Foursquare buys Placed from Snap Inc. on the heels of $150M in new funding

/0 Comments/in /by

Foursquare just made its first acquisition. The location tech company has acquired Placed from Snap Inc. on the heels of a fresh $150 million investment led by The Raine Group. The terms of the deal were not disclosed. Placed founder and CEO David Shim will become president of Foursquare.

Placed is the biggest competitor to Foursquare’s Attribution product, which allows brands to track the physical impact (foot traffic to store) of a digital campaign or ad. Up until now, Placed and Attribution by Foursquare combined have measured more than $3 billion in ad-to-store visits.

Placed launched in 2011 and raised $13.4 million (according to Crunchbase) before being acquired by Snap Inc. in 2017.

As part of the deal with Foursquare, the company’s Attribution product will henceforth be known as Placed powered by Foursquare. The acquisition also means that Placed powered by Foursquare will have more than 450 measureable media partners, including Twitter, Snap, Pandora and Waze. Moreover, more than 50% of the Fortune 100 are partnered with Placed or Foursquare.

It’s also worth noting that this latest investment of $150 million is the biggest financing round for Foursquare ever, and comes following a $33 million Series F last year.

Here’s what Foursquare CEO Jeff Glueck had to say about the financing in a prepared statement:

This is one of the largest investments ever in the location tech space. The investment will fund our acquisition and also capitalize us for our increased R&D and expansion plans, allowing us to focus on our mission to build the world’s most trusted, independent location technology platform.

That last bit, about an independent location technology platform, is important here. Foursquare is 10 years old and has transformed from a consumer-facing location check-in app — a game, really — into a location analytics and development platform.

Indeed, when Glueck paints his vision for the company, he lists five key areas of focus:

  1. Developer Tools to build smarter apps and customer engagement, using geo-context;
  2. Analytics, including consumer insights for planning;
  3. Audiences, so businesses can reach the right consumer segments for their message;
  4. Attribution, to test and learn which messages, segments and channels work best;
  5. Consumer, where through our own apps and Foursquare Labs’ R&D efforts we showcase what’s possible and inspire developers via our innovations around contextual location.

You’ll notice that its consumer apps, Foursquare and Swarm, are at the bottom of the list. But that’s because Foursquare’s real technological and strategic advantage isn’t in building the best social platform. In fact, Glueck said that more than 90% of the company’s revenue came from the enterprise side of the business. Foursquare’s advantage is in the accuracy of its technology, as afforded by the decade of data that has come from Foursquare, Swarm and the users who have expressly verified their location.

The Pilgrim SDK fits into that top item on the list: developer tools. The Pilgrim SDK allows developers to embed location-smart experiences and notifications into their apps and services. But it also expands Foursquare’s access to data from beyond its own apps to the greater ecosystem, yielding the data it needs to power analytics tools for brands and publishers.

With this acquisition, Placed will be able to leverage Foursquare’s existing map of 105 million places of interest across 190 countries, as well as tap into the measured U.S. audience of more than 100 million monthly devices:

Foursquare and Placed share a similar philosophy of building against a truth set of real consumer responses. Getting real people to confirm the name of their location is the only way to know if your technology is accurate or not. Placed has leveraged over 135 million survey responses in its first-party Placed survey apps, all from consumers opted-in to its rewards app. Foursquare expands the truth set for machine learning exponentially by adding in our over 13 billion consumer confirmations.

The hope is that Foursquare is accurate enough to become the de facto location analytics and services company for measuring ad spend. With enough scale, that may allow the company to break into the walled gardens where most of that ad spend is going: Facebook and Google.

Of course, to win as the “world’s most trusted, independent location technology platform,” consumers have to trust the platform. After all, one’s location may be the most sensitive piece of data about them. Foursquare has taken steps to be clear about what its technology is capable of. In fact, at SXSW this year, Foursquare offered a limited run of a product called Hypertrending, which was essentially an anonymized view of real-time location data showing activity in the Austin area.

Here’s what executive chairman and co-founder Dennis Crowley had to say at the time:

We feel the general trend with internet and technology companies these days has been to keep giving users a more and more personalized (albeit opaquely personalized) view of the world, while the companies that create these feeds keep the broad “God View” to themselves. Hypertrending is one example of how we can take Foursquare’s aggregate view of the world and make it available to the users who make it what it is. This is what we mean when we talk about “transparency” – we want to be honest, in public, about what our technology can do, how it works, and the specific design decisions we made in creating it.

