What do you call "Stuxnet on steroids"?? Voyager 1 update Android 15 to quarantine apps Thunderbird & Microsoft Exchange China bans Western encrypted messaging apps Gentoo says "no" to AI Cars collecting diving data Freezing your cred

GhostRace - AT&T Breach Update, Cookie Notices, Router Buttons

7 days ago 1h 53m

An update on the AT&T data breach 340,000 social security numbers leaked Cookie Notice Compliance The GDPR does enforce some transparency Physical router buttons Wifi enabled button pressers Netsecfish disclosure of Dlink NAS vulnerabi

Minimum Viable Secure Product - Dlink NAS Backdoor, Privnote, Crowdefense

14 days ago 1h 51m

Out-of-support DLink NAS devices contain hard coded backdoor credentials Privnote is not so "Priv" Crowdfense is willing to pay millions Engineers Pinpoint Cause of Voyager 1 Issue, Are Working on Solution SpinRite Update Minimum Viable S

A Cautionary Tale - XZ Outbreak, AT&T Data Breach

21 days ago 1h 45m

A near-Universal (Local) Linux Elevation of Privilege vulnerability TechCrunch informed AT&T of a 5 year old data breach Signal to get very useful cloud backups Telegram to allow restricted incoming HP exits Russia ahead of schedule Adv

GoFetch - Apple vs. DOJ, ".INTERNAL" TLD

28 days ago 2h 2m

Apple vs U.S. DOJ G.M.'s Unbelievably Horrible Driver Data Sharing Ends Super Sushi Samurai Apple has effectively abandoned HomeKit Secure Routers The forthcoming ".INTERNAL" TLD The United Nations vs AI. Telegram now blocked throughou

Morris The Second - Voyager 1, The Web Turns 35

Mar 20th, 2024 2h 7m

Voyager 1 update The Web turned 35 and Dad is disappointed Automakers sharing driving data with insurance companies A flaw in Passkey thinking Passkeys vs 2fa Sharing accounts with Passkeys Passkeys vs. Passwords/MFA Workaround to sit

Passkeys vs. 2FA - Unhelpful CERT, VMware patch, Signal 7.0 Beta

Mar 13th, 2024 2h 23m

VMware needs immediate patching Midnight Blizzard still on the offensive China is quietly "de-American'ing" their networks Signal Version 7.0, now in beta Meta, WhatsApp, and Messenger -meets- the EU's DMA The Change Healthcare cyberatt

PQ3 - Voyager 1's fate, Apple's post-quantum iMessage protocol

Mar 6th, 2024 2h 12m

"Death, Lonely Death" by Doug Muir, about the decades-old Voyager 1 explorer Cory Doctorow's Visions of the Future Humble Book Bundle CTRL-K shortcut for search on a browser Direct bootable image downloading for GRC's servers Closing the

Web portal? Yes please! - Firefox v123, LockBit Disrupted

Feb 28th, 2024 2h 4m

Nevada attempts to block Meta's end-to-end encryption for minors. A survey of security breaches Edge's Super-Duper Secure Mode moves into Chrome DoorDash dashes our privacy Avast charged $16.5 million for selling user browsing data No c

The Internet Dodged a Bullet - Wyze Breach, Patch Tuesday, KeyTrap

Feb 21st, 2024 2h 14m

Wyze breach Microsoft patch Tuesday fixes 15 remote code execution flaws Why are there password restrictions? The Canadian Flipper Zero Ban Security on the old internet Using Old Passwords Passwordless login TOTP as a second factor G

Bitlocker: Chipped or Cracked? - Honeypots, Toothbrush Botnet, Bitlocker Cracked

Feb 14th, 2024 2h 3m

Toothbrush Botnet "There are too many damn Honeypots!" Remotely accessing your home network securely Going passwordless as an ecommerce site Facebook "old password" reminders Browsers on iOS More UPnP Issues A password for every websi

Unforeseen Consequences - CISA's "Secure by Design" Initiative, Fastly's BoringSSL

Feb 7th, 2024 2h 4m

CISA's "Secure by Design" Initiative The GNU C Library Flaw Fastly CDN switches from OpenSSL to BoringSSL Roskomnadzor asserts itself Google updates Android's Password Manager Firefox gets post-quantum crypto Get your TOTP tokens from

Stamos on "Microsoft Security" - HP Printer Bricking, Mercedes Benz Source Code

Jan 31st, 2024 2h 17m

iOS to allow native Chromium and Firefox engines. An OS immune to ransomware? HP back in the doghouse over "anti-virus" printer bricking The mother of all breaches New "Thou shall not delete those chats" rules Fewer ransoms are being pa

