Security Now!

From Wikipedia, the free encyclopedia

Security Now!

Host(s) Leo Laporte / Steve Gibson
Website http://twit.tv/
Update Schedule Weekly
Launch Date 19 August 2005
Genre Computer security

Security Now! is a weekly podcast (Internet radio show) hosted by Leo Laporte of this WEEK in TECH and Steve Gibson of Gibson Research Corporation (GRC). It is part of the TWiT.tv network [1], and the first episode was released on 19 August 2005.

Released each Thursday, Security Now! consists of a discussion between Gibson and Laporte of issues of computer security and, conversely, insecurity. Topics that have been covered include then-current security vulnerabilities, firewalls, password security, spyware, rootkits, Wi-Fi, virtual private networks (VPNs), and virtualization. In late 2005 and early 2006, the Windows Metafile vulnerability was also covered. While it remains to be officially confirmed, it is believed that the title is a reference to the Seinfeld episode The Serenity Now.

Contents

[edit] Podcast feed

Security Now! is distributed via its main podcast RSS feed (link) and on the GRC Security Now! page [2]. As with many podcasts, the audio is encoded in MP3 format, with higher quality (64 kilobits per second) and lower quality (16 kbit/s) versions available for listeners on low bandwidth connections (such as dial-up) or those with limited storage space.

[edit] Additional content

As part of GRC's section on the podcast, supplementary notes and transcripts of each show are available in plain text and PDF formats. Through Frappr, an online map is available for people to place a marker on, creating a geographical picture of where Security Now! listeners around the world live [3].

[edit] Listener feedback

Every fourth episode (referred to as the "mod 4 podcast"), Gibson and Laporte devote an episode to answering questions and responding to feedback provided by Security Now! listeners. This began on 1 December 2005. The GRC web page has a feedback form allowing listeners to submit their comments and questions [4].

[edit] Popularity

In August 2006, Security Now! ranked fourth in the "Top 40" of all podcasts listened to via the PodNova service.[1] Security Now! averages around 100,000 downloads per episode throughout 2006. [2][3]

