176	25-Dec-08	64 min.	Drop My Rights - Leo and I delve into the inner workings of a free, easy to use and useful yet unknown Microsoft utility known as "DropMyRights."  It can be used to easily run selected, dangerous Internet-facing applications - such as your web browser and email client - under reduced, safer non-administrative privileges while everything else in the system runs unhampered.	Drop My Rights
175	18-Dec-08	86 min.	Listener Feedback #56 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #56
174	11-Dec-08	60 min.	Sandbox Limitations - Having described "Sandboxie" and Virtual Machine sandboxing utilities in the past, Leo and I discuss the limitations of any sort of sandboxing for limiting the negative impacts of malware on a user's privacy and system's security.	Sandbox Limitations
173	4-Dec-08	105 min.	Listener Feedback #55 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #55
172	27-Nov-08	90 min.	Sandboxie - Leo and I return to take a much closer look at "Sandboxie," an extremely useful, powerful, and highly recommended Windows security tool we first mentioned two years ago.  This time, after interviewing Sandboxie's creator, Ronen Tzur, I explain why I am totally hooked and why Leo is wishing it was available for his Macs.	Sandboxie
171	20-Nov-08	88 min.	Listener Feedback #54 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #54
170	13-Nov-08	103 min.	The TKIP Hack - Leo and I begin with a refresher on WEP, the original technology of WiFi encryption. With that fresh background, we then tackle the detailed explanation of every aspect of the recently revealed very clever hack against the TKIP security protocol. TKIP is the older and less secure of the two security protocols offered within the WPA and WPA2 WiFi Alliance certification standards.	The TKIP Hack
169	6-Nov-08	93 min.	Listener Feedback #53 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #53
168	30-Oct-08	57 min.	ClickJacking - Leo and I discuss yet another challenge to surfing safely in the web world: Known as "ClickJacking," or more formally as "UI Redressing," this class of newly popular threats tricks web users into performing web-based actions they don't intend by leading them to believe they are doing something else entirely.	ClickJacking
167	23-Oct-08	89 min.	Listener Feedback #52 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #52
166	16-Oct-08	75 min.	Cross-Site Request Forgery - Leo and I discuss the week's security events, then we address another fundamental security and privacy concern inherent in the way web browsers and web-based services operate: Using "Cross-Site Request Forgery" (CSRF), malicious pranksters can cause your web browser to do their bidding using your authentication.	Cross-Site Request Forgery
165	9-Oct-08	108 min.	Listener Feedback #51 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #51
164	2-Oct-08	97 min.	SockStress - Leo and I discuss a class of newly disclosed vulnerabilities reported to exist in many operating systems' implementations of the fundamental TCP protocol. Two security researchers, claiming that they could not get anyone's attention (after less than one month), disclosed far too much information in a recent audio interview - leaving little to the imagination - and exposing the Internet to a new class of DoS attacks. They'll certainly get attention now. (See this episode's Show Notes for many additional links.)	SockStress
163	25-Sep-08	97 min.	GoogleUpdate & DNS Security - Leo and I wrap up the loose ends from last week's final Q&A question regarding the self-removal of the GoogleUpdate system following the removal of Google's Chrome web browser, then we discuss the operation and politics of upgrading the Internet's entire DNS system to fully secure operation.	GoogleUpdate & DNS Security
162	18-Sep-08	89 min.	Listener Feedback #50 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #50
161	11-Sep-08	75 min.	Google's Chrome - Leo and I examine Google's new "Chrome" web browser.  Leo likes Chrome and attempts to defend it as being just a beta release; but, while I am impressed by the possibilities created by Chrome's underlying architecture, I'm extremely unimpressed by its total lack of critically important security and privacy features.	Google's Chrome
160	4-Sep-08	87 min.	Listener Feedback #49 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #49
159	28-Aug-08	95 min.	Vista Security Bypass - Steve and Leo discuss some recent revelations made by two talented security researchers during their presentation at the Black Hat conference.  Steve explains how, why, and where the much touted security improvements introduced in the Windows Vista operating system fail to prevent the exploitation of unknown security vulnerabilities.	Vista Security Bypass
158	21-Aug-08	93 min.	Listener Feedback #48 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #48
157	14-Aug-08	74 min.	DNS - After the Patch - Leo and I follow-up on the recent industry-wide events surrounding the discovery, partial repair, and disclosure of the serious (and still somewhat present) "spoofability flaw" in the Internet's DNS protocol. We also examine what more can be done to make DNS less spoofable.	DNS - After the Patch
156	7-Aug-08	84 min.	Listener Feedback #47 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #47
155	31-Jul-08	103 min.	Bailiwicked Domain Attack - Steve and Leo discuss the deeply technical and functional aspects of DNS, with a view toward explaining exactly how the recently discovered new DNS cache poisoning attacks are able to cause users' browsers to be undetectably redirected to malicious phishing sites.	Bailiwicked Domain Attack
154	24-Jul-08	88 min.	Listener Feedback #46 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #46
153	17-Jul-08	62 min.	DePhormed Politics - Leo and I conclude our coverage of the serious privacy invasion threat from the Phorm system with a discussion with Alexander Hanff, a technologist and activist located in the United Kingdom, who has been at the center of the public outcry against this invasive technology.	DePhormed Politics
152	10-Jul-08	83 min.	Listener Feedback #45 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #45
151	3-Jul-08	107 min.	Phracking Phorm - Leo and I continue our discussion of "ISP Betrayal" with a careful explanation of the intrusive technology created by Phorm and currently threatening to be deployed by ISPs, for profit, against their own customers.	Phracking Phorm
150	26-Jun-08	91 min.	Listener Feedback #44 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #44
