HubSpot unveils new content management system aimed at marketers

/0 Comments/in /by

HubSpot, the Boston-based inbound marketing firm, announced today it is launching a standalone content management system designed to make it easy for marketing personnel to add and update content.

While content management, in a sense, has been core to HubSpot from the beginning — many companies use their blogging platform, for example — the company built this one from the ground up for marketers, says chief marketing officer Kipp Bodnar.

“For me, the marketer owning the website is one of the most thankless jobs you have. There’s a lot of pain associated with it. Your CEO asks you to update a bio or your legal team needs a new terms of service. Everybody’s coming at you from everywhere and the actual management of websites has just a huge amount of pain associated with it,” he said.

Angela DeFranco, the company’s director of product management, says that HubSpot wanted to address that problem with a product designed specifically for the marketing team. “We wanted to build a content management system and a suite of tools that could stand on its own and take away the pain of content management, not only from the marketer but also from the developer and the people that help the site run,” she said.

The product is built on the notion of themes that allow the marketer and developer helping to build the site to get the look and feel they want, while balancing what De Franco calls “the paradox between powerful and easy-to-use.”

It allows developers to use the languages they want to build the site, while taking advantage of the HubSpot CMS’s modular structure. At the same time, the modules give marketers a friendly interface to make frequent changes required in a modern website.

“When you actually get into the editor and you’re dragging in, for example, your event registration theme module, it inherits the styling and the characteristic, the look and feel of that theme overall that the developers had set up and custom built for your team,” she said.

“The theme module is really the crux of how we were able to achieve some of these more complex functionality features and power, while also allowing that with drag-and-drop ease of use to build a full site as a marketer,” DeFranco added.

HubSpot was founded in 2006. It raised over $100 million, according to Crunchbase data, before going public in 2014.

HubSpot adds customer service tools to its marketing platform

WorkClout shifts focus to manufacturing performance support and raises $2.3M seed

/0 Comments/in /by

WorkClout, a graduate of the Y Combinator Winter 2019 cohort, announced today that it has shifted its focus from manufacturing automation to manufacturing performance support and has raised a $2.3 million seed round.

The funding was led by Spider Capital with participation from Y Combinator, Liquid 2, Soma Capital, Pioneer Fund, Mehta Ventures and several individual investors.

When the company launched last year, it was looking at helping customers drive operational efficiency in their processes, but WorkClout founder and CEO Arjun Patel says they were seeing that there was a ceiling in terms of how much efficiency they could squeeze out of work processes using software.

At that point, Patel decided to take a step back and do some research to figure out how WorkClout could best help manufacturing customers with its software-based solutions. After surveying 124 manufacturers, he says that he realized that these companies really needed help training front-line workers, an area he says is called performance support.

“We found that most of the companies were saying that employees are the biggest challenge that they have to face in terms of how to engage them better or how to empower them better, because ultimately they realize people, even if there is automation, are still the driving force for a lot of sectors,” Patel told TechCrunch.

Towards the end of last year, the company built a new tool to help customers train employees for complex front-line tasks. The workers might have a phone or tablet, which shows them how to complete each task, and gives them feedback as they move through a set of tasks. It also enables these workers to communicate with one another and with management about issues they are seeing on the line. Managers can monitor communication and see how workers are doing on a back-end system in the office.

“We gave them the ability to allow employees to capture and share critical information in real time on the factory floor, where the goal is to actually create standardized multimedia and training content for machines, processes and stations, allowing new and existing employees to get better insight into their work, and at the same time, allowing employees to communicate better about problems on the floor and reduce downtime,” he explained.

Patel recognizes that this is a difficult time to pivot, but says he believes it puts the company in a better position to succeed in the long term. He has cut the team from nine to five employees in an effort to run lean for the short term.

He hopes to begin hiring again in the fourth quarter this year or, at the latest, by Q1 next year. He plans to use that time to build out the product and prepare for a big go-to market push whenever the economy begins to rebound.

He sees this money giving him a long runway of 2.5 years with the company’s current burn and revenue rates, and that should give him enough time to wait out the current economic downturn.

