Emissary wants to make sales networking obsolete

There is nothing meritocratic about sales. A startup may have the best product, the best vision, and the most compelling presentation, only to discover that their sales team is talking to the wrong decision-maker or not making the right kind of small talk. Unfortunately, that critical information — that network intelligence — isn’t written down in a book somewhere or on an online forum, but generally is uncovered by extensive networking and gossip.

For David Hammer and his team at Emissary, that is a problem to solve. “I am not sure I want a world where the best networkers win,” he explained to me.

Emissary is a hybrid SaaS marketplace which connects sales teams on one side with people (called emissaries, naturally) who can guide them through the sales process at companies they are familiar with. The best emissaries are generally ex-executives and employees who have recently left the target company, and therefore understand the decision-making processes and the politics of the organization. “Our first mission is pretty simple: there should be an Emissary on every deal out there,” Hammer said.

Expert networks, such as GLG, have been around for years, but have traditionally focused on investors willing to shell out huge dollars to understand a company’s strategic thinking. Emissary’s goal is to be much more democratized, targeting a broader range of both decision-makers and customers. It’s product is designed to be intelligent, encouraging customers to ask for help before a sales process falters. The startup has raised $14 million to date according to Crunchbase, with Canaan leading the last series A round.

While Emissary is certainly a creative startup, its the questions spanning knowledge arbitrage, labor markets, and ethics it poses that I think are most interesting.

Sociologists of science generally distinguish between two forms of knowledge, concepts descended from the work of famed scholar Michael Polanyi. The first is explicit knowledge — the stuff you find in books and on TechCrunch. These are facts and figures — a funding round was this size, or the CEO of a company is this individual. The other form is tacit knowledge. The quintessential example is riding a bike — one has to learn by doing it, and no number of physics or mechanics textbooks are going to help a rider avoid falling down.

While org charts may be explicit knowledge, tacit knowledge is the core of all organizations. It’s the politics, the people, the interests, the culture. There is no handbook on these topics, but anyone who has worked in an organization long enough knows exactly the process for getting something done.

That knowledge is critical and rare, and thus ripe for monetization. That was the original inspiration for Hammer when he set out to build a new startup.“Why does Google ever make a bad decision?” Hammer asked at the time. Here you have the company with the most data in the world and the tools to search through it. “How do they not have the information they need?” The answer is that it has all the explicit knowledge in the world, but none of the implicit knowledge required.

That thinking eventually led into sales, where the information asymmetry between a customer and a salesperson was obvious. “The more I talked to sales people, the more I realized that they needed to understand how their account thinks,” Hammer said. Sales automation tools are great, but what message should someone be sending, and to who? That’s a much harder problem to solve, but ultimately the one that will lead to a signed deal. Hammer eventually realized that there were individuals who could arbitrage their valuable knowledge for a price.

That monetization creates a new labor market for these sorts of consultants. For employees at large companies, they can now leave, take a year off or even retire, and potentially get paid to talk about what they know about an organization. Hammer said that “people are fundamentally looking for ways to be helpful,” and while the pay is certainly a major highlight, a lot of people see an opportunity to just get engaged. Clearly that proposition is attractive, since the platform has more than 10,000 emissaries today.

What makes this market more fascinating long-term though is whether this can transition from a part-time, between-jobs gig into something more long-term and professional. Could people specialize in something like “how does Oracle purchase things,” much as how there is an infrastructure of people who support companies working through the government procurement system?

Hammer demurred a bit on this point, noting that “so much of that is being on the other side of those walls.” It’s not any easier for a potential consultant to learn the decision-making outside of a company than it is for a salesperson. Furthermore, the knowledge of an internal company’s processes degrades, albeit at different rates depending on the organization. Some companies experience rapid change and turnover, while knowledge of other companies may last a decade or more.

All that said, Hammer believes that there will come a tipping point when companies start to recommend emissaries to help salespeople through their own processes. Some companies who are self-aware and acknowledge their convoluted procurement procedures may eventually want salespeople to be advised by people who can smooth the process for all sides.

