Another instance of Russian Protest in JavaScript's repository.
End-of-service life for some popular Windows editions.
Miscellany.
Closing The Loop.
Spring4Shell.

We invite you to read our show notes at https://www.grc.com/sn/SN-866-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
plextrac.com/twit
ZipRecruiter.com/securitynow

View Details

Picture of the Week.
0-Day Watch.
Spring Forward (Java: Spring4Shell)
QNAP and the OpenSSL DoS vulnerability.
Sophos has a 9.8.
CISA orders federal civilian agencies to patch the Sophos vulnerability.
Browser-in-the-browser.
The supply-chain attacks on NPM have been growing.
FinFisher bites the dust.
A LAPSUS$ in judgment.
Not so Wyze.
Closing The Loop.
Port Knocking.

We invite you to read our show notes at https://www.grc.com/sn/SN-865-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
itpro.tv/securitynow promo code SN30
kolide.com/securitynow

View Details

Picture of the Week.
A high severity 0-day vulnerability update for Chrome.
An interview with the CTO of a large Ukraine ISP, Ukrtelecom.
NPM under attack, again.
Honda says, nothing to worry about...
The U.S., the FCC, Kaspersky Labs and Chinese Telecoms.
Closing The Loop.
Targeted Exploitation.

We invite you to read our show notes at https://www.grc.com/sn/SN-864-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

grammarly.com/securitynow
NetFoundry.io/TWIT
wwt.com/twit

View Details

Picture of the Week.
Report Cybercrime: It's the Law.
A software supply chain compromise.
Browser in the Browser.
TrickBot, MicroTik & Microsoft.
The Infinite Loop OpenSSL Bug.
CISA Alert AA22-074A.
The Windows Local Privilege Escalation that Microsoft seems unable to fix.
Use After Free.

We invite you to read our show notes at https://www.grc.com/sn/SN-863-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

barracuda.com/securitynow
Melissa.com/twit
plextrac.com/twit

View Details

Picture of the Week.
Patch Tuesday for the Industry.
Android, too.
Firefox emergency update.
HP's major UEFI firmware patch-fest.
The NVIDIA breach.
ProtonMail gets it right.
Linux Blues.
Russia's New CA.
The state of WordPress security.
Sci-Fi update.
QWACs on? or QWACs off?

We invite you to read our show notes at https://www.grc.com/sn/SN-862-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

kolide.com/twit
canary.tools/twit - use code: TWIT
newrelic.com/securitynow

View Details

Picture of the Week.
The Russians are coming.
Ukrainian "Cyber Unit Technologies" is paying for attacks on Russia.
StarLink in Ukraine.
Russia blocks access to Facebook, Twitter, foreign news outlets.
Google has become proactive.
Namecheap says "no more".
Telegram's use explodes.
Microsoft also shuts down in Russia.
Coinbase.
Russia releases the IP addresses and Domains of DDoS attacks.
Russia to permit software piracy.
Will Russia Disconnect?.

We invite you to read our show notes at https://www.grc.com/sn/SN-861-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

progress.com/security-now
expressvpn.com/securitynow
go.acronis.com/twit-4

View Details

Picture of the Week.
Honor among thieves?
Daxin.
Whither or Wither: Log4j / Log4Shell.
"418 I'm a teapot"
Will the US attack?
Windows 11 Compatibility.
Closing the Loop.
SpinRite News.
Trust Dies in Darkness.

We invite you to read our show notes at https://www.grc.com/sn/SN-860-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

itpro.tv/securitynow promo code SN30
privacy.com/securitynow
bitwarden.com/twit

View Details

Picture of the Week.
The "UpdraftPlus" WordPress Plug-In.
"Xenomorph"
Decrypting "The Hive"
Un-Pixelating redacted text.
No Internet For You!!
If at first you don't succeed...
Ukrainian DDoS Attacks.
The Bobiverse trilogy.
SpinRite News.
A BGP Routing Attack.

We invite you to read our show notes at https://www.grc.com/sn/SN-859-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

privacy.com/securitynow
kolide.com/twit
plextrac.com/twit

View Details

Picture of the Week.
A high-severity 0-day in Chrome.
Apple updates against another 0-day.
CISA thinks this Apple vulnerability is quite serious.
Which brings us back to "SeriousSAM" as it's being called.
The CISA Top 16 list.
Last Tuesday was the industry's monthly Patch extravaganza.
The Magento Emergency.
"PHP Everywhere"
Google's Vulnerability Reward Program for 2021.
Google's Project Zero Stats.
Bye bye WMIC.
InControl.

We invite you to read our show notes at https://www.grc.com/sn/SN-858-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

canary.tools/twit - use code: TWIT
newrelic.com/securitynow
barracuda.com/securitynow

View Details

Picture of the Week.
China's Olympics: Leave your tech at home.
We have a serious CVS 9.9 remote code execution vulnerability in SAMBA.
Living off the Land.
The suspension of the ms-appinstaller:// protocol scheme handler.
Soon: Internet-sourced macros WILL NOT RUN in Office apps!
Never11?
The Inept Panda.

We invite you to read our show notes at https://www.grc.com/sn/SN-857-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

expressvpn.com/securitynow
go.acronis.com/twit-2
privacy.com/securitynow

View Details

Picture of the Week.
Apple eliminates 0-days from iOS and macOS.
Qualys published technical details for PwnKit.
Log4Shell hits Ubiquiti. New bug bounties posted by Zerodium.
"DrawnApart": A device identification technique based on remote GPU fingerprinting.
Sorting Windows Folders to the TOP!
Closing the Loop.
SpinRite.
The "Topics" API.

