Home Blog Page 295

Artificial Intelligence Startup H2O.ai secures $72.5 million to accelerate growth

H20.ai raises $72.5 million

H2O.ai, a provider of artificial intelligence and automatic machine learning services, recently announced that it has secured $72.5 million in a Series D funding round led by Goldman Sachs along with the participation from Wells Fargo, NVIDIA, and Nexus Venture Partners. H2O.ai stated the new proceeds will accelerate the company’s sales and marketing operations. Along with the investment, Jade Mandel from Goldman Sachs will be joining the H2O.ai Board of Directors.

Founded in 2012, H2O.ai provides AI and automatic machine learning services to enterprises with a mission to introduce AI to every sector including financial services, insurance, healthcare, telco, retail, pharmaceutical, and marketing.

H2O.ai claims that it has a strong client base of technology firms including NVIDIA, IBM, AWS, Intel, Microsoft Azure, Google Cloud Platform, Snowflake, and IBM Red Hat.

Speaking on the new investment, Sri Ambati, the CEO and Founder at H2O.ai said, “H2O.ai is democratizing AI and powering the imagination of every entrepreneur and business globally – we are making them the true AI superpowers. Our customers are unlocking discovery in every sphere and walk of life and challenging the dominance of technology giants. This will be fun.”

“We’re thrilled to partner with the H2O.ai team on their mission to democratize artificial intelligence,” said Jade Mandel, Vice President at Goldman Sachs. “Their deep technical bench and customer-centricity make them well-positioned to bring transparency and efficiency to the world of prediction.”

In a similar funding news, Artificial Intelligence technology provider VISENZE raised $20 million in a Series C funding round co-led by venture capital firm Gobi Partners and venture investor Sonae IM. The other participants in the funding round include Tembusu ICT Fund, 31Ventures Global Innovation Fund, and Jonathan Coon’s Impossible Ventures, along with the participation of existing investors Rakuten Ventures, WI Harper Group, Singapore Press Holdings (SPH) Ventures, Raffles Venture Partners, Enspire Capital, and UOB Venture Management.

Teenage Hacker Sentenced for Selling Personal Data Online

Patchwork BADNEWS, APT31 threat group

A teenage hacker pleaded guilty and ordered to pay £407,359, for providing freelance hacking and money laundering services.

According to the Norwich Crown Court, Elliot Gunton, a 19-year-old British hacker, was sentenced to 20 months for his illegal activities like selling personal data online, breaching Sexual Harm Prevention Order, and publicizing compromised data.

The investigation officials revealed that Gunton kept compromised personal data of individuals on the dark web for sale, which let cybercriminals commit frauds.

Speaking on the verdict, Detective Sergeant Mark Stratford said, “This was a complex investigation which relied on the expertise of officers and staff from the Norfolk and Suffolk Cybercrime Unit. This emerging type of criminality requires police investigators to be at the forefront of technological advancements in order to effectively combat the ever-growing paradigm of cybercrime.”

“Gunton was exploiting the personal data of innocent businesses and people in order to make a considerable profit but he did not succeed in hiding all of his ill-gotten gains which enabled us to seize hundreds of thousands of pounds worth of Bitcoin,” Stratford added.

Earlier, an Australian teen tried to hack Apple thinking that it will land him a job at the global technology conglomerate. The boy along with a friend confessed that they broke into the mainframe of Apple in December 2015 and again in 2017 by creating false credentials. The servers in Apple gave him access thinking it was an employee.

The incident was found by the Federal Bureau of Investigation which contacted the Australian Federal Police (AFP) and reported him. According to his lawyer, Mark Twiggs, the boy wasn’t aware of the seriousness of his actions and thought the company would have given him a job. “This started when my client was 13 years of age, a very young age. He had no idea about the seriousness of the offense and hoped that when it was discovered he might gain employment at this company,” he said. Fortunately, Apple did not incur any financial loss in the incident.