Obviously, with money and knowledge trading hands, there are significant concerns about ethics. “Ethics have to be at the center of what we do,” Hammer said. “They are not sharing deep confidential information, they’re sharing knowledge about the culture of the organization.” Emissary has put in place procedures to monitor ethics compliance. “Emissaries can not work with competitors at the same time,” he said. Furthermore, emissaries obviously have to have left their companies, so they can’t influence the buying decision itself.

Networking has been the millstone of every salesperson. It’s time consuming, and there is little data on what calls or coffees might improve a sale or not. If you take Emissary’s vision to its asymptote though, all that could potentially be replaced. Under the guidance of people in the know, the fits and starts of sales could be transformed into a smooth process with the right talking points at just the right time. Maybe the best products could win after all.

Hacked Routers Being Used To Spread Malware

Beware of compromised routers spreading malware.  This is according to both Kaspersky Labs and a recently released government report.

Using hacked routers to spread malware is nothing new.  Security insiders have known about it for years. However, since 2008, the number of instances where routers are being used to push malicious code has been steadily increasing. Researchers are observing marked increases in their use by APTs (Advanced Persistent Threat) around the world.

APTs are nothing new either, although their ranks have been growing in recent years.  Many are state-sponsored hacking groups with virtually unlimited resources. Some are simply tight-knit groups of hackers banding together under a single banner.

Many people view hackers as lone wolves and that there are millions of lone wolves hacking networks across the globe.  Increasingly though, these are becoming minor actors on the world stage.  The real threat is now well-organized groups of hackers who can execute highly coordinated globe-spanning attacks and create botnets comprised of tens, or even hundreds of thousands, of compromised computers.

In addition to identifying and calling attention to a little-known attack vector, the recent announcement underscores an important weakness in current cybersecurity thinking.  Most people are still laboring under the faulty assumption that they’re facing individual hackers operating out of a dark room in someone’s basement.

While those types of threats are no doubt present, it’s false to assume that’s where the biggest danger lies.  If you get hacked, it’s just as likely (perhaps even more likely) that you’re actually facing a well-organized group who may have more resources at their disposal than your entire IT department.  While you’re preparing to fight a skirmish, the barbarians are coming to your gates with an army.  Most people are simply planning to fight the wrong type of battle, and that could prove to be a devastating mistake.

Used with permission from Article Aggregator

Microsoft makes managing and updating Windows 10 easier for its business users

With the Windows 10 April 2018 Update, Microsoft is launching a number of new features for its desktop operating system today. Most of those apply to all users, but in addition to all the regular feature updates, the company also today announced a couple of new features and tools specifically designed for its business users with Microsoft 365 subscriptions that combine a license for Windows 10 with an Office 365 subscription and device management tools.

According to Brad Anderson, Microsoft’s corporate VP for its enterprise and mobility services, the overall thinking behind all of these new features is make it easier for businesses to give their employees access to a “modern desktop.” In Microsoft’s parlance, that’s basically a desktop that’s part of a Microsoft 365 subscription. But in many ways, this so much about the employees but the IT departments that support them. For them, these updates will likely simplify their day-to-day lives.

The most headline-grabbing feature of today’s update is probably the addition of an S-mode to Windows 10. As the name implies, this allows admins to switch a Windows 10 Enterprise device into the more restricted and secure Windows 10 S mode, where users can only install applications from a centrally managed Microsoft Store. Until now, the only way to do this was to buy a Windows 10 S device, but now, admins can automatically configure any device that run Windows 10 Enterprise to go into S mode.

It’s no secret that Windows 10 S as a stand-alone operating system wasn’t exactly a hit (and launching itat an education-focused event with the Surface Laptop probably didn’t help). The overall idea is sound, though, and probably quite attractive to many an IT department.

“We built S mode as a way to enable IT to ensure what’s installed on a device,” Anderson told me. “It’s the most secure way to provision Windows.”

The main surprise here is actually that S mode is already available now, since it was only in March that Microsoft’s Joe Belfiore said that it would launch next year.

