From Digital Age to Nano Age. WorldWide.

Tag: Security

Atoms Lanka Solutions > Security
Robotic Automations

Despite complaints, Apple hasn't yet removed an obviously fake app pretending to be RockAuto | TechCrunch

April 26, 2024 10:49 PM0


Apple’s App Store isn’t always as trustworthy as the company claims. The latest example comes from RockAuto, an auto parts dealer popular with home mechanics and other DIYers, which is upset that a fake app masquerading as its official app has not been removed from the App Store, despite numerous complaints to Apple.

RockAuto co-founder and president Jim Taylor was first alerted to the situation when customers began complaining about “annoying ads” in its app — something he said “surprised us since we don’t have an app.”

Fake RockAuto app on the App Store. Image Credits: Apple (screen capture by TechCrunch)

“We discovered someone placed an app in the Apple App Store using our logo and company information — but with the misspellings and clumsy graphics typical of phishing schemes,” he told TechCrunch.

On closer inspection, the fake app doesn’t look very legit, but it’s easy to see how someone could be fooled. Its App Store images show a photo of a truck with the word “Heading” across the image as if a template was hastily used and the work was unfinished. In addition, despite being titled “RockAuto” on the App Store, the app refers to itself as “RackAuto” throughout its App Store description.

What’s more, it promises customers that “Your privacy is a top priority” and that “all your data is securely stored and encrypted, giving you peace of mind.” That’s not likely, given the nature of this app.

The issue is not only concerning because of the app’s ability to fool at least some portion of RockAuto’s customers but also because it undermines Apple’s messaging about how the App Store is a trusted and secure marketplace — which is why it demands a cut of developers’ in-app purchase transactions. The tech giant has been fighting back against regulations like the EU’s Digital Markets Act (DMA), by claiming these laws would compromise customer safety and privacy. Apple believes that customers will be at risk if they conduct business outside its App Store with unknown parties. But, as these cases show, bad actors can too easily infiltrate its own app marketplace as well.

Image Credits: Fake RockAuto app on the App Store. Image Credits: Apple (screen capture by TechCrunch)

Apple has so far ignored RockAuto’s requests to remove the fake app, which were all sent through proper channels, according to documentation the company shared with TechCrunch.

While searching for a solution to this problem, RockAuto came across our coverage of a similar situation with LastPass. The password manager was also the victim of a similar scheme when a fake app pretending to be LastPass was live on the App Store for weeks. LastPass eventually had to warn its customers publicly in a blog post, as Apple had not yet taken the fake app down until after the press coverage and LastPass’s own post went live.

Apple didn’t respond to requests for comment at the time. The company wasn’t immediately available for requests for comment about RockAuto’s complaint either.

Apple pulled a fake app masquerading as password manager LastPass from the App Store

Taylor says that RockAuto’s Customer Service manager initially reached out to Apple to resolve the situation. When he didn’t get a response, Taylor got involved.

“It’s mostly one-way since the only replies we’ve had from Apple are ‘you shouldn’t have emailed, go use the online form’ and ‘upload screen prints of the app store listing and your trademark registration,’” Taylor explains, both of which RockAuto had already done, its documentation indicates.

“Neither the uploaded documents nor the online form submissions produced any response at all,” Taylor noted, “not even the promised ‘case number in 24 hours’ despite multiple submissions,” he said.

Since filing the complaint on April 18, 2024, RockAuto has shared its trademark registration with Apple, emailed the company, called the number provided on Apple’s copyright infringement page, sent a DMCA Takedown request and filled out Apple’s required forms.

It has not received anything other than automated responses and the fake app remains live as of the time of publication.

Apple’s reluctant, punitive compliance with regulators will burn its political and developer goodwill


Software Development in Sri Lanka

Robotic Automations

Despite complaints, Apple hasn't yet removed an obviously fake app pretending to be RockAuto | TechCrunch

April 26, 2024 8:49 PM0


Apple’s App Store isn’t always as trustworthy as the company claims. The latest example comes from  RockAuto, an auto parts dealer popular with home mechanics and other DIYers, which is upset that a fake app masquerading as its official app has not been removed from the App Store, despite numerous complaints to Apple.

RockAuto Co-Founder and President Jim Taylor was first alerted to the situation when customers began complaining about “annoying ads” in its app — something he said “surprised us since we don’t have an app.”

“We discovered someone placed an app in the Apple App Store using our logo and company information — but with the misspellings and clumsy graphics typical of phishing schemes,” he told TechCrunch.

