Sequoia Backs Simplisafe In A Play For The Home Security Market

Sequoia Capital has made a minority investment in the do-it-yourself home security company Simplisafe in a play on the home security and automation market, TechCrunch has learned.

The investment from Sequoia came on the heels of Google’s $3.2 billion acquisition of Nest Labs, which showed just how lucrative the home market can be. That deal netted a healthy return for investors, including Kleiner Perkins Caufield & Byers, Lightspeed Venture Partners, Generation Investment Management, Venrock, and Google’s own Google Ventures.

The Nest acquisition also marked the first push by a large tech company to open a gateway into home automation. Investors think it probably won’t be the last.

Even before Nest showed the corporate appetite for home automation — including thermostat controls for heating and cooling, home security, and other types of remote monitoring and management — investors had begun backing a slew of startups tackling the problem.

Now Sequoia has a portfolio company of its own to tackle the market.

The firm invested in Simplisafe after an intense bidding war through a process that was handled by the investment bank Raymond James, according to multiple sources with knowledge of the investment. Sequoia declined to comment for this article.

Simplisafe’s out-of-the-box home security system garners rave reviews, and is already installed in thousands of homes.

While Simplisafe has gotten a huge boost with its new Sequoia financing, it’s not the only entrant that’s attracted big-name venture capital. Earlier this year Khosla Ventures invested $10 million in Canary, another high-concept, well-designed security system. And capital from investors keeps coming, according to data from CrunchBase.

Some investors may have placed early bets, but the market for do-it-yourself home security and automation is still wide open, and new opportunities to back privately held companies that haven’t yet raised any institutional investment abound.

For instance, the Chicago-based company Scout has completed a successful Kickstarter campaign; FrontPoint Security offers a panoply of automated security technologies for the home; and LiveWatch Security also has new security and safety technologies for homeowners and apartment dwellers who would have more comfort if they were staying in a place more castle than home.

“There’s a bunch of investments in the space,” says Lemnos Labs founder Jeremy Conrad. “The fact is that everybody is looking at ADT and how they pull down a couple of billion dollars in revenue for a service that hasn’t changed in twenty years. It’s very similar to how Nest went after Honeywell in the thermostat space.”

New Tax Fraud Scam Reminds Us: Protect Your Social Security Number

While Heartbleed and credit card breaches at Target and Michael's have us all on the watch for our security, the most secure number in your inventory isn't your credit card number: It's your Social Security number. Here are a few tips for protecting it.

Krebs on Security recently reported on a major break-in to a payroll software database and HR departments, specifically targeted to grab a social security numbers:

According to the control panel seen by this reporter, the scammers in charge of this scheme have hacked more than a half-dozen U.S. companies, filing fake tax returns on nearly every employee. At last count, this particular scam appears to stretch back to the beginning of this year's tax filing season, and includes fraudulent returns filed on behalf of thousands of people — totaling more than $1 million in bogus returns.

While Krebs reports on a wide-scale hack, the fact is that the treasure trove of potential money isn't in the database of credit cards. When a credit card is stolen, the number can be reissued and the owner (usually) has zero liability. A stolen social security number can result in a stolen tax refund, and reissuing the number isn't as easy as getting a new credit card. Even if you are secure the number, your employer may drop the ball and expose your information.

So what can you do to protect yourself and others? Here are a few tips:

• If you have access to Social Security numbers at work, guard them them. Create strong passwords and don't leave your systems logged in. Don't leave the Social Security numbers in plain view and avoid printing them on a shared printer. Shred the documents when done and securely erase the drive the even if the drive is an SSD.
• Consider getting a Federal Employer ID Number (FEIN) instead of giving out your Social security number. If you are a freelancer or otherwise self-employed you should always give out your FEIN instead of your Social Security number.
• Hide anything that has your Social Security number better than you would hide your credit card number. Don't leave this number in plain sight in the car or at work and don't use your number in a public place such as coffee shop. Shred any file with your Social Security number if you don't need the file. Check here to see when to do that.
• Consider getting an Identity Protection PIN. This is a two-factor authentication strategy.

