DataRobot expands platform and announces Zepl acquisition

DataRobot, the Boston-based automated machine learning startup, had a bushel of announcements this morning as it expanded its platform to give technical and nontechnical users alike something new. It also announced it has acquired Zepl, giving it an advanced development environment where data scientists can bring their own code to DataRobot. The two companies did not share the acquisition price.

Nenshad Bardoliwalla, SVP of Product at DataRobot says that his company aspires to be the leader in this market and it believes the path to doing that is appealing to a broad spectrum of user requirements, from those who have little data science understanding to those who can do their own machine learning coding in Python and R.

“While people love automation, they also want it to be [flexible]. They don’t want just automation, but then you can’t do anything with it. They also want the ability to turn the knobs and pull the levers,” Bardoliwalla explained.

To resolve that problem, rather than building a coding environment from scratch, it chose to buy Zepl and incorporate its coding notebook into the platform in a new tool called Composable ML. “With Composable ML and with the Zepl acquisition, we are now providing a really first-class environment for people who want to code,” he said.

Zepl was founded in 2016 and raised $13 million along the way, according to Crunchbase data. The company didn’t want to reveal the number of employees or the purchase price, but the acquisition gives it advanced capabilities, especially a notebook environment to call its own to attract those more advanced users to the platform. The company plans to incorporate the Zepl functionality into the platform, while also leaving the standalone product in place.

Bardoliwalla said that they see the Zepl acquisition as an extension of the automated side of the house, where these tools can work in conjunction with one another with machines and humans working together to generate the best models. “This [generates an] organic mixture of the best of what a system can generate using DataRobot AutoML and the best of what human beings can do and kind of trying to compose those together into something really interesting […],” Bardoliwalla said.

The company is also introducing a no-code AI app builder that enables nontechnical users to create apps from the data set with drag and drop components. In addition, it’s adding a tool to monitor the accuracy of the model over time. Sometimes, after a model is in production for a time, the accuracy can begin to break down as the data on which the model is based is no longer valid. This tool monitors the model data for accuracy and warns the team when it’s starting to fall out of compliance.

Finally, the company is announcing a model bias monitoring tool to help root out model bias that could introduce racist, sexist or other assumptions into the model. To avoid this, the company has built a tool to identify when it sees this happening both in the model-building phase and in production. It warns the team of potential bias, while providing them with suggestions to tweak the model to remove it.

DataRobot is based in Boston and was founded in 2012. It has raised more than $750 million and has a valuation of over $2.8 billion, according to PitchBook.

Cycode raises $20M to secure DevOps pipelines

Israeli security startup Cycode, which specializes in helping enterprises secure their DevOps pipelines and prevent code tampering, today announced that it has raised a $20 million Series A funding round led by Insight Partners. Seed investor YL Ventures also participated in this round, which brings the total funding in the company to $24.6 million.

Cycode’s focus was squarely on securing source code in its early days, but thanks to the advent of infrastructure as code (IaC), policies as code and similar processes, it has expanded its scope. In this context, it’s worth noting that Cycode’s tools are language and use case agnostic. To its tools, code is code.

“This ‘everything as code’ notion creates an opportunity because the code repositories, they become a single source of truth of what the operation should look like and how everything should function, Cycode CTO and co-founder Ronen Slavin told me. “So if we look at that and we understand it — the next phase is to verify this is indeed what’s happening, and then whenever something deviates from it, it’s probably something that you should look at and investigate.”

Cycode Dashboard

Cycode Dashboard. Image Credits: Cycode

The company’s service already provides the tools for managing code governance, leak detection, secret detection and access management. Recently it added its features for securing code that defines a business’ infrastructure; looking ahead, the team plans to add features like drift detection, integrity monitoring and alert prioritization.

“Cycode is here to protect the entire CI/CD pipeline — the development infrastructure — from end to end, from code to cloud,” Cycode CEO and co-founder Lior Levy told me.

“If we look at the landscape today, we can say that existing solutions in the market are kind of siloed, just like the DevOps stages used to be,” Levy explained. “They don’t really see the bigger picture, they don’t look at the pipeline from a holistic perspective. Essentially, this is causing them to generate thousands of alerts, which amplifies the problem even further, because not only don’t you get a holistic view, but also the noise level that comes from those thousands of alerts causes a lot of valuable time to get wasted on chasing down some irrelevant issues.”

What Cycode wants to do then is to break down these silos and integrate the relevant data from across a company’s CI/CD infrastructure, starting with the source code itself, which ideally allows the company to anticipate issues early on in the software life cycle. To do so, Cycode can pull in data from services like GitHub, GitLab, Bitbucket and Jenkins (among others) and scan it for security issues. Later this year, the company plans to integrate data from third-party security tools like Snyk and Checkmarx as well.