On closer inspection, the fake app doesn’t look very legit, but it’s easy to see how someone could be fooled. Its App Store images show a photo of a truck with the word “Heading” across the image as if a template was hastily used and the work was unfinished. In addition, despite being titled “RockAuto” on the App Store, the app refers to itself as “RackAuto” throughout its App Store description.

What’s more, it promises customers that “Your privacy is a top priority” and that “all your data is securely stored and encrypted, giving you peace of mind.” That’s not likely, given the nature of this app.

The issue is not only concerning because of the app’s ability to fool at least some portion of RockAuto’s customers but also because it undermines Apple’s messaging about how the App Store is a trusted and secure marketplace — which is why it demands a cut of developers’ in-app purchase transactions. The tech giant has been fighting back against regulations like the EU’s Digital Markets Act (DMA), by claiming these laws would compromise customer safety and privacy. Apple believes that customers will be at risk if they conduct business outside its

App Store with unknown parties. But, as these cases show, bad actors can too easily infiltrate its own app marketplace as well.

Image Credits: Fake RockAuto app on the App Store

Apple has so far ignored RockAuto’s requests to remove the fake app, which were all sent through proper channels, according to documentation the company shared with TechCrunch.

While searching for a solution to this problem, RockAuto came across our coverage of a similar situation with LastPass. The password manager was also the victim of a similar scheme when a fake app pretending to be LastPass was live on the App Store for weeks. LastPass eventually had to warn its customers publicly in a blog post, as Apple had not yet taken the fake app down until after the press coverage and LastPass’s own post went live.

Apple didn’t respond to requests for comment at the time. The company wasn’t immediately available for requests for comment about RockAuto’s complaint either.

Apple pulled a fake app masquerading as password manager LastPass from the App Store

Taylor says that RockAuto’s Customer Service manager initially reached out to Apple to resolve the situation. When he didn’t get a response, Taylor got involved.

“It’s mostly one-way since the only replies we’ve had from Apple are ‘you shouldn’t have emailed, go use the online form’ and ‘upload screen prints of the app store listing and your trademark registration,’” Taylor explains, both of which RockAuto had already done, its documentation indicates.

“Neither the uploaded documents nor the online form submissions produced any response at all,” Taylor noted, “not even the promised ‘case number in 24 hours’ despite multiple submissions,” he said.

Since filing the complaint on April 18, 2024, RockAuto has shared its trademark registration with Apple, emailed the company, called the number provided on Apple’s copyright infringement page, sent a DMCA Takedown request, and filled out Apple’s required forms.

It has not received anything other than automated responses and the fake app remains live as of the time of publication

Apple’s reluctant, punitive compliance with regulators will burn its political and developer goodwill


Software Development in Sri Lanka

Robotic Automations

Breaking down TikTok's legal arguments around free speech, national security claims | TechCrunch

April 26, 2024 12:20 AM0


Social media platform TikTok says that a bill banning the app in the U.S. is “unconstitutional” and that it will fight this latest attempt to restrict its use in court.

The bill in question, which President Joe Biden signed Wednesday, gives Chinese parent company ByteDance nine months to divest TikTok or face a ban on app stores to distribute the app in the U.S. The law received strong bipartisan support in the House and a majority Senate vote Tuesday, and is part of broader legislation including military aid for Israel and Ukraine.

“Make no mistake. This is a ban. A ban on TikTok and a ban on you and YOUR voice,” said TikTok CEO Shou Chew in a video posted on the app and other social media platforms. “Politicians may say otherwise, but don’t get confused. Many who sponsored the bill admit that a TikTok ban is their ultimate goal…It’s actually ironic because the freedom of expression on TikTok reflects the same American values that make the United States a beacon of freedom. TikTok gives everyday Americans a powerful way to be seen and heard, and that’s why so many people have made TikTok a part of their daily lives,” he added.

This isn’t the first time the U.S. government has attempted to ban TikTok, something several other countries have already implemented.

TikTok is based in Los Angeles and Singapore, but it’s owned by Chinese technology giant ByteDance. U.S. officials have warned that the app could be leveraged to further the interests of an “entity of concern.”

In 2020, former President Donald Trump issued an executive order to ban TikTok’s operations in the country, including a deadline for ByteDance to divest its U.S. operations. Trump also tried to ban new downloads of TikTok in the U.S. and barred transactions with ByteDance after a specific date.

Federal judges issued preliminary injunctions to temporarily block Trump’s ban while legal challenges proceeded, citing concerns about violation of First Amendment rights and lack of sufficient evidence demonstrating that TikTok posted a national security threat.