WorkClout brings SaaS to factory floor to increase operational efficiency

Cloud Foundry Foundation executive director Abby Kearns steps down to pursue a new executive role elsewhere

/0 Comments/in /by

The Cloud Foundry Foundation (CFF), the home of the Cloud Foundry open-source developer platform, today announced that its executive director Abby Kearns is stepping down from her role to pursue an executive role elsewhere.

If you’ve followed the development of the CFF for a while, it won’t come as a surprise that its current CTO, Chip Childers, is stepping into the executive director role. For the last few years, Kearns and Childers shared duties hosting the foundation’s bi-annual conferences and were essentially the public faces of the organization.

Both Kearns and Childers stepped into their roles in 2016 after CFF founding CEO Sam Ramji departed the organization for a role at Google . Before joining the Cloud Foundry Foundation, Kearns worked on Pivotal Cloud Foundry and spent over eight years as head of product management for integration services at Verizon (which, full disclosure, is also the corporate parent of TechCrunch).

Today, according to its own data, the Linux Foundation-based Cloud Foundry project is used by more than half the Fortune 500 enterprises. And while some use the open-source code to run and manage their own Cloud Foundry platforms, most work with a partner like the now VMware-owned Pivotal.

“I am tremendously proud of Cloud Foundry and of the Foundation we have all built together,” said Kearns in today’s announcement. “Cloud Foundry offers the premier developer experience for the cloud native landscape and has seen massive adoption in the enterprise. It also has one of the strongest, kindest, most diverse communities (and staff) in open source. I leave the organization in the best hands possible. Chip was the first Foundation staff member and has served as CTO for more than four years. There is literally nobody else in the world more qualified for this job.”

During her role as executive director, Kearns helped shepherd the project through a number of changes. The most important of those was surely the rise of Kubernetes and containers in general, which quickly changed the DevOps landscape. Unlike other organizations, the CFF adapted to these changing times and started integrating these new technologies. Over the course of the last two years, the Cloud Foundry community started to deeply integrate these cloud-native technologies into its own platform, despite the fact that the community had already built its own container orchestration system in the past.

As Childers told me last year, though, the point of Cloud Foundry isn’t any specific technology, though. Instead, it’s about the developer experience. Ideally, the developers who use it don’t have to care about the underlying infrastructure and can simply integrate it into their DevOps workflow. With a lot of the recent technical changes behind it,

“We as a Foundation are turning the page to a new chapter; raising the profiles of our technical contributors, highlighting the community’s accomplishments and redefining the Cloud Foundry platform as the best Kubernetes experience for enterprise developers,” said Childers today. “Abby has done a tremendous job leading the Foundation through a period of massive growth and upheaval in the cloud native world. Her leadership was instrumental in building Cloud Foundry as a leading cloud development tool.”

As the CFF also today announced, Paul Fazzone, SVP Tanzu R&D at VMware, has been named Chairman of the Board of Directors, where he replaces Dell EMC global CTO John Roese.

“This next chapter for Cloud Foundry will be a shift forward in focusing on evolving the technology to a Kubernetes-based platform and supporting the diverse set of contributors who will make that outcome possible,” said Fazzone. “In my new role as Chairman of the Board, I look forward to helping guide the Foundation toward its goal of expanding and bolstering the ecosystem, its community and its core of users.”

With its Kubernetes bet paying off, Cloud Foundry doubles down on developer experience

Cloud Foundry Foundation CEO Sam Ramji departs for Google

Continuous delivery pioneer CircleCI scores $100M Series E

/0 Comments/in /by

CircleCI, an early adherent to the notion of continuous delivery when it launched in 2011, announced a $100 million Series E investment today. It comes on top of a $56 million round last July.

The round was led by IVP and Sapphire Ventures . Under the terms of the deal, Cack Wilhelm will be joining the CircleCI board. Jai Das from Sapphire will also be joining the board as an observer.

Today’s investment brings the total raised to $215 million, according to the company, with $156 million coming over the last 8 months. The company did not want to discuss its current valuation.

Circle CI CEO Jim Rose says with so much uncertainty because of COVID-19 he welcomes not only the money, but the quality of the firms and people involved in the investment.

“We’re really excited to get both IVP and Sapphire because they’ve seen all of it all the way through public and beyond. Given all of the nuttiness over the last few months obviously having cash on the balance sheet is extremely helpful, but the other part, too is that this a time when you want to have more brains around the table, not fewer. And so being able to get people to help out and just think about the problems that we’re encountering right now is really helpful,” Rose told TechCrunch .