We invite you to read our show notes at https://www.grc.com/sn/SN-856-Notes.pdf

Hosts: Steve Gibson and Jason Howell

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

bitwarden.com/twit
itpro.tv/securitynow promo code SN30
progress.com/security-now

View Details

Picture of the Week.
Log4J News.
Who pays for RansomWare attack recovery?
The rising cost of cyber-insurance.
Another very dangerous WordPress add-on.
And a supply-chain attack on a popular WordPress add-on provider.
Does WordPress make sense anymore?
The European Union plans to fund some bug bounty programs.
The "MoonBounce" EFI Bootkit.
Closing the Loop.
Inside the NetUSB Hack.

We invite you to read our show notes at https://www.grc.com/sn/SN-855-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

plextrac.com/twit
privacy.com/securitynow
Melissa.com/twit

View Details

Picture of the Week
"Hack the Pentagon" with Log4j
Open Source Software Security Summit
Microsoft's January Patch Tuesday Review: The GOOD News
Microsoft's January Patch Tuesday Review: The Not So Good News
Check Your Router Firmware Updates
Chrome to Implement PNA
Three High Severity Flaws in WordPress Add-ons
Closing the Loop: Listener feedback
SpinRite
Anatomy of a Log4j Exploit

We invite you to read our show notes at https://www.grc.com/sn/SN-854-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

newrelic.com/securitynow
canary.tools/twit - use code: TWIT
kolide.com/twit

View Details

Picture of the Week.
The US CISA Log4J status update.
The H2 Database Console vulnerability.
The Federal Trade Commission gets into the act!
Chrome fixed 37 known problems last week.
The Privacy-first Brave browser.
WordPress 5.8.3 security update.
What, exactly, is a "Pluton"?
The first of Dennis Taylor's three Bobiverse novels.
SpinRite.
URL Parsing Vulnerabilities.

We invite you to read our show notes at https://www.grc.com/sn/SN-853-Notes.pdf Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

go.acronis.com/twit-1
barracuda.com/securitynow
expressvpn.com/securitynow

View Details

Picture of the Week.
Log4j's 5th update.
Microsoft's Log4j scanner triggers false positives.
Chinese government is annoyed with Alibaba.
"Hack the DHS" Bug Bounty Expanded.
COVID postpones the RSA Conference.
DuckDuckGo continues to grow.
The cost of cyber insurance will likely be rising or perhaps terminated.
"The Matrix Resurrections" what a disappointment!
SpinRite.
December 33rd.

We invite you to read our show notes at https://www.grc.com/sn/SN-852-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

progress.com/security-now
bitwarden.com/twit
itpro.tv/securitynow promo code SN30

View Details

Leo Laporte walks through some of the highlights of the show and most impactful stories of 2021. Stories include:

SolarWinds Hack Detailed By Microsoft
Crispy Subtitles from Lay's
Remembering Dan Kaminsky
REvil Hacks Apple Supplier Quanta Computer
The "Doom" CAPTCHA
How Colonial Pipeline Was Breached
When John McAfee Called Steve Gibson
T-Mobile Subscribers: Do This Now
Internet Anonymity" is an Oxymoron

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

ZipRecruiter.com/securitynow

View Details

Picture of the Week.
Google's 16th exploited Chrome 0-day of the year.
Firefox refuses to do Microsoft.com!
Firefox disabled Microsoft's Cloud Clipboard.
Weaknesses in all cellular networks since 2G.
Cross Wi-Fi / Bluetooth leakage.
"The Matrix Resurrections" aka "The Matrix 4".
SpinRite.
It's a Log4j Christmas.

We invite you to read our show notes at https://www.grc.com/sn/SN-850-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

andela.com/for-companies
stripe.com
UserWay.org/twit

View Details

Picture of the Week.
Amazon outage and cloud dependence.
AirTag Abuse.
Windows 11 vs Your Browser of Choice.
WordPress once again in the crosshairs.
Closing the Loop.
Sci-Fi.
SpinRite.
Log4j & Log4Shell.

We invite you to read our show notes at https://www.grc.com/sn/SN-849-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Melissa.com/twit
canary.tools/twit - use code: TWIT
expressvpn.com/securitynow

View Details

Picture of the Week.
Tavis finds a bad bug in NSS.
Cheap Smartwatches for kids and babies?
Additional VPN vendors just say no to Roskomnadzor!
Windows 11 loosens its grip on Edge.
RTF Templates being used to inject malicious content.
A Malicious Botnet uses the Bitcoin Blockchain.
HP's has been shipping vulnerable printers for 8 years.
Sci-Fi.
SpinRite.
XSinator.

We invite you to read our show notes at https://www.grc.com/sn/SN-848-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

wwt.com/twit
itpro.tv/securitynow promo code SN30
bitwarden.com/twit

View Details

Picture of the Week.
"Super Duper Secure Mode"
37% of the world's smartphones are vulnerable.
The RAT Dispenser.
The Entirely Predictable 0-Day Windows Exploit.
"The Frontiers Saga: Fringe Worlds"
Closing the Loop.
Bogons Begone!

We invite you to read our show notes at https://www.grc.com/sn/SN-847-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

business.eset.com/twit
plextrac.com/twit
itpro.tv/securitynow promo code SN30

Security Now (Audio): Recent Episodes

TWiT