After Trump left office, Biden’s administration picked up the anti-TikTok baton. Today, the same core fundamentals are at stake. So why do Congress and the White House think the outcome will be different?

TikTok has not responded to TechCrunch’s inquiry as to whether it has filed a challenge in a district court, but we know it will because both Chew and the company have said so.

When the company makes it in front of a judge, what are its chances of success?

TikTok’s ‘unconstitutional’ argument against a ban

“In light of the fact that the Trump administration’s attempt in 2020 to force ByteDance to sell TikTok or face a ban was challenged on First Amendment grounds and was rejected as an impermissible ‘indirect regulation of informational materials and personal communications,’ coupled with last December’s federal court order enjoining enforcement of Montana’s law that sought to impose a statewide TikTok ban as a ‘likely’ First Amendment violation, I believe this latest legislation suffers from the same fundamental infirmity,” Douglas E. Mirell, partner at Greenberg Glusker, told TechCrunch.

In other words, both TikTok as a corporation and its users have First Amendment rights, which a ban threatens.

In May 2023, Montana Governor Greg Gianforte signed into law a bill that would ban TikTok in the state, saying it would protect Montanans’ personal and private data from the Chinese Communist Party. TikTok then sued the state over the law, arguing that it violated the Constitution and the state was overstepping by legislating matters of national security. The case is still ongoing, and the ban has been blocked while the lawsuit progresses.

Five TikTok creators separately sued Montana arguing the ban violated their First Amendment rights and won. This ruling thus blocked the Montana law from going into effect and essentially stopped the ban. A U.S. federal judge claimed the ban was an overstep of state power and also unconstitutional, likely a violation of the First Amendment. That ruling has set a precedent for future cases.

TikTok’s challenge to this latest federal bill will likely point to that court ruling, as well as the injunctions to Trump’s executive orders, as precedent for why this ban should be reversed.

TikTok may also argue that a ban would affect small and medium-sized businesses that use the platform to make a living. Earlier this month, TikTok released an economic impact report that claims the platform generated $14.7 billion for small- to mid-sized businesses last year, in anticipation of a ban and the need for arguments against it.

The threat to ‘national security’

Mirell says courts do give deference to the government’s claims about entities being a national security threat.

However, the Pentagon Papers case from 1971, in which the Supreme Court upheld the right to publish a classified Department of Defense study of the Vietnam War, establishes an exceptionally high bar for overcoming free speech and press protections.

“In this case, Congress’ failure to identify a specific national security threat posed by TikTok only compounds the difficulty of establishing a substantial, much less compelling, governmental interest in any potential ban,” said Mirell.

However, there is some cause for concern that the firewall between TikTok in the U.S. and its parent company in China isn’t as strong as it appears.

In June 2022, a report from BuzzFeed News found that U.S. data had been repeatedly accessed by staff in China, citing recordings from 80 TikTok internal meetings. There have also been reports in the past of Beijing-based teams ordering TikTok’s U.S. employees to restrict videos on its platform or that TikTok has told its moderators to censor videos that mentioned things like Tiananmen Square, Tibetan independence or banned religious group, Falun Gong.

In 2020, there were also reports that TikTok moderators were told to censor political speech and suppress posts from “undesirable users” – the unattractive, poor, and disabled — which shows the company is not afraid to manipulate the algorithm for its own purposes.

TikTok has largely brushed off such accusations, but following BuzzFeed’s reporting, the company said it would move all U.S. traffic to Oracle’s infrastructure cloud service to keep U.S. user data private. That agreement, part of a larger operation called “Project Texas,” is focused on furthering the separation of TikTok’s U.S. operations from China and employing an outside firm to oversee its algorithms. In its statements responding to Biden’s signing of the TikTok ban, the company has pointed to the billions of dollars invested to secure user data and keep the platform free from outside manipulation as a result of Project Texas and other efforts.

Yaqui Wang, China research director at political advocacy group Freedom House, believes the data privacy issue is real.

“There’s a structural issue that a lot of people who don’t work on China don’t understand, which is that by virtue of being a Chinese company – any Chinese company whether you’re public or private – you have to answer to the Chinese government,” Wang told TechCrunch, citing the Chinese government’s record for leveraging private companies for political purposes. “The political system dictates that. So [the data privacy issue] is one concern.”

“The other is the possibility of the Chinese government to push propaganda or suppress content that it doesn’t like and basically manipulate the content seen by Americans,” she continued.

Wang said there isn’t enough systemic information at present to prove the Chinese government has done this in regards to U.S. politics, but the threat is still there.