Rose recognizes the huge challenge everyone is facing, but he sees this switch to remote workforces really driving the need for more automation, something his company is in a position to help DevOps teams with.

“What we’ve seen from a DevOps perspective is that this forced migration to remote-only for so many organizations has really driven the urgency for more automation in the DevOps pipeline,” he said.

He said this has led to a huge surge in usage on the platform in recent weeks, and today’s investment will at least partly go towards making sure there are enough resources in place to keep the platform stable whatever comes.

“When we think about money and we think about where we’re investing in the near term, we’re investing a lot in making sure that the platform is stable and available and supporting all of our customers as they go through this. You know this is a difficult time, a difficult transition and we’re trying to make sure that we’re doing everything we can to support our customers through that process,” Rose said.

Many companies at this stage of startup maturity begin to look ahead to an IPO, but Rose isn’t ready to discuss that, especially in the current economic climate. “We’re going to have to get folks to some kind of liquidity at some point, but I think right now our focus is on really investing in the platform and investing in our customers and then we’ll let the market clear out and figure out what the new normal looks like,” he said.

The company would consider making some acquisitions with its base of capital if the right opportunity came along. “We’re always evaluating and always looking around. One of the interesting things about our space is that it’s flooded with new and innovative approaches to point problems. There are a lot of companies that are interesting, so we’re definitely always looking around,” he said.

CircleCI closes $56M Series D investment as market for continuous delivery expands

Microsoft Buys Corp.com So Bad Guys Can’t

/0 Comments/in /by

In February, KrebsOnSecurity told the story of a private citizen auctioning off the dangerous domain corp.com for the starting price of $1.7 million. Domain experts called corp.com dangerous because years of testing showed whoever wields it would have access to an unending stream of passwords, email and other sensitive data from hundreds of thousands of Microsoft Windows PCs at major companies around the globe. This week, Microsoft Corp. agreed to buy the domain in a bid to keep it out of the hands of those who might abuse its awesome power.

Wisconsin native Mike O’Connor, who bought corp.com 26 years ago but has done very little with it since, said he hoped Microsoft would buy it because hundreds of thousands of confused Windows PCs are constantly trying to share sensitive data with corp.com. Also, early versions of Windows actually encouraged the adoption of insecure settings that made it more likely Windows computers might try to share sensitive data with corp.com.

From February’s piece:

At issue is a problem known as “namespace collision,” a situation where domain names intended to be used exclusively on an internal company network end up overlapping with domains that can resolve normally on the open Internet.

Windows computers on an internal corporate network validate other things on that network using a Microsoft innovation called Active Directory, which is the umbrella term for a broad range of identity-related services in Windows environments. A core part of the way these things find each other involves a Windows feature called “DNS name devolution,” which is a kind of network shorthand that makes it easier to find other computers or servers without having to specify a full, legitimate domain name for those resources.

For instance, if a company runs an internal network with the name internalnetwork.example.com, and an employee on that network wishes to access a shared drive called “drive1,” there’s no need to type “drive1.internalnetwork.example.com” into Windows Explorer; typing “drive1” alone will suffice, and Windows takes care of the rest.

But things can get far trickier with an internal Windows domain that does not map back to a second-level domain the organization actually owns and controls. And unfortunately, in early versions of Windows that supported Active Directory — Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled.

Compounding things further, some companies then went on to build (and/or assimilate) vast networks of networks on top of this erroneous setting.

Now, none of this was much of a security concern back in the day when it was impractical for employees to lug their bulky desktop computers and monitors outside of the corporate network. But what happens when an employee working at a company with an Active Directory network path called “corp” takes a company laptop to the local Starbucks?

Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”

In practical terms, this means that whoever controls corp.com can passively intercept private communications from hundreds of thousands of computers that end up being taken outside of a corporate environment which uses this “corp” designation for its Active Directory domain.

The story went on to describe how years of testing — some of which was subsidized by grants from the U.S. Department of Homeland Security — showed hundreds of thousands of Windows computers were constantly trying to send this domain information it had no business receiving, including attempts to log in to internal corporate networks and access specific file shares on those networks.

