Category: UNCATEGORIZED

An exposed database at automotive giant Honda allowed anyone to see which systems on its network were vulnerable to unpatched security flaws, potentially giving hackers insider knowledge of the company’s weak points.

The server contained 134 million rows of employee systems data from the company’s endpoint security service, containing technical details of each computer and device connected to the internal network.

There was no password on the database, allowing anyone to access and read the data.

The data included which operating system a user was running, its unique network identifiers and IP address, the status of the endpoint protection, and which patches were installed. That could allow an attacker to figure out which systems are at risk of certain vulnerabilities, or tailor attacks towards machines of interest using exploits known to target vulnerable devices. (We’re not naming the endpoint provider as it could prove useful for an attacker.)

In some cases the database would reveal the endpoint security status — including if a device was unprotected.

Security researcher Justin Paine found the exposed database earlier this month. He wrote up his findings and shared them exclusively with TechCrunch. The database was shut down hours after he made contact with the company.

“I thought this was a likely to be just a single Honda dealership,” Paine told TechCrunch. “The odds of that seemed far more likely than a database containing information related to all of Honda’s global network of employee machines.”

The database contained records on multiple Honda offices around the world, including Mexico, the U.K. and the U.S., said Paine.

He also found the chief executive’s computer in the logs, including which operating system he uses, the patches installed, and more. The records also included his email address and the last time he logged on.

“What makes this data particularly dangerous in the hands of an attacker is that it shows you exactly where the soft spots are,” said Paine. “This data contained enough identifiable information to make it extremely simple to locate specific high value employees and in the hands of an attacker this leaked data could be used to silently monitor for ways to launch very targeted attacks on those executives,” he said.

When reached prior to publication, Honda spokesperson Marcos Frommer did not comment.

It’s the latest find by Paine in recent months. Earlier this year he found a huge database of call logs and SMS messages exposed on the internet, and also the viewing habits of a library and university streaming service.

Read more:

• Another huge database exposed millions of call logs and SMS text messages
• Streaming site Kanopy exposed viewing habits of users, researcher says
• Capital One hacked, over 100 million customers affected
• An exposed password let a hacker access internal Comodo files
• Cryptocurrency loan site YouHodler exposed unencrypted user credit cards and transactions
• FormGet security lapse exposed thousands of sensitive user-uploaded documents

Porsche Digital, the subsidiary of carmaker Porsche, is opening its second U.S. location, after launching its first in 2017 in Silicon Valley. The second North American office for this software and digital product-focused wing of Porsche will open in Atlanta, which is also the seat of Porsche’s North American cars business. Porsche Digital cited proximity to their auto business headquarters as one reason why they picked Atlanta, but also pointed to Atlanta’s “local tech talent” and “robust and constantly growing startup and tech sector” as key factors in its selection.

The need for a second office is specifically about serving the U.S. market, Porsche Digital notes and the company expects to have 45 employees total in the U.S. across both offices within the next year. The subsidiary overall has 120 employees worldwide, with offices in Berlin, Shanghai, and Tel Aviv as well as the U.S.

Porsche Digital does focus on creating software and digital products for the automaker’s customers, but it’s actually probably more valuable to its parent company as a sort of distributed tech talent scouting and business development arm of the company. Its offices definitely occupy global hotspots when it comes to startup tech companies, and having a permanent presence in this locations has got to come in handy when looking to attract engineering talent and potential acquisitions of complimentary early-stage companies.

Jamf has been widely known as an enterprise Mac deployment and management tool company, but it has been looking for ways to expand beyond those core capabilities. One thing it heard from customers was that there was a dearth of native Mac security tools. It checked that box today, announcing it has acquired Digita Security, a startup with a native Mac security suite. The two companies did not reveal the purchase price.

Digita, a two-year old startup, was founded by a team of security experts led by Patrick Wardle, whose background includes a decade as a Mac security researcher, seeking out vulnerabilities on the Mac, and time at the NSA where he honed his security research skills.

Wardle says that because of the relatively low Mac marketshare, many traditional security vendors haven’t paid close attention, which can lead to trouble. “Mac marketshare is somewhat limited, maybe around 10%. So the average company is not going to spend a lot of time and resources developing Mac-specific capabilities,” he said.