“The problem of protecting CI/CD tools like GitHub, Jenkins and AWS is a gap for virtually every enterprise,” said Jon Rosenbaum, principal at Insight Partners, who will join Cycode’s board of directors. “Cycode secures CI/CD pipelines in an elegant, developer-centric manner. This positions the company to be a leader within the new breed of application security companies — those that are rapidly expanding the market with solutions which secure every release without sacrificing velocity.”

The company plans to use the new funding to accelerate its R&D efforts, and expand its sales and marketing teams. Levy and Slavin expect that the company will grow to about 65 employees this year, spread between the development team in Israel and its sales and marketing operations in the U.S.

SightCall raises $42M for its AR-based visual assistance platform

Long before COVID-19 precipitated “digital transformation” across the world of work, customer services and support was built to run online and virtually. Yet it too is undergoing an evolution supercharged by technology.

Today, a startup called SightCall, which has built an augmented reality platform to help field service teams, the companies they work for, and their customers carry out technical and mechanical maintenance or repairs more effectively, is announcing $42 million in funding, money that it plans to use to invest in its tech stack with more artificial intelligence tools and expanding its client base.

The core of its service, explained CEO and co-founder Thomas Cottereau, is AR technology (which comes embedded in their apps or the service apps its customers use, with integrations into other standard software used in customer service environments including Microsoft, SAP, Salesforce and ServiceNow). The augmented reality experience overlays additional information, pointers and other tools over the video stream.

This is used by, say, field service engineers coordinating with central offices when servicing equipment; or by manufacturers to provide better assistance to customers in emergencies or situations where something is not working but might be repaired quicker by the customers themselves rather than engineers that have to be called out; or indeed by call centers, aided by AI, to diagnose whatever the problem might be. It’s a big leap ahead for scenarios that previously relied on work orders, hastily drawn diagrams, instruction manuals and voice-based descriptions to progress the work in question.

“We like to say that we break the barriers that exist between a field service organization and its customer,” Cottereau said.

The tech, meanwhile, is unique to SightCall, built over years and designed to be used by way of a basic smartphone, and over even a basic mobile network — essential in cases where reception is bad or the locations are remote. (More on how it works below.)

Originally founded in Paris, France before relocating to San Francisco, SightCall has already built up a sizable business across a pretty wide range of verticals, including insurance, telecoms, transportation, telehealth, manufacturing, utilities and life sciences/medical devices.

SightCall has some 200 big-name enterprise customers on its books, including the likes of Kraft-Heinz, Allianz, GE Healthcare and Lincoln Motor Company, providing services on a B2B basis as well as for teams that are out in the field working for consumer customers, too. After seeing 100% year-over-year growth in annual recurring revenue in 2019 and 2020, SightCall’s CEO says it’s looking like it will hit that rate this year as well, with a goal of $100 million in annual recurring revenue.

The funding is being led by InfraVia, a European private equity firm, with Bpifrance also participating. The valuation of this round is not being disclosed, but I should point out that an investor told me that PitchBook’s estimate of $122 million post-money is not accurate (we’re still digging on this and will update as and when we learn more).

For some further context on this investment, InfraVia invests in a number of industrial businesses, alongside investments in tech companies building services related to them such as recent investments in Jobandtalent, so this is in part a strategic investment. SightCall has raised $67 million to date.

There has been an interesting wave of startups emerging in recent years building out the tech stack used by people working in the front lines and in the field, a shift after years of knowledge workers getting most of the attention from startups building a new generation of apps.

Workiz and Jobber are building platforms for small business tradespeople to book jobs and manage them once they’re on the books; BigChange helps manage bigger fleets; and Hover has built a platform for builders to be able to assess and estimate costs for work by using AI to analyze images captured by their or their would-be customers’ smartphone cameras.

And there is Streem, which I discovered is a close enough competitor to SightCall that they’ve acquired AdWords ads based on SightCall searches in Google. Just ahead of the COVID-19 pandemic breaking wide open, General Catalyst-backed Streem was acquired by Frontdoor to help with the latter’s efforts to build out its home services business, another sign of how all of this is leaping ahead.

What’s interesting in part about SightCall and sets it apart is its technology. Co-founded in 2007 by Cottereau and Antoine Vervoort (currently SVP of product and engineering), the two are long-time telecoms industry vets who had both worked on the technical side of building next-generation networks.