O’Connor told me he was selling the domain after doing basically nothing with it for 26 years because he was getting on in years and didn’t want his kids to inherit this mess. When he put the domain up for sale, I asked if he’d agree to let me know if and when he sold it.

On Monday evening, he wrote to say that Microsoft had agreed to purchase it. O’Connor said he could  not discuss the terms of the deal, nor could he offer further comment beyond acknowledging the sale of corp.com to Microsoft.

In a written statement, Microsoft said it acquired the domain to protect its customers.

“To help in keeping systems protected we encourage customers to practice safe security habits when planning for internal domain and network names,” the statement reads. “We released a security advisory in June of 2009 and a security update that helps keep customers safe. In our ongoing commitment to customer security, we also acquired the Corp.com domain.”

Over the years, Microsoft has shipped several software updates to help decrease the likelihood of namespace collisions that could create a security problem for companies that still rely on Active Directory domains that do not map to a domain they control.

However, experts say hardly any vulnerable organizations have deployed these fixes for two reasons. First, doing so requires the organization to take down its entire Active Directory network simultaneously for some period of time.

Second, according to Microsoft applying the patch(es) will likely break or at least slow down a number of applications that the affected organization relies upon for day-to-day operations. Faced with either or both of these scenarios, most affected companies probably decided the actual risk of not applying these updates was comparatively low.

It should be noted that while Microsoft’s purchase of corp.com will safeguard companies that built Active Directory infrastructures on top of “corp” or “corp.com,” any company that has tied their internal Active Directory network to a domain they do not control is opening itself to a similar potential security nightmare.

Further reading:

Mitigating the Risk of DNS Namespace Collisions (PDF)

DEFCON 21 – DNS May Be Hazardous to your Health (Robert Stucke)

Mitigating the Risk of Name Collision-Based Man-in-the-Middle Attacks (PDF)

How Will Cybercriminals Take Advantage of AI in the Future?

/0 Comments/in /by

It’s difficult to predict what can happen in a decade. Looking back to 2009, when the iPhone 3GS dominated the (very new) smartphone market and Google Maps forever changed the way we move, we would be hard pressed to envisage the future we now find ourselves in.

On one hand, we can try to learn from these previous technologies in a bid to make an educated guess as to what’s around the corner. After all, the smart home assistants and rapid streaming services we’re now accustomed to have long been predicted by those clever enough to extrapolate from the past and imagine what that means for the future.

On the other hand, it’s anyone’s guess. Historically, it was believed that computers would get bigger and bigger over time, as this was the trend initially. I’m sure some can remember back when computers were the size of a whole room. Countless engineers, technicians and analysts predicted this over the years, which we now know to be totally false. Instead, computers have miniaturised and multiplied. Now your laptop, television and toaster can all house several computers.

Hello Google

Just as miniature computers have long been sprinkled throughout our homes and workplaces, the past 18 months has seen a similar adoption of AI. From Alexa to Google Home, Nest to smart speakers, you’d struggle to find a home that hasn’t incorporated some form of AI. Beyond our devices, AI recommendation engines are allowing for highly targeted (and creepily precise) advertisments across the web and social media.

Machine learning and other additions are also making AI even more intelligent. This allows AI to monitor anomalies, perform classification on gathered data and predict if a user is about to quit a service, for example.

But with more capabilities comes more code, and with more code comes more bugs. Coupled with the fact that AI is a new technology, which as a rule makes it inherently less secure, it’s easy to see why cybercriminals are taking advantage of this problematic new tool. The question is how they will continue to do so, and on what scale.

Goodbye Transparency

While recent headlines are hardly fear-mongering, it’s easy to predict a time when attackers finally harness the full criminal potential of AI to cause some serious damage. I believe the first case of this will come from audio fakes.

The technology to record, analyse, and emulate a voice already exists, though it has yet to be criminalised on a major scale due to the fact that the software is not publicly available. These things only stay secure for so long, of course, and once one clever hacker finds a way through the fence others will hastily follow.

Once it’s in their hands, there’s no end to how they can leverage it. Imagine a cybercriminal pretending to be you on the phone to your bank, equipped not only with your security details but a perfect replica of your voice to boot. Imagine your managing director or boss calling you in a panic, asking you to transfer valuable company information or complete a fraudulent wire transfer. The list goes on and on.