“Chinese companies are beholden to the Chinese government which absolutely has an agenda to undermine freedom around the world,” said Wang. She noted that while China doesn’t appear to have a specific agenda to suppress content or push propaganda in the U.S. today, tensions between the two countries continue to rise. If a future conflict comes to a head, China could “really leverage TikTok in a way they’re not doing now.”

Of course, American companies have been at the center of attempts by foreign entities to undermine democratic processes, as well. One need look no further than the Cambridge Analytica scandal and Russia’s use of Facebook political ads to influence the 2016 presidential election, as a high-profile example.

That’s why Wang says more important than a ban on TikTok is comprehensive data privacy law that protects user data from being exploited and breached by all companies.

“I mean if China wants Facebook data today, it can just purchase it on the market,” Wang points out.

TikTok’s chances in court are unclear

The government has a hard case to prove, and it’s not a sure decision one way or the other. If the precedent set by past court rulings is applied in TikTok’s future case, then the company has nothing to worry about. After all, as Mirell has speculated, the TikTok ban appears to have been added as a sweetener needed to pass a larger bill that would approve aid for Israel and Ukraine. However, the current administration might also have simply disagreed with how the courts have decided to limit TikTok in the past, and want to challenge that.

“When this case goes to court, the Government (i.e., the Department of Justice) will ultimately have to prove that TikTok poses an imminent threat to the nation’s national security and that there are no other viable alternatives for protecting that national security interest short of the divestment/ban called for in this legislation,” Mirell told TechCrunch in a follow-up email.

“For its part, TikTok will assert that its own (and perhaps its users’) First Amendment rights are at stake, will challenge all claims that the platform poses any national security risk, and will argue that the efforts already undertaken by both the Government (e.g., through its ban upon the use of TikTok on all federal government devices) and by TikTok itself (e.g., through its ‘Project Texas’ initiative) have effectively mitigated any meaningful national security threat,” he explained.

In December 2022, Biden signed a bill prohibiting TikTok from being used on federal government devices. Congress has also been considering a bill called the Restrict Act that gives the federal government more authority to address risks posed by foreign-owned technology platforms.

“If Congress didn’t think that [Project Texas] was sufficient, they could draft and consider legislation to enhance that protection,” said Mirell. “There are plenty of ways to deal with data security and potential influence issues well short of divestment, much less a ban.”

What’s going on with the TikTok ban?




Software Development in Sri Lanka

Robotic Automations

Security bugs in popular phone-tracking app iSharing exposed users' precise locations | TechCrunch

April 25, 2024 4:27 AM0


Last week when a security researcher said he could easily obtain the precise location from any one of the millions of users of a widely used phone-tracking app, we had to see it for ourselves.

Eric Daigle, a computer science and economics student at the University of British Columbia in Vancouver, found the vulnerabilities in the tracking app iSharing as part of an investigation into the security of location-tracking apps. iSharing is one of the more popular location-tracking apps, claiming more than 35 million users to date.

Daigle said the bugs allowed anyone using the app to access anyone else’s coordinates, even if the user wasn’t actively sharing their location data with anybody else. The bugs also exposed the user’s name, profile photo and the email address and phone number used to log in to the app.

The bugs meant that iSharing’s servers were not properly checking that app users were only allowed to access their location data or someone else’s location data shared with them.

Location-tracking apps — including stealthy “stalkerware” apps — have a history of security mishaps that risk leaking or exposing users’ precise location.

In this case, it took Daigle only a few seconds to locate this reporter down to a few feet. Using an Android phone with the iSharing app installed and a new user account, we asked the researcher if he could pull our precise location using the bugs.

“770 Broadway in Manhattan?” Daigle responded, along with the precise coordinates of TechCrunch’s office in New York from where the phone was pinging out its location.

The security researcher pulled our precise location data from iSharing’s servers, even though the app was not sharing our location with anybody else. Image Credits: TechCrunch (screenshot)

Daigle shared details of the vulnerability with iSharing some two weeks earlier but had not heard anything back. That’s when Daigle asked TechCrunch for help in contacting the app makers. iSharing fixed the bugs soon after or during the weekend of April 20-21.

“We are grateful to the researcher for discovering this issue so we could get ahead of it,” iSharing co-founder Yongjae Chuh told TechCrunch in an email. “Our team is currently planning on working with security professionals to add any necessary security measures to make sure every user’s data is protected.”

iSharing blamed the vulnerability on a feature it calls groups, which allows users to share their location with other users. Chuh told TechCrunch that the company’s logs showed there was no evidence that the bugs were found prior to Daigle’s discovery. Chuh conceded that there “may have been oversight on our end,” because its servers were failing to check if users were allowed to join a group of other users.

