The Call Is Coming From Inside the House - Live From Zero Trust World 2026

March 5, 2026·52 min·4 clips

Steve Gibson explains how Microsoft's raw sockets in Windows XP sparked a DDoS crisis and inspired his Shields Up tool.

Live in Orlando, the familiar Security Now rhythm relaxes into a conference-room back and forth. Steve Gibson is introduced in person at Zero Trust World, and Leo Laporte moves quickly from welcome to talk mode. The title earns its keep. The call is coming from inside the house is a warning about defenses that collapse after a valid connection, not just before one. Authentication comes off as brittle. Steve works through examples of attackers getting past the door, then asks the more uncomfortable question: what can they still reach afterward? That is where the episode gets useful. North Korean hackers come up as fast operators chasing fresh problems, with billions of dollars moving because border defenses still have too many soft spots. Convenience keeps winning. Steve's answer is plain, almost stubbornly so: assume authentication fails, then design the network so that failure hurts less. IP filtering gets the spotlight. He talks through three locations, fixed addresses, and a firewall posture that makes the rest of the internet see a black hole. It is not flashy, which is exactly the point. IP filtering in front of sensitive systems can cover ground that usernames and passwords no longer cover by themselves. Leo brings it home with his story about repeated Chinese login attempts and an SSH server on port 22. Obscurity gets a careful shrug. Nobody treats obscure ports as a security theory, but reducing noisy automated contact still has some value. The live ending turns warm, circling back to the show's longevity, episode 1,068, the old worry about stopping at 999, and selfies before the cocktail party.

As heard by us

Steve Gibson argues for assuming authentication can fail, then tightening the network so attackers have less room to move.

The Call Is Coming From Inside the House is Security Now in conference mode: Steve Gibson and Leo Laporte are live at Zero Trust World in Orlando, working from one blunt premise. Assume authentication fails, then ask what an attacker can do next.

Read the full review in PlayNext →

Why you'd press play

Your login screen is not the last line of defense -- Steve Gibson explains why it never was.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Security Now (Audio)