And it doesn’t stop there; deep fakes, in their most basic form, are already doing the rounds on social media. These clever misuses of AI not only copy your voice, they also have a generated video of you saying these words into a webcam or FaceTime call. Once an attacker has the software to pull this off, watching and profiling you via your webcam to get the information they need is the easy part. In these types of attacks, criminals could reap equal havoc to audio fakes, with the added illusion of being physically present to squash any remaining suspicions.

A Call to Arms

AI shows no signs of slowing down; it’s effective and addictive, which is why we have adopted it with open arms. Clearly, there’s no going back now. As defenders, our next step has to be building the tools, security models and processes to combat the wave of deep fakes and beyond, securing a bright future with AI by our side, not against us.

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

Paul Cormier takes over as Red Hat CEO, as Jim Whitehurst moves to IBM

/0 Comments/in /by

When Ginni Rometty indicated that she was stepping down as IBM CEO at the end of January, the company announced that Arvind Krishna would be taking over, while Red Hat CEO Jim Whitehurst would become president. To fill his role, Red Hat announced today that long-time executive Paul Cormier has been named president and CEO.

Cormier would seem to be a logical choice to run Red Hat, having been with the company since 2001. He joined as its VP of engineering and has seen the company grow from a small startup to a multi-billion dollar company.

Cormier spoke about the historical arc he has witnessed in his years at Red Hat. “Looking back to when I joined, we were in a different position and facing different issues, but the spirit was the same. We were on a mission to convince the world that open source was real, safe and enterprise-grade,” Cormier said in an email to employees about his promotion.

Former CEO Whitehurst certainly sees this as a sensible transition. “After working with him closely for more than a decade, I can confidently say that Paul was the natural choice to lead Red Hat. Having been the driving force behind Red Hat’s product strategy for nearly two decades, he’s been intimately involved in setting the company’s direction and uniquely understands how to help customers and partners make the most out of their cloud strategy,” he said in a statement.

In a Q&A with Cormier on the company website, he talked about the kind of changes he expects to see under his leadership in the next five years of the company. “There’s a term that we use today, ‘applications run the business.’ In five years, I see it becoming the case for the majority of enterprises. And with that, the infrastructure underpinning these applications will be even more critical. Management and security are paramount — and this isn’t just one environment. It’s bare metal and hypervisors to public and private clouds. It’s Linux, VMs, containers, microservices and more,” he said.

When IBM bought Red Hat in 2018 for $34 billion, there was widespread speculation that Whitehurst would eventually take over in an executive position there. Now that that has happened, Cormier will step into run Red Hat.

While Red Hat is under the IBM umbrella, it continues to operate as a separate company with its own executive structure, but that vision that Cormier outlined is in line with how it will fit within the IBM family as it tries to make its mark on the shifting cloud and enterprise open source markets.

Arvind Krishna will replace Ginni Rometty as IBM CEO in April

Koch Industries closes nearly $13B Infor acquisition

/0 Comments/in /by

Koch Industries announced today that it has closed on the acquisition of Infor, announced in February. The company never officially announced the purchase price, but sources indicated that it was close to $13 billion, putting it in line to be one of the top 10 enterprise acquisitions this year.

The company will remain an independent subsidiary of Koch, which tends to deal more in manufacturing than software. The goal is to use the resources of Koch to continue to build out the Infor product family with a focus on industry-specific solutions, according to the company.

At the time of the deal in February, CEO Kevin Samuelson certainly saw the potential of having a company with the financial resources of Koch backing his organization.

“As a subsidiary of a $110 billion+ revenue company that re-invests 90% of earnings back into its businesses, we will be in the unique position to drive digital transformation in the markets we serve,” Samuelson said.

As the company pointed out, Infor is helping customers move to the cloud, even in industries like manufacturing, distribution and finance that might otherwise be stuck on legacy systems. This transition to the cloud is becoming even more pressing as companies deal with the COVID-19 crisis and are forced to find creative ways to keep their businesses going, even when many employees can’t come into the office. Having access to applications in the cloud certainly helps ease that burden.

