Security Now - 16k MP3

In this second installment of our three-part coverage of web-based remote code injection, Leo and I discuss cross-site scripting vulnerabilities and exploits. I quickly read through the 28 vulnerabilities discovered in popular software just during the previous month and discusses the nature of the threat and challenge facing authors of modern 'dynamic' web sites and services.

Leo and I begin a three-episode series to discuss and examine web-based remote code injection exploits. Commonly known as 'Cross-Site Scripting' and 'SQL Injection,' these exploits are growing in popularity and strength as hackers discover increasingly clever ways to exploit subtle defects in next-generation web-based applications.

Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.

Leo and I wrap up our quest to get Windows Wi-Fi to 'Maintain Full Radio Silence' by adding one additional important tweak to Windows settings. Then we discuss the detailed security implications, now and in the future, of Vista's new and powerful user account control (UAC) system.

Leo and I discuss the interesting topic of state-sponsored Cyber Warfare. While born through the imagination of science fiction writers, the reality of international, inter-nation cyber combat is fiction no longer.

Leo and I discuss the distressing results and implications of two recent very large population studies (more than 100,000 drives each) of hard drive field failures. Google and Carnegie Mellon University (CMU) both conducted and submitted studies for the recent 5th USENIX conference on File and Storage Technologies.

Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.

Leo's 'TWiT.tv' and my 'GRC.com' domains are used by spambots which spoof their domains as the source of bogus eMail. This week they discuss the details of eMail "Received:" headers and explain how the examination of those headers can penetrate any spoofing to reveal the true originating IP of any spoofed spam eMail.

With our new SecurAble freeware now launched, Leo and I discuss the full impact and importance of hardware DEP technology. I explain why I believe that hardware DEP is the single most important Internet-related security technology developed so far.

In episode #74 Peter Gutmann shared his concerns and fears about the system-wide consequences and impact of the digital rights management (DRM) Microsoft has built deeply into Vista. Microsoft's Vista Team responded with a comprehensive Blog posting which Leo and I read and examine this week. Here is the blog posting we used as our source:Windows Vista Content Protection - Twenty Questions (and An...

Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.

Following last week's guest appearance by Peter Gutmann, Leo and I wrap up the topic of Vista's new, deep, and pervasive Digital Rights Management (DRM) system. I also announce the completion and availability of GRC's latest freeware: "SecurAble."Click this link for Securable's web page.

Peter Gutmann, the author of the highly controversial white paper detailing the significant cost of Windows Vista's deeply-entrenched digital rights management (DRM) technology, joins Leo and me this week to discuss his paper and his findings.

In preparation for next week's look at how and why Windows Vista has incorporated the most pervasive and invasive system for digital rights management ever created, AACS, Leo and I first take a step back to survey the history and evolution of media property rights and the technologies used to enforce them.

Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.

This week I take the wraps off our forthcoming security freeware utility: SecurAble. Although I'm still working to get it finished, tested, and ready for initial release, I describe what SecurAble will do and some of the unexpected hurdles I've encountered with the application and with details of Windows operation along the way.

Last week Leo and I discussed the social implications and the social power of Internet Anonymity. This week we discuss the technology of Freenet and TOR (Onion Router) networks, and I describe the detailed technical operation of both systems.

To create some background for next week's discussion about the significant technical challenges involved in creating true anonymity on the Internet, this week Leo and I discuss the consequences of the use and abuse of the extreme power afforded by many different forms of Internet anonymity, privacy, and freedom of speech.

Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.

Leo and I first discuss errata from previous episodes, correcting, among other things, Steve's first poor impression of Vista's performance. Then we discuss the results of my in-depth research into the inner workings of Vista's Kernel Patch Protection (aka PatchGuard) to uncover its limitations, benefits, and real purpose.

Leo and I describe the new security features Microsoft has designed and built into their new version of Windows, Vista. We examine the impact of having such features built into the base product rather than offered by third parties as add-ons. And we carefully compare the security benefits of Vista on 64-bit versus 32-bit hardware platforms.

Leo and I get a bit philosophical this week. We discuss the broad nature of Security — all security, not just computer security. We propose a new definition of 'Security' and flesh it out with examples to illustrate why security is so difficult, if not impossible.

Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.

Leo and I get deeply into the new MojoPac product from RingCube Technologies. After spending several days plumbing the depths of this intriguing new idea for installing secure and private Windows program and file installations onto transportable USB devices, I tell all about what I found and what I believe it means now and in the future.

Leo and I discuss the entire range of applications for Internet Proxies and Proxy Servers. We describe the many different uses for proxies while discussing both the benefits and the potential security and privacy liabilities created by filtering and caching web and other Internet content.