Another part of this update is what Microsoft calls ‘delivery optimization” for updates. With this, a single device can download an update and the distribute it to other Windows 10 devices over the local network. Downloads take a while and eat up a lot of bandwidth, after all. And to monitor those deployments, the Windows Analytics dashboard now includes a tab for keeping tabs on them.

Another new deployment feature Microsoft is launching today is an improvement to the AutoPilot service. AutoPilot allows IT to distribute laptops to employees without first setting them up to a company’s specifications. Once a user logs in, the system will check what needs to be done and then applies those settings, provisions policies and installs apps as necessary. With this update, AutoPilot now includes an enrollment status page that does all of this before the user ever gets to the desktop. That way, users can’t get in the way of the set-up process and IT knows that everything is up to spec.

A number of PC vendors are now also supporting AutoPilot out of the box, including Lenovo and Dell, with HP, Toshiba and Fujitsu planning to launch their AutoPilot-enabled PCs later this year.

To manage all of this, Microsoft is also launching a new Microsoft 365 admin center today that brings all the previously disparate configurations and monitoring tools of Office 365 and Microsoft 365 under a single roof.

One other aspect of this launch is an addition to Microsoft 365 for firstline workers. Windows 10 in S mode is one part of this, but the company is also updating the Office mobile apps licensing terms to add the company’s iOS and Android apps to the Office 365 E1, F1 and Business Essential licenses. For now, though, only access to Outlook for iOS and Android is available under these licenses. Support for Word, PowerPoint, Excel and OneNote will launch in the next few months.

DocuSign closes up 38% and Smartsheet 30% in their debuts on Nasdaq and NYSE

It was a big day for enterprise tech IPOs, which have been on a roll in 2018. Today, not one but two enterprise tech companies, DocuSign and Smartsheet, saw their share prices pop as they made their debuts on to the public markets, trends that continued throughout the day.

At the close of the markets New York time, DocuSign closed at $39.96, up nearly 38 percent from its IPO price of $29 and giving the company a market cap of $6 billion. Smartsheet closed at $19.50, up 30 percent from its initial price of $15 and giving it a market cap of $1.9 billion.

Smartsheet was first out of the gates. Trading on NYSE under the ticker SMAR, the company clocked an opening price of $18.40. This represented a pop of 22.7 percent on its IPO pricing of $15 yesterday evening — itself a higher figure than the expected range of $12-$14. Smartsheet, whose primary product is a workplace collaboration and project management platform (it competes with the likes of Basecamp, Wrike and Asana), raised $150 million in its IPO and is currently trading around $18.30/share. Its price went as high as $19.70 in trading today and never dipped below $18.06.

Later in the day, DocuSign — which facilitates e-signatures and other features to speed up contractural negotiations online, competing against the likes of AdobeSign and HelloSign — started to trade, and it saw an even bigger pop. Trading on Nasdaq under DOCU, the stock opened at $37.75, which worked out to a jump of 30 percent on its IPO price last night of $29. Like Smartsheet, DocuSign had priced its IPO higher than the expected range of $26-$28, raising $629 million in the process. In all, it went as high as $40.89 in trading today.

In the case of both companies, they are coming to the market with net losses on their balance sheets, but evidence of strong revenue growth. And in a period that seems to be a generally strong market for IPOs at the moment, combined with the generally positive climate for cloud-based enterprise services (with both Microsoft and Amazon crediting their cloud businesses for their own strong earnings), that rising tide appears to be lifting these two boats.

Rohit Kulkarni, MD and head of research at brokerage firm SharesPost notes that this bodes very well for more IPOs this year of so-called “unicorns” — startups valued at more than $1 billion that might have in past years been very strong candidates for IPOs, but have in more recent years been more likely to sit an raise privately, averting potentially less receptive public markets and taking advantage of the vast amounts of funding available via VC, private equity houses and other private channels.

But he believes that generally we’re now seeing a swing to more sober and less exuberant IPOs. “This doesn’t mean companies will go no faster to an IPO now,” he added. “They will still have a long gestation of seven to 10 years, and, when they do go public, they will be stronger and more mature, with a clear pathway to profitability, which will help them thrive.”