You can change a credit card number, you can change your passwords, but changing your Social Security number is much more difficult. So make sure you're securing your Social Security number as much as you can.

Crimeware Helps File Fraudulent Tax Returns | Krebs on Security

Photo by 410(K) 2012.

View the Original article

Canary Smart Home Security Shows Off Its Smartphone App For The First Time

Canary has had a big year. After smashing through its Indiegogo campaign goal and picking up an extra $10 million in VC funding, the company is nearly ready to ship its home security product.

Due to a couple of hurdles, Canary units won’t arrive until “this summer,” but to tide us over, the team has given us our first real look at the complementary smartphone application.

So, when you first receive your Canary, you must pair it to your Wi-Fi and your smartphone. Rather than go through some painful process, the company set it up so that you can pair the unit with the smartphone and connect the Canary to the Internet by simply using a standard audio cord, which is included with the device.

Once you’re paired, you create a user ID and password and you’re essentially done. From there, the Canary will give you constant access to a live video feed of your home, as well as reads on temperature, air quality, noise, etc. But you can have even more control.

Canary lets you sync up to four different units in a single location to get a clear view of every room in the house. You can also set up multiple Canary units in different locations to keep a lookout on your house and your office, for example.

For each location, the user can assign contacts as either primary or backups. Primary users (most likely family members of roommates) have complete access to the Canary system at any time, and get notifications if anything is awry. Backups are usually neighbors or close friends who will not have anytime access to the live video, but will be next in line if you don’t respond to a notification. That way, friends and neighbors can rescue your cat if there’s a fire while you’re at work, or call the cops if someone is breaking in and you don’t respond to your notifications.

The app also has different modes: “Home”, “Away”, “Privacy” (which stops recording and monitoring) and “Vacation.” Canary already knows when you’re home and away, and you have complete control over the vacation and privacy modes.

Perhaps the most interesting part of the Canary app is the ability to flag events. I asked the founders why anyone would need to save recorded clips of “motion events” on their smartphones, as it seems you would either act on them or not need them anymore. However, Canary realizes that not every event has to be a bad one.

Maybe Canary picks up your kid’s first steps, or catches a special moment in your life and you want to hold on to that. By flagging the event in the Canary app, that moment is saved and can be downloaded to your computer.

Canary doesn’t ship until this summer, but the team is still taking pre-orders here.

1. Photo Apr 18, 12 50 11 PM

2. unnamed

3. unnamed (1)

4. Photo Apr 18, 1 07 29 PM

5. Photo Apr 18, 12 59 16 PM

6. Photo Apr 18, 12 59 41 PM

Smartphone users are unwitting participants to widespread surveillance effort, says security expert

The ubiquity of mobile devices has prompted government agencies to piggyback on corporate efforts to collect our information all in the name of marketing, says security expert Bruce Schneier.

Depending on which study you reference, smartphone penetration in the US reportedly ranges from 62 percent to 71 percent, according to analytics firms like comScore and NPD. Regardless of the actual figures, one thing is for sure: smartphones, tablets and wearable devices like smartwatches and smart glasses are gaining ground among consumers.

The convenient fact is that these devices offer an unprecedented level of connectedness among users, that we are plugged into the cloud almost our entire lives — at home, at work, at play, and on the move. With applications like Gmail, Facebook, Twitter and other services, we can keep connected with each other, collaborate, share content, gain access to information and much more.

Surveillance: the business model of the Internet

In many cases, these are offered for free. And there’s the saying that if something is given for free, then you’re the product. This is the sentiment of security researcher and author Bruce Schneier, who gave a keynote at the SOURCE Boston Conference earlier this week.

“Surveillance is the business model of the Internet,” said Schneier in his Keynote, adding that the Internet today is built on an ecosystem of spying. Information is the most valuable currency in this scenario. “We build systems that spy on people in exchange for services. Corporations call it marketing.”

Schneier says the data economy is not really bad in itself. However, it has become an amplifier of human intent and activity. For example, political dissidents have used social media services like Facebook to converge and act on their collective will. However, governments are also using the same media to enforce their own agenda. According to Schneier, governments are already powerful in the first place, but their power is magnified by technology.