149	19-Jun-08	67 min.	ISP Betrayal - In this first of two episodes, Steve and Leo discuss the disturbing new trend of Internet Service Providers (ISPs) allowing the installation of customer-spying hardware into their networks for the purpose of profiling their customers' behavior and selling this information to third-party marketers.	ISP Betrayal
148	12-Jun-08	100 min.	Listener Feedback #43 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #43
147	5-Jun-08	57 min.	Microsoft's Baseline Security Analyzer - Leo and I discuss the recent hacker takeover of the Comcast domain, then examine two very useful free security tools offered by Microsoft: the Baseline Security Analyzer (MBSA) and the Microsoft Security Assessment Tool (MSAT).	Microsoft's Baseline Security Analyzer
146	29-May-08	90 min.	Listener Feedback #42 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #42
145	22-May-08	51 min.	Secunia's PSI - Leo and I focus upon a comprehensive and highly recommended free software security vulnerability scanner called "PSI," Personal Software Inspector.  Where anti-viral scanners search a PC for known malware, PSI searches for known security vulnerabilities appearing in tens of thousands of known programs.  Everyone should run this small program!  You'll be surprised by what it finds.	Secunia's PSI
144	15-May-08	85 min.	Listener Feedback #41 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #41
143	8-May-08	84 min.	YubiKey - Leo and I delve into the detailed operation of the YubiKey, the coolest new secure authentication device I discovered at the recent RSA Security Conference.  Our special guest during the episode is Stina Ehrensvrd, CEO and Founder of Yubico, who describes the history and genesis of the YubiKey, and Yubico's plans for this cool new technology.	YubiKey
142	1-May-08	76 min.	Listener Feedback #40 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #40
141	24-Apr-08	91 min.	RSA Conference 2008 - Leo and I discuss recent security news; then I describe the week I spent at the 2008 annual RSA security conference, including my chance but welcome discovery of one very cool new multifactor authentication solution.	RSA Conference 2008
140	17-Apr-08	98 min.	Listener Feedback #39 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #39
139	10-Apr-08	81 min.	Network Congestion - Leo and I discuss an aspect of the "cost" of using the Internet - a packetized global network which (only) offers "best effort" packet delivery service.  Since "capacity" is the cost, not per-packet usage, the cost is the same whether the network is used or not.  But once it becomes "overused" the economics change since "congestion" results in a sudden loss of network performance.	Network Congestion
138	3-Apr-08	66 min.	Listener Feedback #38 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #38
137	27-Mar-08	66 min.	RAM Hijacks - Leo and I plow into the detailed operation of static and dynamic RAM memory to give some perspective to the recent Princeton research that demonstrated that dynamic RAM (DRAM) does not instantly "forget" everything when power is removed.  They examine the specific consequences of various forms of physical access to system memory.	RAM Hijacks
136	20-Mar-08	86 min.	Listener Feedback #37 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #37
135	13-Mar-08	77 min.	IronKey - Leo and I spend 45 terrific minutes speaking with David Jevans, Ironkey's CEO and founder, about the inner workings and features of their truly unique security-hardened cryptographic hardware USB storage device.	IronKey
134	6-Mar-08	84 min.	Listener Feedback #36 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #36
133	28-Feb-08	69 min.	TrueCrypt v5.0 - In this second half of our exploration of whole-drive encryption, Leo and I discuss the detailed operation of the new version 5.0 release of TrueCrypt, which offers whole-drive encryption for Windows.	TrueCrypt v5.0
132	21-Feb-08	94 min.	Listener Feedback #35 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #35
131	14-Feb-08	69 min.	FREE CompuSec - In this first of our two-part exploration of the world of whole-drive encryption, Leo and I begin by discussing the various options and alternatives, then focus upon one excellent, completely free, and comprehensive security solution known as "FREE CompuSec.""	FREE CompuSec
130	7-Feb-08	97 min.	Listener Feedback #34 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #34
129	31-Jan-08	39 min.	Windows SteadyState - Leo and I examine and discuss Microsoft's "Windows SteadyState," an extremely useful, free add-on for Windows XP that allows Windows systems to be "frozen" (in a steady state) to prevent users from making persistent changes to ANYTHING on the system.	Windows SteadyState
128	24-Jan-08	73 min.	Listener Feedback #33 - Leo and I discuss the week's major security events and discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #33
127	17-Jan-08	48 min.	Corporate Security - Leo and I discuss the week's major security events, then use a listener's story of his organization's security challenges to set the stage for our discussion of the types of challenges corporations face in attempting to provide a secure computing environment.	Corporate Security
126	10-Jan-08	101 min.	Listener Feedback #32 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #32
125	3-Jan-08	67 min.	Symmetric Ciphers - Steve explains, very carefully and clearly this time, why and how multiple encryption increases security. Steve also carefully and in full detail explains the operation of the new global encryption AES cipher: Rijndael.	Symmetric Ciphers
124	27-Dec-07	67 min.	Listener Feedback #31 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #31
123	20-Dec-07	46 min.	Jungle Disk - Leo and I invite Jungle Disk's creator, Dave Wright, to join the podcast to talk about his $20 product that allows for extremely economical, efficient, seamless and absolutely secure online storage of any user data within Amazon's high-performance, high-reliability "S3" storage facility.	Jungle Disk
122	13-Dec-07	73 min.	Listener Feedback #30 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #30
121	6-Dec-07	54 min.	Is Privacy Dead? - This week Steve and Leo take a break from the details of bits and bytes to discuss and explore the many issues surrounding the gradual and inexorable ebbing of individual privacy as we (consumers) rely increasingly upon the seductive power of digital-domain services.	Is Privacy Dead?
120	29-Nov-07	97 min.	Listener Feedback #29 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #29
119	22-Nov-07	70 min.	PayPal and DoubleClick - Leo and I dissect the "Links" on PayPal's site with an eye toward reverse engineering the reason for many of them routing PayPal's users through servers owned by DoubleClick. We carefully explain the nature of the significant privacy concerns raised by this practice.	PayPal and DoubleClick
118	15-Nov-07	81 min.	Listener Feedback #28 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #28
117	8-Nov-07	53 min.	Even More Perfect paper Passwords - Leo and I discuss the updated second version of our Perfect Paper Passwords (PPP) system and examine a number of interesting subtle questions such as whether it's better to have fully random equally probable passwords or true one-time-only passwords; and how, whether, and why attack strategies affect that decision.	Even More Perfect paper Passwords
116	1-Nov-07	47 min.	Listener Feedback #27 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #27
115	25-Oct-07	83 min.	Perfect Paper Passwords - During this week's second half of our discussion of GRC's new secure roaming authentication system, I reveal and fully describe the unique, simple, clean, and super-secure one-time password solution I designed to provide roaming authentication for GRC's employees. I also describe our own freely available software implementation of the "PPP" system, as well as several other recently created open source implementations.	Perfect Paper Passwords
114	18-Oct-07	95 min.	Listener Feedback #26 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #26
113	11-Oct-07	56 min.	Roaming Authentication - In this first of a two-part series, Leo and I discuss my recent design of a secure roaming authentication solution for GRC's employees.  I begin to describe the lightweight super-secure system I designed where even an attacker with "perfect knowledge" of an employee's logon will be unable to gain access to protected resources.	Roaming Authentication
112	4-Oct-07	64 min.	Listener Feedback #25 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #25
111	27-Sep-07	41 min.	OpenID Precautions - Having several times addressed the value and potential of the open source, open spec., and popular OpenID system, which is rapidly gaining traction as a convenient means for providing "single sign-on" identification on the Internet, this week Leo and I examine problems and concerns, both with OpenID and those inherent in any centralized identity management solution.	OpenID Precautions
110	20-Sep-07	95 min.	Listener Feedback #24 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #24
109	13-Sep-07	95 min.	GRC's eCommerce System - Leo and I delve into some of the non-obvious problems encountered during the creation of a robust and secure eCommerce system. I explain the hurdles I faced, the things that initially tripped me up, and the solutions I found when I was creating GRC's custom eCommerce system.	GRC's eCommerce System
108	6-Sep-07	80 min.	Listener Feedback #23 - Leo and I discuss questions and comments from listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback #23
107	30-Aug-07	53 min.	PIP & Even More Perfect Passwords - Leo and I discuss two topics this week:  The availability and operation of VeriSign Labs' OpenID PIP (Personal Identity Provider) beta, offering many useful features for online identity authentication; and my recent redesign of the algorithms behind GRC's popular Perfect Passwords page.	PIP & Even More Perfect Passwords
106	23-Aug-07	64 min.	Listener Mailbag #2 - Leo and I open the Security Now mailbag to share and discuss the thoughts, comments, and observations of other Security Now listeners.	Listener Mailbag #2
105	16-Aug-07	62 min.	Firewall LeakTesting - Leo and I discuss the history, purpose, and value of personal firewall leaktesting. We examine the myriad techniques clever developers have found for accessing the Internet and sending data out of PCs even when those PCs are being protected by outbound-blocking personal firewalls.	Firewall LeakTesting
104	9-Aug-07	70 min.	Listener Feedback Q&A #22 - Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #22
103	2-Aug-07	51 min.	PayPal Security Key - Leo and I talk with Michael Vergara, PayPal's Director of Account Protections, to learn everything they can about the PayPal security key effort and its probable future.	PayPal Security Key
102	26-Jul-07	78 min.	Listener Mailbag #1 - Leo and I open the Security Now mailbag to share and discuss the thoughts, comments, and observations of other Security Now listeners.	Listener Mailbag #1
101	19-Jul-07	83 min.	Are You Human? - Leo and I explore the Internet's rapidly growing need to automatically differentiate human from non-human automated clients.  We discuss the advantages and limitations of many past and current approaches to this problem while paying close attention to the most commonly used visual 'CAPTCHA' solutions.	Are You Human?
100	12-Jul-07	60 min.	Listener Feedback Q&A #21 - Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #21
99	5-Jul-07	53 min.	Trusted Platform Module (TPM) - Leo and I explain the virtues and misbegotten negative reputation of the entirely benign and extremely useful emergent crypto facility known as the "Trusted Platform Module.""	Trusted Platform Module (TPM)
98	28-Jun-07	49 min.	Internet Identity Metasystems - Leo and I discuss the user experience and operation of Microsoft's "CardSpace" technology which hopes to completely change the way users identify themselves on the Internet by doing away with traditional usernames and passwords.	Internet Identity Metasystems
97	21-Jun-07	46 min.	Operation: Bot Roast - Leo and I discuss the recent news of the FBI's announced crackdown and pursuit of 'bot-herders' who individually control networks of remote control DoS and Spam zombies numbering in the many tens of thousands.	Operation: Bot Roast
96	14-Jun-07	75 min.	Listener Feedback Q&A #20 - Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #20
95	7-Jun-07	52 min.	OpenID - Leo and I examine the open, platform agnostic, license free, OpenID secure Internet identity authentication system which is rapidly gaining traction within the Internet community.  It may well be the "single sign-on" solution that will simplify and secure our use of the world wide web.	OpenID
94	31-May-07	54 min.	The Fourth Factor - Having discussed the first three "factors" in multifactor authentication (something you know, something you have, something you are), Leo and I explore aspects of the power and problems with the fourth factor, "someone you know.""	The Fourth Factor
93	24-May-07	72 min.	Microsoft Patent Wars - Leo and I tackle the past, present and future of software patents. Our discussion of this non-security topic was triggered by Microsoft's recent declaration that since free and open source software (FOSS) was infringing at least 235 of their software patents, someone ought to be paying them.	Microsoft Patent Wars
92	17-May-07	61 min.	Listener Feedback Q&A #19 - Leo and I discuss questions asked by listeners of previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #19
91	10-May-07	81 min.	Marc Maiffret   (pronounced "may-fray") - Leo and I talk with Marc Maiffret, co-founder of eEye Digital Security of Aliso Viejo, California. eEye has perhaps done more forensic and vulnerability testing research to increase the remote security of Windows than any other group, including Microsoft. They continue to find and report an amazing number of Windows security vulnerabilities.	Marc Maiffret
90	3-May-07	61 min.	Multifactor Authentication - Leo and I discuss the theory and practice of multifactor authentication which uses combinations of "something you know," "something you have," and "something you are" to provide stronger remote authentication than traditional, unreliable single-factor username and password authentication.	Multifactor Authentication
89	26-Apr-07	46 min.	Even More Badly Broken WEP - Leo and I review the operation of wireless network security and discuss in detail the operation of the latest attack on the increasingly insecure WEP encryption system.  This new technique allows any WEP-protected WiFi network's secret cryptographic key to be discovered in less than 60 seconds.	Even More Badly Broken WEP
88	19-Apr-07	57 min.	Listener Feedback Q&A #18 - Leo and I discuss questions asked by listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #18
87	12-Apr-07	45 min.	SQL Injection Exploits - Leo and I wrap up our three-part series on web-based code injection vulnerabilities and exploitation with a discussion web-based structured query language (SQL) database attacks. We explain why and how SQL injection vulnerabilities are creating an ongoing plague of vulnerabilities besetting modern 'Web 2.0' applications.	SQL Injection Exploits
86	5-Apr-07	61 min.	Cross-Site Scripting - In this second installment of our three-part coverage of web-based remote code injection, Leo and I discuss cross-site scripting vulnerabilities and exploits. I quickly read through the 28 vulnerabilities discovered in popular software just during the previous month and discusses the nature of the threat and challenge facing authors of modern 'dynamic' web sites and services.	Cross-Site Scripting
85	29-Mar-07	58 min.	Intro to Web Code Injection - Leo and I begin a three-episode series to discuss and examine web-based remote code injection exploits.  Commonly known as 'Cross-Site Scripting' and 'SQL Injection,' these exploits are growing in popularity and strength as hackers discover increasingly clever ways to exploit subtle defects in next-generation web-based applications.	Intro to Web Code Injection
84	22-Mar-07	62 min.	Listener Feedback Q&A #17 - Leo and I discuss questions asked by listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #17
83	15-Mar-07	50 min.	UAC in Depth - Leo and I wrap up our quest to get Windows Wi-Fi to 'Maintain Full Radio Silence' by adding one additional important tweak to Windows settings.  Then we discuss the detailed security implications, now and in the future, of Vista's new and powerful user account control (UAC) system.	UAC in Depth
82	8-Mar-07	45  min.	Cyber Warfare - Leo and I discuss the interesting topic of state-sponsored Cyber Warfare. While born through the imagination of science fiction writers, the reality of international, inter-nation cyber combat is fiction no longer.	Cyber Warfare
81	1-Mar-07	55 min.	Hard Drive Unreliability - Leo and I discuss the distressing results and implications of two recent very large population studies (more than 100,000 drives each) of hard drive field failures. Google and Carnegie Mellon University (CMU) both conducted and submitted studies for the recent 5th USENIX conference on File and Storage Technologies.	Hard Drive Unreliability
80	22-Feb-07	76 min.	Listener Feedback Q&A #16 - Leo and I discuss questions asked by listeners of previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #16
79	15-Feb-07	61 min.	Backtracking Spoofed Spam eMail - Leo's 'TWiT.tv' and my 'GRC.com' domains are used by spambots which spoof their domains as the source of bogus eMail. This week they discuss the details of eMail "Received:" headers and explain how the examination of those headers can penetrate any spoofing to reveal the true originating IP of any spoofed spam eMail.	Backtracking Spoofed Spam eMail
78	8-Feb-07	40 min.	DEP in Depth - With our new SecurAble freeware now launched, Leo and I discuss the full impact and importance of hardware DEP technology.  I explain why I believe that hardware DEP is the single most important Internet-related security technology developed so far.	DEP in Depth
77	1-Feb-07	61 min.	Microsoft on Vista DRM - In episode #74 Peter Gutmann shared his concerns and fears about the system-wide consequences and impact of the digital rights management (DRM) Microsoft has built deeply into Vista.  Microsoft's Vista Team responded with a comprehensive Blog posting which Leo and I read and examine this week. - Here is the blog posting we used as our source: - Windows Vista Content Protection - Twenty Questions (and Answers)	Microsoft on Vista DRM
76	25-Jan-07	61 min.	Listener Feedback Q&A #15 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #15
75	18-Jan-07	50 min.	Vista DRM Wrap-Up & Announcing "SecurAble" - Following last week's guest appearance by Peter Gutmann, Leo and I wrap up the topic of Vista's new, deep, and pervasive Digital Rights Management (DRM) system.  I also announce the completion and availability of GRC's latest freeware: "SecurAble." - Click this link for Securable's web page.	Vista DRM Wrap-Up & Announcing "SecurAble""
74	11-Jan-07	50 min.	Peter Gutmann on Vista DRM - Peter Gutmann, the author of the highly controversial white paper detailing the significant cost of Windows Vista's deeply-entrenched digital rights management (DRM) technology, joins Leo and me this week to discuss his paper and his findings.	Peter Gutmann on Vista DRM
73	4-Jan-07	65 min.	Digital Rights Management (DRM) - In preparation for next week's look at how and why Windows Vista has incorporated the most pervasive and invasive system for digital rights management ever created, AACS, Leo and I first take a step back to survey the history and evolution of media property rights and the technologies used to enforce them.	Digital Rights Management (DRM)
72	28-Dec-06	61 min.	Listener Feedback Q&A #14 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #14
71	21-Dec-06	58 min.	SecurAble - This week I take the wraps off our forthcoming security freeware utility:  SecurAble.  Although I'm still working to get it finished, tested, and ready for initial release, I describe what SecurAble will do and some of the unexpected hurdles I've encountered with the application and with details of Windows operation along the way.	SecurAble
70	14-Dec-06	56 min.	Achieving Internet Anonymity - Last week Leo and I discussed the social implications and the social power of Internet Anonymity.  This week we discuss the technology of Freenet and TOR (Onion Router) networks, and I describe the detailed technical operation of both systems.	Achieving Internet Anonymity
69	7-Dec-06	37 min.	The Social Implications of Internet Anonymity - To create some background for next week's discussion about the significant technical challenges involved in creating true anonymity on the Internet, this week Leo and I discuss the consequences of the use and abuse of the extreme power afforded by many different forms of Internet anonymity, privacy, and freedom of speech.	The Social Implications of Internet Anonymity
68	30-Nov-06	97 min.	Listener Feedback Q&A #13 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #13
67	23-Nov-06	39 min.	Kernel Patch Protection - Leo and I first discuss errata from previous episodes, correcting, among other things, Steve's first poor impression of Vista's performance. Then we discuss the results of my in-depth research into the inner workings of Vista's Kernel Patch Protection (aka PatchGuard) to uncover its limitations, benefits, and real purpose.	Kernel Patch Protection
66	16-Nov-06	43 min.	Windows Vista Security - Leo and I describe the new security features Microsoft has designed and built into their new version of Windows, Vista.  We examine the impact of having such features built into the base product rather than offered by third parties as add-ons.  And we carefully compare the security benefits of Vista on 64-bit versus 32-bit hardware platforms.	Windows Vista Security
65	9-Nov-06	42 min.	Why Is Security So Difficult? - Leo and I get a bit philosophical this week.  We discuss the broad nature of Security - all security, not just computer security.  We propose a new definition of 'Security' and flesh it out with examples to illustrate why security is so difficult, if not impossible.	Why Is Security So Difficult?
64	2-Nov-06	61 min.	Listener Feedback Q&A #12 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #12
63	26-Oct-06	66 min.	MojoPac - Leo and I get deeply into the new MojoPac product from RingCube Technologies. After spending several days plumbing the depths of this intriguing new idea for installing secure and private Windows program and file installations onto transportable USB devices, I tell all about what I found and what I believe it means now and in the future.	MojoPac
62	19-Oct-06	60 min.	Internet Proxies - Leo and I discuss the entire range of applications for Internet Proxies and Proxy Servers. We describe the many different uses for proxies while discussing both the benefits and the potential security and privacy liabilities created by filtering and caching web and other Internet content.	Internet Proxies
61	12-Oct-06	35 min.	ISP Privacy and Security - Leo and I discuss two new 0-day Internet Explorer vulnerabilities (both now being exploited on the Internet); then we explore the commonly expressed privacy and security concerns presented by the need to trust Internet Service Providers (ISP).	ISP Privacy and Security
60	5-Oct-06	53 min.	Listener Feedback Q&A #11 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #11
59	28-Sep-06	69 min.	Comparing "Parallels" VMs - Completing the topic of current virtual machine technology and products, Steve and Leo closely examine the commercial multiplatform virtual machine offerings from "Parallels," comparing them to VMware and Virtual PC.  Steve also corrects an important incorrect statement he made the previous week about features missing from VMware's free Server VM solution.	Comparing "Parallels" VMs
58	21-Sep-06	34 min.	Two New Critical Windows Problems - Leo and I discuss the breaking news of two new critical Windows problems: A new vulnerability that is being actively exploited on the web to install malware into innocent users' machines - and a work-around that all Windows users can employ to protect themselves. And a serious file-corruption bug Microsoft introduced into last month's security update that affects all Windows 2000 users.	Two New Critical Windows Problems
57	14-Sep-06	42 min.	Virtual PC versus VMware - Leo and I wrap up our multi-week series about virtual machines and virtual machine technology by closely analyzing the differences and similarities between the free and commercial VM products offered by Microsoft and VMware.	Virtual PC versus VMware
56	7-Sep-06	59 min.	Listener Feedback Q&A #10 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #10
55	31-Aug-06	48 min.	Application Sandboxes - Having discussed "heavy weight" virtualization technology in recent weeks, this week Leo and I examine "lighter weight" application sandboxing technology and the software solutions currently available to perform this form of application "wrapping."  We discuss the inherent limitations of sandbox security and explain how valuable sandboxes can be for privacy enforcement.	Application Sandboxes
54	24-Aug-06	52 min.	Blue Pill - Leo and I continue our ongoing discussion of the security implications and applications of virtualization and virtual machines. This week we examine the "Blue Pill" OS subversion technology made possible by AMD's next generation virtualization hardware support. We debunk the hype surrounding this interesting and worrisome capability, placing it into a larger security and virtualization context.	Blue Pill
53	17-Aug-06	40 min.	VMware - Leo and I briefly recap the concepts and technology of Virtual Machine (VM) technology, then thoroughly explore the free and commercial offerings of the earliest company to pioneer Intel-based high-performance virtual machines, VMware.  We focus upon the free VMware Player which allows Virtual Machine 'Appliances' to be 'played' on any supported platform.  They examine the value of these VMware solutions for creating highly secure 'sandbox' containment environments as well as for cover-your-tracks privacy.	VMware
52	10-Aug-06	49 min.	A Busy Week for Security Troubles - Leo and I discuss the week's security woes, covering D-Link and Centrino wireless buffer overflows which allow remote wireless compromise of user's networks and machines. We explore the recent revelation that JavaScript can be used to scan an unwitting user's internal network to take over their equipment. We talk about the purchase of Hamachi by LogMeIn and how Botnets are being used to create fraudulent eBay users with perfect "feedback" in order to defraud even careful eBay users. And more!	A Busy Week for Security Troubles
51	3-Aug-06	45 min.	Vista's Virgin Stack - Leo and I discuss the revelation, courtesy of a Symantec study and report, that Microsoft's forthcoming Vista operating system has a brand new, written from scratch, networking stack supporting old and new network protocols. They consider the sobering security consequences of Microsoft's decision to scrap Window's old but battled-hardened network stack in favor of one that's new and unproven.	Vista's Virgin Stack
50	27-Jul-06	52 min.	Virtual Machine History & Technology - Leo and I discuss the historical beginnings of Virtual Machine technology, from the 40-year-old IBM VM/360 operating system through virtual machine language emulators and today's VMware and Virtual PC solutions.  This kicks off a multi-episode discussion of the tremendous security benefits and practical uses of modern day Virtual Machine technology.	Virtual Machine History & Technology
49	20-Jul-06	58 min.	The NETSTAT Command - Leo and I describe the operation and use of the universally available "Netstat" command -- available in every desktop operating system from Unix and Linux through Windows and Macs. "Netstat" allows anyone to instantly see what current Internet connections and listening ports any system has open and operating. Mastering the power of this little-known command will greatly empower any security-conscious computer user.	The NETSTAT Command
48	13-Jul-06	66 min.	Listener Feedback Q&A #9 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #9
47	6-Jul-06	62 min.	Internet Weaponry - Leo and I trace the history and rapid growth of Internet Denial of Service (DoS) attack techniques, tools, and motivations over the past eight years.  We discuss many different types of attacks while focusing upon the distributed bandwidth flooding attacks that are the most destructive and difficult to block.	Internet Weaponry
46	29-Jun-06	36 min.	Router Logs - Leo and I clarify the confusion surrounding consumer NAT router logging. We explain why routers tend to overreact to Internet 'noise' by 'crying wolf' too often, why the logs produced by consumer routers are unfortunately not very useful, and when paying attention to logs does and does not make sense.	Router Logs
45	22-Jun-06	26 min.	The 'Hosts' File - Leo and I reveal and describe the 'HOSTS' file, which is hidden away within every Internet-capable machine. We explain how, because it is always the first place a machine looks for the IP address associated with any other machine name, it can be used to easily and conveniently intercept your computer's silent communication with any questionable web sites you'd rather have it not talking to.	The 'Hosts' File
44	15-Jun-06	63 min.	Listener Feedback Q&A #8 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #8
43	8-Jun-06	58 min.	Open Ports - This week Leo and I cover the broad subject of 'open ports' on Internet-connected machines.  We define 'ports', and what it means for them to be open, closed, and stealth.  We discuss what opens them, what it means to have ports 'open' from both a functional and security standpoint, how open ports can be detected, whether stealth ports are really more secure than closed ports, and differences between TCP and UDP port detection.	Open Ports
42	1-Jun-06	35 min.	NAT Traversal - Leo and I delve into the inner workings of NAT routers. We examine the trouble NAT routers present to peer-to-peer networks where users are behind NAT routers that block incoming connections, and we explain how a third-party server can be briefly used to help each router get its packets through to the other, thus allowing them to directly connect.	NAT Traversal
41	25-May-06	40 min.	TrueCrypt - This week Leo and I explain why we love "TrueCrypt", a fabulous, free, open source, on-the-fly storage encryption tool that is fast, flexible, super-well-engineered, feature packed, and able to provide advanced state of the art encryption services for many applications.	TrueCrypt
40	18-May-06	71 min.	Listener Feedback Q&A #7 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world "application notes" for any of the security technologies and issues we have previously discussed.	Listener Feedback Q&A #7
39	11-May-06	50 min.	Buffer Overruns - In one of our more "aggressively technical" episodes, Leo and I discuss the pernicious nature of software security bugs from the programmer's perspective. We explain how "the system stack" functions, then provide a detailed look at exactly how a small programming mistake can allow executable code to be remotely injected into a computer system despite the best intentions of security-conscious programmers.	Buffer Overruns
38	4-May-06	37 min.	Browser Security - Leo and I discuss the broad topic of web browser security.  We examine the implications of running "client-side" code in the form of interpreted scripting languages such as Java, JavaScript, and VBScript, and also the native object code contained within browser "plug-ins" including Microsoft's ActiveX.  I outline the "zone-based" security model used by IE and explain how I surf with high security under IE, only "lowering my shields" to a website after I've had the chance to look around and decide that the site looks trustworthy.	Browser Security
37	27-Apr-06	36 min.	Crypto Series Wrap-up - Leo and I conclude our multi-week coverage of the fundamental technologies underlying modern cryptographic systems.  We discuss the number of 512-bit primes (two of which are used to form 1024-bit public keys) and the relative difficulty of performing prime factorizations at various bit lengths.  We discuss the importance of, and solutions to, private key recovery using varying numbers of trustees.  And conclude by explaining the need for, and the operation of, security certificates.	Crypto Series Wrap-up
36	20-Apr-06	56 min.	Listener Feedback Q&A #6 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world "application notes" for any of the security technologies we have previously discussed.	Listener Feedback Q&A #6
35	13-Apr-06	34 min.	Cryptographic Hashes - Having covered stream and block symmetric ciphers and asymmetric ciphers, this week Leo and I describe and discuss "cryptographic hashes", the final component to comprise a complete fundamental cryptographic function suite. We discuss the roles of, and attacks against, many common and familiar cryptographic hashes including MD5 and SHA1.	Cryptographic Hashes
34	6-Apr-06	37 min.	Public Key Cryptography - Having discussed symmetric (private) key ciphers during the last two weeks, this week Leo and I examine asymmetric key cryptography, commonly known as "Public Key Cryptography".  We begin by examining the first public key cryptosystem, known as the Diffie-Hellman Key Exchange, invented in 1976. Then we describe the operation of general purpose public key cryptosystems such as the one invented by RSA.	Public Key Cryptography
33	30-Mar-06	43 min.	Symmetric Block Ciphers - Leo and I answer last week's Puzzler/BrainTeaser which explored the idea of using two private one-time pad "keys," like two padlocks, to securely convey a message between two parties, neither of whom would have the other's key.  Then we continue our ongoing tour of fundamental crypto technology by describing the operation of Symmetric Block Ciphers.	Symmetric Block Ciphers
32	23-Mar-06	55 min.	Listener Feedback Q&A #5 - Leo and I briefly review last week's topic of symmetric stream ciphers, then we pose the first Security Now! Puzzler/BrainTeaser which proposes a secure means for sending encrypted messages where neither party knows the other's key. The Puzzler/BrainTeaser will be answered and resolved at the start of next week's episode. Then, as always in our Q&A episodes, we answer questions and discuss issues raised by listeners.	Listener Feedback Q&A #5
31	16-Mar-06	53 min.	Symmetric Stream Ciphers - Leo and I continue our multi-episode tour of cryptographic technology. This week we analyze the cryptographic operation of secret decoder rings which we use to develop a solid foundation of cryptographic terminology. We then examine the first of two forms of symmetric, private key cryptography known as symmetric stream ciphers. Two weeks from now, after next week's Q&A episode, we'll discuss the operation of symmetric block ciphers.	Symmetric Stream Ciphers
30	9-Mar-06	30 min.	Cryptographic Issues -  - Leo and I open our multi-week discussion of the operation and technology of cryptography. This first week we start by examining the social consequences and ethical implications of common citizens being empowered with freely available cryptographic technology that no force on Earth - no government agency, no corporation, no private individual - can crack within their lifetimes.	Cryptographic Issues
29	2-Mar-06	52 min.	Ethernet Insecurity - Leo and I discuss the design, operation, and complete lack of security of Ethernet - the LAN technology that virtually all of the world uses. We explain how this lack of security enables a wide range of serious attacks to be perpetrated by any other machine sharing the same Ethernet - such as in a wireless hotspot, within a corporate network, or even in a wired hotel where the entire hotel is one big exploitable Ethernet LAN. GRC's ARP Cache Poisoning page contains a detailed explanation of these problems with diagrams and links to readily available Ethernet ARP exploitation malware. - ARP Cache Poisoning: /nat/arp.htm	Ethernet Insecurity
28	23-Feb-06	40 min.	Listener Feedback Q&A #4 - Leo and I discuss questions asked by listeners of our previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world "application notes" for any of the security technologies we have previously discussed.	Listener Feedback Q&A #4
27	16-Feb-06	37 min.	How Local Area Networks Work, Part 1 - Having covered the operation of the Internet's WAN (Wide Area Network) technology in the past two weeks, this week Leo and I turn to discussing the way Local Area Networks (LANs) operate and how they interface with the Internet WAN. We address the configuration of subnet masks, default gateways, and DHCP to explain how packets are routed among machines and gateways within a LAN.	How Local Area Networks Work, Part 1
26	9-Feb-06	38 min.	How the Internet Works, Part 2 - During this 38-minute, part 2 episode of "How the Internet Works," Leo and I briefly review last week's discussion of the ICMP protocol, then discuss the operational details of the Internet's two main data-carrying protocols: UDP and TCP.	How the Internet Works, Part 2
25	2-Feb-06	49 min.	How the Internet Works, Part 1 - During this 49-minute episode, Leo and I briefly discuss the 'Kama Sutra' virus that will become destructive on February 3rd. We briefly discuss PC World Magazine's recent evaluation and ranking of ten top anti-malware systems. And we begin our long-planned 'fundamental technology' series with a two-part close look at the history and detailed operation of the global Internet.	How the Internet Works, Part 1
24	26-Jan-06	40 min.	Listener Feedback Q&A #3 - Leo and I discuss questions asked by listeners of our previous episodes.  We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world "application notes" for any of the security technologies we have previously discussed.	Listener Feedback Q&A #3
23	19-Jan-06	29 min.	GRC's "MouseTrap" - Leo and I "close the backdoor" on the controversial Windows WMF Metafile image code execution (MICE) vulnerability. We discuss everything that's known about it, separate the facts from the spin, explain exactly which Windows versions are vulnerable and why, and introduce a new piece of GRC freeware: MouseTrap which determines whether any Windows or Linux/WINE system has 'MICE'. - Download "MouseTrap" – our free MICE tester (29 kb)	GRC's "MouseTrap""
22	12-Jan-06	39 min.	The Windows MetaFile Backdoor? - Leo and I carefully examine the operation of the recently patched Windows MetaFile vulnerability. I describe exactly how it works in an effort to explain why it doesn't have the feeling of another Microsoft "coding error". It has the feeling of something that Microsoft deliberately designed into Windows. Given the nature of what it is, this would make it a remote code execution "backdoor". We will likely never know if this was the case, but the forensic evidence appears to be quite compelling. - Download "MouseTrap" – our free MICE tester (29 kb)	The Windows MetaFile Backdoor?
21	5-Jan-06	27 min.	The Windows MetaFile (WMF) Vulnerability - Leo and I discuss everything known about the first serious Windows security exploits of the New Year, caused by the Windows MetaFile (WMF) vulnerability. In our show's first guest appearance, we are joined by Ilfak Guilfanov, the developer of the wildly popular -- and very necessary -- temporary patch that was used by millions of users to secure Windows systems while the world waited for Microsoft to respond.	The Windows MetaFile (WMF) Vulnerability
20	29-Dec-05	54 min.	A SERIOUS new Windows vulnerability - and Listener Q&A - On December 28th a serious new Windows vulnerability has appeared and been immediately exploited by a growing number of malicious web sites to install malware. Many worse viruses and worms are expected soon. We start off discussing this and our show notes provides a quick necesary workaround until Microsoft provides a patch. Then we spend the next 45 minutes answering and discussing interesting listener questions.	A SERIOUS new Windows vulnerability - and Listener Q&A
19	22-Dec-05	53 min.	VPNs Three: Hamachi, iPig, and OpenVPN - Leo and I wrap up our multi-week, in-depth coverage of PC VPN solutions by discussing some aftermath of the zero-configuration Hamachi system; introducing "iPig," a very appealing new zero-configuration VPN contender; and describing the many faces of OpenVPN, the "Swiss army knife" of VPN solutions.	VPNs Three: Hamachi, iPig, and OpenVPN
18	15-Dec-05	33 min.	""Hamachi" Rocks! - This week Leo and I discuss and describe the brand new, ready to emerge from a its long development beta phase, ultra-secure, lightweight, high-performance, highly-polished, multi-platform, peer-to-peer and FREE! personal virtual private networking system known as "Hamachi". After two solid weeks of testing and intense dialog with Hamachi's lead developer and designer, I have fully vetted the system's security architecture and have it running on many of my systems.  While I am travelling to Toronto this week, Hamachi is keeping my roaming laptop securely and directly connected to all of my machines back home. Don't miss this one!	""Hamachi" Rocks!
17	8-Dec-05	33 min.	PPTP and IPSec VPN Technology - In our continuing exploration of VPN technology for protecting network users on networks they don't control, Leo and I discuss the oldest "original" VPN protocols: Industry standard IPSec, and Microsoft's own PPTP and L2TP/IPSec.  We examine and explain the trouble with interconnecting Windows machines to third-party VPN routers and examine the many reasons these older technologies are probably not optimal for on-the-go road warriors.	PPTP and IPSec VPN Technology
16	1-Dec-05	42 min.	Listener feedback Q&A #1 - Leo and I discuss questions asked by listeners of our previous episodes. We tie up loose ends, explore a wide range of topics that are too small to fill their own episode, clarify any confusion from previous installments, and present real world 'application notes' for any of the security technologies we have previously discussed.	Listener feedback Q&A #1
15	24-Nov-05	43 min.	VPN Secure Tunneling Solutions - Leo and I discuss the use of SSL and SSH encrypted tunneling for providing privacy and security whenever an insecure local network is being used - such as at an open WiFi hotspot or when using a hotel's network. These solutions are not transparent and tend to be configuration intensive. They also require the use of a "server" of some sort at the user's home or office. This makes these approaches less suitable for casual users, but offers a solution for the more technically inclined road warriors.	VPN Secure Tunneling Solutions
14	17-Nov-05	27 min.	Virtual Private Networks (VPN): Theory - Leo and I first follow-up on the past two episodes, discussing new developments in the continuing Sony Rootkit DRM drama, and clearing up some confusion over the crackability of WPA passphrases.  Then, in this first of our two-part series on VPNs, we discuss the theory of VPN connections and tunnels, explaining how they work and why they represent such a terrific solution for anyone who needs security while they're away from home.	Virtual Private Networks (VPN): Theory
13	10-Nov-05	35 min.	Unbreakable WiFi Security - Leo and I follow-up on last week's discussion of the Sony Rootkit debacle with the distressing news of "phoning home" (spyware) behavior from the Sony DRM software, and the rootkit's exploitation by a new malicious backdoor Trojan. We then return to complete our discussion of WiFi security, demystifying the many confusing flavors of WPA encryption and presenting several critical MUST DO tips for WPA users.	Unbreakable WiFi Security
12	3-Nov-05	24 min.	Sony's "Rootkit Technology" DRM (copy protection gone bad) - Leo and I discuss details and consequences of Sony Corporation's alarming "Rootkit" DRM (digital rights management) copy protection scheme. This poorly written software unnecessarily employs classic rootkit technology (see episode #9) to hide from its users after installation. It can not be uninstalled easily, it can be easily misused for malicious purposes, and it has been implicated in many repeated BSOD "blue screen of death" PC crashes.	Sony's "Rootkit Technology" DRM
11	27-Oct-05	38 min.	Bad WiFi Security (WEP and MAC address filtering) - Leo and I answer some questions arising from last week's episode, then plow into a detailed discussion of the lack of security value of MAC address filtering, the futility of disabling SSID's for security, and the extremely poor security offered by the first-generation WEP encryption system.	Bad WiFi Security
10	20-Oct-05	28 min.	Open Wireless Access Points - Leo and I examine the security and privacy considerations of using non-encrypted (i.e. 'Open') wireless access points at home and in public locations. We discuss the various ways of protecting privacy when untrusted strangers can 'sniff' the data traffic flowing to and from your online PC.	Open Wireless Access Points
9	13-Oct-05	32 min.	Rootkits - This week we discuss "rootkit technology". We examine what rootkits are, why they have suddenly become a problem, and how that problem is rapidly growing in severity. We also discuss their detection and removal and point listeners to some very effective free rootkit detection solutions.	Rootkits
8	6-Oct-05	24 min.	Denial of Service (DoS) Attacks - Distributed Denial of Service (DDoS) attacks are occurring with ever-greater frequency every day. Although these damaging attacks are often used to extort high-profile gaming and gambling sites before major gambling events, attacks are also launched against individual users who do something to annoy "zombie fleet masters" while they are online. Some router and firewall vendors claim that their devices prevent DDoS attacks. Is that possible? What can be done to dodge the bullet of a DDoS attack launched against you while you're online?	Denial of Service (DoS) Attacks
7	29-Sep-05	36 min.	SPYaWAREness - Any contemporary discussion of threats to Internet security must discuss the history, current situation, and future of spyware. Leo and I spend a little more time than usual covering many aspects of this important topic. DON'T MISS the Episode Notes Page for this episode!	SPYaWAREness
6	22-Sep-05	18 min.	Mechanical & Electromagnetic Information Leakage - Triggered by a recent report of three UC Berkeley researchers recovering text typed at a keyboard (any keyboard) after simply listening to ten minutes of typing, Leo and I discuss the weird realm of "alternative information leakage" - from CRT glowing, to radio emissions, to LEDs lamps on the front of network equipment . . . to a microphone listening to anyone typing.	Mechanical & Electromagnetic Information Leakage
5	15-Sep-05	20 min.	Personal Password Policy - Part 2 - Our previous episode (#4), which discussed personal password policies, generated so much great listener feedback, thoughts, ideas, and reminders about things we didn't mention, that we decided to wrap up this important topic with a final episode to share listeners' ideas and to clarify some things we left unsaid.	Personal Password Policy - Part 2
4	8-Sep-05	24 min.	Personal Password Policy - Everyone who uses web-based services such as eBay, Amazon, and Yahoo, needs to authenticate their identity with passwords. Password quality is important since easily guessable passwords can be easily defeated. Leo and I recap a bit from last week's program, then discuss passwords. We suggest an approach that anyone can use to easily create unbreakable passwords.	Personal Password Policy
3	1-Sep-05	25 min.	NAT Routers as Firewalls - Most people don't think of common NAT routers as hardware firewalls, but ANY NAT router inherently provides terrific security and protection against incoming malicious traffic. Learn how and why this is, and which default settings MUST be changed to lock down the security of your NAT router.	NAT Routers as Firewalls
2	25-Aug-05	25 min.	HoneyMonkeys - How Microsoft's HoneyMonkey system works, how it finds malicious web sites before they find you, and what Microsoft is doing (and NOT doing) with this valuable security information it is now collecting.	HoneyMonkeys
1	19-Aug-05	18 min.	As the Worm Turns - the first Internet worms of 2005 - How a never-disclosed Windows vulnerability was quickly reverse-engineered from the patches to fix it and turned into more than 12 potent and damaging Internet worms in three days. What does this mean for the future of Internet security?	As the Worm Turns