SightCall started life as a company called Weemo that built video chat services that could run on WebRTC-based frameworks, which emerged at a time when we were seeing a wider effort to bring more rich media services into mobile web and SMS apps. For consumers and to a large extent businesses, mobile phone apps that work “over the top” (distributed not by your mobile network carrier but the companies that run your phone’s operating system, and thus partly controlled by them) really took the lead and continue to dominate the market for messaging and innovations in messaging.

After a time, Weemo pivoted and renamed itself as SightCall, focusing on packaging the tech that it built into whichever app (native or mobile web) where one of its enterprise customers wanted the tech to live.

The key to how it works comes by way of how SightCall was built, Cottereau explained. The company has spent 10 years building and optimizing a network across data centers close to where its customers are, which interconnects with Tier 1 telecoms carriers and has a lot of latency in the system to ensure uptime. “We work with companies where this connectivity is mission critical,” he said. “The video solution has to work.”

As he describes it, the hybrid system SightCall has built incorporates its own IP that works both with telecoms hardware and software, resulting in a video service that provides 10 different ways for streaming video and a system that automatically chooses the best in a particular environment, based on where you are, so that even if mobile data or broadband reception don’t work, video streaming will. “Telecoms and software are still very separate worlds,” Cottereau said. “They still don’t speak the same language, and so that is part of our secret sauce, a global roaming mechanism.”

The tech that the startup has built to date not only has given it a firm grounding against others who might be looking to build in this space, but has led to strong traction with customers. The next steps will be to continue building out that technology to tap deeper into the automation that is being adopted across the industries that already use SightCall’s technology.

“SightCall pioneered the market for AR-powered visual assistance, and they’re in the best position to drive the digital transformation of remote service,” said Alban Wyniecki, partner at InfraVia Capital Partners, in a statement. “As a global leader, they can now expand their capabilities, making their interactions more intelligent and also bringing more automation to help humans work at their best.”

“SightCall’s $42M Series B marks the largest funding round yet in this sector, and SightCall emerges as the undisputed leader in capital, R&D resources and partnerships with leading technology companies enabling its solutions to be embedded into complex enterprise IT,” added Antoine Izsak of Bpifrance. “Businesses are looking for solutions like SightCall to enable customer-centricity at a greater scale while augmenting technicians with knowledge and expertise that unlocks efficiencies and drives continuous performance and profit.”

Cottereau said that the company has had a number of acquisition offers over the years — not a surprise when you consider the foundational technology it has built for how to architect video networks across different carriers and data centers that work even in the most unreliable of network environments.

“We want to stay independent, though,” he said. “I see a huge market here, and I want us to continue the story and lead it. Plus, I can see a way where we can stay independent and continue to work with everyone.”

SaaS companies can grow to $20M+ ARR by selling exclusively to developers

With more than 200,000 customers, a market cap of nearly $56 billion, and the recent acquisition of Segment for $3.2 billion, Twilio is a SaaS behemoth.

It’s hard to imagine companies like Twilio as anything but a giant. But everybody starts out small, and you can usually trace success back to key decisions made in the early days.

First, you need to have a product that developers can actually sign up for. This means ditching demos for real-time free trials or freemium tools.

For Twilio, a big differentiator was being one of the first technology-focused SaaS organizations that focused on empowering and building for the end user (which in their case is developers) with a self-service function. Another differentiator was, the executive team designed the organization to create tight feedback loops between sales and product with national roadshows, during which CEO Jeff Lawson frequently met with users.

Moreover, Twilio’s “secret sauce” per their S-1 is a developer-focused model and a strong belief in the future of software. They encourage developers to explore and innovate with Twilio’s flexible offering, which led to an incredible 155% net-dollar expansion rate at the time of the IPO.

Most importantly, Twilio put the product in the hands of teams before the sale happened, standing by to answer hard questions about how Twilio would fit into their infrastructure. This was pretty rare at the time — sales engineering resources aren’t cheap — and it was a strong differentiating factor. So much so that when the company went public, they were growing at 106% annually.

Twilio sells to developers at large enterprises by solving a problem that developers come up against regularly: Getting in touch with customers.

But as more successful public software companies emerge, it’s clear that Twilio’s secret sauce can and will be replicated.

Why traditional marketing doesn’t work on developers

Before I started looking at successful developer-focused businesses, I understood the developer-focused playbook to look a little like this:
  1. Don’t hire marketing (or sales, either). If you do, hire someone super experienced from an enterprise sales background. And then fire them within three to six months.
  2. Just hire someone who’s passionate about the product to “manage the community.” What is community management? Lots of swag. Cool meetups. Publish 1–2 articles as a stab at content (bonus points if they’re listicles). Oh, wait. How can we show the ROI here? Make the community manager do that until she quits. Repeat.