New vulnerability lets attackers spy on your Data sent via Bluetooth: Researchers

4 in 10 Companies Expose Unsafe Network Services Online, network and security

With technology advancing day by day, cyber-attackers too are finding innovative ways to get into our devices.

Researchers discovered that Bluetooth-enabled devices, including mobile phones, IoT devices, and laptops are potentially vulnerable to a flaw that could allow attackers to spy and even alter user’s data that’s transferred via Bluetooth.

The vulnerability, dubbed as Key Negotiation of Bluetooth (KNOB) attack, enables remote hackers to intercept and manipulate encrypted Bluetooth content among paired devices. However, the attacker should have to be near you in order to launch a KNOB attack, according to the security researchers from the Singapore University of Technology and Design and the University of Oxford.

“A remote attacker can manipulate the entropy negotiation to let any standard-compliant Bluetooth device negotiate encryption keys with 1 byte of entropy and then brute force the low entropy keys in real-time,” the researchers said in a statement.

“We found and exploited a severe vulnerability in the Bluetooth specification that allows an attacker to break the security mechanisms of Bluetooth for any standard-compliant device. As a result, an attacker is able to the listen, or change the content of, nearby Bluetooth communication, even between devices that have previously been successfully paired,” the statement added.

A similar research revealed that attackers can hack modern audio gadgets to make deafening sounds. According to Matt Wixey, a cybersecurity researcher at technology consulting firm PWC UK, attackers can build a custom-made malware to induce it on connected speakers to produce deafening sounds at high intensity, turning them into offensive cyber-weapons.

Wixey explained that his team has tested different kinds of connected speakers, including laptops speakers, headphones, and mobile phone speakers for research purposes. The researcher stated that aural attacks could cause tinnitus or even lead to psychological changes.

Surge in Cryptocurrency Crimes cause $4.3 billion loss in Q2 2019: Report

Bitcoin hack

According to a report from US-based Blockchain security company CipherTrace, the cryptocurrency industry might experience a huge surge in thefts and frauds in 2019. In its newly released Q2 2019 Cryptocurrency Anti-Money Laundering (AML) report, CipherTrace revealed that cryptocurrency thefts and frauds across the world could hit over $4.3 billion this year.

The report stated that hackers are using sophisticated methods to beat even advanced cybersecurity measures. It also highlighted that cybercriminals robbed around $125 million in Ethereum, Bitcoin, and other digital currencies from different cryptocurrency exchanges in Q2 2019.

CipherTrace develops Anti-Money Laundering (AML), cryptocurrency forensics, and blockchain threat intelligence solutions. The company claims that banks, investigators, regulators, and other digital asset businesses use its security platform to comply with regulatory anti-money laundering requirements and to mitigate threats related to the customer cryptocurrency activity. CipherTrace’s products are also used by government regulators, law enforcement investigators and auditors to enforce AML laws, combat crime and reduce fraud.

Earlier, CipherTrace revealed that a total of $761 million was stolen from cryptocurrency exchanges in the first half of 2018, which exceeds the whole amount, $266 million, of 2017 by three times. The company also estimated the losses could rise to over 1.5 billion in the current year.

“Stolen cryptocurrencies are three times bigger this year than last year, so the trend is obviously not our friend here,” said Dave Jevans, the chief executive officer of CipherTrace and the chairman of the Anti-Phishing Working Group. “The stolen virtual currencies end up being laundered to help criminals hide their true identities and avoid arrest, which has resulted in a three-fold rise in money laundering of cryptocurrencies.”

Around 70 percent of Financial Companies in the UK suffer Security Incidents

UK-Cybersecurity

A recent survey revealed that more than half of the companies in the United Kingdom were experienced a security incident over the past 12 months. According to a survey from data security firm Clearswift, around 70 percent of financial firms in the UK reported security incidents last year, in which half of the incidents occurred due to internal errors.

