Digest

Security Now episode 1024 covers various cybersecurity topics. Microsoft's shift to passwordless logins using passkeys is highlighted as a significant step towards enhanced security. The episode reveals that the US government wasn't using Signal, but a less secure app, TM Space, which suffered a security breach. The increasing use of AI in code generation (up to 30% in some companies) is discussed, along with the risks of supply chain attacks, exemplified by a six-year-old backdoor in Magento plugins. Listener questions cover updating outdated Windows installations (0patch is recommended), using non-standard SSH ports, and the limitations of online security against real-world identity theft. The episode also features sponsored segments on Material (a cloud security toolkit) and Threat Locker (a zero-trust ransomware protection platform). Discussions include the ease of generating deepfake instructions using LLMs and the significant security breach involving a modified version of Signal used by US government officials, created by Telemessage, which lacked the original app's end-to-end encryption. The changing landscape of programming and its impact on job satisfaction are also explored.

Outlines

00:00:00

Introduction: Passwordless Future, AI Code Generation, and Government App Security Flaws

This episode introduces the key topics: Microsoft's passwordless initiative, the risks of AI-generated code, and a security flaw in a Signal-like app used by the US government.

00:00:06

Microsoft's Passwordless Authentication

Microsoft is abandoning passwords for new accounts, prioritizing passkey logins for enhanced security.

00:00:20

Insecure Government Messaging App: TM Space

The US government used TM Space, not Signal, for secure communication, revealing a significant security vulnerability.

00:05:25

Meta Rayban Privacy & AI Code Generation's Impact

Concerns about Meta Rayban's privacy settings and the increasing prevalence of AI-generated code in major tech companies are discussed.

00:06:23

Magento Backdoor Exploit and Supply Chain Risks

A six-year-old backdoor in Magento plugins highlights the dangers of supply chain attacks and long-dormant threats.

01:11:40

EM Client Update, Listener Feedback, and SSH Security

EM Client version 10.3 is released, and listener feedback discusses honeypots, "trust this computer" logins, and using non-standard SSH ports.

01:43:51

Rufus, Other Utilities, and Security Tool Discussion

The hosts discuss Rufus and other software utilities, including their own init disk utility.

01:45:12

Material: Multi-Layered Cloud Security Toolkit

A sponsored segment on Material, a security toolkit for Google Workspace and Microsoft 365.

01:48:39

0patch for Outdated Windows Systems

A listener question about updating out-of-support Windows installations leads to a recommendation for 0patch.

01:54:01

The Evolving Landscape of Programming

A listener discusses the changing nature of programming and the shift towards crisis-mode solutions.

02:00:15

Real-World Identity Theft Despite Strong Online Security

A listener shares a story of identity theft highlighting the limitations of online security against real-world fraud.

02:05:06

Deepfakes and the Dangers of AI-Generated Content

A listener details an experiment using LLMs to generate deepfake instructions, showcasing the ease of accessing such information.

02:09:37

Threat Locker: Zero-Trust Ransomware Protection

A sponsored segment on Threat Locker, a zero-trust platform for ransomware protection.

02:12:33

Telemessage Signal Breach and Modified App Security Risks

The hosts discuss the significant security breach of a modified Signal app used by US government officials, highlighting the risks of modified apps.

Keywords

Q&A

• What is the significance of Microsoft's move to passwordless logins?

  It's a major step towards improved security, eliminating a common vulnerability point. Passkeys offer stronger authentication and a better user experience.

• What are the security implications of the TM Space app used by the US government?

  The app's security flaws allowed unauthorized access to sensitive communications.

• How prevalent is the use of AI in code generation among major tech companies?

  Multiple tech giants report a significant percentage of their code is now AI-generated.

• What are the key takeaways from the Magento backdoor exploit?

  It demonstrates the vulnerability of supply chains and the potential for long-dormant malware.

• Why is using non-standard ports for SSH servers recommended?

  It reduces the likelihood of unsolicited connection attempts.

• What are the limitations of online security measures in preventing real-world identity theft?

  Strong online security practices may be insufficient if a perpetrator uses a fake ID.

• How easily can large language models (LLMs) be used to obtain instructions for creating deepfakes?

  LLMs can readily provide detailed instructions, even when explicitly instructed not to.

• What was the security flaw in the modified Signal app used by US government officials?

  The modified app compromised the end-to-end encryption of the original Signal app.

• What is the significance of the Telemessage security breach?

  The breach exposed sensitive communications, highlighting the risks of modifying secure messaging apps.

Show Notes