The company counts some of the largest organizations in the world as customers, including 17 of the top 20 global banks, 9 of the 10 largest global hotel brands and 7 of the top 10 global luxury brands

Infor was founded in 2002 and raised over $6 billion along the way, according to PitchBook. Its most recent investment before the acquisition was for $1.5 billion in January 2019.

Koch Industries acquires Infor in deal pegged at nearly $13B

In the wake of COVID-19, UK puts up £20M in grants to develop resilience tech for critical industries

/0 Comments/in /by

Most of the world — despite the canaries in the coal mine — was unprepared to cope with the coronavirus outbreak that’s now besieging us. Now, work is starting to get underway both to help manage what is going on now and better prepare us in the future. In the latest development, the UK government today announced that it will issue £20 million ($24.5 million) in grants of up to £50,000 each to startups and other businesses that are developing tools to improve resilience for critical industries — in other words, those that need to keep moving when something cataclysmic like a pandemic hits.

You can start your application here. Unlike a lot of other government efforts, this one is aimed at a quick start: you need to be ready to kick of your project using the grant no later than June 2020, but earlier is okay, too.

Awarded through Innovate UK, which part of UK Research and Innovation (itself a division of the Department of Business, Energy and Industrial Strategy), the grants will be available to businesses of any size as long as they are UK-registered, and aim to cover a wide swathe of industries that form the core fabric of how society and the economy can continue to operate.

“The Covid-19 situation is not just a health emergency, but also one that effects the economy and society. With that in mind, Innovate UK has launched this rapid response competition today seeking smart ideas from innovators,” said Dr Ian Campbell Executive Chair, Innovate UK, in a statement. “These could be proposals to help the distribution of goods, educate children remotely, keep families digitally connected and even new ideas to stream music and entertainment. The UK needs a great national effort and Innovate UK is helping by unleashing the power of innovation for people and businesses in need.”

These include not just what are typically considered “critical” industries like healthcare and food production and distribution, but also those that are less tangible but equally important in keeping society running smoothly, like entertainment and wellbeing services:

  • community support services
  • couriers and delivery (rural and/or city based)
  • education and culture
  • entertainment (live entertainment, music, etc.)
  • financial services
  • food manufacture and processing
  • healthcare
  • hospitality
  • personal protection equipment
  • remote working
  • retail
  • social care
  • sport and recreation
  • transport
  • wellbeing

The idea is to introduce new technologies and processes that will support existing businesses and organizations, not use the funding to build new startups from scratch. Those getting the funding could already be businesses in these categories, or building tools to help companies that fall under these themes.

The grants were announced at a time where we are seeing a huge surge of companies step up to the challenge of helping communities and countries cope with COVID-19. That’s included not only those that already made medical supplies increase production, but a number of other businesses step in and try to help where they can, or recalibrate what they normally do to make their factories or other assets more useful. (For example, in the UK, Rolls Royce, Airbus and the Formula 1 team are all working on ventilators and other hospital equipment, a model of industry retooling that has been seen in many other countries, too.)

That trend is what helped to inspire this newest wave of non-equity grants.

“The response of researchers and businesses to the coronavirus outbreak have been remarkable,” said Science Minister Amanda Solloway in a statement. “This new investment will support the development of technologies that can help industries, communities and individuals adapt to new ways of working when situations like this, and other incidents, arise.”

The remit here is intentionally open-ended but will likely be shaped by some of the shortcomings and cracks that have been appearing in recent weeks while systems get severely stress-tested.

So, unsurprisingly, the sample innovations that UK Innovate cites appear to directly relate to that. They include things like technology to help respond to spikes in online consumer demand — every grocery service in the online and physical world has been overwhelmed by customer traffic, leading to sites crashing, people leaving stores disappointed at what they cannot find, and general panic. Or services for families to connect with and remotely monitor vulnerable relatives: while Zoom and the rest have seen huge surges in traffic, there are still too many people on the other side of the digital divide who cannot access or use these. And better education tools: again, there are thousands of edtech companies in the world, but in the UK at least, I wouldn’t say that the educational authorities had done even a small degree of disaster planning, leaving individual schools to scramble and figure out ways to keep teaching remotely that works for everyone (again not always easy with digital divides, safeguarding and other issues).

None of this can cure coronavirus or stop another pandemic from happening — there are plenty of others that are working very squarely on that now, too — but these are equally critical to get right to make sure that a health disaster doesn’t extend into a more permanent economic or societal one.