With regards to today’s acquisition of Placed, Jeff Glueck had this to say:

Both companies also share a commitment to privacy and consumers being in control. Our Foursquare credo of “data as a privilege” only deepens as our company expands. We believe location should only be shared when consumers can see real value and visible benefits driven by location. We remain dedicated to elevating the industry through respect for transparency, user control, and instituting layers of privacy safeguards.

This new financing brings Foursquare’s total funding to $390.4 million.

Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors

/0 Comments/in /by

Canadian government regulators are using the country’s powerful new anti-spam law to pursue hefty fines of up to a million dollars against Canadian citizens suspected of helping to spread malicious software.

In March 2019, the Canadian Radio-television and Telecommunications Commission (CRTC) — Canada’s equivalent of the U.S. Federal Communications Commission (FCC), executed a search warrant in tandem with the Royal Canadian Mounted Police (RCMP) at the home of a Toronto software developer behind the Orcus RAT, a product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015.

The CRTC was flexing relatively new administrative muscles gained from the passage of Canada’s Anti-Spam Legislation (CASL), which covers far more than just junk email. Section 7 of CASL deals with the alteration of transmission data, including botnet activity. Section 8 involves the surreptitious installation of computer programs on computers or networks including malware and spyware.

And Section 9 prohibits an individual or organization from aiding, inducing, procuring or causing to be procured the doing of any of the above acts.

CRTC Director Neil Barratt said this allows his agency to target intermediaries who, through their actions or through inaction, facilitate the commission of CASL violations. Businesses found to be in violation of CASL can be fined up to $10 million; individuals can face up to a $1 million fine.

“We’re dealing with a lower burden of proof than a criminal conviction, and CASL gives us a little more leeway to get bad actors off our networks in Canada and to ultimately improve security for people here and hopefully elsewhere,” Barratt said in an interview with KrebsOnSecurity.

“CASL defines spam as commercial electronic messages without consent or the installation of software without consent or the intercepting of electronic messages,” Barratt said. “The installation of software is under Section 8, and this is one of the first major investigations under that statute.”

Barratt added that the CRTC also was counting on CASL to help tidy up the reputation of the Canadian Web hosting industry.

“We’ve been trying to make sure that service providers operating in Canada — whether or not they are Canadian — are not unduly contributing to the infection of machines and hosting malware,” Barratt said. “We have great power in CASL and Section 9 makes it a violation to aid in the doing of a violation. And this extends quite broadly, across email service providers and various intermediaries.”

The enforcement division of the CRTC recently took action against two companies — Datablocks Inc. and Sunlight Media Network Inc — for having violated CASL section 9 by disseminating online ads that caused malicious computer programs to be downloaded onto the computers of unsuspecting victims.

Under CASL, and for the purposes of verifying compliance or determining whether any of sections 6 to 9 were violated, the CRTC may compel individuals and organizations to provide any information in their possession or control, and ask a justice of the peace to issue a warrant authorizing entry into a place of residence.

It’s good to see a civil anti-spam law being used to go after people involved in selling malware couched as legitimate software, as seems to be the case with the Orcus RAT investigation. A relatively competent remote access trojan author can earn a tidy income selling their wares, but CASL may give Canadians interested in this line of a work a reason to reconsider if the end result is a million dollar fine.

More to the point, Canada (anecdotally at least) seems to have far more than its fair share of computer criminals, and yet unfortunately far less appetite than many other western countries for prosecuting those individuals criminally. In this regard, CASL offers a welcome alternative.

“One of the key takeaways of CASL was that it wasn’t just about emails that were annoying people, but also the use of email as a vector to mislead or defraud people and cause harm to computers and computer networks,” Barratt said. “Our parliamentarians decided to ensure the legislature covered a broad ambit. The search warrant executed in this case was a great example of criminal and civil law enforcement working together by using our unique tools and powers under the act to achieve the greatest good we could.”

NY Investigates Exposure of 885 Million Mortgage Documents

/0 Comments/in /by

New York regulators are investigating a weakness that exposed 885 million mortgage records at First American Financial Corp. [NYSE:FAF] as the first test of the state’s strict new cybersecurity regulation. That measure, which went into effect in March 2019 and is considered among the toughest in the nation, requires financial companies to regularly audit and report on how they protect sensitive data, and provides for fines in cases where violations were reckless or willful.