The research, which surveyed 100 senior business decision-makers from financial organizations in the UK, highlighted that most of the attacks have originated due to employees who failed to follow proper data protection policies.

Apart from employees’ errors, the survey also revealed other reasons, that led to attacks, including downloads of Malware or Viruses from third-party devices like USBs, and file transfers to unsecured sources.

“The financial sector is the lynchpin of the UK’s economy and a vital part of our nation’s Critical National Infrastructure, so it is alarming to see such high numbers of security incidents within financial organizations,” said Guy Bunker, CTO, Clearswift. “Unfortunately, in this day and age, it’s a case of ‘when’ not ‘if’ a firm is breached, so the financial sector needs to shift gears and speed up the innovation and deployment of effective data protection and threat mitigation strategies.”

“Cybersecurity needs to rapidly evolve, and the budgeting process should take this into account – the threat which can bring down a company may not have existed three months ago. Financial organizations need to be able to respond immediately in order to protect their reputation,” Bunker added.

A similar research from business and financial adviser Grant Thornton UK LLP discovered that cyber-attacks are a present danger for businesses in the UK. The research report, named Cyber Security – the Board Report, stated that the businesses are not prepared to manage the cyber risks.

Grant Thornton stated they surveyed over 500 UK mid-market companies, in which half of them reported losses of up to 10 percent of their income over cyberattacks. The research revealed that 63 percent of the companies don’t have a cybersecurity team. Only 36 percent stated that they’ve provided cybersecurity training to their employees. And more than half of the businesses (59 percent) don’t have a cyber incident action plan, according to the research.

“Build your processes around the ability to stay agile”

Michael Raypold

As the Chief Technology Officer of Echosec, Michael Raypold oversees the strategy and implementation of the engineering and product development for the company’s OSINT initiatives.

From coder he has now transformed to IT leader, though he still enjoys dabbling with code. He is deeply passionate about building a DevOps culture to allow agility in product delivery.  In an exclusive interaction with CISO MAG’s Rudra Srinivas, Raypold explains more about Beacon, the dark web search tool, and how it compares with a Tor browser. And then he talks about his transition from a developer to a CTO.

Tell us about your journey. What was your transition from a developer to a CTO like?

My journey has involved a lot of hard work, continuous learning and developing cross-functional skills. I’m still relatively young, but always eager to accept new responsibilities, learn and improve. My journey has been condensed as a result, but, has certainly been helped by the fact that I have an appreciation for both the technical and business side of building a company.

Transitioning from a developer to a CTO has been about learning how to scale strategy amongst the team, while also taking a step back and allowing others to take ownership of day to day product or technical initiatives. I’ve learned to remove myself from the critical path so that the company can better scale.

Can you brief us about Beacon, the dark web search tool?

Beacon is a data discovery tool that helps security professionals and analysts uncover threats to their organization from hidden online sources. Threats can include data leaks, fraud, personally identifiable information, and other critical data that can negatively impact an organization and its people. The platform is designed to make hidden data more accessible while improving proactive monitoring, without overloading the user with information or notifications.

As a security leader, what are the challenges you face while executing new security strategies?

The biggest challenge when executing new security strategies is information asymmetry. Often times you don’t know what you don’t know, and the execution of the new strategy slows down as you incorporate new information. You need to build your processes around the ability to stay agile while fostering a culture that encourages continuous learning and discovery.

Your profile says that you oversee the implementation of Open Source Intelligent (OSINT) initiatives.  Can you brief us about the same? Why does an organization need an OSINT team?

It is difficult for organizations to aggregate and tag relevant open data from dozens of external data sources. As such Echosec has built Beacon around the ability to gather and tag publicly accessible data. Echosec’s customers find that often times there is data that can be sourced through OSINT that damages a brand, reputation, employees or event security. OSINT is another means for organizations to operate in an environment where data is more available for decision making.

Primarily, my role as CTO is putting a strategy in place which allows Echosec to continue to build data discovery and OSINT products such as Beacon without constraining the company with technical debt or rigid processes.

