Security Now (Audio)

• Android to get "Lockdown Mode".
• What's in the new editions of Chrome and Firefox?
• Why did Apple silently re-enable automatic updates?
• My new iPhone 16, Chinese tariffs and electronics.
• Dynamic "hotpatching" coming to Win11 Enterprise & Edu.
• Why is it so difficult for Oracle to fess up?
• Another multi-year breach inside US Treasury.
• An Apple -vs- the UK update.
• "Thundermail" (Can't someone come up with a better name?)
• The (in)Security of Programmable Logic Controllers.
• When LLM's write code and hallucinate non-existent packages.
• Wordpress core security and PHP gets an important audit.
• Device-Bound Session Credentials update session cookie technology

Show Notes - https://www.grc.com/sn/SN-1021-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• expressvpn.com/securitynow
• vanta.com/SECURITYNOW
• threatlocker.com for Security Now
• legatosecurity.com
• bitwarden.com/twit

• Canon printer driver vulnerabilities enable Windows kernel exploitation.
• Astonishing cyber-security awareness from a household appliance manufacturer.
• France tries to hook 2.5 million school children with a Phishing test.
• Wordpress added an abuse prone feature in 2022. Guess what happened?
• Oracle? Is there something you'd like to tell us?
• Utah's governor just signed the App Store Accountability Act. Now what?
• AI bots hungry for new data are DDoSing FOSS projects.
• No Microsoft Account? No Microsoft Windows 11.
• Gmail claims it now offers E2EE. It kinda sorta does. Somewhat.
• A dreaded CVSS 10.0 was discovered in Apache Parquet.
• A bunch of terrific listener feedback.
• What's Multi-Perspective Issuance Corroboration and why must all certificate authorities now do it?

Show Notes - https://www.grc.com/sn/SN-1020-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• material.security
• threatlocker.com for Security Now
• canary.tools/twit - use code: TWIT
• joindeleteme.com/twit promo code TWIT
• bitwarden.com/twit

• Kuala Lumpur International Airport says no to a ransom attack, switches to whiteboard.
• A tired and jet-lagged Troy Hunt got Phished then listed himself on his own site.
• Cloudflare completely pulls the plug on port 80 (HTTP) API access.
• Malware is switching to obscure languages to avoid detection. FORTH, anyone?
• Password reuse doesn't appear to be dropping. Cloudflare has numbers.
• A listener shares his log of malicious Microsoft login attempts. Why no geofencing?
• 23andMe down for the count (reminder).
• A sobering Ransomware attack & victim listing website. Gulp!
• "InControl" keeps VR planes aloft.
• And the European Union gets serious about a switch to Linux

Show Notes - https://www.grc.com/sn/SN-1019-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• drata.com/securitynow
• outsystems.com/twit
• bitwarden.com/twit
• threatlocker.com for Security Now
• legatosecurity.com

• The dangers of doing things you don't understand.
• Espressif responds to the claims of an ESP32 backdoor.
• A widely leveraged mistake Microsoft stubbornly refuses to correct.
• A disturbingly simple remote takeover of Apache Tomcat servers.
• A 10/10 vulnerability affecting some ASUS, ASRock and HPE motherboards.
• Google snapped up another cloud security firm but paid a price!
• RCS messaging to soon get full end-to-end encryption (done right!).
• How did an AI Crypto Chatbot lose $105,000? ...and what is an AI Crypto Chatbot?
• Looks like Oracle may take stewardship of TikTok to keep it in-country.
• Whoops! 23andMe is sinking — don't let them take your genetics with them!
• The White House says "the cyber guys should stay!"
• AI project failure rates are on the rise. Anyone surprised?
• Listener feedback, and a very interesting update on just how looming is the threat from quantum computing?

Show Notes - https://www.grc.com/sn/SN-1018-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• zscaler.com/security
• legatosecurity.com
• joindeleteme.com/twit promo code TWIT

• An analysis of Telegram Messenger's crypto.
• A beautiful statement of the goal of modern crypto design.
• Who was behind Twitter's recent outage trouble?
• An embedded Firefox root certificate expired. Who was surprised?
• AI-generated Github repos, voice cloning, Patch Tuesday and an Apple 0-day.
• The FBI warns of another novel attack vector that's seeing a lot of action.
• Google weighs in on the Age Verification controversy.
• In a vacuum, Kazakhstan comes up with their own solution.
• Was Google also served an order from the UK? Can they say?
• A serious PHP vulnerability you need to know you don't have.
• A bunch of great listener feedback, some Sci-Fi content reviews and...
• A new tool allows YOU to test YOUR PCs for their RowHammer susceptibility