Jamf snags zero trust security startup Wandera for $400M

Jamf, the enterprise Apple device management company, announced that it was acquiring Wandera, a zero trust security startup, for $400 million at the market close today. Today’s purchase is the largest in the company’s history.

Jamf provides IT at large organizations with a set of management services for Apple devices. It is the leader in the market, and snagging Wandera provides a missing modern security layer for the platform.

Jamf CEO Dean Hager says that Wandera’s zero trust approach fills in an important piece in the Jamf platform tool set. “The combination of Wandera and Jamf will provide our customers a single source platform that handles deployment, application lifecycle management, policies, filtering and security capabilities across all Apple devices while delivering zero trust network access for all mobile workers,” Hager said in a statement.

Zero trust, as the name implies, is an approach to security where you don’t trust anybody regardless of whether they are inside or outside your network. It requires that you force everyone to provide multiple forms of authentication to prove their identity before they can access company resources.

The need for a zero trust approach became even more acute during the pandemic when employees  have often been working from home and have needed access to applications and other company resources from wherever they happened to be, a trend that was happening even prior to COVID, and is likely to continue after it ends.

Wandera, which is based in London, was founded in 2012 by brothers Roy and Eldar Tuvey, who had previously co-founded another security startup called ScanSafe. Cisco acquired that company, which helped protect web gateways as a service for $183 million back in 2009. The brothers raised over $53 million along the way for Wandera. Investors included Bessemer Venture Partners, 83North and Sapphire Ventures.

Sapphire co-founder and managing director Andreas Weiskam had this to say about the deal: “[Wandera] created a unique security product which addresses mobile threats by leveraging the increasingly important zero trust network. By joining the Jamf family, the two will help shape the future of the zero trust cloud. And it goes without saying that this is a big win for the customers, especially for those in the Apple ecosystem.”

Jamf now has access to all of that technology and everything else the company has developed since. Under the terms of the deal, Jamf is paying Wandera $350 million in cash, then paying them two $25 million payments on October 1, 2021 and December 15, 2021. The deal is expected to close in the third quarter assuming it passes regulatory scrutiny.

 

A Closer Look at the DarkSide Ransomware Gang

The FBI confirmed this week that a relatively new ransomware group known as DarkSide is responsible for an attack that caused Colonial Pipeline to shut down 5,550 miles of pipe, stranding countless barrels of gasoline, diesel and jet fuel on the Gulf Coast. Here’s a closer look at the DarkSide cybercrime gang, as seen through their negotiations with a recent U.S. victim that earns $15 billion in annual revenue.

Colonial Pipeline has shut down 5,500 miles of fuel pipe in response to a ransomware incident. Image: colpipe.com

New York City-based cyber intelligence firm Flashpoint said its analysts assess with a moderate-strong degree of confidence that the attack was not intended to damage national infrastructure and was simply associated with a target which had the finances to support a large payment.

“This would be consistent with DarkSide’s earlier activities, which included several ‘big game hunting’ attacks, whereby attackers target an organization that likely possesses the financial means to pay the ransom demanded by the attackers,” Flashpoint observed.

In response to public attention to the Colonial Pipeline attack, the DarkSide group sought to play down fears about widespread infrastructure attacks going forward.

“We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives [sic],” reads an update to the DarkSide Leaks blog. “Our goal is to make money, and not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”

First surfacing on Russian language hacking forums in August 2020, DarkSide is a ransomware-as-a-service platform that vetted cybercriminals can use to infect companies with ransomware and carry out negotiations and payments with victims. DarkSide says it targets only big companies, and forbids affiliates from dropping ransomware on organizations in several industries, including healthcare, funeral services, education, public sector and non-profits.

Like other ransomware platforms, DarkSide adheres to the current badguy best practice of double extortion, which involves demanding separate sums for both a digital key needed to unlock any files and servers, and a separate ransom in exchange for a promise to destroy any data stolen from the victim.

At its launch, DarkSide sought to woo affiliates from competing ransomware programs by advertising a victim data leak site that gets “stable visits and media coverage,” as well as the ability to publish victim data by stages. Under the “Why choose us?” heading of the ransomware program thread, the admin answers:

An advertisement for the DarkSide ransomware group.

“High trust level of our targets. They pay us and know that they’re going to receive decryption tools. They also know that we download data. A lot of data. That’s why the percent of our victims who pay the ransom is so high and it takes so little time to negotiate.”