How do you think security teams and public safety professionals will find Beacon as beneficial and explore newer avenues of cybersecurity that have not been tapped?

Beacon delivers publicly available information in an organized way that can be queried and pivoted on to draw connections between internal data sources, validate the hypothesis and gather supplementary information. Beacon helps reduce information asymmetry which allows better decision making and outcomes without further straining the resources of existing teams. This is a huge benefit for security and public safety teams.

How does Beacon differentiate itself from a regular Tor browser? While Tor is free, open-source software that enables anonymous communication on the web, Beacon is a commercial product. How does it fare in comparison with Tor?

Beacon is more comparable to a search engine than a TOR browser. It allows users to query and pivot on entities on Onion domains, amongst other Darkweb and open web content. When Beacon sources data, it retains a summary of that data and then tags relevant entities so that the information can be discovered more easily without the need to install multiple tools such as the TOR browser to discover content. Echosec has some open source initiatives that we will be releasing soon. Since all the data we source is publicly available, how we source that data should be public as well.

Echosec recently secured $2million from TIMIA Capital. What are your plans around this investment? 

We secured the $2M to cover the cost of growth over the last year. We found that with explosive growth there was a lag in receivables, and it was the best way to manage the trajectory of the company. Echosec has listened to a lot of feedback from current customers and will be using the additional funding to incorporate feedback into Beacon going forward.

Barracuda acquires Indian Bot Technology Startup InfiSecure

Acquisition

Barracuda, a provider of cloud-enabled security solutions, recently announced the acquisition of advanced bot detection technology firm InfiSecure Technologies to enhance its bot protection capabilities.

Founded in 2016, InfiSecure provides machine-learning functions that offer application-specific protection from bot attacks. Barracuda provides cloud-enabled, enterprise-grade security solutions for organizations to protect email, networks, data, and applications.

As per the acquisition deal, Barracuda acquired intellectual properties and other digital assets from InfiSecure. The new alliance integrates Barracuda’s Global Threat Intelligence Infrastructure with the InfiSecure technology to detect and prevent advanced Bot-attacks.

“This strategic technology acquisition further strengthens our application security portfolio and our commitment to provide application security to our customers,” said Tim Jefferson, SVP, Engineering of Data Protection, Barracuda Networks. “InfiSecure perfectly complements our recently released Advanced Bot Protection and will bring next-generation capabilities to our WAF-as-a-Service and Web Application Firewall offerings.”

“At Barracuda we strive to make the world a safer place. We believe every business deserves access to cloud-enabled, enterprise-grade security solutions that are easy to buy, deploy and use. We protect email, networks, data and applications with innovative solutions that grow and adapt to our customers’ journey. More than 150,000 organizations worldwide trust Barracuda to protect them — in ways they may not even know they are at risk — so they can focus on taking their business to the next level,” Jefferson added.

Microsoft reports two ‘Wormable Security Flaws’ in its Windows Platform

microsoft, flaws in SonicWall SRA SMA

Microsoft revealed that it has discovered two new security flaws in its Windows Desktop Services package. However, the technology giant clarified that it has fixed both the vulnerabilities.

Security officials at Microsoft stated that the two vulnerabilities, dubbed CVE-2019-1181 and CVE-2019-1182, can be exploited by attackers to launch “Wormable Attacks” that spread across different network systems without a user’s knowledge. Microsoft also stated the present flaws are similar to the vulnerability known as BlueKeep (CVE-2019-0708), which was patched in May 2019.

According to Microsoft, the infected versions of Windows due to the flaws included, Windows 7 SP1, Windows 8.1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows Server 2012 R2, and other versions of Windows 10. However, Windows Server 2003, Windows XP and Windows Server 2008 are not affected due to the flaws.