[edit] Episode list

Episode list
Episode Date Episode name Discussed
1 19 August 2005 As the Worm Turns Zotob, one of the first worms of 2005.
2 25 August 2005 HoneyMonkeys Microsoft's Strider HoneyMonkey research project to find malicious and phishing web sites.
3 1 September 2005 NAT Routers as Firewalls Network address translation routers and how they can act as firewalls.
4 8 September 2005 Personal Password Policy Various ways of creating and using a personal password "algorithm" for Internet web sites.
5 15 September 2005 Personal Password Policy — Part 2 A wrap-up of the password topic with answers to listeners' questions.
6 22 September 2005 Mechanical and Electromagnetic Information Leakage How researchers at UC Berkeley were able to recover text typed at a keyboard through the sound made by the keys, and how CRT emissions can be used to snoop on users. [5]
7 29 September 2005 "SPYaWAREness" How and why Steve Gibson wrote one of the first spyware removal tools.
8 6 October 2005 Denial of Service Attacks How denial-of-service attacks are being used not only against large corporate sites but the average computer user also.
9 13 October 2005 Rootkits Rootkits, their use, detection and removal.
10 20 October 2005 Open Wireless Access Points The privacy and security concerns of "open" wireless access points.
11 27 October 2005 Bad Wi-Fi Security Some of the less secure Wi-Fi security methods, including WEP and MAC address filtering.
12 3 November 2005 Sony's "Rootkit Technology" Sony's XCP, the technology behind the 2005 Sony BMG CD copy protection scandal.
13 10 November 2005 Unbreakable Wi-Fi Security Wi-Fi Protected Access encryption on wireless networks and the various flavours of it.
14 17 November 2005 Virtual Private Networks — Theory The reasoning behind virtual private networks and how they can offer security for the average user.
15 24 November 2005 Virtual Private Networks — Secure Tunneling Solutions SSL and SSH used in conjunction with virtual private networks.
16 1 December 2005 Listener Q&A #1 Answers to questions sent in by Security Now! listeners.
17 10 December 2005 PPTP and IPSec VPN Technology Earlier VPN protocols and some of the difficulties in applying them.
18 15 December 2005 Hamachi Rocks! Hamachi — a zero-configuration VPN system.
19 22 December 2005 VPNs — Part 3 Hamachi, iPIG and OpenVPN systems compared.
20 29 December 2005 Listener Q&A #2 Listener questions and the first word on the Windows Metafile vulnerability.
- 1 January 2006 WMF special edition A special short edition concerning the WMF vulnerability and a temporary hot-fix by software developer Ilfak Guilfanov.
21 5 January 2006 The Windows Metafile vulnerability Ilfak Guilfanov who makes a guest appearance and the impact of the WMF vulnerability.
22 12 January 2006 The Windows Metafile backdoor? Steve Gibson raises his concerns that the WMF vulnerability could be a backdoor inserted deliberately by Microsoft.
23 19 January 2006 GRC's MouseTrap Steve Gibson's MouseTrap utility to test Windows computers for the WMF vulnerability [6].
24 26 January 2006 Listener Q&A #3 —
25 2 February 2006 How the Internet Works — Part 1 The fundamental technology behind the Internet.
26 9 February 2006 How the Internet Works — Part 2 The two main data protocols of the Internet: UDP and TCP.
27 16 February 2006 How LANs Work — Part 1 The operation of local area networks.
28 23 February 2006 Listener Q&A #4 —
29 2 March 2006 Ethernet Insecurity The flaws in Ethernet security and the phenomenon of ARP cache poisoning [7].
30 9 March 2006 Cryptographic Issues The social and ethical implications of cryptography.
31 16 March 2006 Symmetric Stream Ciphers The use and security behind stream ciphers and early decoder rings.
32 23 March 2006 Listener Q&A #5 —
33 30 March 2006 Symmetric Block Ciphers The fundamentals of symmetric block ciphers.
34 6 April 2006 Public Key Cryptography Public key cryptography such as the Diffie-Hellman key exchange and RSA.
35 13 April 2006 Cryptographic Hashes How cryptographic hashes work and are used to verify the integrity of files and email.
36 20 April 2006 Listener Q&A #6 —
37 27 April 2006 Primes and Certificates Prime number generation, key recovery, and digital certificates.
38 4 May 2006 Browser Security The security of web browsers.
39 11 May 2006 Buffer Overruns How buffer overruns occur.
40 19 May 2006 Listener Q&A #7 —
41 26 May 2006 TrueCrypt Discussion of the open source file encryption program TrueCrypt.
42 01 June 2006 NAT Traversal Discussion of NAT routers and techniques for P2P programs to traverse them.
43 08 June 2006 Open Ports Open, closed, and stealth ports
44 15 June 2006 Listener Q&A #8 —
45 22 June 2006 The Hosts File The Hosts file, and its use in privacy and spyware applications
46 29 June 2006 Router Logs Steve discusses whether or not router logs are useful security information.
47 6 July 2006 Internet Weaponry Denial of Service Attacks and botnets.
48 13 July 2006 Listener Q&A #9 —
49 21 July 2006 Netstat Operation and use of netstat.
50 28 July 2006 Intro to Virtualization Virtual machine technology and its history.
51 4 August 2006 Vista's Virgin Stack Windows Vista's new network stack.
52 11 August 2006 Security Bulletins JavaScript exploits, eBay gaming and Hamachi's sale to LogMeIn
53 17 August 2006 VMware VMware Player and its Virtual Machine "appliances"; use of virtualization for sandboxing
54 24 August 2006 Blue Pill "Blue Pill" rootkit that takes advantage of next generation virtualization hardware support and is "completely undetectable".
55 31 August 2006 Application Sandboxes Lighter programs for virtualization, with focus on semi freeware-semi nagware ("just" one nag once a month) and crippleware (some "extra" features can be unlocked by paying) (Sandboxie. [8]
56 7 September 2006 Listener Q&A #10 —
57 14 September 2006 Virtual PC versus VMware Virtual PC review and why Steve thinks VMware is superior.
58 21 September 2006 Two New Critical Windows Problems Vulnerability in Vector Markup Language for IE and Windows 2000 NTFS file corruption bug.
59 28 September 2006 Parallels Steve and Leo closely examine the commercial multiplatform virtual machine offerings from Parallels, comparing them to VMware and Virtual PC.
60 05 October 2006 Listener Q&A #11 —
61 12 October 2006 ISP Privacy and Security Two new 0-day Internet Explorer vulnerabilities and the exploration of commonly expressed privacy and security concerns presented by the need to trust Internet Service Providers.
62 19 October 2006 Internet Proxies The entire range of applications for Internet proxies and proxy servers, as well as both the benefits and the potential security and privacy liabilities created by filtering and caching web and other Internet content.
63 26 October 2006 MojoPac MojoPac from RingCube Technologies. Steve tells all about what he found and what he believes it means now and in the future.
64 02 November 2006 Listener Feedback Q&A #12 —
65 09 November 2006 Why Is Security So Difficult? Leo and Steve discuss the difficulties of securing Windows.
66 16 November 2006 Windows Vista Security The new security features Microsoft has designed and built into their new version of Windows, Vista.
67 23 November 2006 Kernel Patch Protection Vista's Kernel Patch Protection (aka PatchGuard), its limitations, benefits, and real purpose.
68 30 November 2006 Listener Feedback Q&A #13 —
69 7 December 2006 Internet Anonymity Is there such a thing as anonymity on the Internet? How important is it?
70 14 December 2006 Freenet and TOR Two interesting implementations of Internet anonymization: The Freenet Project for anonymously storing and transmitting files, and Tor, "the onion router" which can anonymise Internet traffic.
71 21 December 2006 SecurAble SecurAble, Steve's latest freeware for analyzing processor support for x86-64, the NX bit and hardware virtualization.
72 28 December 2006 Listener Feedback Q&A #14 —
73 4 January 2007 Digital Rights Management The history of digital rights management and the technologies used to enforce it.
74 11 January 2007 Peter Gutmann on Vista DRM Peter Gutmann is a guest to discuss the Advanced Access Content System for protecting high-definition content in Windows Vista.
75 16 January 2007 Vista DRM Premium content protection features in Windows Vista.
76 23 January 2007 Listener Feedback Q&A #15 —
77 1 February 2007 Microsoft Responds Microsoft's response to Peter Gutmann's paper on Windows Vista's digital rights management.
78 8 February 2007 Hardware DEP How hardware data execution protection works, how to turn it on, and the possible pitfalls of using it.
79 15 February 2007 Spambots An explanation of how spambots work, and how one can ascertain the original source of spam.
80 22 February 2007 Listener Feedback Q&A #16 —
81 1 March 2007 Hard Drive Unreliability A discussion of the distressing results and implications of two recent very large studies of hard drive field failures.
82 8 March 2007 Cyber Warfare A discussion of the interesting topic of state-sponsored Cyber Warfare.

