Index episodes with lasting educational value rather than weekly news
Help learners build systematic understanding from basic concepts
Enable quick finding of episodes on specific security topics
Honor Steve Gibson's legacy of cybersecurity education
Structured progression paths for systematic cybersecurity education using Security Now! episodes.
Goal: Build fundamental understanding of cybersecurity concepts
Goal: Deep expertise in network security and attack methodologies
Goal: Comprehensive understanding of cryptographic principles and applications
Goal: Understand security from hardware foundations through operating systems
Air Date: July 6, 2006
The evolution of Denial of Service attacks from simple single-machine floods to massive distributed botnets with tens of thousands of compromised machines. Steve and Leo trace the history from Mafiaboy's 1999 attacks through IRC-based bot armies and modern extortion schemes targeting gambling sites.
Air Date: July 20, 2006
Complete tutorial on the netstat command - the universal network monitoring tool available in every operating system. Learn to diagnose what your computer is actually doing on the network, which programs are making connections, and how to identify suspicious activity.
Air Date: July 6, 2006
Analysis of constant Internet scanning and probe activity. Understanding what "normal" Internet background radiation looks like and how to distinguish between automated scanning and targeted attacks through router log analysis.
Air Date: August 24, 2006
Deep dive into Joanna Rutkowska's groundbreaking "Blue Pill" research demonstrating undetectable rootkits using AMD's SVM/Pacifica virtualization technology. This episode explores how next-generation hardware virtualization can be weaponized to create hypervisor-level attacks that completely bypass traditional operating system security.
Fundamental Paradigm Shift: Traditional rootkit detection methods completely ineffective against hardware-assisted attacks. Only external timing measurements or manual user timing tests can potentially detect Blue Pill presence.
Industry Response: Microsoft, AMD, and Intel immediately began developing countermeasures after this research was published.
Air Date: July 27, 2006
Historical foundation of virtualization from IBM VM/360 (1960s) through modern VMware/Virtual PC. Understanding the difference between software emulation and hardware-assisted virtualization, plus the revolutionary security implications of true machine isolation.
Air Date: May 11, 2006
One of Steve's most technically detailed episodes explaining the fundamental cause of countless security vulnerabilities. A deep dive into how the system stack works, how programming errors create exploitable conditions, and exactly how hackers inject malicious code into systems through buffer overflow attacks.
DEP (Data Execution Prevention): Windows XP SP2 introduced hardware-based protection marking the stack as non-executable. Modern Intel and AMD processors support this feature, preventing code execution from stack memory and eliminating entire class of buffer overflow exploits.
Why Vulnerabilities Persist: Component-based programming, team development, deadline pressures, and reliance on third-party code create conditions where even security-conscious programmers can miss these flaws.
Air Date: August 3, 2006
Critical analysis of Microsoft's decision to completely rewrite Windows Vista's networking stack from scratch. Steve examines the security implications of abandoning battle-tested code for untested implementations, featuring insights from Symantec's security research on Vista beta vulnerabilities.
Battle-Hardening Requirements: Network stacks require years of attack testing to become secure. Fresh code inherently contains unknown vulnerabilities regardless of development quality.
Windows 2000 Mystery: Speculation that Microsoft's suddenly-mature Windows 2000 stack may have originated from BSD sources due to behavioral similarities.
Air Dates: March-April 2006
Steve's definitive explanation of cryptographic principles, from basic concepts through advanced implementations. This series establishes the mathematical and practical foundations for understanding all modern security systems.
Air Date: May 7, 2009
Comprehensive explanation of the Internet's most-used security protocol. Steve details the complete operation of TLS (Transport Layer Security), the evolution from SSL, and exactly how secure connections are established. Essential for understanding HTTPS, secure email, VPNs, and virtually all encrypted Internet communications.
Network Stack Position: TLS inserts between TCP and application layer (HTTP/FTP/SMTP). It relies on TCP for reliable delivery and provides encryption/authentication to applications above it.
Performance: Once handshake completes, symmetric key encryption (AES) provides near-zero overhead for payload traffic while maintaining maximum security.
Air Dates: January-February 2006
Technical deep-dive into Internet infrastructure, routing protocols, and the fundamental technologies that make global networking possible. Critical background for understanding security implications.
Air Date: October 2005
Detailed explanation of Network Address Translation (NAT) and its security implications, including how firewalls work and why NAT provides inherent protection against incoming attacks.
Air Date: November 2005
Comprehensive coverage of Virtual Private Network technology, tunneling protocols, and the cryptographic foundations that make secure remote access possible.
Air Date: April 26, 2007
Definitive explanation of why WEP (Wired Equivalent Privacy) wireless encryption is fundamentally broken. Steve details the latest attack techniques that allow any WEP-protected WiFi network's secret cryptographic key to be discovered in less than 60 seconds, down from the previous requirement of five million captured packets.
Air Date: July 31, 2008
Comprehensive explanation of how DNS (Domain Name System) works from first principles, followed by detailed analysis of Dan Kaminsky's groundbreaking discovery of a fundamental vulnerability in DNS that affects the entire Internet. This episode covers the complete DNS architecture and the most serious DNS security flaw ever discovered.
Dan Kaminsky's Responsible Disclosure: Coordinated with all major DNS vendors (Microsoft, ISC BIND, Cisco) for simultaneous patching before public disclosure. This was one of the largest coordinated security updates in Internet history.
Design Flaw from 1987: Original DNS RFCs (1034 and 1035) written without security considerations - predates any commercial Internet threats by years.
DNS OARC Test: Visit snipurl.com/dnstest to check if your DNS provider uses source port randomization. The test issues 25 queries and charts both port randomization and transaction ID randomness.
Air Date: August 19, 2005
The very first Security Now! episode that launched the series. Steve explains how the undisclosed MS05-039 vulnerability was reverse-engineered from Microsoft's patch and weaponized into 12 different worms within 72 hours.
Air Dates: September-October 2005
Early exploration of rootkit technology and stealth malware, including the Sony BMG scandal and how malware can hide itself from traditional detection methods.
Air Dates: January - June 2010
Steve's ambitious and comprehensive "Let's Design a Computer" series that builds understanding from basic logic gates through modern processor architecture. Essential for understanding why security vulnerabilities exist at the hardware level and how computers actually work from first principles.
Bottom-Up Learning: Starts with basic electronic components and builds systematically to complete computer systems. Each episode builds on previous concepts to create comprehensive understanding.
Security Relevance: Understanding how computers work at the hardware level is essential for comprehending why certain security vulnerabilities exist and how they can be exploited.
All episode content belongs to GRC-Gibson Research Corporation and TWiT Network.
This index is created for educational purposes and community benefit.
Visit the original sources for complete episodes, show notes, and Steve's security tools.
Check out Steve's most popular software: SpinRite for disk recovery and maintenance, and DNS Benchmark for optimizing DNS performance.