SN 1009: Attacking TOTP - Force-Installed Outlook, DJI Firmware Update

Security Now (Audio)

Leo Laporte

Cyber Crime, Malware, Technology, Encryption, Steve Gibson, Security, Hacking, Twit, Spyware, Leo Laporte

4.6 • 2.1K Ratings

🗓️ 21 January 2025

⏱️ 187 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

What do we learn from January's record breaking 0-day critical Patch Tuesday?
Microsoft to "force-install" a new Outlook into all Windows 10 and 11 desktops?
GoDaddy required to get much more serious about its hosting security.
More age verification enforcement is coming, including globally.
What another instance of a widely exposed management interface teaches us.
DJI drone's official firmware update lifts geofencing for unrestricted flight.
CISA's efforts pay off with MUCH improved critical infrastructure security.
Listener feedback about TOTP, HOTP and age-verification.
And we take a deep dive into cracking authenticator keys

Show Notes - https://www.grc.com/sn/SN-1009-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to Security Now at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Transcript

Click on a timestamp to play from that location

0:00.0	It's time for security now. Steve Gibson is here with a rundown of the, what is it, 160 critical
0:07.1	patches, Microsoft shipped latch last week on Patch Tuesday. Microsoft's also forcing you to take
0:13.4	Outlook. GoDaddy is going to get much more serious about its hosting security and then get ready.
0:20.6	Get your propeller hats on
0:21.9	because there will be math we're going to brute force your one-time password authenticator
0:28.3	well at least we'll talk about how hard or easy it would be to do that it's going to be a fun
0:33.4	episode next on Security Now.
0:39.3	Podcasts you love.
0:40.9	From people you trust.
0:43.7	This is Twit.
0:50.4	This is Security Now with Steve Gibson.
0:58.8	Episode 1009 recorded Tuesday, January 21st, 2025, attacking TOTP.
1:05.3	It's time for security now. The show we talk about security, privacy, protecting yourself and your loved ones on the great big, vast internet with this guy right here, our security in chief.
1:13.4	You jumped a little bit when you said we talk about security.
1:16.0	I thought, well, you're surprised?
1:17.2	No.
1:17.7	What?
1:18.1	Is this the security show?
1:19.5	We do like to surprise our listeners every week, one way or the other.
1:23.6	Give them something to think about, and we're going to do that again this week.
1:28.9	Today's topic for Security Now, number 1009, and yes, that's four digits, is attacking TOTP.
1:40.2	We've talked a lot in the past about brute force attacks, and we understand the concept of that,
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from Leo Laporte, and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of Leo Laporte and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.