At a most fundamental model, we are tenant farming for companies like Google. We are on their land producing data.

Because of advantages in data architecture and infrastructure, service providers can now afford to offer almost-unlimited storage for free. Gmail users no longer have to delete messages to make way for new ones — we just use search to sift through years’ worth of emails to find the right information. The same goes with other content, like photos, IM conversations, social media comments and the like. This vast ocean of information is now being mined by corporations, all with the intent of profiting from the marketing capabilities that targeted messaging can offer.

Corporations do the spying for government, sometimes unwittingly

The result is that we have become the metadata that we generate, says Schneier. It’s not so much about the content of our conversations and information sharing, but rather whom we share these with. “I like to think of this as a feudal model,” Schneier quips. “At a most fundamental model, we are tenant farming for companies like Google. We are on their land producing data.”

The interesting part here, says Schneier, is that governments have started piggybacking on the efforts of corporations to track our data. “The NSA woke up and said ‘Corporations are spying on the Internet, let’s get ourselves a copy,’” he says.

The cost of technology has been drastically lowered, especially since we mobile users are buying into the whole thing by subscribing to cellular service, sending SMS and IM messages, connecting to WiFi hotspots, exchanging emails, and sharing on social media. Schneier even said surveillance is no longer just “follow that car” — in reference to how the stereotypical spy or detective does surveillance and tailing. Rather, with metadata and tracking, it’s now “tell me everywhere the car has been for the past month.”

If surveillance previously involved several people actively following just one person, now individual intelligence agents can keep track of thousands. Interestingly, with the recent disclosure that even our supposedly secure SSL connections are not free from eavesdropping with the “Heartbleed” bug, we are likely to have been targets of government spying and surveillance for some time now.

But perhaps as mobile and Internet users, we’re already aware of the likelihood that we’re being tracked. The question is this: what do we do about it? “I think this is the issue by which we will be judged when our grandchildren read the history of the early days of the Internet,” concludes Schneier.

Featured image credit: Bikeriderlondon /Shutterstock

previous post

---

HTC One M8 now available in-stores: 10 things you need to know

next post

---

Los Angeles wants to become the largest city with free Wi-Fi

Google Expands Android's Built-In App Scanning Safety 2014

Google Expands Android's Built-In App Scanning Safety 2014

Android: Right now, Google announced that it is increasing its Verify Apps system to continually scan all apps put in on a telephone to determine in the event that they're malicious or harmful.

Previously, the Verify Apps system would only kick in if you installed an app from outside the Play Store, and it would only scan an app as its being installed. However, not only can apps change their behavior once they have permission to run, as we've learned recently, you can find crap software on the Play Store too.

The new system is rolling out via Play Services, so any device running higher than Android 2.3 should benefit. If an app is scanned and found to be potentially harmful, you'll receive a warning to either block installation or remove it from your system. You can also check out our guide on how secure Android really is for more information on how to protect yourself.

Expanding Google's security services for Android | Official Android Blog

Related

How Secure Is Android, Really?

Dear Lifehacker, I maintain hearing conflicting arguments on the state of Android security. Eric Schmidt says it is more secure than the iPhone, but… Read…

Posted by: http://gosspot.com/

Writted by: totor

View the Original article

Heartbleed, The First Security Bug With A Cool Logo

Next Story

Booktrack Raises $3M To Add Soundtracks To E-Books, Launches Classroom Version

It’s been fascinating to watch news of heartbleed, the massive OpenSSL exploit, spread on the web. After years of quietly putting us at risk, the general web user became aware of the exploit only a few days ago, and probably via heartbleed.com.

The site, which appeared almost overnight, was full of interesting info on the exploit, had a handsome minimalist design and included a nice logo. Someone had taken a bit of time to build an attractive and usable site.

But I was curious: how did heartbleed.com happen? When major exploits appear they are usually proliferated through wonky pages on security researcher sites. These “old-fashioned” exploit pages included a brief description, some references, and mention of the researchers involved. No images, just text.

