SN 902: A Generic WAF Bypass - Pwn2Own Toronto, URSNIF malware, Vivaldi Mastodon support, Bye Bye SHA-1

Security Now (Audio)

Leo Laporte

Technology, Spyware, Steve Gibson, Twit, Encryption, Security, Cyber Crime, Hacking, Malware, Leo Laporte

4.6 • 2.1K Ratings

🗓️ 20 December 2022

⏱️ 117 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

Picture of the Week.
A malware operation known as URSNIF.
Pwn2Own Toronto 2022.
Citrix and Fortinet recently released security updates to patch 0-day vulnerabilities.
Patch Tuesday.
Another Uber breach?
Elon Botches 'Bot Blockage.
Vivaldi integrates Mastodon in its desktop browser.
5,200 Dutch government warnings.
CIB: "Coordinated Inauthentic Behavior"
GitHub to require 2FA by the end of next year.
Bye bye SHA-1.
WordFence's VERY useful looking WordPress add-on vulnerability database.
Closing The Loop.
SpinRite.
A Generic WAF Bypass.

Show Notes https://www.grc.com/sn/SN-902-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now! at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsor:

plextrac.com/twit

Transcript

Click on a timestamp to play from that location

0:00.0	It's time for Security Now!
0:01.6	Last show of the year, Steve Gibson is here.
0:04.3	We're going to talk about the results of the POND-OUN competition.
0:07.9	Everybody got to act.
0:08.9	Everybody!
0:09.9	Then it's the latest on last week's Microsoft Patch Tuesday.
0:14.4	And finally, what exactly is coordinated inauthentic behavior?
0:19.1	You'll find out nothing but authentic behavior next on Security Now.
0:25.0	Podcasts you love.
0:26.9	Front people you trust.
0:28.4	This is Twit.
0:35.4	This is Security Now with Steve Gibson.
0:37.9	Episode 902 recorded Tuesday, December 20th, 2022.
0:43.4	A generic WAF bypass.
0:46.4	Security Now is brought to you by PlexTrack, the premier cyber security reporting and collaboration platform.
0:53.9	With PlexTrack, you'll streamline the full workflow from testing to reporting to remediation.
0:59.9	Visit PlexTrack.com slash Twit to claim your free months of the PlexTrack platform today.
1:07.9	Listeners of this program get an ad-free version if their members of Club Twit $7 a month
1:13.9	gives you ad-free versions of all of our shows.
1:16.9	Plus, membership in the Club Twit Discord a great clubhouse for Twit listeners.
1:21.9	And finally, the Twit Plus feed with shows like Stacey's Book Club, the Untitled Linux Show,
1:27.9	the Gizfiz and more.
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from Leo Laporte, and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of Leo Laporte and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.