SN 938: Apple Says No - Topics coming to Android, Apple security research, browser extension vulnerabilities

Security Now (Audio)

Leo Laporte

Cyber Crime, Malware, Technology, Encryption, Steve Gibson, Security, Hacking, Twit, Spyware, Leo Laporte

4.6 • 2.1K Ratings

🗓️ 5 September 2023

⏱️ 123 minutes

🔗️ Recording | iTunes | RSS

🧾️ Download transcript

Summary

Steve provides an update on ValiDrive, his new freeware utility for testing USB drives. It identifies bogus mass storage drives and performance differences between drives.
There has been another sighting of Google's Topics API, this time on Android phones. It allows apps to get information about users' interests based on recent app usage.
Apple has opened up their iPhones to security researchers through their Security Research Device program since 2019. Researchers get access to customize kernels, entitlements, and other low-level features without compromising security.
Research reveals vulnerabilities in browser extensions that allow them to steal plaintext passwords from a website's HTML source code. Even sites like Google, Facebook, Amazon, IRS, and Capital One are affected.
Feedback from listeners on topics like Apple's stance on scanning iCloud data for CSAM, Microsoft's broken TLS timestamp implementation, using VirusTotal to check downloaded files, ReadSpeed limitations, and downloading malware for VirusTotal checks.
Apple publicly shares a letter from a CSAM activist demanding they implement scanning to detect child abuse images in iCloud Photos. Apple responds clearly stating they will not compromise user privacy and security to do so.

Show Notes - https://www.grc.com/sn/SN-938-Notes.pdf

Hosts: Steve Gibson and Leo Laporte

Download or subscribe to this show at https://twit.tv/shows/security-now.

Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit

You can submit a question to Security Now at the GRC Feedback Page.

For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

Sponsors:

Transcript

Click on a timestamp to play from that location

0:00.0	It's time for security now, Steve Gibson is here as always a fact-filled fund
0:06.0	tour through the world of security. We'll talk about Steve giving into
0:10.4	pressure, mostly for me, and developing a free app that will test the integrity
0:16.4	of your hard drive, the details on valid drive coming up in just a little bit.
0:21.1	Then we'll also talk about why you've got to be really careful about the browser
0:24.8	extensions you need to use more, more careful than anybody ever realized.
0:29.2	And finally, Apple's response to the demand that they open up their encryption.
0:35.2	Steve has all the details coming up next on security now.
0:42.0	Podcasts you love. From people you trust.
0:46.3	This is Twit.
0:50.5	This is security now with Steve Gibson, Episode 938, recorded Tuesday, September 5th, 2023.
1:00.8	Apple says no. Security now is brought to you by DRAWDA, all too often security
1:08.3	professionals undergo the tedious and arduous task of manually collecting evidence.
1:14.4	With DRAWDA, companies can complete audits, monitor controls, and expand security
1:18.8	assurance efforts to scale. Say goodbye to manual evidence collection.
1:23.3	Hello to Automation, all done at DRAWDA speed.
1:27.7	Visit DRAWDA.com slash Twit to get a demo and 10% off implementation.
1:34.0	And by Panoptica, reduce the complexities of protecting your workloads and
1:39.1	applications in a multi-cloud environment. Panoptica provides comprehensive
1:43.7	cloud workload protection integrated with API security to protect the entire
1:48.7	application life cycle. Learn more about Panoptica at panoptica.app.
1:54.7	And by thinks canary, thousands of irritating false alerts help no one.
	...

Please login to see the full transcript.

Previous episode | Next episode

Disclaimer: The podcast and artwork embedded on this page are from Leo Laporte, and are the property of its owner and not affiliated with or endorsed by Tapesearch.

Generated transcripts are the property of Leo Laporte and are distributed freely under the Fair Use doctrine. Transcripts generated by Tapesearch are not guaranteed to be accurate.