Tech
Microsoft reveals how hackers stole its email signing key… kind of
A series of unfortunate and cascading mistakes allowed a China-backed hacking group to steal one of the keys to Microsoft’s email kingdom that granted near unfettered access to U.S. government inboxes. Microsoft explained in a long-awaited blog post this week how the hackers pulled off the heist. But while one mystery was solved, several important details remain unknown.
To recap, Microsoft disclosed in July that hackers it calls Storm-0558, which it believes are backed by China, “acquired” an email signing key that Microsoft uses to secure consumer email accounts like Outlook.com. The hackers used that digital skeleton key to break into both the personal and enterprise email accounts of government officials hosted by Microsoft. The hack is seen as a targeted espionage campaign aimed at snooping on the unclassified emails of U.S. government officials and diplomats, reportedly including U.S. Commerce Secretary Gina Raimondo and U.S. Ambassador to China Nicholas Burns.
How the hackers obtained that consumer email signing key was a mystery — even to Microsoft — until this week when the technology giant belatedly laid out the five separate issues that led to the eventual leak of the key.
Microsoft said in its blog post that in April 2021, a system used as part of the consumer key signing process crashed. The crash produced a snapshot image of the system for later analysis. This consumer key signing system is kept in a “highly isolated and restricted” environment where internet access is blocked to defend against a range of cyberattacks. Unbeknownst to Microsoft, when the system crashed, the snapshot image inadvertently included a copy of the consumer signing key 1️⃣ but Microsoft’s systems failed to detect the key in the snapshot 2️⃣.
The snapshot image was “subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network” to understand why the system crashed. Microsoft said this was consistent with its standard debugging process, but that the company’s credential scanning methods also did not detect the key’s presence in the snapshot image 3️⃣.
Then, at some point after the snapshot image was moved to Microsoft’s corporate network in April 2021, Microsoft said that the Storm-0558 hackers were able to “successfully compromise” a Microsoft engineer’s corporate account, which had access to the debugging environment where the snapshot image containing the consumer signing key was stored. Microsoft said it cannot be completely certain this was how the key was stolen because “we don’t have logs with specific evidence of this exfiltration,” but said this was the “most probable mechanism by which the actor acquired the key.”
As for how the consumer signing key granted access to enterprise and corporate email accounts of several organizations and government departments, Microsoft said its email systems were not automatically or properly performing key validation 4️⃣, which meant that Microsoft’s email system would “accept a request for enterprise email using a security token signed with the consumer key,” 5️⃣ the company said.
Mystery solved? Not quite
Microsoft’s admission that the consumer signing key was probably stolen from its own systems ends a theory that the key may have been obtained elsewhere.
But the circumstances of how exactly the intruders hacked into Microsoft remains an open question. When reached for comment, Jeff Jones, senior director at Microsoft, told TechCrunch that the engineer’s account was compromised using “token-stealing malware,” but declined to comment further.
Token-stealing malware, which can be delivered by phishing or malicious links, seek out session tokens on a victim’s computer. Session tokens are small files that allow users to stay persistently logged-in without having to constantly re-enter a password or re-authorize with two-factor authentication. As such, stolen session tokens can grant an attacker the same access as the user without needing the user’s password or two-factor code.
It’s a similar attack method to how Uber was breached last year by a teenage hacking crew called Lapsus$, which relied on malware to steal Uber employee passwords or session tokens. Software company CircleCi was also similarly compromised in January after the antivirus software the company was using failed to detect token-stealing malware on an engineer’s laptop. LastPass, too, had a major data breach of customers’ password vaults after hackers broke into the company’s cloud storage by way of a compromised LastPass developer’s computer.
How the Microsoft engineer’s account was compromised is an important detail that could help network defenders prevent a similar incident in the future. It’s not clear if the engineer’s work-issued computer was compromised, or if it was a personal device that Microsoft allowed on its network. In any case, the focus on an individual engineer seems unfair given the real culprits for the compromise are the network security policies that failed to block the (albeit highly skilled) intruder.