TechCrunch held the publication of this story until Daigle confirmed the fix.

“Finding the initial flaw in total was probably an hour or so from opening the app, figuring out the form of the requests, and seeing that creating a group on another user and joining it worked,” Daigle told TechCrunch.

From there, he spent a few more hours building a proof-of-concept script to demonstrate the security bug.

Daigle, who described the vulnerabilities in more detail on his blog, said he plans to continue research in the stalkerware and location-tracking area.

Read more on TechCrunch:

To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.


Software Development in Sri Lanka

Robotic Automations

Tines taps $50M to expand its workflow automation beyond security teams | TechCrunch

April 24, 2024 6:11 PM0


Automation continues to be a major theme in the enterprise — underscored not least by the rise of AI as a tool to help fix some of the more routine, resource-intensive and fragmented aspects of how security and other IT functions operate. To capitalize on that trend, one of the bigger startups in the space, the Dublin-founded Tines, is announcing $50 million in funding. Tines started with its roots in security workflow automation but has seen adoption across other parts of the IT landscape. Now, on the back of revenues growing 200% in the last 18 months, it plans to use the new capital to expand its automation platform play deeper into applications in infrastructure, engineering and product.

The funding — co-led by existing investors Accel and Felicis — is being described as an extension of the company’s Series B rather than a Series C.

“We weren’t proactively trying to raise and were focused on building the business,” Tines’ CEO and co-founder Eoin Hinchy said in an interview. “Our existing investors saw our execution and approached us. We went from discussing what a round could look like to it being wrapped up in a couple of weeks.” He confirmed that it is not profitable currently by choice, to focus on growth.

This actually makes this the second extension to Tines’ Series B in three years, with the original round appearing in 2021 (at $26 million), and the first extension coming in October 2022 ($55 million).

But it’s not without a valuation bump. Hinchy declined to disclose the numbers but other sources close to the company confirmed it’s now valued post-money at close to $600 million. (As a point of comparison, PitchBook data notes that it was valued at $423 million at the first extension.) Others in this round include Addition, strategic backer CrowdStrike Falcon Fund and SVCI — all existing investors in Tines.

It has now raised some $146.2 million in total.

As we have previously described, the gap in the market that Tines is targeting comes from Hinchy’s and his co-founder Thomas Kinsella’s own direct experience. Hinchy is a classic technical founder. He and Kinsella (now chief customer officer) both spent around a decade working in leading roles in cybersecurity for companies like DocuSign, eBay and Deloitte, where they found major gaps in the market for tools to help better manage the large number of services they used to track data and network activity for his companies.

All of that was compounded by not just the explosion of new cybersecurity techniques but also hacking risks that grew out of the rise of cloud computing and related innovations. Hinchy estimated to me that the average security team manages some 77 different products, with “some in the hundreds.”

“By 2017 we desperately needed a workflow automation tool, and really nothing out there came close to what we wanted, so we decided to build what we wish we had,” Hinchy said. Tines covers what he describes as “mission critical workflows” which in security include tools to monitor and track security alerts, compliance alerts and increasingly areas that are adjacent to where security teams need to have visibility such as employee onboarding and offboarding, patch management in IT and more.

“We are the plumbing between these systems,” he said.

Although Hinchy is technical himself, he saw that another gap was that a lot of the need for monitoring was best served by not having to be a technical solution in itself. The whole of Tines is conceptualized in a drag-and-drop, no-code framework, building blocks that aim to reduce the amount of time it takes to create and manage workflows on the platform.

That is where the opportunity lies also for Tines’ investors. Although there are definite and very large competitors in the market including Splunk (and now Cisco by virtue of having acquired Splunk this year), Palo Alto Networks, ServiceNow and Microsoft, Tines and its backers and its users would contend that their focused and more context-aware approach are more useful and effective.

“Customer satisfaction is typically abysmally low in security,” Jake Storm, the partner at Felicis who led the deal, said in an interview. He said that he was surprised, when making due diligence calls when weighing up this latest deal, how different that was for Tines. “That’s just unheard of. It was just glaringly obvious that Tines was years ahead of its competitors back in 2022 and we just feel that gap has continued to widen.”

Luca Bocchio at Accel sees workflow as the key missing link, one that gives Tines a lot of potential to position itself further as a platform, not a service.

“If anything over the last few years, the growth of security needs has led to more security products and tools and that boils down to more workflow needs. That means Tines is becoming more relevant. With security being part of broader IT and business operations, it naturally needs to engage with the rest of the organization.”


Software Development in Sri Lanka

Robotic Automations

US government says security flaw in Chirp Systems' app lets anyone remotely control smart home locks | TechCrunch

April 23, 2024 12:46 AM0


A vulnerability in a smart access control system used in thousands of U.S. rental homes allows anyone to remotely control any lock in an affected home. But Chirp Systems, the company that makes the system, has ignored requests to fix the flaw.

U.S. cybersecurity agency CISA went public with a security advisory last week saying that the phone apps developed by Chirp, which residents use in place of a key to access their homes, “improperly stores” hardcoded credentials that can be used to remotely control any Chirp-compatible smart lock.

Apps that rely on passwords stored in its source code, known as hardcoding credentials, are a security risk because anyone can extract and use those credentials to perform actions that impersonate the app. In this case, the credentials allowed anyone to remotely lock or unlock a Chirp-connected door lock over the internet.

In its advisory, CISA said that successful exploitation of the flaw “could allow an attacker to take control and gain unrestricted physical access” to smart locks connected to a Chirp smart home system. The cybersecurity agency gave the vulnerability severity score of 9.1 out of a maximum of 10 for its “low attack complexity” and for its ability to be remotely exploited.

The cybersecurity agency said Chirp Systems has not responded to either CISA or the researcher who found the vulnerability.

Security researcher Matt Brown told veteran security journalist Brian Krebs that he notified Chirp of the security issue in March 2021 but that the vulnerability remains unfixed.

Chirp Systems is one of a growing number of companies in the property tech space that provide keyless access controls that integrate with smart home technologies to rental giants. Rental companies are increasingly forcing renters to allow the installation of smart home equipment as dictated by their leases, but it’s murky at best who takes responsibility or ownership when security problems arise.

Real estate and rental giant Camden Property Trust signed a deal in 2020 to roll out Chirp-connected smart locks to more than 50,000 units across over a hundred properties. It’s unclear if affected properties like Camden are aware of the vulnerability or have taken action. Kim Callahan, a spokesperson for Camden, did not respond to a request for comment.

Chirp was bought by property management software giant RealPage in 2020, and RealPage was acquired by private equity giant Thoma Bravo later that year in a $10.2 billion deal. RealPage is facing several legal challenges over allegations its rent-setting software uses secret and proprietary algorithms to help landlords raise the highest possible rents on tenants.

Neither RealPage nor Thoma Bravo have yet to acknowledge the vulnerabilities in the software it acquired, nor say if they plan on notifying affected residents of the security risk.

Jennifer Bowcock, a spokesperson for RealPage, did not respond to requests for comment from TechCrunch. Megan Frank, a spokesperson for Thoma Bravo, also did not respond to requests for comment.

How did a rental startup I’d never heard of leak my home address?


Software Development in Sri Lanka

Robotic Automations

Exclusive: Simbian brings AI to existing security tools

April 20, 2024 1:33 AM0


Ambuj Kumar is nothing if not ambitious.

An electrical engineer by training, Kumar led hardware design for eight years at Nvidia, helping to develop tech including a widely used high-speed memory controller for GPUs. After leaving Nvidia in 2010, Kumar pivoted to cybersecurity, eventually co-founding Fortanix, a cloud data security platform.

It was while heading up Fortanix that the idea for Kumar’s next venture came to him: an AI-powered tool to automate a company’s cybersecurity workflows, inspired by challenges he observed in the cybersecurity industry.

“Security leaders are stressed,” Kumar told TechCrunch. “CISOs don’t last more than a couple of years on average, and security analysts have some of the highest churn. And things are getting worse.”

Kumar’s solution, which he co-founded with former Twitter software engineer Alankrit Chona, is Simbian, a cybersecurity platform that effectively controls other cybersecurity platforms as well as security apps and tooling. Leveraging AI, Simbian can automatically orchestrate and operate existing security tools, finding the right configurations for each product by taking into account a company’s priorities and thresholds for security, informed by their business requirements.

With Simbian’s chatbot-like interface, users can type in a cybersecurity goal in natural language, then have Simbian provide personalized recommendations and generate what Kumar describes as “automated actions” to execute the actions (as best it can).

“Security companies have focused on making their own products better, which leads to a very fragmented industry,” Kumar said. “This results in a higher operational burden for organizations.”

To Kumar’s point, polls show that cybersecurity budgets are often wasted on an overabundance of tools. More than half of businesses feel that they’ve misspent around 50% of their budgets and still can’t remediate threats, according to one survey cited by Forbes. A separate study found that organizations now juggle on average 76 security tools, leading IT teams and leaders to feel overwhelmed.

“Security has been a cat-and-mouse game between attackers and defenders for a long time; the attack surface keeps growing due to IT growth,” Kumar said, adding that there’s “not enough talent to go around.” (One recent survey from Cybersecurity Ventures, a security-focused VC firm, estimates that the shortfall of cyber experts will reach 3.5 million people by 2025.)

In addition to automatically configuring a company’s security tools, the Simbian platform attempts to respond to “security events” by letting customers steer security while taking care of lower-level details. This, Kumar says, can significantly cut down on the number of alerts a security analyst must respond to.

But that assumes Simbian’s AI doesn’t make mistakes, a tall order, given that it’s well established that AI is error-prone.

To minimize the potential for off-the-rails behavior, Simbian’s AI was trained using a crowdsourcing approach — a game on its website called “Are you smarter than an LLM?” — that tasked volunteers with trying to “trick” the AI into doing the wrong thing. Kumar explained that Simbian used this learning, along with in-house researchers, to “ensure the AI does the right thing in its use cases.”

This means that Simbian effectively outsourced part of its AI training to unpaid gamers. But, to be fair, it’s unclear how many people actually played the company’s game; Kumar wouldn’t say.

There are privacy implications of a system that controls other systems, especially concerning those that are security-related. Would companies — and vendors, for that matter — be comfortable with sensitive data funneling through a single, AI-controlled centralized portal?

Kumar claims that every attempt has been made to protect against data compromise. Simbian uses encryption — customers control the encryption keys — and customers can delete their data at any time.

“As a customer, you have full control,” he said.

While Simbian isn’t the only platform to attempt to apply a layer of AI over existing security tools — Nexusflow offers a product along a similar vein — it appears to have won over investors. The company recently raised $10 million from investors including Coinbase board member Gokul Rajaram, Cota Capital partner Aditya Singh, Icon Ventures, Firebolt and Rain Capital.

“Cybersecurity is one of the most important problems of our time, and has famously fragmented ecosystem with thousands of vendors,” Rajaram told TechCrunch via email. “Companies have tried to build expertise around specific products and problems. I applaud Simbian’s method of building an integrated platform that would understand and operate all of security. While this is extremely challenging approach from technology perspective, I’ll put my money — and I did put my money — on Simbian. It’s the team with unique experience all the way from hardware to cloud.”

Mountain View-based Simbian, which has 15 employees, plans to put the bulk of the capital it’s raised toward product development. Kumar’s aiming to double the size of the startup’s workforce by the end of the year.


Software Development in Sri Lanka

Robotic Automations

Apple alerts users in 92 nations to mercenary spyware attacks | TechCrunch

April 19, 2024 11:45 PM0


Apple sent threat notifications to iPhone users in 92 countries on Wednesday, warning them that they may have been targeted by mercenary spyware attacks.

The company said it sent the alerts to individuals in 92 nations at 12 p.m. Pacific Time Wednesday. The notification, which TechCrunch has seen, did not disclose the attackers’ identities or the countries where users received notifications.

“Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID -xxx-,” it wrote in the warning to affected customers.

“This attack is likely targeting you specifically because of who you are or what you do. Although it’s never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously,” Apple added in the text.

The iPhone maker sends these kind of notifications multiple times a year and has notified users to such threats in over 150 countries since 2021, per an updated Apple support page.

Apple also sent an identical warning to a number of journalists and politicians in India in October last year. Later, nonprofit advocacy group Amnesty International reported that it had found Israeli spyware maker NSO Group’s invasive spyware Pegasus on the iPhones of prominent journalists in India. (Users in India are among those who have received Apple’s latest threat notifications, according to people familiar with the matter.)

The spyware alerts arrive at a time when many nations are preparing for elections. In recent months, many tech firms have cautioned about rising state-sponsored efforts to sway certain electoral outcomes. Apple’s alerts, however, did not remark on their timing.

“We are unable to provide more information about what caused us to send you this notification, as that may help mercenary spyware attackers adapt their behavior to evade detection in the future,” Apple told affected customers.

Apple previously described the attackers as “state-sponsored” but has replaced all such references with “mercenary spyware attacks.”

The warning to customers adds: “Mercenary spyware attacks, such as those using Pegasus from the NSO Group, are exceptionally rare and vastly more sophisticated than regular cybercriminal activity or consumer malware.”

Apple said it relies solely on “internal threat-intelligence information and investigations to detect such attacks.”

“Although our investigations can never achieve absolute certainty, Apple threat notifications are high-confidence alerts that a user has been individually targeted by a mercenary spyware attack and should be taken very seriously,” it added.