[edit] Windows Metafile vulnerability claims

In episode 22 of Security Now! in January 2006, Steve Gibson made an accusation[4] that Microsoft may have intentionally put a backdoor into the Windows Metafile processing code of the Windows 2000 and XP operating systems.

Gibson claimed that while reverse engineering the Windows Metafile format, he could only run arbitrary code if he used a "nonsensical" value in the metafile. His conclusion was that Microsoft had intentionally designed Windows in this way to allow them to use the feature as a backdoor to running code on Windows computers without the knowledge of the user.

Gibson's claim was refuted[5] by Stephen Toulouse of Microsoft in an MSDN blog posting on 13 January 2006, stating that Gibson's observations applied only to metafiles containing one data record, and that the behavior was not intentional.

Further information: Windows Metafile vulnerability and Transcript of episode 22 of Security Now!

[edit] References

  1. ^ PodNova Top 40. PodNova (8 2006). Retrieved on January 12, 2007. “4. Security Now!”
  2. ^ Leo Laporte (2006-07-19). June Numbers. Leo Laporte's blog. TWiT.tv. Retrieved on January 12, 2007. “Security Now: 103,034”
  3. ^ Leo Laporte (2006-11-21). October Numbers. Leo Laporte's blog. TWiT.tv. Retrieved on January 12, 2007. “Security Now 61: 99,751”
  4. ^ Steve Gibson; Leo Laporte (January, 2006). Security Now!, Transcript of Episode #22. Security Now! podcast. Retrieved on March 18, 2006.
  5. ^ Stephen Toulouse (January, 2006). Looking at the WMF issue, how did it get there?. Microsoft Security Response Center Blog. MSDN TechNet Blogs. Retrieved on March 18, 2006.

[edit] External links

TWiT.tv
TWiT.tv (network) | Leo Laporte
TWiT.tv podcasts
this WEEK in TECH | Security Now! | net@nite | Inside the Net | Daily Giz Wiz | FLOSS Weekly | Futures in Biotech | MacBreak | this WEEK in MEDIA | MacBreak Weekly | Windows Weekly | this WEEK in LAW | Inside the Black Box | The VFX Show | The iLifeZone | The Laporte Report | The Tech Guy
TWiT.tv presenters
Alex Lindsay | Amber MacArthur | Chris DiBona | Dick DeBartolo | Steve Gibson | Paul Thurrott | Merlin Mann | This WEEK in TECH panelists
Retrieved from "http://en.wikipedia.org../../../s/e/c/Security_Now%21_c629.html"