But this exploit now had its own logo, its own website, and had taken on a life of its own. In short, Heartbleed was one of the first “branded” exploits, a computer bug that has been professionally packaged for easy mass consumption.

Not everyone was happy about this. One Twitter user writes:

While it’s fun to think that someone is profiting from exposing this exploit, the facts are much more mundane. With a bit of not particularly difficult sleuthing, I found the registrar listing for the site. It belonged to a company in Finland, Codenomicon who registered it a mere four days ago, a day or so after the exploit became “popular.”

The company was happy to answer questions about the site and stated emphatically that they were just trying to help the community.

“The content started as an internal Q&A which we wrote when trying to understand this bug and its impact,” said Miia Vuontisjärvi of Codenomicon. “Within hours of discovery we contacted NCSC-FI to handle the vulnerability coordination. When we tried the attack against ourselves and saw the disclosure of secret keys we understood that the Internet community has a new kind of vulnerability remediation challenge to solve.”

“Experiencing the pain of the bug first hand we got a nagging feeling that this calls for a ‘Bugs 2.0′ approach in getting the message out in an emergency. Ossi, one of our experts came up with Heartbleed as an internal codeame and from there on thing lead to the other. The domain was available and our artist Leena Snidate did a an excellent job in putting our pain into the logo. It all went much faster than expected.

“When the vulnerability became public we realized that this is going to be a crisis communication. We said what we had to say in the Q&A with as little litter as possible. We put it available on a low latency and high bandwidth content delivery network so that it is very accessible for anyone in the need. Based on initial reactions we did some minor edits but we quickly saw the Internet community picked the issue up in an astonishing way.”

The idea of a branded exploit – one that is carefully curated for easy consumption – is a new one. Historically obfuscation, either real or inadvertent, has been the watchword in computer security mostly because not everyone cared about major exploits. Heartbleed, in a way, was different. It was worldwide, very dangerous, and oddly photogenic. Whereas a Java exploit or Adobe Reader problem is “invisible” to the average user, the idea of a hacker watching your passwords scroll, Matrix-like without security systems setting off alarm bells is compelling and frightening. By creating a “bugs 2.0″ page for the exploit, Codenomicon inadvertently allowed the average user to understand and potentially react to the problem.

It worked.

“It is amazing to see such a community reaction to address this: internet wide scans, detection tools, pressure on passive service providers, top-notch reactions from progressive service providers (including re-keying and password changes), users advising each other and useful analysis by the media worldwide,” said Vuontisjärvi. “All this is making security more democratic, this issue was too big for the security community to handle alone. Seeing almost one tweet per second at its peak on normal users reacting to this has been reassuring and is restoring our trust into the Internet.”

5-Year Old Kid Finds A Security Exploit On The Xbox One, Gets A Researcher Credit

I thought I was a pretty clever kid when I was 5. Other kids ate boogers; I didn’t. Do you know how many gold stars I had? All the gold stars.

One thing I didn’t have, though: an acknowledgement from Microsoft for finding a security vulnerability. This kid does.

In a story that is surely making someone’s day pretty crappy over at Microsoft HQ, a 5-year old kid reportedly figured out how to bypass the account restrictions meant to keep him off of his Dad’s Xbox One.

The trick? When asked for a password, he pounded the space bar a bunch of times, then hit enter. For some crazy reason, this… worked. Repeatedly.

Late April Fool’s joke? Doesn’t seem like it. Word of Kristoffer’s 1337-ness comes from ABC10 news down in LA, who notes that Microsoft took the bug seriously enough to give Kristoffer a security researcher credit after the bug was patched.

Sure enough, a quick glance at Microsoft’s security acknowledgements for March lists one Kristoffer Wilhelm von Hassel. He’s one of few individuals on the page whose name doesn’t link to a Twitter account, since he’s… you know, too young to have a Twitter account.

Sure, it’s not like the kid found some buffer overflow that let him execute remote code and turn the Xbox into a toaster or whatever. But he tried something, and it worked, and he knew he’d done something he wasn’t supposed to — enough so to admit he felt a bit nervous about the whole thing. This kid is awesome.