More information and applications are here.

The Good, the Bad and the Ugly in Cybersecurity – Week 14

/0 Comments/in /by

The Good

This is an interesting time to be part of the security industry. The struggle to protect and preserve critical infrastructure and services has taken on an entirely new and elevated sense of urgency. There is a great deal of uncertainty as we all traverse through the COVID-19/SARS-CoV-2 pandemic. One thing we can be certain of, collectively, is that we are all pulling together, pooling resources and skills to ensure the availability of our most important resources during this time. Our medical system is under a great deal of strain at the moment. It is vital that they do not have to face a crippling malware attack in the midst of supporting and treating SARS-CoV-2 patients.  

That being said, it is already quite clear that our collective adversaries are continuing to target medical entities. In some ways we have made their job easier with the spike in use of remote collaboration tools (Zoom, Slack, BlueJeans, TeamViewer, etc.) as well as VPNs, mobile devices and other methods of remote access.

This week Microsoft’s Threat Protection Intelligence Team and the MSTIC announced a proactive effort to assist medical operations in hopes of preventing catastrophic attacks. Microsoft’s teams have been taking the unprecedented steps of reaching out directly to “dozens of hospitals with vulnerable gateway and VPN appliance infrastructure” in order to head attacks off at the pass. Microsoft’s intent is to help these organizations understand their exposure and take swift action to reduce their attack surface, while minimizing the potential impact of a ransomware or other type of malware attack. They are specifically focused on educating the hospitals on how vulnerabilities in their environment can be used by attackers, as well as guiding them through the available remediation steps (patches, updates, configuration changes, and beyond).

This is a much needed, proactive, effort by Microsoft and the current climate calls for new and innovative steps like this. Perhaps this effort can help sprout other similar initiatives across the industry.

The Bad

On March 31st, Marriott announced a data breach that potentially impacts up to 5.2 million guests. This is their second reported breach within the last three years. While this incident was not an outright breach of their point-of-sale systems, it is still quite concerning given the methodology and impact of the attack.

According to Marriott, the issue stems from an internal application which provides guest services within franchised Marriott properties. Near the end of February 2020, the credentials of two specific employees were used to access and exfiltrate guest information, including personal data. The data leaked includes:

  • Personal contact information (Name, email, mailing address, phone number, gender, birthday, corporate affiliations)
  • Guest preferences (room type, language , smoking status, accessibility status)
  • Rewards and affiliate identification data (partnership programs, airline loyalty program IDs)

Marriott has stated that the compromised data does not include payment card details, driver’s license numbers, passport data, Marriott Bonvoy account information or national ID data.

Marriott publicly announced the breach on March 31, 2020 as well as directly contacting affected guests via email. Upon discovery of the incident, Marriott was quick to disable the affected accounts along with additional methods to harden the environment during the investigation. The hotelier provides further support here for concerned customers.

The Ugly

Early morning, April 1st, and Israeli researcher Gil Dabah tweeted a new collection of bugs, with proof-of-concept code. This announcement was accompanied by a dump of more than a dozen PoCs into the his GitHub repository, along with thorough documentation for each issue. This release comes exactly one year after Dabah committed to uncovering at least 15 new issues and exploits in this class.

The disclosed issues are all focused on the Windows UI kernel (win32k), heavily targeting exploitable UAF (use-after-free) conditions. In total, Dabah documented 25 new vulnerabilities in this bug class.

These issues were disclosed responsibly, with Dabah working with Microsoft throughout the process. According to Dabah, of the 25 reported vulnerabilities “11 were exploited to prove feasibility for elevation-of-privilege (EOP).” It is reported that Microsoft has been working to release patches for these issues between November 2019 and February of 2020.

One thing this release does illustrate is that researchers (and attackers) are always digging for novel attacks and exploits. This is even true with a heavily-aging codebase such as that which is associated with the Win32k component. While we can’t yet say when all of these issues will be addressed by Microsoft, we can state this is yet another reminder of just how vast the attack surface is, and that good user hygiene and update cycles are critical. We should all strive to keep our critical systems fully patched per vendor recommendations, as well as leverage up-to-date and properly configured endpoint protection.

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security