“From the hacker’s point of view, this is great news, because their backdoor implants are generally not going to be detected by traditional tools. What I’ve been working on the last few years, and then most recently at Digita Security, is creating a system that is Mac specific, that leverages Mac-specific and Apple-specific frameworks and technologies,” he added.

The Digita Suite consists of three main tools. It takes advantage of and enhances XProtect, the Mac’s built-in malware detection system with a tool called UXProtect, that provides a valuable missing front end to the tool. It also offers a Mac laptop security tool called Do Not Disturb that sends you message if someone tries to access your laptop without permission, and finally it offers a tool called Gameplan, a heuristic-based malware detection system.

Jamf plans to continue to market the Digita toolset as a set of stand-alone package for the time being, while taking advantage of the Jamf policy engine when it makes sense, according to company CEO Dean Hagar. “With Digita, we’re going to be able to bring a whole solution to our customers, In addition to leaving Digita as a solution that can be offered on its own, we will be able to complete that journey for our customers by being able to monitor and hunt for threats and apply security policy,” Hagar told TechCrunch.

The deal has closed and the five Digita Security employees are now part of the Jamf security team. Having a security tool like this in the fold could help make companies more comfortable deploying Macs by giving security teams the tools they need to monitor and defend them, which could in turn expand Mac usage in the enterprise.

Ahead of Apple launching its big video streaming initiative Apple TV+ this autumn, a integration is going live today that brings Apple closer to working with third-party TV makers and making its services available on a wider array of devices. Today Vizio said it would start to roll out support for AirPlay2 and HomeKit to its SmartCast TV sets, making it possible to stream video and other media from Apple devices to its TVs and control the sets using Apple’s Home app and through its Siri voice assistant.

The support is coming by way of an over-the-air update to SmartCast 3.0, the system that underpins Vizio’s smart TVs. Notably, using the Apple services will not necessarily mean buying new Vizio TVs: the service is backwards compatible to TVs dating back to 2016. New sets range in prices from $259.99 to $3,499.99.

“SmartCast 3.0 is full of added value for VIZIO customers. With both AirPlay 2 and HomeKit support, users can now share movies, TV shows, music and more from their favorite apps, including the Apple TV app, directly to SmartCast TVs, and enable TV controls through the Home app and Siri,” said Bill Baxter, Chief Technology Officer, VIZIO. “We are thrilled to offer an even more compelling value proposition to our users with a smart TV experience that supports all three major voice assistants. This broad range of compatibility enables VIZIO SmartCast to seamlessly integrate into any household with Siri, Google Assistant or Alexa – giving users more ways to sit back and enjoy the entertainment they love.” Vizio still appears to be the only smart TV maker that’s offering support on its sets for all of the major voice assistants.

Vizio’s integration for Apple’s media services was first announced in January at CES, when Vizio said it would be getting actually rolled out later in the year.

The news was notable at the time for a couple of reasons. First, it underscored how Vizio was stepping up its growth efforts after a tough couple of years involving lawsuits, regulatory investigations and a failed M&A attempt.

Second, it was part of a bigger theme of Apple branching out into a wider consumer electronics ecosystem for its push into the world of TV and video. The latter still stands in stark contrast to Apple’s approach around smartphones, computers and watches, where it has spent years building hardware, operating systems and walled gardens.

That’s a story that is still playing out. The timing of the Vizio news is notable given that it’s just one day after Apple’s quarterly earnings report, where the company revealed a solid quarter that beat analyst expectations but also continued to show slowing growth, largely on the back of an ongoing decline in unit sales for the iPhone (amid a similar, bigger market trend for smarphones overall). To offset that story, Apple has been working hard to build new product categories in newer hardware areas like wearables (the Apple Watch) and smart home hubs (HomePod), and Services, which includes Apple’s efforts in areas like video and music (

Services came in at $11.455 billion — missing analysts expections but still growing 13% on a year ago. The promise — or perhaps more accurately, the hope — is that adding TV and gaming into the mix later in the year will boost that even more. This is where integrations such as the one getting announced today with Vizio will fit in: they will help expand the number of people who might be using the services, and of course the number of screens where the content can be consumed.

