help & how to
SN 995: uBlock Origin & Manifest V3 - DDoS Record, N. Korean Workers, Vitamin D
Facebook's parent Meta not hashing passwords A New, forthcoming PayPal default opts their users into merchant data sharing DDoS breaks another record Speaking of these ASUS routers Do you know who you're hiring? Vitamin D The CUPS vulnerablility Routers for normal people uBlock Origin & Manifes...
SN 994: Recall's Re-Rollout - Domain Security, Tor + Tails, VLC Update
The Linux remote code execution flaw The CRUCIAL importance of Domain Control Security Roskomnadzor strikes a discordant note VLC gets a security update Tor and Tails Merge Telegram changes its long-standing "zero cooperation" policy Enshittification Bobiverse book 5 Windows 10 notifications Experi...
SN 993: Kaspersky exits the U.S. - Exploding Pagers, Passkeys in Chrome
The case of the exploding pagers and walkie-talkies "Ford seeks patent for tech that listens to driver conversations to serve ads" Another large chunk of personal data exposed Passkeys takes a big step forward: Now supported by Chrome A nascent 9.9 Linux Unauthenticated RCE? Freezing Credit Credit ...
SN 992: Password Manager Injection Attacks - Aging Media, Naval Starlink, adam:ONE
Windows Endpoint Security Ecosystem Summit Aging storage media does NOT last forever How Navy chiefs conspired to get themselves illegal warship Wi-Fi adam:ONE named the #1 best Secure Access Service Edge (SASE) solution AI Talk Password Manager Injection Attacks Show Notes - https://www.grc.com/sn...
SN 991: RAMBO - Cloned YubiKeys, Telegram vs. Signal, French Elevators, Unix Time
Offer to uninstall Recall was a bug, not a feature YubiKeys can be cloned Miscellany Is WhatsApp secure? Telegram vs Signal French elevators Freezing your credit The Quiet Canine Unix time Bobiverse book 5 Exodus: The Achemedes Engine Watching SpinRite RAMBO Show Notes - https://www.grc.com/sn/SN-9...
SN 990: Is Telegram an Encrypted App? - CrowdStrike Exodus, DDoS-as-a-Service, 'Active Listening' Ad Tech?
Telegram puts End-to-End Privacy in the Crosshairs Free security logging is good for everyone CrowdStrike hemorrhaging customers Microsoft to meet privately with EDR (Endpoint Detection & Response) vendors Yelp's Unhappy with Google Telegram as the hotbed for DDoSass – DDoS as a Service Chrome ...
SN 989: Cascading Bloom Filters - Key Card Backdoors, Fake Cisco Gear
CrowdStrike Exec's "Most Epic Fail" Award Hardware backdoors discovered in Chinese-made key cards Counterfeit CISCO networking gear SpinRite Errata NPD breach updates from listeners Looking back at old SN episodes Cascading Bloom Filters Show Notes - https://www.grc.com/sn/SN-989-Notes.pdf Hosts: S...
SN 988: National Public Data - Big Patch Tuesday, The Biggest Data Breach
Revocation Update GRC's next experiment Patch Tuesday "The Famous Computer Café" IsBootSecure GRC Email Working through WiFi Firewalls Transferring DNS OCSP attestation vs. TLS expiration Platform key expiration National Public Data Show Notes - https://www.grc.com/sn/SN-988-Notes.pdf Hosts: Steve ...
SN 987: Rethinking Revocation - SinkClose, IsBootSecure, Another Bad RCE
Sitting Ducks DNS attack A Bad RCE in another Microsoft server SinkClose The CLFS.SYS BSoD IsBootSecure Rethinking Revocation Show Notes - https://www.grc.com/sn/SN-987-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episo...
SN 986: How Revoking! - Crowdstrike Damage, Firefox Cookies
Platform Key Disclosure Firefox's 3rd-party Cookie mess The W3C Finally Weighs-in CrowdStrike Damages. GRC's Email How Revoking! Show Notes - https://www.grc.com/sn/SN-986-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get ep...