In terms of trends, the proliferation of enterprise cloud companies that we’ve seen in the world of startups is going to translate into yet more enterprise cloud IPOs. “We expect more enterprise cloud companies to public this year,” he said. “Trends in the past 16 months have been lopsided, with Cloud and Enterprise software companies accounting for 75% of public unicorns. Clearly, these companies are the backbone of the private tech growth asset category.”

DocuSign underscores that trend. The company reported $518.5 million in revenue for its fiscal year ending in 2018 in its IPO filings, up from $381.5 million last year and $250.5 million in 2016. Losses were $52.3 million, but that figure was halved over 2017, when it posted a net loss of $115.4 million. DocuSign’s customers include T-Mobile, Salesforce, Morgan Stanley and Bank of America.

Smartsheet, meanwhile, reported a strong 3.6 million users in its IPO filings, with business customers including Cisco and Starbucks. The company brought in $111.3 million in revenue for its fiscal 2018 year, but as with many SaaS companies, it’s going public with a loss. Specifically in 2018 it reported a loss of $49.1 million for 2018, up from a net loss of $15.2 million and $14.3 million in 2017 and 2016 respectively.

And as for those highly capitalised startups who are staying private for now, their valuations continue to ratchet up, he added. “This year, we have tracked just one down-round IPO, whereas there were eight such down-round IPOs in 2017,” said Kulkarni. “Plus, more than 50% of the VC-backed companies going public this year have raised their IPO pricing range at least once. Clearly, a sign of healthy appetite for such companies among public investors.”

Other strong enterprise tech public offerings this year have included Dropbox, Zscaler, Cardlytics, Zuora and Pivotal. All of them closed above their opening prices, in what is shaping up to be a huge year for tech IPOs overall.

DocuSign CEO: ‘we’re becoming a verb,’ company up 37% following public debut

DocuSign CEO Dan Springer was all smiles at the Nasdaq on Friday, following the company’s public debut.

And he had a lot to be happy about. After pricing the IPO at a better-than-expected $29, the company raised $629 million. Then DocuSign finished its first day of trading at $39.73, up 37% in its debut.

Springer, who took over DocuSign just last year, spoke with TechCrunch in a video interview about the direction of the company. “We’ve figured out a way to help businesses really transform the way they operate,” he said about document-signing business. The goal is to “make their life more simple.”

But when asked about the competitive landscape which includes Adobe Sign and HelloSign, Springer was confident that DocuSign is well-positioned to remain the market leader. “We’re becoming a verb,” he said. Springer believes that DocuSign has convinced large enterprises that it is the most secure platform.

Yet the IPO was a long-time coming. The company was formed in 2003 and raised over $500 million over the years from Sigma Partners, Ignition Partners, Frazier Technology Partners, Bain Capital Ventures and Kleiner Perkins, amongst others. It is not uncommon for a venture-backed company to take a decade to go public, but 15 years is atypical, for those that ever reach this coveted milestone.

Dell Technologies Capital president Scott Darling, who sits on the board of DocuSign, said that now was the time to go public because he believes the company “is well positioned to continue aggressively pursuing the $25 billion e-signature market and further revolutionizing how business agreements are handled in the digital age.”

Sales are growing, but it is not yet profitable. DocuSign brought in $518.5 million in revenue for its fiscal year ending in 2018. This is an increase from $381.5 million last year and $250.5 million the year before. Losses for this year were $52.3 million, reduced from $115.4 million last year and, $122.6 million for 2016.

Springer says DocuSign won’t be in the red for much longer. The company is “on that fantastic path to GAAP profitability.” He believes that international expansion is a big opportunity for growth.

Google Wants Children Watching YouTube Kids App

More often than not, Google is seen as a force for good on the internet. However, in one area in particular, their actions and words haven’t been in alignment, and it’s gotten them in trouble.

Here’s Google’s official statement about their YouTube Kids service:

“Protecting kids and families has always been a top priority for us.  Because YouTube is not for children, we’ve invested significantly in the creation of the YouTube Kids app to offer an alternative specifically designed for children.”