In late March, DarkSide introduced a “call service” innovation that was integrated into the affiliate’s management panel, which enabled the affiliates to arrange calls pressuring victims into paying ransoms directly from the management panel.

In mid-April the ransomware program announced new capability for affiliates to launch distributed denial-of-service (DDoS) attacks against targets whenever added pressure is needed during ransom negotiations.

DarkSide also has advertised a willingness to sell information about upcoming victims before their stolen information is published on the DarkSide victim shaming blog, so that enterprising investment scammers can short the company’s stock in advance of the news.

“Now our team and partners encrypt many companies that are trading on NASDAQ and other stock exchanges,” DarkSide explains. “If the company refuses to pay, we are ready to provide information before the publication, so that it would be possible to earn in the reduction price of shares. Write to us in ‘Contact Us’ and we will provide you with detailed information.”

DarkSide also started recruiting new affiliates again last month — mainly seeking network penetration testers who can help turn a single compromised computer into a full-on data breach and ransomware incident.

Portions of a DarkSide recruitment message, translated from Russian. Image: Intel 471.

“We have grown significantly in terms of the client base and in comparison to other projects (judging by the analysis of publicly available information), so we are ready to grow our team and a number of our affiliates in two fields,” DarkSide explained. The advertisement continued:

“Network penetration testing. We’re looking for one person or a team. We’ll adapt you to the work environment and provide work. High profit cuts, ability to target networks that you can’t handle on your own. New experience and stable income. When you use our product and the ransom is paid, we guarantee fair distribution of the funds. A panel for monitoring results for your target. We only accept networks where you intend to run our payload.”

DarkSide has shown itself to be fairly ruthless with victim companies that have deep pockets, but they can be reasoned with. Cybersecurity intelligence firm Intel 471 observed a negotiation between the DarkSide crew and a $15 billion U.S. victim company that was hit with a $30 million ransom demand in January 2021, and in this incident the victim’s efforts at negotiating a lower payment ultimately reduce the ransom demand by almost two-thirds.

The DarkSide ransomware note.

The first exchange between DarkSide and the victim involved the usual back-and-forth establishing of trust, wherein the victim asks for assurances that stolen data will be deleted after payment.

Image: Intel 471.

When the victim counter-offered to pay just $2.25 million, DarkSide responded with a lengthy, derisive reply, ultimately agreeing to lower the ransom demand to $28.7 million.

“The timer it [sic] ticking and in in next 8 hours your price tag will go up to $60 million,” the crooks replied. “So, you this are your options first take our generous offer and pay to us $28,750 million US or invest some monies in quantum computing to expedite a decryption process.”

Image: Intel 471.

The victim complains that negotiations haven’t moved the price much, but DarkSide countered that the company can easily afford the payout. “I don’t think so,” they wrote. “You aren’t poor and aren’t children if you f*cked up you have to meet the consequences.”

Image: Intel 471.

The victim firm replies a day later saying they’ve gotten authority to pay $4.75 million, and their tormentors agree to lower the demand significantly to $12 million.

Image: Intel 471.

The victim replies that this is still a huge amount, and it tries to secure additional assurances from the ransomware group if it agrees to pay the $12 million, such as an agreement not to target the company ever again, or give anyone access to its stolen data. The victim also tried to get the attackers to hand over a decryption key before paying the full ransom demand.

Image: Intel 471.

The crime gang responded that its own rules prohibit it from giving away a decryption key before full payment is made, but they agree to the rest of the terms.

Image: Intel 471.

The victim firm agrees to pay an $11 million ransom, and their extortionists concur and promise not to attack or help anyone else attack the company’s network going forward.

Image: Intel 471

Flashpoint assesses that at least some of the criminals behind DarkSide hail from another ransomware outfit called “REvil,” a.k.a. “Sodinokibi” (although Flashpoint rates this finding at only “moderate” confidence). REvil is widely considered to be the newer name for GandCrab, a ransomware-as-a-service offering that closed up shop in 2019 after bragging that it had extorted more than $2 billion.

Experts say ransomware attacks will continue to grow in sophistication, frequency and cost unless something is done to disrupt the ability of crooks to get paid for such crimes. According to a report late last year from Coveware, the average ransomware payment in the third quarter of 2020 was $233,817, up 31 percent from the second quarter of last year. Security firm Emsisoft found that almost 2,400 U.S.-based governments, healthcare facilities and schools were victims of ransomware in 2020.

Last month, a group of tech industry heavyweights lent their imprimatur to a task force that delivered an 81-page report to the Biden administration on ways to stymie the ransomware industry. Among many other recommendations, the report urged the White House to make finding, frustrating and apprehending ransomware crooks a priority within the U.S. intelligence community, and to designate the current scourge of digital extortion as a national security threat.