Vizio does not specify how many sets it currently has in the market — last number it gave me earlier in the year was “millions” — but it generally is behind Samsung, which currently leads in the smart TV category.

It notes that the service will work by way of tapping an AirPlay icon within SmartCast to be able to stream 4K and Dolby VisionTM HDR movies and TV shows from Apple TV, along with other AirPlay-compatible video apps. Mirroring (which you can also do with non-smart TVs) will also be supported. AirPlay 2 also lets users play content across multiple rooms (provided you have the sets, HomePods or other AirPlay 2 speakers installed).

Spotify added 8 million subscribers in the quarter that ended in June, slightly below the estimated 8.5 million figure, the streaming giant reported today.

The top music streamer said it had amassed 232 million monthly active users and 108 million paying subscribers at the end of June, up from 217 million users and 100 million subscribers in the quarter that ended in March. Monthly active users include paying subscribers and non-paying users.

“We missed on subs… That’s on us,” the company said.

Paying subscribers count includes users who are enjoying the 30-day trial Spotify offers. Additionally, Spotify recently kickstarted a biannual campaign, which offered customers access to the premium service for $1. This, among other factors, pushed its average revenue per user to €4.86 ($5.42) — down 1% since last quarter — the company said, adding that it expects the decline to continue in the low single digits for the rest of the year.

In comparison, Apple Music had 60 million paying subscribers as of June this year. (This also includes users who are part of Apple Music’s three-month free trial.)

On the business side, Spotify said its quarterly revenue rose 31% (from the same period last year) to $1.86 billion, while operating expenses increased 4%. Its operating loss narrowed to $3.34 million, the company said — better than estimations of analysts who expected Spotify to lose about $62 million on sales of $1.83 billion.

Additionally, Spotify revealed that it has reached an agreement with two of the four major record labels for licenses and is in active talks with the other two. It did not identify the labels.

Spotify’s future profits will depend on how its existing margins change with the music labels. Bulk of the revenue Spotify generates, it has to pay them to music labels. Every few years, the company has to renew its agreements with them.

The music streaming service, which has ramped up its podcast offerings with the acquisition of Gimlet Media, Anchor and Parcast, said its podcast audience is up 50% since the last quarter. Barry McCarthy, CFO of Spotify, said the company is still open to acquiring more podcasting businesses.

Spotify added 8 million subscribers in the quarter that ended in June, slightly below the estimated 8.5 million figure, the streaming giant reported today.

The top music streamer said it had amassed 232 million monthly active users and 108 million paying subscribers at the end of June, up from 217 million users and 100 million subscribers in the quarter that ended in March. Monthly active users include paying subscribers and non-paying users.

“We missed on subs… That’s on us,” the company said.

Paying subscribers count includes users who are enjoying the 30-day trial Spotify offers. Additionally, Spotify recently kickstarted a biannual campaign, which offered customers access to the premium service for $1. This, among other factors, pushed its average revenue per user to €4.86 ($5.42) — down 1% since last quarter — the company said, adding that it expects the decline to continue in the low single digits for the rest of the year.

In comparison, Apple Music had 60 million paying subscribers as of June this year. (This also includes users who are part of Apple Music’s three-month free trial.)

On the business side, Spotify said its quarterly revenue rose 31% (from the same period last year) to $1.86 billion, while operating expenses increased 4%. Its operating loss narrowed to $3.34 million, the company said — better than estimations of analysts who expected Spotify to lose about $62 million on sales of $1.83 billion.

Additionally, Spotify revealed that it has reached an agreement with two of the four major record labels for licenses and is in active talks with the other two. It did not identify the labels.

Spotify’s future profits will depend on how its existing margins change with the music labels. Bulk of the revenue Spotify generates, it has to pay them to music labels. Every few years, the company has to renew its agreements with them.

The music streaming service, which has ramped up its podcast offerings with the acquisition of Gimlet Media, Anchor and Parcast, said its podcast audience is up 50% since the last quarter. Barry McCarthy, CFO of Spotify, said the company is still open to acquiring more podcasting businesses.