On May 24, KrebsOnSecurity broke the news that First American had just fixed a weakness in its Web site that exposed approximately 885 million documents — many of them with Social Security and bank account numbers — going back at least 16 years. No authentication was needed to access the digitized records.

On May 29, The New York Times reported that the inquiry by New York’s Department of Financial Services is likely to be followed by other investigations from regulators and law enforcement.

First American says it has hired a third-party security firm to investigate, and that it shut down external access to the records.

The Times says few people outside the real estate industry are familiar with First American, but millions have entrusted their data to the company when they go to close the deal on buying or selling a new home.

“First American provides title insurance and settlement services for property sales, which typically require buyers to hand over extensive financial records to other parties in their transactions,” wrote Stacy Cowley. “The company is one of the largest insurers in the United States, handling around one in every four transactions, according to the American Land Title Association.”

News also emerged this week that First American is now the target of a class action lawsuit alleging the Fortune 500 mortgage industry giant “failed to implement even rudimentary security measures.”

How Hackers Use Social Media To Profile Targets

/0 Comments/in /by

As cybercrime is all about monetary gain, attackers know that the more intelligence they gather about their targets the easier it is to achieve a compromise. On the other hand, most people voluntarily share large amounts of personal information on social networks without fully appreciating the risks. In this post, we’ll find out how hackers use social media to profile targets and how you can protect yourself and your business.

How Hackers Use Social Media To Profile Targets

What is Social Media Profiling?

Social media is all about sharing, whether it’s photos from the latest conference, overseas holiday or an important life event, or just trivia about your daily routines, the name of your pet cat, favourite soccer team or TV show; it’s all data that has value to someone. That someone may be a company that wants to sell you a new brand of cat food or an advertisement for a new season of that great TV drama, or it may be cybercriminals engaged in a spear-phishing campaign. The truth is that data from social media is a prime commodity, and that truth holds for hackers and threat actors just as much as legitimate marketeers.

Social media profiling, building a composite of a person’s identity and lifestyle from publicly available information, is just the latest trick in the cybercriminal’s armoury.

Mining social media for clues about people and their interests is a technique widely used by governments, businesses, and now threat actors. It is part and parcel of today’s reality of interconnectedness. Just as a marketing department may employ legitimate techniques to identify audiences that will be receptive to their brand message, attackers can use the same methods to identify likely targets, too.

So what kind of information can be gleaned from social media profiling? That all depends on how much you share. If you share a detailed CV or resumé online, that’s gold dust to profilers. If you likewise share information about special events, names of family members, places you’re visiting and such like on social media, that can add up to quite a detailed composite picture of you, your lifestyle and your background, particularly if that data is harvested over an extended period of time.

If you’re trying to use social media to market yourself, the advice on how to do that effectively is also going to make you easy to profile. For example, using the same handle across social media platforms makes you easy to find. If you’re jane-marie-smith on Facebook and you’re @jane-marie-smith on Twitter and Skype, then it’s a good guess that your email is jane-marie-smith@gmail, jane-marie-smith@icloud.com and so on.

Similarly, it’s good for personal brand marketing to include a profile picture that’s a headshot, but that picture also identifies you to bad actors, and provides them with a picture they can scrape and use to impersonate you. With AI tech that can now generate entire bodies of people that don’t exist, using an algorithm trained on tens of thousands of online photos, that may be more convincing than you might realise.

Marketing gurus also suggest that you share a narrative about your bio, including achievements and interests, and give advice such as this:

“if this is a business-related profile, you’ll want most everything to be public…don’t forget to interlink your profiles to each other. Many networks have places to include links to other networks, and you can and should use them whenever possible”

Making it easy for the good guys also makes it easy for the bad guys.

How Can Threat Actors Exploit Social Media?

Social media profiling was big news last year, when it emerged that Facebook had allowed a private company, Cambridge Analytica, to harvest data such as location, birth date, page likes and public profiles from tens of millions of users without their consent. A recent TED talk by a British journalist brought to light just how that information could be used to encourage a person in a particular location to make a certain electoral choice.

For criminals looking to steal either data and/or money, the very same kind of profiling can be used to craft targeted advertisements and phishing emails that can carry malware to infect the user’s machine. The techniques are identical; only the “payload” differs.

Sites like LinkedIn encourage users to be comprehensive in the details they provide as that can help in job recruitment, but that can also lead criminals to victims under the seeming pretext of offering employment. Such was the modus operandi of one hacker group, allegedly Lazarus APT, that infiltrated Redbanc, the ATM consortium for Chilean banks. A LinkedIn advertisement for a software developer turned out to be a front for the hacker group. They interviewed an employee of Redbanc over Skype and convinced him to open a malicious PDF that was supposedly an application form. The resulting breach in December 2018 went undisclosed until the following month.