What is clear is that cybersecurity is incredibly difficult, even for corporate mega-giants with near-limitless cash and resources. Microsoft engineers imagined and considered a wide range of the most complex threats and cyberattacks in designing protections and defenses for the company’s most sensitive and critical systems, even if those defenses ultimately failed. Whether Storm-0558 knew it would find the keys to Microsoft’s email kingdom when it hacked into the company’s network or it was pure chance and sheer timing, it’s a stark reminder that cybercriminals often only need to be successful once.
There seems to be no apt analogy to describe this unique breach or circumstances. It’s both possible to be impressed by the security of a bank’s vault and still acknowledge the efforts by the robbers who stealthily stole the loot inside.
It’s going to be some time before the full scale of the espionage campaign becomes clear, and the remaining victims whose emails were accessed have yet to be publicly disclosed. The Cyber Security Review Board, a body of security experts tasked with understanding the lessons learned from major cybersecurity incidents, said it will investigate the Microsoft email breach and conduct a broader review of issues “relating to cloud-based identity and authentication infrastructure.”
source
Disclaimer – This is just shared content from above mentioned source for knowledge sharing.
Earlier this year, a big French tech company started requiring an email to the CEO for every purchase above €1,000. That’s because they didn’t have the right tool to manage procurement.
Meet Pivot, a new French startup that wants to overhaul spend management solutions. Pivot wants to work with young companies that are growing fast and feel like they need a procurement solution. Instead of picking a legacy business spend management system from an ERP vendor, Pivot wants to be the first (and last) procurement system for these companies.
At the helm of the startup, you will find three experienced co-founders. Romain Libeau was one of the first employees at Swile and more recently acted as the Chief Product Officer for the French unicorn. Marc-Antoine Lacroix has spent several years working for Qonto as the Chief Technology Officer and then Chief Product Officer. Estelle Giuly has been a workflow engineers for several enterprise companies and for Wave.ai.
“I worked a lot on operations at Swile, and especially on all the internal tools. I actually saw a sequencing where first we tried to get as many customers as possible, so first we focused on all the tools for our go-to-market strategy and sales — basically Salesforce. Then, you have a lot of customers, and you want to keep them happy. So we structured our customer service, our customer success team,” Romain Libeau told me.
“And then you get to the last brick, which is how well you manage all your financial flows,” he added. And that’s where Pivot comes in.
When companies hire a head of procurement, that person usually starts by listing all the requirements and issues a call for tenders. Usually, they get to choose between Oracle NetSuite’s procurement component or maybe Coupa. It then takes several months to integrate the product in the company and procurement teams feel like they are only using 10% of the feature set.
Pivot isn’t the only startup trying to improve procurement. In the U.S., Zip and Levelpath have both raised tens of millions of dollars. “There are some regional features, European features when it comes to compliance and the payment ecosystem,” Libeau said.
But the fact that some American startups are thriving also proves that there is a real market opportunity. That’s why Pivot has already raised a $5.3 million pre-seed round (€5 million) from several VC firms (Visionaries, Emblem, Cocoa, Anamcara and Financière Saint James) as well as entrepreneurs and investors such as Loïc Soubeyrand (founder of Swile), Steve Anavi (co-founder of Qonto), Hanno Renner (co-founder of Personio), Oliver Samwer (co-founder of Rocket Internet), Pierre Laprée, Alexis Hartmann and Alexandre Berriche.
And things have been advancing at a very rapid pace. After this funding round in April, the company started developing the product over the summer and launched it in September with a first client — Voodoo.
“We’re rolling out gradually, because, as I always tell our team, more haste, less speed. But we’re going to end the year with around ten customers. So we’ve got the deals, but we don’t want to rush into anything,” Libeau said.
A PO workflow for humans
If you work for a big company and you often fill out purchase orders, you know that it’s a painful process. There are too many fields, you’re not sure what you’re supposed to write in each field and you would rather find a workaround to avoid purchase orders.