Further reading: Intel 471’s take on the Colonial Pipeline attack.

Microsoft Patch Tuesday, May 2021 Edition

Microsoft today released fixes to plug at least 55 security holes in its Windows operating systems and other software. Four of these weaknesses can be exploited by malware and malcontents to seize complete, remote control over vulnerable systems without any help from users. On deck this month are patches to quash a wormable flaw, a creepy wireless bug, and yet another reason to call for the death of Microsoft’s Internet Explorer (IE) web browser.

While May brings about half the normal volume of updates from Microsoft, there are some notable weaknesses that deserve prompt attention, particularly from enterprises. By all accounts, the most pressing priority this month is CVE-2021-31166, a Windows 10 and Windows Server flaw which allows an unauthenticated attacker to remotely execute malicious code at the operating system level. With this weakness, an attacker could compromise a host simply by sending it a specially-crafted packet of data.

“That makes this bug wormable, with even Microsoft calling that out in their write-up,” said Dustin Childs, with Trend Micro’s ZDI program. “Before you pass this aside, Windows 10 can also be configured as a web server, so it is impacted as well. Definitely put this on the top of your test-and-deploy list.”

Kevin Breen from Immersive Labs said the fact that this one is just 0.2 points away from a perfect 10 CVSS score should be enough to identify just how important it is to patch.

“For ransomware operators, this kind of vulnerability is a prime target for exploitation,” Breen said. “Wormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it’s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.”

Breen also called attention to CVE-2021-26419 — a vulnerability in Internet Explorer 11 — to make the case for why IE needs to stand for “Internet Exploder.” To trigger this vulnerability, a user would have to visit a site that is controlled by the attacker, although Microsoft also recognizes that it could be triggered by embedding ActiveX controls in Office Documents.

“IE needs to die – and I’m not the only one that thinks so,” Breen said. “If you are an organization that has to provide IE11 to support legacy applications, consider enforcing a policy on the users that restricts the domains that can be accessed by IE11 to only those legacy applications. All other web browsing should be performed with a supported browser.”

Another curious bug fixed this month is CVE-2020-24587, described as a “Windows Wireless Networking Information Disclosure Vulnerability.” ZDI’s Childs said this one has the potential to be pretty damaging.

“This patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system,” he said. “It’s not clear what the range on such an attack would be, but you should assume some proximity is needed. You’ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.”

Microsoft also patched four more security holes its Exchange Server corporate email platform, which recently was besieged by attacks on four other zero-day Exchange flaws that resulted in hundreds of thousands of servers worldwide getting hacked. One of the bugs is credited to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server vulnerability that was patched in an out-of-band release back in March.

Researcher Orange Tsai commenting that nobody guessed the remote zero-day he reported on Jan. 5, 2021 to Microsoft was in Exchange Server.

“While none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible,” said Satnam Narang, staff research engineer at Tenable.

As always, it’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor.

But before you update, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.

So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.

And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide.

If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.

How To Be The Superhero Who Protects Your Schools From Cyber Attacks 

Your schools have a bullseye on them, and bad guys are taking their shots. The global education sector has seen a 20% increase in cyber-attacks as criminals exploit newly implemented virtual learning environments. Threats range from nuisance adware to severe malware like trojans and backdoors, but the most common, by far, is ransomware. Recent data suggests that the education sector has been the most affected by the current rise of ransomware attacks across all business sectors.

Why Are Schools Attractive Targets For Hackers?

Schools have become enticing targets for attackers because they store personal information on students and teachers, and security updates often aren’t installed on remote devices that have been loaned out for remote learning.

Furthermore, students and teachers are frequent victims of phishing scams. They typically use simple passwords across multiple services, making them susceptible to credential harvesting and password-spraying attacks.

Devices loaned out for remote learning also connect to other networks with regularity, giving the hacker access to those systems. For instance, when students connect with their home networks, they’re opening the door for hackers to enter and steal private data such as bank account numbers and sensitive documents.

When hackers infiltrate your devices with ransomware or wiper ware, they lock them up so they can’t be used for learning. Suddenly, the capacity to simply teach students is held hostage to hackers.

Preventing Cyber Attacks On Education

Preventing these attacks can be difficult because schools have so many different devices. During the COVID-19 pandemic, many of those devices have been loaned out to teachers and students, so maintaining control over them is difficult. IT teams in education typically have limited staff and lack the visibility they need into the institution’s attack surface, including cloud-based technologies and remote endpoints, to adequately protect them against threats like ransomware.