A Week of News and Listener Views - HSS Breach, CISA's Policing Results

Jan 24th, 2024 2h 15m

Microsoft's Top Execs' Emails Breached in Sophisticated Russia-Linked APT Attack US Health and Human Services Breached Firefox vs "The Competition" Brave reduces its anti-fingerprinting protections CISA's proactive policing results one y

The Protected Audience API - Hacked Washing Machine, Quantum Crypto Troubles

Jan 17th, 2024 1h 45m

What would an IoT device look like that HAD been taken over? And speaking of DDoS attacks Trouble in the Quantum Crypto world The Browser Monoculture Question about the Apple backdoor Getting into infosec proton drive vs sync SpinRite

The Inside Tracks - 23andME Mess, Ukraine Telecom Hack, LastPass

Jan 10th, 2024 1h 53m

More on Apple's hardware backdoor Russian Hacking of Ukranian cameras Russian hackers were inside Ukraine telecoms giant for months Things are still a mess at 23andMe CoinsPaid was the victim of another cyberattack Crypto Hacking in 202

The Mystery of CVE-2023-38606 - SpinRite Update, Nebula Mesh, Apple's Backdoor

Jan 3rd, 2024 1h 53m

SpinRite 6.1 update Pruning Root Certificates A solution to Schrodinger's Bowl DNS Benchmark and anti-virus tools Nebula Mesh SpinRite 7 is coming The Mystery of CVE-2023-38606 Show Notes - https://www.grc.com/sn/SN-955-Notes.pdf Hos

Best of 2023 - Security Now's Best Moments of 2023

Dec 26th, 2023 1h 39m

Leo looks back at the year's top security stories of 2023. Steve's Next Password Manager After the LastPass Hack CHESS is Safe Here Come the Fake AI-generated "News" Sites How Bad Guys Use Satellites Microsoft's "Culture of Toxic Obfuscat

Active Listening - KOSA, Cloudflare's Numbers, SpinRite Update

Dec 20th, 2023 2h

Child protection legislation in the US Meta pushes back on the $200 billion FTC fine for COPPA violation Age verification on the internet Google moving from 3rd party cookies to topics A look at Cloudflare's metrics SpinRite update Cox

Quantum Computing Breakthrough - The Clear/Deep/Dark Web, Quad 9 victory, Telegram Flaw

Dec 13th, 2023 2h 4m

The government collection of push notification metadata Facebook Messenger sets end to end encryption as the default Iran's Cyber Av3ngers Cisco's Talos Top 10 cyber security exploits this year Over 30% of apps are still using a using a

Revisiting Browser Trust - ICANN RDRS, Beeper Mini, TikTok ban, .meme TLD

Dec 6th, 2023 2h 10m

How masked domain owners can be unmasked through ICANN's new Registration Data Request Service (RDRS) WhatsApp's addition of Secret Code for extra privacy protection in Chat Lock Iranian hackers exploited default passwords in programmable

Leo Turns 67 - Fingerprint Security, Do-Not-Track

Nov 29th, 2023 2h 12m

Adobe Flash Player Updater is (still) desperately trying to update Veracrypt password security Firefox moves to 120 with a bunch of very nice new features Do-Not-Track is back on track "ownCloud" -or- "PwnCloud" ? CrushFTP Critical Vuln

Ethernet Turned 50 - Signal funding, X (Twitter) ad fallout, RCS for iPhone, TETRA review

Nov 22nd, 2023 2h 12m

Privacy and Funding Challenges Facing Signal Messaging App Loss of Advertisers for Twitter After Controversial Tweet by Elon Musk Ransomware Group Files SEC Complaint Against Breached Company Europe Opening Up Radio Encryption Standard TE

What if a Bit Flipped? - Privacy Badger, Downfall, OpenVPN, Windshield Barnacle, Article 45

Nov 15th, 2023 2h 12m

Privacy Badger blocks trackers on news sites and prevents browser exposure to unwanted domains like TikTok and Datadog. No major updates on EU's controversial Article 45 in eIDAS 2.0. Industry pushback continues as implementation would thre

Article 45 - Citrix Bleed update, Ace Hardware cyberattack, Bitwarden get Passkeys

Nov 8th, 2023 2h 13m

Microsoft announced storing their Azure keys in an HSM after previously losing control of a private signing key A quartet of new 0-day vulnerabilities in Exchange Server that Microsoft declined to fix Apache ActiveMQ servers under attack e