SN 985: Platform Key Disclosure - Crowdstrike Post-mortem, Entrust Update
Crowdstrike post-mortem PiDP-11 What Crowdstrike is fixing Marcus Hutchins on who is to blame Entrust's Updated Info 3rd-Party Cookie Surprise Security training firm mistakenly hires a North Korean attacker Google and 3rd party cookies Google's influence The auto industry and data brokers DNS Bench...
SN 984: CrowdStruck - Crowdstrike, Cellebrite, More Entrust
Cellebrite unlocks Trump's would-be assassin's phone. Cisco reported on a CVSS of 10.0 Entrust drops the other shoe Google gives up on removing 3rd-party cookies Miscellany Snowflake and data warehouse applications CDK auto dealership outage Polyfill.io and resource hashes MITM Blocking Copilot Blo...
SN 983: A Snowflake's Chance - CDN Safety, Microsoft's Behavior, CDK Ransomware Attack
Using Content Delivery Networks Safely The CDK Global Ransomware Attack The IRS and Entrust Polyfill.io fallout Microsoft's Behavior A Snowflake's Chance Show Notes - https://www.grc.com/sn/SN-983-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/sh...
SN 982: The Polyfill.io Attack - Entrust Responds, Passkey Redaction Attacks
Entrust Responds Other major Certificate Authorities respond Passkey Redaction Attacks Syncing passkeys Port Knocking Fail2Ban The Polyfill.io Attack Show Notes - https://www.grc.com/sn/SN-982-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/...
SN 981: The End of Entrust Trust - Open SSH Vulnerability, SyncThing, Endtrust
The regreSSHion Bug 50BTC moved Voyager 1 Update Email @ GRC SyncThing DNS queries Recall The End of Entrust Trust Show Notes - https://www.grc.com/sn/SN-981-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now . Get episodes ad-free...
SN 980: The Mixed Blessing of Lousy PRNG - Kaspersky Ban, EU vs. Google's Privacy Sandbox
Expected follow-up on CVE-2024-30078 From Russia with Love An EU privacy agency complains about Google's Privacy Sandbox? Email @ GRC Security Now SPAM? Orange Tsai needs help! Recall and 3rd Party Leakage Errata The Mixed Blessing of a Crappy PRNG Show Notes - https://www.grc.com/sn/SN-980-Notes.p...
SN 979: The Angle of the Dangle - "Recall" Recall, IT at the NYT, Private Cloud Compute
CVE-2024-30078 "Recall" has been recalled Matthew Green on Apple's Private Cloud Compute A WGET flaw with a CVSS of 10.0? Thou shall not Resolve! Email @ GRC Downloading email with MailStore Home IT at The New York Times ReMarkable The Angle of the Dangle Show Notes - https://www.grc.com/sn/SN-979-...
SN 978: The Rise and Fall of code.microsoft.com - Apple Password Manager, AI Coding
MS on Recall changes Thanks for the "Memory" New York Times (and Wordle) leak Apple's own password manager app DJI drones on the defensive SlashData reveals some interesting developer statistics Are we going to turn programming over to AIs? The Linux Kernel Project goes CVE crazy Email @ GRC Pizza ...
SN 977: A Large Language Model in Every Pot - Problems With Recall, End of ICQ, Email @ GRC
"Tornado Notes" Email @ GRC Have I Been Pwned? A new "supply chain" attack vector Another CA in the DogHouse ICQ to shutter its service Steve reviews "Déjà vu" Hide my email Security in Windows SpinRite update A Large Language Model in Every Pot Show Notes - https://www.grc.com/sn/SN-977-Notes.pdf ...
SN 976: The 50 Gigabyte Privacy Bomb - Google AI Workarounds, Microsoft Recall
The bigger problem with AI Overview https://udm14.com/ -and- https://tenbluelinks.org/ The horses have left the barn VPNs and Firewalls Email @ GRC Extension to fix Google search Passwords and SPAM Fixing motherboard components Vertical tabs in Firefox FritzBox routers Too many PINs More Google sea...