New Episode of Security Now: Security Now 1021

In this episode of Security Now, Steve Gibson and Leo Laporte address several crucial topics related to computer security. One of the highlights of the episode is the discussion on "device-bound session credentials," a new method of managing login sessions that could replace traditional session cookies. This technology uses cryptographic keys to bind a session to a specific device, thus providing enhanced security. Steve Gibson explains that session cookies, introduced by Netscape in 1994, have long been used to maintain the login state of users on websites. However, they have vulnerabilities, particularly in the case of cookie theft. The new method of "device-bound session credentials" aims to solve this problem by using cryptographic keys stored in the device's hardware, such as the TPM (Trusted Platform Module). These keys cannot be exported and are used to sign cryptographic challenges, thus proving that the device is indeed the one that initiated the session. Another important topic discussed is the security update for Microsoft Windows 11 Enterprise and Education, which introduces "hot patching." This feature allows security updates to be applied without restarting the system, thereby reducing disruptions. Apple was also mentioned for re-enabling automatic updates on its devices, a measure aimed at improving overall security. The podcast also discusses recent vulnerabilities in Android and the patches provided by Google, as well as security flaws in PLCs (Programmable Logic Controllers), which are essential for the operation of critical infrastructure. A recent study revealed that many PLCs have inadequate security mechanisms, making them vulnerable to attacks. Finally, Steve and Leo talk about security issues at Oracle, including a breach in the Office of the Comptroller of the Currency of the U.S. Department of the Treasury, which lasted nearly two years. They also discuss Mozilla's efforts to improve the security of its PHP interpreter and security issues in WordPress plugins. In conclusion, this episode of Security Now provides a comprehensive overview of the latest trends and developments in computer security. "Device-bound session credentials" represent a significant advancement in managing login sessions, while Microsoft's security updates and Google's patches for Android highlight the importance of keeping systems up to date. The discussions on PLCs and security issues at Oracle underscore the need for constant vigilance in the field of cybersecurity.