That statement is true as far as it goes, but there’s an important catch.  The YouTube Kids app is frustratingly difficult to get.  You can’t install it on your Xbox.  Most smart TV’s on the market today don’t support it, and you can’t put it on a PC.  Aside from a few models of LG and Sony smart TVs, and smartphones, it’s just not an option.

Contrast that with the regular YouTube app, which has been rolled out to just about every platform there is, and it’s easy to see where Google’s primary focus is.

It’s not hard to understand the reasoning behind the difference in availability.  One of the key differences between YouTube and YouTube Kids is that the latter doesn’t have targeted advertising, while the former does. Google makes a lot of money on YouTube ads.  It’s simple economics.

Unfortunately, it’s also gotten the company into hot water.  They’ve had complaints from more than 20 consumer advocacy groups, who have banded together and taken their case to the FTC.

In part, the complaint reads as follows:

“Google has made substantial profits from the collection and use of personal data from children on YouTube.  Its illegal collection has been going on for many years and involves tens of millions of US children.”

Ultimately, what the advocacy groups want is for Google to move all kid-centric content over to YouTube kids. However, the company would be extremely reluctant to do that because their kid-friendly app has such limited availability.

This is a thorny issue with no easy answers, and at this point, it’s unclear how Google is going to respond to the complaint.

Used with permission from Article Aggregator

IBM introduces a blockchain to verify the jewelry supply chain

Every time I talk to someone about the viability of blockchain, I get challenged to show a real project beyond the obvious bitcoin use case. IBM has been working to build large enterprise projects blockchain and today they offered an irrefutable example that they have dubbed TrustChain, a blockchain that proves the provenance of jewelry by following the supply chain from mine to store.

As you might expect the TrustChain is built on IBM blockchain technology and includes a consortium of companies involved in every step of the supply chain: Asahi Refining, the precious metals refiner; Helzberg Diamonds, a U.S. jewelry retailer; LeachGarner, a precious metals supplier and The Richline Group, a global jewelry manufacturer. It even includes some third-party verification with UL Labs for the skeptical among you.

“What we are announcing and bringing forward has been in the works for some time. It’s the first end-to-end industry capability on blockchain that has its core in trust,” Jason Kelley, the GM of blockchain services at IBM told TechCrunch.

While there are trust mechanisms in place to ensure the authenticity of jewelry, they tend to be more piecemeal and this one is designed to be more comprehensive. One of the primary benefits of using blockchain in this instance is that it’s so much more efficient. Instead shuffling paper, the process becomes much more digital and reduces a lot (although not all) of the manual paper-pushing along the way.

Photo: IBM

Of course, just because it’s on the blockchain doesn’t mean there won’t be attempts to circumvent the system, but the TrustChain has a mechanism for participants to check the validity of each transaction, each step of the way. “If there is a dispute, instead of calling and following back through the process in a more manual way, you can click on a trusted chain, and you’re able to see what happened immediately. That reduces the number of steps in the process, and speeds up what has been a paper-laden and manual effort,” Kelley explained.

He fully recognizes the hype surrounding blockchain and that it’s the latest shiny tech thing, but he says if you set aside the name, the capability is really what’s important here. “Now we can share this [data] in a permissioned network and we can be sure it’s accurate,” he said.

The notion of the permissioned blockchain is an important one here. It means that you have to be allowed on the blockchain to participate, and everyone on the blockchain has to agree to let any members on. “That’s what exciting with TrustChain. Each point in the supply chain has bought into the consortium,” he said.

He acknowledges that errors could be introduced in any system, whether intentional or not, but he says the beauty of this system is that blockchain is a team sport and many, many eyeballs are acting as a check for each step along the way. If a problem is found, it can be fixed through the same level of consensus.

Blockchain network Photo: Zapp2Photo

Kelley says this level of trust is increasingly essential because consumers are demanding transparency in the jewelry they buy. They want to be sure the diamond or precious metal in the jewelry was not mined by exploited labor and in a sustainable way. Research has found consumers are willing to pay more for such proof.