But in some educational institutions, these challenges are being met and defeated. Like a comic-book superhero who fights off the bad guy before the villain has a chance to steal the money, SentinelOne can defeat intruders before they hijack your devices. SentinelOne enables your school to automatically detect and manage devices as they join your network, with no hardware or network changes, and extends protection and control to cloud-based assets and applications running on them.

That’s why Lenovo pre-enables SentinelOne on its best-in-class laptops, desktops, and Chromebooks, so that you can ensure a seamless and engaging experience for students whether they’re learning face-to-face or remotely.

Visibility Into Your Entire IT Surface

SentinelOne is the only cybersecurity solution encompassing AI-powered prevention, detection, response, and hunting across endpoints and cloud workloads in a single autonomous platform. It gives your IT team full transparency into everything happening across the network at machine speed so that you can defeat every attack at every stage of the threat lifecycle.

By autonomously detecting and responding to attacks, SentinelOne eases the burden on under-resourced school IT teams, leaving staff to focus their attention on the most severe and impactful security issues.

The source of a ransomware attack may likely be contained in an infected file sent via email. In such cases, SentinelOne’s endpoint detection and response (EDR) system identifies the file as soon as it tries to install itself on the endpoint, disables it, and deletes it from all endpoints across the school system.

If an attacker successfully infiltrates a device, SentinelOne can rollback the device to a healthy state, including decrypting encrypted files.

The SentinelOne Singularity security platform includes:

  • Singularity Core, the entry-level endpoint security product for schools that want to replace their antivirus solution with an endpoint protection platform that is more effective and easier to manage.
  • Singularity Control is for schools that want the additional “security suite” features for endpoint management.
  • Singularity Complete is for schools that need modern endpoint protection and control plus advanced EDR features.
  • Singularity Ranger adds network visibility and control for IoT devices, including those currently unmanaged, and Singularity Cloud provides automated application control for cloud-based workloads.

That’s just a hint of Singularity’s capabilities. Request a demo to experience this robust solution.

Heroic Defense Awaits

Getting this endpoint protection technology for attack surface visibility and control of your Lenovo devices is simple: the platform is integrated into Lenovo’s ThinkShield end-to-end security portfolio.

ThinkShield offers automated and intelligent solutions to help device administrators and end-users secure data against cyber-attacks. SentinelOne strengthens that protection to superhero levels. To learn more about how SentinelOne and Lenovo can help protect your schools, click here.

For the non-Lenovo devices in your institution, you can still take advantage of all the benefits of the SentinelOne platform discussed above. Contact us for more information or request a demo.


Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Blind raises $37M to double down on workplace gossip and career advice

Blind has carved out a unique niche in the social-networking world. It’s an app of verified, pseudonymous employees talking to each other about what’s going on at their employers, trading notes on everything from layoffs, to promotions, to policies. Part LinkedIn, part Reddit, part Slack — it’s become widely popular among tech workers at Silicon Valley companies, and even outside the tech industry, with 5 million verified users.

Workplaces have changed dramatically post-COVID-19, with remote work becoming more of a norm, and that has made Blind indispensable for many workers who feel increasingly alienated from their companies and their colleagues.

The company announced this morning a $37 million Series C funding round led by South Korean venture firm Mainstreet Investment along with Cisco Investments and Pavilion Capital, a subsidiary of Singapore sovereign wealth fund Temasek. The company had filed a Form D in late March for roughly $20.5 million, and the $37 million represents the final total fundraised.

We last did a deep dive in the company back in 2018, so what’s changed? Well, first, there’s the pandemic. Co-founder and general manager Kyum Kim says that Blind’s users are now coming to the app all throughout the day. “Usage used to peak during the commute times,” he said. “8-10 a.m. before COVID and then after work, 7 a.m.-10 p.m. was another timeframe that people used to use Blind a lot. But now, it has kind of flattened out [throughout the day].” The new peak is 2 p.m., and, according to Kim, users are logging in 30 times per month over about 13-15 days.

This gets to the first of two areas where Blind is experimenting with revenue generation. As remote work has taken hold, particularly at tech companies, internal messaging channels have become less valuable as sources for clear information from executive leadership. Blind believes it has a better pulse on how employees are feeling about policies and their employers, and is building tools around, for example, pulse surveys to give HR teams better insight than they might get from other services.

“People are just more honest on our platform versus these company-sponsored channels,” Kim said. We’re “probably the only platform where people are coming voluntarily, have visibility into their intentions, how they feel about their company’s policies.” Blind wants to protect the identities of its users, while also offering aggregate insights to companies.