Remember to put this one on the ol’ college application when the time comes, Kristoffer. Pretty sure “Acknowledged by Microsoft as a security researcher at the age of 5″ would open a door or ten.

[via ABC10News]

Cyanogen’s new brand identity is centered on choice, security, and openness

Back in fall, when the developers of CyanogenMod teamed up to form Cyanogen Inc., we were told that a fresh visual identity is in the works, one that would reflect the values and aspirations of the ambitious new project.

Now the new identity is here, and at its center stand three core values: customization, security, and openness.

Naturally, customization means that users are given the power to make their smartphone or tablet truly theirs. “This is my phone. There are many like it, but this is one is mine,” reads Cyanogen’s introductory graphic, and that truly is a great way to summarize what’s special about CM in particular, and Android in general.

Security is a hot topic in the age of massive hackings and government snooping. Cyanogen has been baking several security and privacy features in its software, including the WhisperPush secure messaging system. Expect more in the future.

Open source, the third core value of Cyanogen Inc., is a commitment to maintaining the project’s roots in the open source community. When Steve Kondik and his team created Cyanogen Inc., there was some controversy on the project’s licensing model and future as a commercial endeavor. The dust has since settled, and the CM open source project is still thriving, powered by the work of Cyanogen’s growing team of full time developers.

The old mascot of the project, Cid will live on, said community manager Abhisek Devkota, as a symbol of the CM community: “Cid belongs to the community, he is yours, not the company’s.”

The next big  hurdle for Cyanogen is the release of the OnePlus One on April 23. The OnePlus One is the first device designed specifically for CyanogenMod, with CM contributing to the conception of all aspects of the phone, software and hardware.

previous post

---

Project Ara gets a progress update video ahead of developers conference

next post

---

Xiaomi has two phones in the top 10 global list of best selling devices

Palo Alto Networks Buys Cyber Security Company Cyvera For $200M

Security company Palo Alto Networks has bought Cyvera, a cyber security company out of Israel. The deal is worth $200 million. The acquisition is expected to close during the second half of 2014. Cyvera had raised $13 million from Battery Ventures, Blumberg Capital, Prof. Ehud Weinstein and Dr. Ofir Shalvi.

As we wrote last year, Cyvera has crafted a new approach to combat zero-day attacks, using the coding equivalent of military-style guerrilla obstructive defense techniques. Zero-day cyber attacks represent one of the major threats to enterprises, governments, and service provider organizations that rely on a variety systems, applications, and devices to run their businesses. These cyber attacks often exploit a vulnerability known only to the attacker. While there are literally tens of thousands of vulnerabilities an attacker can potentially target, there is a significantly smaller number of exploit techniques they may use to target that vulnerability.

Cyvera provides real-time prevention against core attack techniques at the endpoint during the exploitation phase, before the malware has a chance to run. The company’s TRAPS (Targeted Remote Attack Prevention System) is a 16-point system of controls that, rather than try to block or monitor and identify everything that comes through, creates obstacles that will stop or slow down malicious intruders enough so that they can be eliminated before they ever touch sensitive servers.

Cyvera’s approach works–they’ve successfully stopped every published zero-day attack since they first began deploying their product.

For background, Palo Alto Networks’s proprietary hardware and software detects data threats as they come into an enterprise environment. It’s made for the new types of attacks that come through the web in the form of malware. The company’s offering is designed for all the ways people access the web, either through their laptops or their mobile devices. What makes Palo Alto Networks distinct is that it goes beyond what traditional firewalls are capable of doing. Most networking technology is meant for threats that come from basic email or web browsing. But today’s threats come in the form of botnet attacks and other modern techniques, such as phishing attacks.

Palo Alto Networks says that the combination of Cyvera, Palo Alto Network’s next-generation firewall, and the company’s threat cloud will create one of the most powerful integrated and automated enterprise security platforms in the market.

This is the second acquisition for Palo Alto Networks, which bought Morta Security earlier this year.