It’s not just “business” sites where you have to think about what you share. What about online gaming communities? Millions of people play and chat within MMORPG game environments, and statistics suggest that only around 26% of them are teens. The rest are adults (average age: 26), employed (50%), married (36%) and have children (22%). But those percentages aren’t the point. The fact that those percentages can be gathered though, is. How much data are you giving away to online gaming providers and how secure is their handling of your data? When even the “big boys” like Sony get hacked, there’s every reason to believe that smaller outfits with large amounts of valuable data on millions of users are also likely to be targeted by threat actors.

How Can I Avoid Social Media Profiling?

There are several steps you can take to protect yourself and your business. Let’s start with the common sense ones.

First, you should be treating all solicitous contacts with a dose of healthy scepticism. Verify claims of acquaintance from people you have not met, and consider whether details included in unsolicited correspondence are details that you’ve made publicly available. Caution is your number one defense, and conversely, a lack of it the main reason why phishing and spear-phishing attacks are successful. That’s because despite all the attacker’s hard work, the success of a phishing or spear-phishing campaign depends on one crucial factor: the intended victim’s cooperation. Therefore, even when you have been profiled by threat actors, you are still in control.

Second, ensure your company has in place protections against malicious Office and PDF documents, such as with a modern ActiveEDR security solution, and be sure to report any suspicious phishing activity to your IT or security department.

Third, review the information you are sharing on social media. Do you really need to give away all those details on LinkedIn? Perhaps you could still make yourself attractive to potential employers without giving away quite so much detail. You can always offer further details upon request, and of course verify contacts that actually do make those requests.

Finally, learn a lesson from the developer who was duped over Skype and from these unwitting system administrators: don’t run programs provided by others. If you must open a file from an unknown source, check it with a reputable security software solution first; better still, use an automated security solution that will autonomously block and quarantine files that try to execute suspicious code.

Conclusion

Sharing on social media has the great advantage of helping us to connect with others, whether it’s for business or personal reasons, with all the benefits that that can bring: new friends, new jobs, new experiences. Unfortunately, there’s always the possibility of bad actors lurking who will use that information for their own gain.

It’s important to remember that prior to the advent of the modern wired world, we were all reasonably careful about our personal information. We didn’t go around sharing details like our birth dates, jobs, and favourite animals with just anyone, and certainly not with just about everyone, as we do now via the internet. That was because prior to the advent of the connected world, we all implicitly understood the boundary between what was personal and what was public. Social media has broken that boundary down, but therein lies the danger. When it comes to cybersecurity, boundaries – and caution – are essential elements of defense.

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Fintech and clean tech? An odd couple or a perfect marriage?

/0 Comments/in /by

The Valley’s rocky history with clean tech investing has been well-documented.

Startups focused on non-emitting generation resources were once lauded as the next big cash cow, but the sector’s hype quickly got away from reality.

Complex underlying science, severe capital intensity, slow-moving customers, and high-cost business models outside the comfort zones of typical venture capital, ultimately caused a swath of venture-backed companies and investors in the clean tech boom to fall flat.

Yet, decarbonization and sustainability are issues that only seem to grow more dire and more galvanizing for founders and investors by the day, and more company builders are searching for new ways to promote environmental resilience.

While funding for clean tech startups can be hard to find nowadays, over time we’ve seen clean tech startups shift down the stack away from hardware-focused generation plays towards vertical-focused downstream software.

A far cry from past waves of venture-backed energy startups, the downstream clean tech companies offered more familiar technology with more familiar business models, geared towards more recognizable verticals and end users. Now, investors from less traditional clean tech backgrounds are coming out of the woodworks to take a swing at the energy space.

An emerging group of non-traditional investors getting involved in the clean energy space are those traditionally focused on fintech, such as New York and Europe based venture firm Anthemis — a financial services-focused team that recently sat down with our fintech contributor Gregg Schoenberg and I (check out the full meat of the conversation on Extra Crunch).

The tie between clean tech startups and fintech investors may seem tenuous at first thought. However, financial services has long played a significant role in the energy sector and is now becoming a more common end customer for energy startups focused on operations, management and analytics platforms, thus creating real opportunity for fintech investors to offer differentiated value.