“These vulnerabilities were discovered by Microsoft during hardening of Remote Desktop Services as part of our continual focus on strengthening the security of our products. At this time, we have no evidence that these vulnerabilities were known to any third party,” Microsoft said in a statement.

“There is partial mitigation on affected systems that have Network Level Authentication (NLA) enabled. The affected systems are mitigated against ‘Wormable’ malware or advanced malware threats that could exploit the vulnerability, as NLA requires authentication before the vulnerability can be triggered. However, affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate,” the statement added.

Recently, Microsoft issued an alert to several users about its mail platform Outlook hack. In a wordy notification, it stated hackers may have accessed data sent by several users on the platform between January 1, 2019, and March 28, 2019.

According to Microsoft, apart from the contents of the emails which includes attachments, hackers may have also accessed email addresses, folder names, subject lines–from both senders and recipients.

It is still unclear what the hackers target and why they launched an attack like this.

“We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators’ access,” the report quoted a Microsoft spokesperson as saying. The tech giant also pointed out that email login credentials were not directly impacted by the incident, however, it has cautioned the users to reset their passwords.

Smart Speakers can be turned into Cyber-Weapons to make Aural Attacks: Researcher

Google Voice Authentication

Security researchers revealed that attackers can hack modern audio gadgets to make deafening sounds. According to Matt Wixey, a cybersecurity researcher at technology consulting firm PWC UK, attackers can build a custom-made malware to induce it on connected speakers to produce deafening sounds at high intensity, turning them into offensive cyber-weapons, according to the BBC.

Speaking at the Defcon security conference in Las Vegas, Wixey explained that his team has tested different kinds of connected speakers, including laptops speakers, headphones, and mobile phone speakers for research purposes. The researcher stated that aural attacks could cause tinnitus or even lead to psychological changes.

“Some attacks leveraged known vulnerabilities in a particular device, which could be done locally or remotely in some cases. Other attacks would either require proximity to the device, or physical access to it,” Wixey said in a statement.

Earlier, a security team from Tencent Blade exposed security vulnerabilities in smart speakers. Researchers Wu HuiYu and Qian Wenxiang gave a live demonstration on how to hack a smart speaker. The team used Amazon Echo smart speakers to present their attack program.

The researchers hacked the speaker by adding a malicious device embedded with an attack program.  “After several months of research, we successfully break the Amazon Echo by using multiple vulnerabilities in the Amazon Echo system, and achieve remote eavesdropping,” the researchers said in a media report. “When the attack succeeds, we can control Amazon Echo for eavesdropping and send the voice data through a network to the attacker.” The researchers notified Amazon of their findings before the presentation, and Amazon has already pushed a security patch to fix the issues.

Cybersecurity Startup Securiti.ai emerges from Stealth with $31 million Investment

Axonius Raises US$58 Million to Accelerate its Security Management Tool

Cybersecurity and compliance startup Securiti.ai recently emerged from stealth mode and raised $31 million in a funding round led by Mayfield Fund along with the participation from General Catalyst. The California-based startup stated the new proceeds will accelerate the company’s growth, according to Forbes.

Founded by security veterans from Elastica, Symantec, and Cisco, Securiti.ai helps organizations to meet California’s Consumer Privacy Act (CCPA) requirements through AI-driven DSR automation, documented accountability, and greater visibility into data processing operations. Securiti says its primary goal is to ensure that clients are compliant with new privacy laws and regulations globally.

“If there’s no teeth in it, then nobody implements it. This enforcement point of being fined up to $7,500 per incident, a company with millions of consumers, multiplied it could cost billions of dollars,” said Rehan Jalil, Securiti.ai CEO. “The first thing we had to crack was to not only discover the data that belongs to a particular consumer but find the owner of the data.”

“Companies can take requests from consumers to submit the request. On the backend, a bot will figure out where the data is, who owns it, in which system, and allow team collaboration to generate a report which can be approved by company lawyers and shared with consumers,” Jalil added.

1...294295296...409Page 295 of 409