By next year, you could be able to pull out your smart phone, scan a QR code on the diamond you want to by and see a visual of the entire supply chain right on your smartphone. Kelley such an interface is in the works for the consumer side.

The blockchain is clearly still in early days, and it can’t solve every problem, but systems like this could help prove that there are actual viable scalable use cases for it.

Dropbox rolls out a templates tool for its Paper online document service

As Dropbox looks to woo larger and larger businesses with its strategy of building simpler collaboration tools than what’s on the market, it’s making some moves in its online document tool Paper to further reduce that friction today.

Dropbox said it was rolling out a new tool for Dropbox Paper that allows users to get a paper document up and running through a set of templates. It may seem like something that would be table stakes for a company looking to create an online document tool like Google Docs, but figuring out what Paper’s core use cases look like can take a lot of thinking and user research before finally pulling the trigger. Dropbox at its heart hopes to have a consumer feel for its products, so preserving that as it looks to build more robust tools presents a bigger challenge for the freshly-public company.

The templates tool behaves pretty much like other tools out there: you open Dropbox Paper, and you’ll get the option to create a document from a number of templates. Some common use cases for Dropbox Paper include continuous product development timelines and design specs, but it seems the company hopes to broaden that by continuing to integrate new features like document previews. Dropbox Paper started off as a blank slate, but given the number of options out there, it has to figure out a way to differentiate itself eventually.

The company said it’s also rolling out a number of other small features. That includes a way to pin documents, launch presentations, format text and insert docs and stickers. There’s also a new meeting widget and increased formatting options in the comments section in Paper. Finally, it’s adding a number of small quality-of-life updates like viewing recent Paper docs by alphabetical order and the ability to unsubscribe to comment notifications and archive docs on iOS, as well as aggregating to-do lists across docs.

Dropbox went public earlier this year to dramatic success, immediately getting that desired “pop” and more or less holding it throughout the past month or so as one of the first blockbuster IPOs of 2018. There have been a wave that have followed since, including DocuSign, and it’s one of a batch of several enterprise companies looking to get out the door now that it appears the window is open for investor demand for fresh IPOs.

Paper, to that end, appears to be a key piece of the puzzle for Dropbox. The company has always sought to be a company centered around simple collaboration tools, coming from its roots as a consumer company to start. It’s an approach that has served it — and others, like Slack — well as the company looks to expand more and more into larger enterprises. While it’s been able to snap up users thanks to its simpler approach, those enterprise deals are always more lucrative and serve as a stronger business line for Dropbox.

Dropbox will have to continue to not only differentiate itself from Google Docs and other tools, but also an emerging class of startups that’s looking to figure out ways to snap up some of the core use cases of online document tools. Slite, for example, hopes to capture the internal wiki and note-taking portion of an online doc system like Google Docs. That startup raised $4.4 million earlier this month. There’s also Coda, a startup that’s looking to rethink what a document looks altogether, which raised $60 million. Templates are one way of reducing that friction and keeping it feeling like a simple document tool and hopefully getting larger businesses excited about its products.

DocuSign raises $629 million after pricing IPO

DocuSign priced its IPO Thursday evening at $29 per share, netting the company $629 million.

It was a better price than the e-signature company had been expecting. The initially proposed price range was $24 to $26 and then that was raised to $26 to $28.

The price gives the company a valuation of $4.4 billion on the eve of its public debut, above the $3 billion the company had raised for its last private round.

The IPO has been a long-time coming. Founded in 2003, DocuSign had raised over $500 million over the course of 15 years.

The company brought in $518.5 million in revenue for its fiscal year ending in 2018. This is up from $381.5 million last year and $250.5 million the year before. Losses for this year were $52.3 million, down from $115.4 million last year and, $122.6 million for 2016.

“We have a history of operating losses and may not achieve or sustain profitability in the future,” the company warned in the requisite “risk factors” section of the prospectus.