Finance powering the world?

Though the conversation around energy resources and decarbonization often focuses on politics, a significant portion of decisions made in the energy generation business is driven by pure economics — Is it cheaper to run X resource relative to resources Y and Z at a given point in time? Based on bid prices for Request for Proposals (RFPs) in a specific market and the cost-competitiveness of certain resources, will a developer be able to hit their targeted rate of return if they build, buy or operate a certain type of generation asset?

Alternative generation sources like wind, solid oxide fuel cells, or large-scale or even rooftop solar have reached more competitive cost levels – in many parts of the US, wind and solar are in fact often the cheapest form of generation for power providers to run.

Thus as renewable resources have grown more cost competitive, more, infrastructure developers, and other new entrants have been emptying their wallets to buy up or build renewable assets like large scale solar or wind farms, with the American Council on Renewable Energy even forecasting cumulative private investment in renewable energy possibly reaching up to $1 trillion in the US by 2030.

A major and swelling set of renewable energy sources are now led by financial types looking for tools and platforms to better understand the operating and financial performance of their assets, in order to better maximize their return profile in an increasingly competitive marketplace.

Therefore, fintech-focused venture firms with financial service pedigrees, like Anthemis, now find themselves in pole position when it comes to understanding clean tech startup customers, how they make purchase decisions, and what they’re looking for in a product.

In certain cases, fintech firms can even offer significant insight into shaping the efficacy of a product offering. For example, Anthemis portfolio company kWh Analytics provides a risk management and analytics platform for solar investors and operators that helps break down production, financial analysis, and portfolio performance.

For platforms like kWh analytics, fintech-focused firms can better understand the value proposition offered and help platforms understand how their technology can mechanically influence rates of return or otherwise.

The financial service customers for clean energy-related platforms extends past just private equity firms. Platforms have been and are being built around energy trading, renewable energy financing (think financing for rooftop solar) or the surrounding insurance market for assets.

When speaking with several of Anthemis’ clean tech portfolio companies, founders emphasized the value of having a fintech investor on board that not only knows the customer in these cases, but that also has a deep understanding of the broader financial ecosystem that surrounds energy assets.

Founders and firms seem to be realizing that various arms of financial services are playing growing roles when it comes to the development and access to clean energy resources.

By offering platforms and surrounding infrastructure that can improve the ease of operations for the growing number of finance-driven operators or can improve the actual financial performance of energy resources, companies can influence the fight for environmental sustainability by accelerating the development and adoption of cleaner resources.

Ultimately, a massive number of energy decisions are made by financial services firms and fintech firms may often times know the customers and products of downstream clean-tech startups more than most.  And while the financial services sector has often been labeled as dirty by some, the vital role it can play in the future of sustainable energy offers the industry a real chance to clean up its image.

The Slack origin story

/0 Comments/in /by

Let’s rewind a decade. It’s 2009. Vancouver, Canada.

Stewart Butterfield, known already for his part in building Flickr, a photo-sharing service acquired by Yahoo in 2005, decided to try his hand — again — at building a game. Flickr had been a failed attempt at a game called Game Neverending followed by a big pivot. This time, Butterfield would make it work.

To make his dreams a reality, he joined forces with Flickr’s original chief software architect Cal Henderson, as well as former Flickr employees Eric Costello and Serguei Mourachov, who like himself, had served some time at Yahoo after the acquisition. Together, they would build Tiny Speck, the company behind an artful, non-combat massively multiplayer online game.

Years later, Butterfield would pull off a pivot more massive than his last. Slack, born from the ashes of his fantastical game, would lead a shift toward online productivity tools that fundamentally change the way people work.

Glitch is born

In mid-2009, former TechCrunch reporter-turned-venture-capitalist M.G. Siegler wrote one of the first stories on Butterfield’s mysterious startup plans.

“So what is Tiny Speck all about?” Siegler wrote. “That is still not entirely clear. The word on the street has been that it’s some kind of new social gaming endeavor, but all they’ll say on the site is ‘we are working on something huge and fun and we need help.’”

Siegler would go on to invest in Slack as a general partner at GV, the venture capital arm of Alphabet .

“Clearly this is a creative project,” Siegler added. “It almost sounds like they’re making an animated movie. As awesome as that would be, with people like Henderson on board, you can bet there’s impressive engineering going on to turn this all into a game of some sort (if that is in fact what this is all about).”