Pivot is well aware of that and has designed a tool that makes the PO workflow less painful. Admins can set up workflows from Pivot’s interface directly — no coding skills required. For instance, a very large purchase with a software vendor might trigger a security review, an IT review, a legal review, etc. That’s why Pivot is betting on third-party integrations and an interface that works for everyone.
Pivot integrates directly with your existing tech stack. It fetches the company’s org chart for the approval workflow from the HR system, it retrieves budgets from Pigment, Anaplan, etc. It then communicates with your communication tools, such as Slack, Microsoft Teams and Jira.
And, of course, Pivot integrates with ERP software (NetSuite, SAP…) so that vendors, cost centers, compliance rules and more are instantly propagated once a purchase order is validated.
Too many companies waste time in approvals and endless workflows. Pivot wants to add a layer of spend management without slowing down business teams. And the timing seems right as many companies are reviewing how they spend money.
Image Credits: Pivot
source
Disclaimer – This is just shared content from above mentioned source for knowledge sharing.
Welcome back to The Interchange, where we take a look at the hottest fintech news of the previous week. If you want to receive The Interchange directly in your inbox every Sunday, head here to sign up! It was a relatively quiet week in fintech startup land, so we took the time to scrutinize where we’re seeing the most funding deals.
Table of Contents
Seed deals everywhere
Across the board in all industries, except perhaps AI, we’ve seen a big drop in later-stage funding deals and no shortage of seed-stage rounds.
When it comes to fintech, I can tell you at least anecdotally that the vast majority of pitches that hit my inbox are for seed rounds. It is very rare these days to get pitched for Series B or later, or even for Series A rounds.
Venture banker Samir Kaji, co-founder and CEO of Allocate, points out that the private markets often take their cues from the public markets and as such, it’s no surprise that we’re seeing far fewer later-stage deals and a plethora of seed rounds. The Fintech Index — which tracks the performance of emerging, publicly traded financial technology companies — was down a staggering 72% in 2022, according to F-Prime Capital’s State of Fintech 2022 report.
“Seed is typically the least affected because those companies are just too early to really feel like you have to worry about where the public markets are,” he told me in a phone interview last week. “We’re so far divorced from the time period where these companies are going to be large enough where the public market sentiment is going to really matter.”
Allocate, which recently just closed on $10 million in capital, is currently an investor in about 60 funds. But Kaji is seeing the tide beginning to turn.
“The investment pace in 2022 was just so slow, and the beginning of 2023 was incredibly slow as well, but we’re starting to see things pick up as people are now starting to see that the bid ask on deals at the Series A and later are starting to narrow,” Kaji added. “And I think entrepreneurs have started to capitulate to this new environment. This always is the case — it’s like an 18- to 24-month lag in the public markets. So I would expect much more later-stage activity again in the next 18 to 24 months.”
I asked our friends at PitchBook what they’re seeing, and unsurprisingly, in the second quarter, there were more seed deals forged in the retail fintech space (135) compared to any other stage. When it came to the enterprise fintech space, early-stage deals accounted for most of the deal activity (239) with seed-stage coming in a close second (221), according to PitchBook.
Will we start seeing more later-stage deals in 2024? I sure hope so. Will we see any fintechs actually go public? That’s probably less likely. But you can be sure we’ll be on the lookout.
Slope continues its climb
It’s always great to see startups rise through the ranks, especially at a time when fintech hasn’t been doing so well. One of the companies I have had the pleasure of following is Slope. The company, founded by Lawrence Murata and Alice Deng, developed a business-to-business payments platform for enterprise companies.
When covering the company’s initial $8 million seed round in 2021, I learned that Slope’s origins came from Murata watching his wholesaler family struggle with an easier way to manage payments. He and Deng built the company so that moving to a digital order-to-cash workflow was seamless.
