SN 902: A Generic WAF Bypass - Pwn2Own Toronto, URSNIF malware, Vivaldi Mastodon support, Bye Bye SHA-1

12/20/22 • 116 min

1 Listener

Security Now (Audio)

Picture of the Week.
A malware operation known as URSNIF.
Pwn2Own Toronto 2022.
Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities.
Patch Tuesday.
Another Uber breach?
Elon Botches 'Bot Blockage.
Vivaldi integrates Mastodon in its desktop browser.
5,200 Dutch government warnings.
CIB: "Coordinated Inauthentic Behavior"
GitHub to require 2FA by the end of next year.
Bye bye SHA-1.
WordFence's VERY useful looking WordPress add-on vulnerability database.
Closing The Loop.
SpinRite.
A Generic WAF Bypass.

Show Notes https://www.grc.com/sn/SN-902-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

plextrac.com/twit

Picture of the Week.
A malware operation known as URSNIF.
Pwn2Own Toronto 2022.
Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities.
Patch Tuesday.
Another Uber breach?
Elon Botches 'Bot Blockage.
Vivaldi integrates Mastodon in its desktop browser.
5,200 Dutch government warnings.
CIB: "Coordinated Inauthentic Behavior"
GitHub to require 2FA by the end of next year.
Bye bye SHA-1.
WordFence's VERY useful looking WordPress add-on vulnerability database.
Closing The Loop.
SpinRite.
A Generic WAF Bypass.

Show Notes https://www.grc.com/sn/SN-902-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

plextrac.com/twit

Previous Episode

SN 901: Apple Encrypts the Cloud - Chrome Passkeys, Telegram malware, SYNC.com outage, Rackspace lawsuits

Picture of the Week.
Chrome does Passkeys.
SYNC.COM suffered its first outage.
Medibank reboot.
Totally fake cryptocurrency trading platforms.
Malware on Telegram.
Texas gets in on the TikTok banning.
The LastPass class action lawsuit.
Rackspace had a big embarrassing problem.
Rackspace is now facing at least three class action lawsuits.
Another country goes on the offensive.
Closing The Loop.
SpinRite.
Miscellany.
Apple Encrypts the Cloud.

Show Notes https://www.grc.com/sn/SN-901-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Next Episode

SN 903: Security Now Best of 2022 - The best moments from throughout the year

Anatomy of a Log4j Exploit.
Will Russia Disconnect?
FCC Says Kaspersky Labs is a National Security Threat.
Lenovo UEFI Firmware Troubles.
That "Passkeys" Thing.
Dis-CONTI-nued: The End of Conti?
Steve's Take on the LastPass Breach.

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors: