Topics

• future topic: keyed message authentication code

News and Errata

• Quicktime 7.6 Update for both Mac and Windows, critical, 7 exploits patched
• illegal iWork ’09 with a trojan that will deeply infect your Mac with a bot net
• you have options for your windows automatic update, choose the one right for you, make sure you are patched
• Yubikey, limited size of password discussed last show, someone wrote in to say longer password is possible
• http://cryptolink.com trademark is in place now
• http://My.BarackObama.com forum, people were putting up trojans

Crypto Recap

3.5 year review of all the security pieces that have been talked about

threat model – what is it we can do? what are we trying to do?

for example, we assume the endpoints are secure while we try to secure the communication between the two endpoints – keystroke logger, for example, we can’t secure against – if someone gets physical access, we’re insecure

we assume non-infinite computational power because all of the crypto is subject to brute force attack, no matter how long the key is

“perfect” security? yes, one-time pad – still isn’t secure if someone has physical access

much crypto depends on this fact: it is very easy to multiply two big prime numbers together, not easy to factor the result into those two original primes

taking something to a power is easy, taking the log is hard – also a fundamental assumption of security at present

you want there not to be a single point of failure, even if single communications is cracked, all the rest of the communications should still be secure – a single shared key is a bad idea for this reason

assume endpoints secure, path inbetween (the internet) totally insecure

what do we mean by security? in this context where we’re protecting traffic between two endpoints, we want 3 things:

1. confidentiality, interceptor in the middle cannot read the messages
2. integrity of message, guard against message being modified
3. authenticate the endpoints, are we really talking who we think we are?

encryption gives confidentiality, symmetric (same key at both ends used to encrypt and decrypt), asymmetric (two different keys used, one to encrypt a random symmetric key that’s used to encrypt the message, the other to decrypt that symmetric key), key agreement

message integrity, using hashes to create a signature (md5, sha1, etc), a hash is a digest of a much-larger communication, a fingerprint – any change to the original message will change that fingerprint – not computationally feasible to make a change to the original message and deliberately produce the same signature – md5 has been broken in this respect

in a couple of weeks we’ll talk about keyed digest, giving an authenticated signature, which we don’t have now

endpoint authentication, certificates and chain of trust anchored to a root authority

get yours here.

iron wil

Hosts: Steve Gibson with Leo Laporte

Our regular mailbag episode with questions and comments from our listeners.

Audible pick: Spin (Unabridged) by Robert Charles Wilson, narrated by Scott Brick. To sign up for a free audio book, visit AudiblePodcast.com/securitynow.

For 16kpbs versions, transcripts, and notes (including fixes), visit Steve’s site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

get yours here.

iron wil

Hosts: Leo Laporte, John C. Dvorak, Kevin Rose, and Patrick Norton

Laptop border patrol, iPhone modems, trolls, Switzerland, Icahn a no-show, a wet Mars, and more.

Links to all our stories are at http://del.icio.us/twit/154.

Audible pick of the week: Dreams from My Father: A Story of Race and Inheritance, By Barack Obama, Narrated By Barack Obama. For your free audio book, visit Audible.com/twit.

get yours here.

iron wil

Hosts: Paul Thurrott and Leo Laporte

Mojave Experiment, Forrester schizophrenia, x64, Windows Live Calendar, Live vs. Cuil, and more.

• Mojave Experiment videos released
• Microsoft Lashes Out at “Schizophrenic” Forrester Analysts
• Windows Live Calendar updated; Outlook Connector beta released. Calendar subscriptions in WLC. Sync with Windows Live Calendar using OL Connector 12 beta.
• x64 comes of age
• Windows Home Server HP post-PP1 updates performance concerns

Search engine news:

• Live Search home page redesigned.
• Cuil: Former Google engineers start new search engine.
• Attack of the tiny PCs continues: Dell Studio Hybrid Desktops and Dell Studio laptops

Vista tip of the week: Sync content from PC to PC with Live Mesh

Software of the week: Yahoo Zimbra Desktop

Audible book of the week: The Martian Chronicles (Unabridged) By Ray Bradbury, Narratored By Ray Bradbury. For a free audiobook, visit Audible.com/windows.

Check out Paul’s blog at http://www.internet-nexus.com and the SuperSite for Windows http://winsupersite.com for more information.

get yours here.

iron wil

Hosts: Steve Gibson with Leo Laporte

The nuts and bolts of DNS and the DNS cache poisoning attacks.

Audible pick: Best of Science Fiction and Fantasy (Unabridged). To sign up for a free audio book, visit AudiblePodcast.com/securitynow

For 16kpbs versions, transcripts, and notes (including fixes), visit Steve’s site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

get yours here.

iron wil

Hosts: Steve Gibson with Leo Laporte

Our regular mailbag episode with questions and comments from our listeners.

Audible pick: The Disappeared (Unabridged) By Kristine Kathryn Rusch. To sign up for a free audio book, visit AudiblePodcast.com/securitynow

For 16kpbs versions, transcripts, and notes (including fixes), visit Steve’s site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

get yours here.

iron wil

Can I say wow again? I just got home from watching ‘The Dark Knight‘. I have to give you some background at this point. When I was about 12 or 13 my father introduced me to the comic books that he was reading, which happened to be Ironman and Superman. I quickly found that I liked other characters.

I landed squarely on Batman and I hit that spot hard. I became a huge fan and started reading every Batman comic book printed every month. He became an ideal, a dream, and Hero. In some ways, I grew up with him.

I was very critical of the 4 Batman movies made with Michael Keaton, Val Kilmer, and George Clooney. None of them lived up to the Dark Knight of the comics. Michael Keaton came close with his grim approach and so they are okay. The last 2 don’t exist – at all.

Batman Begins was a great start and addition to the Batman of my youth. The Dark Knight continues that story and really shows the non-fanboy the true face of Joker. No offense to Jack Nicholson; but he just wasn’t it. My wife was creaped out by Heath Ledger’s performance. I have to say that I was very impressed.

I give it 5 Stars.

iron wil

p.s. Batman: Gotham Knight, you need it.

p.p.s. – one of my poems.

Hosts: Leo Laporte, Don Reisinger, Veronica Belmont, Larry “Major Nelson” Hryb

E3 pared down, cross platforms vs. first party games, social gaming, and more.

Links to all our stories are at http://del.icio.us/twit/152.

Audible pick of the week: The Disappeared, by Kristine Kathryn Rusch. For your free audio book, visit Audible.com/twit.

get yours here.

iron wil

Hosts: Steve Gibson with Leo Laporte

More on the privacy threat from the Phorm system.

Guest: Alexander Hanff, UK technologist and activist.

Audible pick of the week:
The Black Hole War: My Battle to Make the World Safe for Quantum Mechanics (Unabridged) by Leonard Susskind, Narrated by Ray Porter. To sign up for you free book, visit AudiblePodcast.com/securitynow.

For 16kpbs versions, transcripts, and notes (including fixes), visit Steve’s site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6.

get yours here.

iron wil

Hosts: Leo Laporte, John C. Dvorak, Patrick Norton, and Steve Wozniak

Woz waits in line, iPhone 3G, eBay, Microhoo undead, a DNS flaw, and more.

Links to all our stories are at http://del.icio.us/twit/151.

Audible pick of the week: Snoop: What Your Stuff Says About You by Sam Gosling narrated by David Drummond. For your free audio book, visit Audible.com/twit.

get yours here.

iron wil