Last year, Slope raised another $24 million in Series A funding, and this week banked $30 million in a venture round led by Union Square Ventures, which co-led the Series A. It also included participation from OpenAI’s Sam Altman and a list of other heavy VC hitters. Read more. — Christine
Slope co-founders Lawrence Lin Murata and Alice Deng. Image Credits: Slope
Weekly News
TechCrunch Opinion: Fintech actually has a value system: Here’s how we can reclaim it
Introducing the a16z Global Payments Hub
Other items we are reading:
Apple is ordered to face Apple Pay antitrust lawsuit
Greenlight celebrates launch of web-based financial literacy library
Funding and M&A
As seen on TechCrunch
Pan-African contrarian investor P1 Ventures reaches $25M first close for its second fund
QED and Partech back South African payment orchestration platform Revio in $5.2M seed
Crediverso takes on legal after $3.5M capital infusion
Series, which aims to replace ERP systems, lands $25M
Seen elsewhere
Luge Capital: $71M first close of second fund completed
Colektia completes purchase of non-performing loans for $72M
Mexico’s albo receives $40m in Series C funds, striving for neobank profitability
Grow Credit Inc., a top 30 fintech app, secures $10m funding with USAA as lead investor in Series A round
StretchDollar raises $1.6M in pre-seed funding
WealthTech Vega exits stealth with over $8M funding
Farther closes Series B funding round to gain $131M valuation — This new round comes a little over a year after the wealth tech firm raised a Series A on a $50 million valuation. Check out TechCrunch’s earlier coverage of Farther.
Image Credits: Bryce Durbin
source
Disclaimer – This is just shared content from above mentioned source for knowledge sharing.
If you’re an early-stage founder, the crazy days of 2021 are a distant memory. Money is tight, and the process of getting more is as unsettled as ever.
The past few tumultuous years have tossed out the milestones that defined previous Series A benchmarks. But that doesn’t mean the game is lost. At this year’s TechCrunch Disrupt, three investors shared their perspectives on what’s changed, what’s working today, and what advice they’re giving founders who are looking to raise a Series A.
“As companies mature to seed and Series A, a year and a half ago, if you were at a million or even approaching a million in revenue, a Series A would come together in a snap. That has changed really quickly,” Maren Bannon, co-founder and managing partner at January Ventures, told the audience. “Now it’s probably more like 2 [million] to 3 million in revenue where those rounds come together in a snap.”
For founders, the moving goalposts can be incredibly frustrating — especially since the reasons for it are beyond their control. After a remarkable 13-year bull run, uncertainty crept into the market last year, dampening investor appetite for risk. Rising interest rates compounded the problem.
As a result, Series A investors have pulled back dramatically. “What we’ve noticed in the statistics is that the Series A deployment is down 60% over the last year and a half. The amount deployed per Series A is down 25% from $10 million to $7.5 million. And the number of deals getting done is much fewer,” said James Currier, general partner at NFX.
“The bulk of seed stage companies were [successfully] raising off of story, not traction,” Loren Straub, general partner at Bowery Capital, said of market conditions two years ago. “I think there’s been a real shift in focus towards traction, momentum, legitimate product-market fit.”
“A lot of the Series A investors are understandably looking for a higher bar,” she added.
A market crowded with venture capitalists hasn’t helped, either, Currier said. Back in the ’90s, there were about 150 general partners in the U.S., he said. Today, there are more than 31,000 listed on Signal, a network of investors his firm runs.
source
Disclaimer – This is just shared content from above mentioned source for knowledge sharing.
Trump business empire under threat as New York fraud trial opens
Procurement is painful, so Pivot wants to simplify it
At least 38 injured in police station fire in Egypt’s Ismailia
-
Fashion6 years agoThese ’90s fashion trends are making a comeback in 2017
-
News1 month ago
Police register FIR after double cabin vehicle runs over 4 of a family in Karachi’s Gulshan-i-Iqbal
-
Entertainment6 years ago
The final 6 ‘Game of Thrones’ episodes might feel like a full season
-
Tech1 month ago
Meta is now showing a carousel of suggested Threads on Instagram to bump up engagement
-
Tech1 month ago
Starfield review: Guns and ships galore, but a vacuum of wonder
-
News1 month ago
A new expressway threatens Karachi’s largest green space
-
Fashion6 years ago
According to Dior Couture, this taboo fashion accessory is back
-
News4 weeks ago
Karachi police take school principal into custody for allegedly raping, blackmailing women