This tool tells you if NSO’s Pegasus spyware targeted your phone


Software Development in Sri Lanka

Robotic Automations

Microsoft employees exposed internal passwords in security lapse | TechCrunch

April 18, 2024 1:39 AM0


Microsoft has resolved a security lapse that exposed internal company files and credentials to the open internet.

Security researchers Can Yoleri, Murat Özfidan and Egemen Koçhisarlı with SOCRadar, a cybersecurity company that helps organizations find security weaknesses, discovered an open and public storage server hosted on Microsoft’s Azure cloud service that was storing internal information relating to Microsoft’s Bing search engine.

The Azure storage server housed code, scripts and configuration files containing passwords, keys and credentials used by the Microsoft employees for accessing other internal databases and systems.

But the storage server itself was not protected with a password and could be accessed by anyone on the internet.

Yoleri told TechCrunch that the exposed data could potentially help malicious actors identify or access other places where Microsoft stores its internal files. Identifying those storage locations “could result in more significant data leaks and possibly compromise the services in use,” Yoleri said.

The researchers notified Microsoft of the security lapse on February 6, and Microsoft secured the spilling files on March 5.

When reached by email, a spokesperson for Microsoft did not provide comment by the time of publication. In a statement shared after publication on Wednesday, Microsoft’s Jeff Jones told TechCrunch: “Though the credentials should not have been exposed, they were temporary, accessible only from internal networks, and disabled after testing. We thank our partners for responsibly reporting this issue.”

Jones did not say for how long the cloud server was exposed to the internet, or if anyone other than SOCRadar discovered the exposed data inside.

This is the latest security gaffe at Microsoft as the company tries to rebuild trust with its customers after a series of cloud security incidents in recent years. In a similar security lapse last year, researchers found that Microsoft employees were exposing their own corporate network logins in code published to GitHub.

Microsoft also came under fire last year after the company admitted it did not know how China-backed hackers stole an internal email signing key that allowed the hackers broad access to Microsoft-hosted inboxes of senior U.S. government officials. An independent board of cyber experts tasked with investigating the email breach wrote in their report, published last week, that the hackers succeeded because of a “cascade of security failures at Microsoft.”

In March, Microsoft said that it continues to counter an ongoing cyberattack that allowed Russian state-backed hackers to steal portions of the company’s source code and internal emails from Microsoft corporate executives.

Updated with comment from Microsoft.

Microsoft reveals how hackers stole its email signing key… kind of


Software Development in Sri Lanka

Robotic Automations

Chrome Enterprise goes Premium with new security and management features | TechCrunch

April 18, 2024 1:13 AM0


At its Google Cloud Next conference in Las Vegas, Google on Tuesday extended its Chrome Enterprise product suite with the launch of Chrome Enterprise Premium.

Google has long offered an enterprise-centric version of its Chrome browser. With Chrome Enterprise, IT departments get the ability to manage employees’ browser settings, the extensions they install and web apps they use, for example. More importantly, though, they also get a number of new security controls around data loss prevention, malware protection, phishing prevention and the Zero Trust access to SaaS apps.

Chrome Enterprise Premium, which will cost $6/user/month, mostly extends the security capabilities of the existing service, based on the insight that browsers are now the endpoints where most of the high-value work inside a company is done.

“Authentication, access, communication and collaboration, administration, and even coding are all browser-based activities in the modern enterprise,” Parisa Tabriz, Google’s VP for Chrome, wrote in Tuesday’s announcement. “Endpoint security is growing more challenging due to remote work, reliance on an extended workforce, and the proliferation of new devices that aren’t part of an organization’s managed fleet. As these trends continue to accelerate and converge, it’s clear that the browser is a natural enforcement point for endpoint security in the modern enterprise.”

These new features include additional enterprise controls to enforce policies and manage software updates and extensions, as well as new security reporting features and forensic capabilities that can be integrated with third-party security tools. Chrome Enterprise Premium takes Zero Trust a step further with context-aware access controls that can also mitigate the risk of data leaks. This includes approved applications and those that were not sanctioned by the IT department.

“With Chrome Enterprise Premium, we have confidence in Google’s security expertise, including Project Zero’s cutting-edge security research and fast security patches. We set up data loss prevention restrictions and warnings for sharing sensitive information in applications like generative AI platforms and noticed a noteworthy 50% reduction in content transfers,” said Nick Reva, head of corporate security engineering at Snap.

The new service is now generally available.


Software Development in Sri Lanka

Back
WhatsApp
Messenger
Viber