After months of speculation, Tiny Speck unveiled its project: Glitch, an online game set inside the brains of 11 giants. It would be free with in-game purchases available and eventually, a paid subscription for power users.

21 macOS and iOS Twitter Accounts You Should Be Following

/0 Comments/in /by

With Apple’s signature developer event WWDC 2019 just around the corner, it’s a good time to think about your Apple-related Twitter feeds from an IT and security-related perspective. Are you keeping up with all the news that Apple want you to know about and (maybe!) some they don’t, like bugs, vulnerabilities and exploits?

In this post, we offer a curated list of all the best macOS and iOS related Twitter accounts to make sure you don’t miss a thing.

21 macOS and iOS Twitter Accounts You Should Be Following

1. @mjtsai | Michael Tsai

image of michael tsai on twitter

Michael Tsai’s Twitter feed curates news and opinions from across the entire spectrum of Apple-related news, blogs and Twitter feeds and is without doubt the best one-stop source for all things connected to Cupertino’s most famous company. Be sure to follow @mjtsai to keep up with the latest conversations.

2. @daringfireball | John Gruber

image of John Gruber on Twitter

Legendary Apple blogger John Gruber’s Daring Fireball website and Twitter feed are another great place to get all the latest news and retweets about what’s happening in the Apple world. If there is such a thing as a social media “influencer” in the Apple ecosystem, then @daringfireball is certainly it.

3. @clattner_llvm | Chris Lattner

image of Chris Lattner on Twitter

The engineer behind such crucial tools as the LLVM Compiler Infrastructure, an open source umbrella project that includes all sorts of toolchain related technology, and the enormously popular Swift programming language, Chris is heavily involved with developments in machine learning and Swift. Having worked at Apple, Tesla and currently with Google, if you have a bent for the deeply technical, @clattner_llvm is a feed to watch.

4. @patrickwardle | Patrick Wardle

image of patrick wardle on twitter

The multi-talented Patrick Wardle is a developer, researcher, reverse engineer, vblogger, blogger and host of the only Mac-focused security conference, Objective By The Sea. There’s not much that goes on in macOS security that @patrickwardle hasn’t got his eye on.

5. @thomasareed | Thomas Reed

image of thomas reed on twitter

Self-taught security expert responsible for the first widely-used adware removal tool on macOS, Reed is now at MalwareBytes. Always insightful and interested in security issues affecting macOS end users, @thomasareed is a Twitter feed that’s definitely worth watching.

6. @howardnoakley | Howard Oakley

image of howard oakley on twitter

Developer and blogger, Howard tweets about his latest posts that dig into the underbelly of macOS. If you’re interested in learning what the macOS operating system is doing that you can’t see or didn’t expect, @howardnoakley is a busy feed that is always interesting and always informative.

7. @rtrouton | Rich Trouton

image of rich trouton on twitter

Focusing on issues that affect Mac admins, Rich’s feed and blog are always full of fascinating technical insights into the dark corners of macOS, from filevault encryption to mitigating vulnerabilities. If you need to know how it works, @rtrouton probably has the answers.

8. @iamevltwin | Sarah Edwards

image of sarah edwards on twitter

An expert on iOS and macOS forensic analysis and incident response, Sarah’s Twitter account @iamevltwin and blog carry content about the tools, tricks and techniques available on macOS and iOS for revealing hidden databases, caches, logs and more that are of interest to digital forensic scientists.

9. @scriptingosx | Armin Briegel

image of Armin Briegel on twitter

Armin is the author of #scriptingosx, a curated roundup of macOS-related content that’s delivered via the web, email and Twitter. If you’re keen on keeping up to date with the latest in the Mac security and IT worlds, @scriptingosx is a great one to follow.

10. @theJoshMeister | Josh Long

image of Josh Long on twitter

Chief Security Analyst and cybersecurity researcher at Intego, Josh is a frequent public speaker and podcaster. @theJoshMeister is a Twitter feed with an array of content relating to macOS security. And besides, Josh is only a couple of dozen followers shy of 100K. Let’s help him out!

11. @gutterchurl | Erika Noerenberg

image of Eriak Noerenberg on twitter

Senior Threat Researcher with Carbon Black’s Threat Analysis Unit, specializing in digital forensics, malware analysis, and software development, Erika’s retweets and self-described “ramblings through the world of digital forensics research” are fantastically useful tips for the rest of us! Follow @gutterchurl if you want to keep up with the latest in these fields.