Show Notes - https://www.grc.com/sn/SN-1017-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• vanta.com/SECURITYNOW
• bitwarden.com/twit
• threatlocker.com for Security Now
• veeam.com

• Utah passes age verification requirement for app stores.
• The inside story on fake North Korean employees. Is that a Texas accent?
• An update on the ongoing Bybit cryptoheist saga.
• The industry may be making some changes in the wake of the Bybit attack.
• Apple pushes back legally against the UK's secret order.
• Did someone crack Passkeys?
• The UK launches a legal salvo at an innocent security researcher.
• The old data breach we witnessed that just keeps on giving.
• A bit more Bybit postmortem forensic news.
• A lesson to learn from a clever and effective ransomware attack.
• And what about that Bluetooth Backdoor discovery everyone is talking about?

Show Notes - https://www.grc.com/sn/SN-1016-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• 1password.com/securitynow
• uscloud.com
• joindeleteme.com/twit promo code TWIT
• zscaler.com/security
• canary.tools/twit - use code: TWIT

• Firefox amends their privacy policy -- the world melts down.
• Signal threatens to leave Sweden.
• Aftermath of the massive $1.5 billion Bybit ETH heist.
• It turns out that it wasn't actually Bybit's fault.
• "The Lazarus Bounty" monitoring and management site.
• Mozilla's commitment to Manifest V2 (and the uBlock Origin).
• What does the ACM's plea for memory-safe languages mean for developers?
• What exactly are memory-safe languages?
• Australia joins the Kaspersky ban.
• Gmail plans to switch from SMS to QR code authentication.
• A SpinRite success and some fun feedback.
• An astonishing new technology for targeted radio jamming

Show Notes - https://www.grc.com/sn/SN-1015-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• legatosecurity.com
• bitwarden.com/twit
• veeam.com
• threatlocker.com for Security Now

• Apple disables Advanced Data Protection for new UK users.
• Paying ransoms is not as cut and dried as we might imagine.
• Elon Musk's "X" social media blocks "Signal.me" links.
• Spain's soccer league blocks Cloudflare and causes a mess.
• Two new (and rare) vulnerabilities discovered in OpenSSH.
• The U.S. seems unable to evict Chinese attackers from its Telecom systems.
• What are those Chinese "Salt Typhoon" hackers doing to get in?
• The largest (by far) cryptocurrency heist in history occurred Friday.
• Ex-NSA head says the U.S. is falling behind on the cyber front lines.
• We have the winner (and a good one) replacement term for "backdoor".
• A look at a pathetic access control system that begs to be hacked (and will be).

Show Notes - https://www.grc.com/sn/SN-1014-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• zscaler.com/security
• joindeleteme.com/twit promo code TWIT
• uscloud.com
• canary.tools/twit - use code: TWIT

• US lawmakers respond to the UK's outrageous demand about Apple's encryption.
• What, exactly, is a "backdoor", and can a "backdoor" NOT be secret?
• Highlights from last week's Windows' Patch Tuesday.
• A look into RansomHub: The latest king of the Ransomware hill.
• "TOAD": Telephone-Oriented Attack Delivery.
• The state of Texas -versus- DeepSeek.
• Disabling Apple's "Restricted Mode".
• Where did I put that $800 million in Bitcoin?
• A Sci-Fi author update.
• And a deep dive into the misoperation of Chrome's critically important Web Extension Store

Show Notes - https://www.grc.com/sn/SN-1013-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• veeam.com
• legatosecurity.com
• threatlocker.com for Security Now
• bitwarden.com/twit
• vanta.com/SECURITYNOW

• New "SparkCat" secret-stealing AI image scanner discovered in App and Play stores.
• The UK demands that Apple does the impossible: decrypting ADP cloud data.
• France moves forward on legislation to require backdoors to encryption.
• Firefox moves to 135 with a bunch of useful new features.
• The Five Eyes alliance publishes edge-device security guidance.
• Six NetGear routers contain CVSS 9.6 and 9.8 vulnerabilities.
• Sysinternals utilities allow malicious Windows DLL injection.
• Google removes restrictive do-gooder language from AI application policies.
• "AI Fuzzing" successfully jailbreaks the most powerful ChatGPT o3 model.
• Examining the well and deliberately hidden truth behind ransomware cyberattacks on U.S. K-12 schools

Show Notes - https://www.grc.com/sn/SN-1012-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free shows, a members-only Discord, and behind-the-scenes access. Join today: https://twit.tv/clubtwit

Sponsors:

• joindeleteme.com/twit promo code TWIT
• canary.tools/twit - use code: TWIT
• zscaler.com/security
• uscloud.com
• 1password.com/securitynow