The filing reveals that Sigma Partners is the largest shareholder, owning 12.9% of the company. Ignition Partners owns 11.7% and Frazier Technology Ventures owns 7.2%.

DocuSign, competes HelloSign and Adobe Sign, among others, but has managed to sign up many of the largest enterprises. T-Mobile, Salesforce, Morgan Stanley and Bank of America are amongst its clients. It has a tiered business model, with companies paying more for added services.

HelloSign COO Whitney Bouck said that “this space is changing the way business is done at its foundation — we are finally realizing the future of digital business and exactly how much more profitable it can be by removing the friction caused by outdated technology and processes.” But she said that DocuSign should be wary of competitive “more nimble vendors that can provide more innovative, faster, and more user-friendly solutions at a cheaper price.”

DocuSign has gone through several management changes over the years.  Dan Springer took over as CEO in early 2017, after running Responsys, which went public and then was later bought by Oracle for $1.5 billion. Chairman Keith Krach had been running the company since 2011. He was previously CEO of Ariba, which was acquired by SAP for $4.3 billion.

Ransomware Mitigation – SentinelOne’s Rollback Demo in RSAC 2018

Like every year, RSAC was a magnificent show. We had a lot of people attending the SentinelOne booth who wanted to get more familiar with our solution. We had four demo stations in the booth, in which we demonstrated real-world use-cases where SentinelOne solution is truly valuable. One of the demos was really a jaw dropper. We demonstrated detection of ransomware and a rollback to a previously known healthy state of the operating system. Several booth visitors, who experienced successful ransomware attacks (some resulted in paying the ransom, others with data loss) were enthusiastic about what they have just seen.

In this post, we will review the demo environment and the set of public tools that we used to establish it. A short video clip is brought at the end, demonstrating the attack flow and the rollback mitigation.

The demo consists of two VMs which are set-up to show a typical Metasploit browser exploit attack.

Attacker VM

This is a simple Kali Linux machine which is set to automatically start the Browser Autopwn 2, an auxiliary module that is provided by Metasploit. The idea behind this module is that it creates a web server which serves different types of exploits for Firefox, Internet Explorer, Adobe Flash, and more. Using “Browser Autopwn 2”, one can easily test browser vulnerabilities. By default, “Browser Autopwn 2” is delivered with 21 exploits. When a browser connects to the web server, the module tries several exploits until it finds a vulnerability. In our demo, the Victim VM is vulnerable to adobe_flash_avm. This exploit, from 2014, exploits a vulnerability in Adobe Flash Player ActiveX component, which results in a remote code execution. This is admittedly an old exploit, and many systems are now patched, but this type of attack is still common.

Once the exploit succeeds, it downloads a TeslaCrypt payload and runs it on the victim machine. TeslaCrypt was detected in February 2015. Originally, it targeted computer game data such as games saves, player profiles, etc. Newer variants of TeslaCrypt were not focused on game-related data and also encrypted JPEG, PDF, and other file types. In our demo, all images residing on the victim machine get encrypted.

Victim VM

This machine runs Internet Explorer with vulnerable version of Shockwave Flash (CVE 2014-0497). When the user browses to the Attacker VM, the “Browser AutoPwn 2” module finds the suitable exploit for the browser, sends the ransomware payload, and executes it. The ransomware then encrypts the images and leaves a ransom note on the screen.

Demo

In this demo we set the policy to Detect/Detect, which means that the agent only detects threats or suspicious behavior (instead of blocking). The reason for that is to let the ransomware encrypt the images, so we can demonstrate the rollback capability. Our recommendation is to set the policy to Protect/Detect, which means that threats such as the ones presented in this demo, will be blocked before something bad happens. Therefore, the rollback option will be used only in rare use-cases as another layer of protection.

Want to see more of these?  To evaluate the SentinelOne Endpoint Protection Platform for yourself, please send us an email at sales@sentinelone.com or use our Request a Demo form and we’d be happy to show you why we are the top-rated endpoint solution in the industry.

 

 

The post Ransomware Mitigation – SentinelOne’s Rollback Demo in RSAC 2018 appeared first on SentinelOne.