12. @OSXreverser | Pedro Vilaca

image of pedro vilaca on twitter

Widely-respected macOS reverse engineer and prolific tweeter, Pedro Vilaca describes himself as a “cyberpsychopath who loves to torture binaries for pleasure”. His content is a mixture of the personal, political and technical. If macOS reverse engineering is your thing, you can’t afford to miss @OSXreverser.

13. @p0sixninja | Joshua Hill

image of Joshua Hill on twitter

You don’t get 165K followers in cybersecurity unless you’ve got something to say, and Joshua’s knowledge and reputation within the iOS jailbreaking community mean that if you are interested in these areas and you’re not following @p0sixninja already, you’re likely one of a very small minority!

14. @ihackbanme | Zuk Avraham

image of zuk avraham on twitter

Among other things, Zuk Avraham is an iOS and macOS vulnerability researcher. Zuk’s a prolific tweeter and retweeter of iPhone and Mac bugs that could impact both personal and enterprise security. Follow @ihackbanme to learn about all the hacks everybody else is missing.

15. @rrcyrus | Richie R. Cyrus

image of richie cyrus on twitter

A former Apple security employee, now Senior Consultant at SpectorOps, Richie also develops the Venator security tool. His interest in incident response, digital and network forensics and security operations make @rrcyrus a valuable resource for anyone in the macOS community.

16. @i0n1c | Stefan Esser

image of Stefan Esser on twitter

Security researcher and founder of antid0te.com, Stefan has a keen interest in macOS and iOS security vulnerabilities, kernel internals and reverse engineering. He’s uncovered several 0-day vulnerabilities in Apple’s code and @i0n1c is always worth keeping an eye on.

17.@Morpheus______ | Jonathan Levin

image of Jon Levin on twitter

Author of macOS and iOS internals books, and widely regarded in the iOS jailbreaking community, @Morpheus______ is an unmissable feed if you’re interested in disassembling Apple’s code and understanding what makes their operating systems tick.

18. @mikeymikey | Mike Lynn

image of mike lynn on twitter

Formerly at Facebook and now with Apple, Mike has a formidable reputation in the Mac admins community as the go-to expert on macOS in the enterprise. A reverse engineer and python enthusiast to boot, @mikeymikey is a Twitter feed packed with useful info.

19. @lapcatsoftware | Jeff Johnson

image of Jeff Johnson on twitter

Developer of macOS software and browser extensions with a focus on privacy, Jeff keeps a close eye on bugs, vulnerabilities and updates to macOS that might be a cause of concern for either the privacy-conscious or for developers. @lapcatsoftware is a Twitter feed for those that want to learn about the secrets of macOS that Apple didn’t want you to know.

20. @qwertyoruiopz | Luca Todesco

image of Luca on twitter

Reverse engineer, crackme writer and iOS jailbreaker, Luca is a multi-talented independent security researcher. Follow the extremely likeable @qwertyoruiopz for insights into the latest hacks, cracks and RCE vulnerabilities in Apple and other products.

21. @_niklasb | Niklas B

image of Nikolas B on twitter

A reverse engineer and “algorithm guy”, Niklas is a hacker “dabbling in vulnerability research”. He specializes in pwning browsers and kernels, and is captain of his own CTF (Capture the Flag) team. @_niklasb is a great feed to learn about new Apple operating system exploits.

Conclusion

All of the accounts in our list are people who are experts in their field, so be sure to follow these 21 great Twitter feeds in order to keep up with all the official and unofficial security and IT-related news about Apple products. Of course, here at SentinelOne we understand the importance of Apple’s platforms, too, which is why we have our own dedicated macOS and iOS research and development teams, so don’t forget to also follow us at @SentinelOne to keep up-to-date with all our latest technical, research and security news affecting Apple enterprise products.

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cybersecurity

FireEye snags security effectiveness testing startup Verodin for $250M

/0 Comments/in /by

When FireEye reported its earnings last month, the outlook was a little light, so the security vendor decided to be proactive and make a big purchase. Today, the company announced it has acquired Verodin for $250 million. The deal closed today.

The startup had raised over $33 million since it opened its doors five years ago, according to Crunchbase data, and would appear to have given investors a decent return. With Verodin, FireEye gets a security validation vendor; that is, a company that can run a review against the existing security setup and find gaps in coverage.

That would seem to be a handy kind of tool to have in your security arsenal, and could possibly explain the price tag. Perhaps it could also help set FireEye apart from the broader market, or fill in a gap in its own platform.