To that end, last week the company brought on Young Yuk as chief product officer. Yuk had been an advisor to Blind for the past four years, while daylighting in senior product roles at Intuit, Yelp and Glassdoor. Kim believes that Yuk’s experience across consumer and enterprise will fit the unique needs of Blind’s business, which combines a consumer social network with B2B products.

For its own users though, the second area of attention is perhaps the most interesting: recruiting. Blind users are obsessed with career paths and compensation, and Kim said that “80% of our search keywords on Blind are company names or company names attached to levels, locations, or teams.” People want to know how to move their careers forward, an area companies are notoriously bad about explaining, and so “people come to Blind to find information from these verified employees.”

Blind is building what it calls “Talent by Blind,” a platform for capturing this hiring intentionality and selling it to recruiters. The goal is to transfer people whose intentions might be, say, L5 engineer at a big tech company in Seattle to a separate platform that can be used as a top-of-funnel for company recruitment efforts. Blind says a couple of companies are currently using this platform.

“Talent by Blind” is a platform to help transfer potential recruits into the top of the recruiting funnel at companies. Image Credits: Blind

Ultimately, Blind’s path has been one of slow and steady growth. The company claims to be deliberate in that approach, noting that pseudonymous communities often falter when they grow too fast and norms aren’t established early. Unlike more notorious anonymous communities from years past like Secret or YikYak, the company says that its network tends to be quite safe, since employees verify their identities and know that they are speaking directly to their colleagues.

Blind’s team has expanded in recent years. Image Credits: Blind

Revenue approaches remain experimental, but ultimately, the key is that it has the users that companies want to hear from: their own employees and potential future employees. We want to “maintain that integrity with users,” Kim said. “ ‘Ally to employees and advisor to companies’ is the phrase we are trying to go for.”

“It’s been eight years we have been doing this business, [and] we have been focused on the longness,” he said. “There’s a lot of optimism in the company.” He would know — he probably checked Blind.

How a band of P2P hackers planted the seeds of a unique expense management giant

Individuality often has no place in the enterprise software space. In a market where a single contract can easily run into the millions, homogeneity is the herald of reliability and serves to reassure buyers of the worth of their potential purchase.

So it’s natural to think a company in the expense report management business would keep it simple and play it by the book. But one look at Expensify is enough to tell you that this is a company that never even looked for the book.

Expensify’s origin story is one of a scrappy group of developers who turned travel into a catalyst for ideas and stuck together through highs and lows, ending up building one of the most unexpectedly original companies in enterprise software today.

Right from its famous “workcations,” to its management structure and its decision-making policies, Expensify has it in its DNA to eschew so-called best practices for its own ideas — a philosophy rooted in its founder and early team’s P2P hacker background and do-it-yourself attitude. As a result, Expensify is atypical of startups in many ways, inside and out.

Founder and CEO David Barrett made it clear his company was different in our first call itself: “We hire in a super different way. We have a very unusual internal management structure. Our business model itself is very unusual. We don’t have any salespeople, for example. We’re an incredibly small company. We focus on the employees over the bosses. Our technology stack is completely different. Our approach toward product design is very different.”

That description would make some people call Expensify weird even by startup standards, but this essential difference has set it apart in a space dominated by giants such as SAP Concur and Coupa. And that’s ultimately been to its benefit: Expensify reached $100 million in annual recurring revenue in 2020, with hefty 25% EBITDA margins to boot. There were also rumors of the company planning to go public during our interviews for this EC-1, but they stopped speaking to us in March, and now we know why: Expensify confidentially filed to go public on May 3.

Expensify’s origin story is one of a scrappy group of developers who turned travel into a catalyst for ideas and stuck together through highs and lows, ending up building one of the most unexpectedly original companies in enterprise software today.

When David met Travis …

To truly understand Expensify, you first need to take a close look at a unique, short-lived, P2P file-sharing company called Red Swoosh, which was Travis Kalanick’s startup before he founded Uber. Framed by Kalanick as his “revenge business” after his previous P2P startup Scour was sued into oblivion for copyright infringement, Red Swoosh would be the precursor for Expensify’s future culture and ethos. In fact, many of Expensify’s initial team actually met at Red Swoosh, which was eventually acquired by Akamai Technologies in 2007 for $18.7 million.

Barrett, a self-proclaimed alpha geek and lifelong software engineer, was actually Red Swoosh’s last engineering manager, hired after the failure of his first project, iGlance.com, a P2P push-to-talk program that couldn’t compete against Skype. “While I was licking my wounds from that experience, I was approached by Travis Kalanick who was running a startup called Red Swoosh,” he recalled in an interview.