FireEye CEO Kevin Mandia certainly sees the potential of his latest purchase. “Verodin gives us the ability to automate security effectiveness testing using the sophisticated attacks we spend hundreds of thousands of hours responding to, and provides a systematic, quantifiable, and continuous approach to security program validation,” he said in a statement.

Chris Key, Verodin co-founder and chief executive officer, sees the purchase through the standard acquisition lens. “By joining FireEye, Verodin extends its ability to help customers take a proactive approach to understanding and mitigating the unique risks, inefficiencies and vulnerabilities in their environments,” he said in a statement. In other words, as part of a bigger company, we’ll do more faster.

While FireEye plans to incorporate Verodin into its on-prem and managed services, it will continue to sell the solution as a standalone product, as well.

Security giant FireEye’s Q1 earnings in line with expectations, but outlook light

Equalum grabs $18M Series B to help companies ingest data faster

/0 Comments/in /by

Equalum, an Israeli startup that helps companies gather data from a variety of enterprise sources, announced an $18 million Series B investment today.

The round was led by Planven Investments . Other participants included United Ventures and prior investors Innovation Endeavors and GE Ventures, along with a group of unnamed individuals. Today’s haul brings the total raised to $25 million, according to data provided by the company.

Equalum CEO and founder Nir Livneh says his company essentially acts as the data pipes to feed artificial intelligence, machine and more traditional business intelligence requirements. “Equalum is a real-time data ingestion platform. The idea of the platform is to be able to [gather] data coming from a bunch of enterprise system sources and be able to centralize that data and send it in real-time into analytic environments and feed those analytic environments,” Livneh explained.

He sees the money from this round as a way to continue to expand the original vision he had for the company. His approach in many ways is a classic Series B play. “I think the original thesis was validated. We have proven that we can go into Fortune 100 companies and get our solution adopted quickly,” he said. The next step is to expand beyond the original set of several dozen large customers and accelerate growth.

The company was founded in 2015 in Tel Aviv, Israel. It still maintains its R&D arm there today, with sales, marketing and management in Silicon Valley. Interestingly, its first customer was GE, which was also an early investor via GE Ventures.

Livneh says that he sees lots of room to grow in this market, which he says is still dominated by legacy vendors. He believes he can swoop in and replace aging offerings by providing a more modern and streamlined approach to data collection. Time will tell if he is right.

Logz.io lands $52M to keep growing open source-based logging tools

/0 Comments/in /by

Logz.io announced a $52 million Series D investment today. The round was led by General Catalyst.

Other investors participating in the round included OpenView Ventures, 83North, Giza Venture Capital, Vintage Investment Partners, Greenspring Associates and Next47. Today’s investment brings the total raised to nearly $100 million, according to Crunchbase data.

Logz.io is a company built on top of the open source tools Elasticsearch, Logstash, and Kibana (collectively known by the acronym ELK) and Grafana. It’s taking those tools in a typical open source business approach, packaging them up and offering them as a service. This approach enables large organizations to take advantage of these tools without having to deal with the raw open source projects.

The company’s solutions intelligently scan logs looking for anomalies. When it finds them, it surfaces the problem and informs IT or security, depending on the scenario, using a tool like PagerDuty. This area of the market has been dominated in recent years by vendors like Splunk and Sumo Logic, but company founder and CEO Tomer Levy saw a chance to disrupt that space by packaging a set of open source logging tools that were rapidly increasing in popularity. They believed could build on that growing popularity, while solving a pain point the founders had actually experienced in previous positions, which is always a good starting point for a startup idea.

Screenshot: Logz.io

“We saw that the majority of the market is actually using open source. So we said, we want to solve this problem, a problem we have faced in the past and didn’t have a solution. What we’re going to do is we’re going to provide you with an easy-to-use cloud service that is offering an open source compatible solution,” Levy explained. In other words, they wanted to build on that open source idea, but offer it in a form that was easier to consume.

Larry Bohn, who is leading the investment for General Catalyst, says that his firm liked the idea of a company building on top of open source because it provides a built-in community of developers to drive the startup’s growth — and it appears to be working. “The numbers here were staggering in terms of how quickly people were adopting this and how quickly it was growing. It was very clear to us that the company was enjoying great success without much of a commercial orientation,” Bohn explained.

In fact, Logz.io already has 700 customers including large names like Schneider Electric, The Economist and British Airways. The company has 175 employees today, but Levy says they expect to grow that 250 by the end of this year, as they use this money to accelerate their overall growth.