Globally, millions of cameras are in deployed by companies and organizations every year. All you have to do is look up. Yes, there they are! But the petabytes of data collected by these cameras really only become useful after something untoward has occurred. They can very rarely influence an action in “real-time”.

Trueface is a US-based computer vision company that turns camera data into so-called ‘actionable data’ using machine learning and AI by employing partners who can perform facial recognition, threat detection, age and ethnicity detection, license plate recognition, emotion analysis as well as object detection. That means, for instance, recognising a gun, as it’s pulled in a dime store. Yes folks, welcome to your brave new world.

The company has now raised $3.7M from Lavrock Ventures, Scout Ventures, and Advantage Ventures to scale the team growing partnerships and market share.

Trueface claims it can identify enterprises’ employees for access to a building, detect a weapon as it’s being wielded, or stop fraudulent spoofing attempts. Quite some claims.

However, it’s good enough for the US Air Force as it recently partnered with them to enhance base security.

Originally embedded in a hardware access control device, Trueface’s computer vision software inside one of the first ‘intelligent doorbell’, Chui which was covered by TechCrunch’s Anthony Ha in 2014.

Trueface has multiple solutions to run on an array of clients’ infrastructures including a dockerized container, SDKs that partners can use to build their own solutions with, and a plug and play solution that requires no code to get up and running.

The solution can be deployed in various scenarios such as fintech, healthcare, retail to humanitarian aid, age verification, digital identity verification and threat detection. Shaun Moore and Nezare Chafni are the cofounders and CEO and CTO, respectively.

The computer vision market was valued at USD 9.28 billion in 2017 and is now set to reach a valuation of USD 48.32 billion by the end of 2023.

Facial recognition was banned by agency use in the city of San Francisco recently. There are daily news stories about privacy concerns of facial recognition, especially in regards to how China is using computer vision technology.

However, Truface is only deployed ‘on-premise’ and includes features like ‘fleeting data’ and blurring for people who have not opted-in. It’s good to see a company building in such controls, from the word go.

However, it’s then it’s up to the company you work for not to require you to sign a statement saying you are happy to have your face recognized. Interesting times, huh?

And if you want that job, well, that’s a whole other story, as I’m sure you can imagine.

Visa is pitching a new way for startups in the fintech space to get to market faster by using its rails and a group of pre-approved partners.

The Fast Track program, a variant of an investment commitment and ecosystem of services the company has already launched in other geographies around the world, comes to the U.S. without an investment commitment, but with a pre-defined list of partners that will help new financial services startups launch more quickly, the company said.

Chiefly, the process makes it easier to integrate with Visa . It’s an attempt to put the payment processor’s network, VisaNet, at the center of a vast array of services ranging from payroll to business to business payments and online banking, online lending, and even digital wallets.

“There’s about $17 trillion in cash and checks today that hasn’t gone digital and $20 trillion in business to business that’s happening over wires and check… those are all opportunities for Visa,” says Terry Angelos, a former fintech entrepreneur who now serves as an senior vice president at Visa and the company’s global head of fintech. 

“To some degree Visa has been the original fintech,” says Angelos. “Today, you would  pitch it as a SAAS platform for payment and commerce.”

For its new service, Visa has come up with a list of partners to provide the array of compliance services and infrastructure that a startup in the financial services space would need to get up and running quickly.

“These are vetted partners that are providing a fast track process and a concierge service so we can track the companies in the program,” says Angelos. 

What the program won’t include, Angelos said, is a commitment to invest in startups in the U.S. that would be equivalent to the $100 million investment fund the company has carved out for European investments as part of the fast track program there.

“We have investments that are happening that are in parallel,” Angelos says. “We don’t have a separate fund.”

Companies that are partnering with Visa on this program represent a different service offering for the ecosystem including: Alloy, BBVA Open Platform, Cross River Bank, Galileo, Green Dot, Marqeta, Netspend (TSYS’ Consumer Segment), Stripe, TabaPay, TSYS, Q2, and Very Good Security. The company said its debit processing service will support some of the partners’ participation in the program.   

Last year, fintech companies raised $39.5 billion from investors globally, up 120% from the previous year, according to data provided by Visa. And as part of their outreach to this startup community, Visa is pre-qualifying portfolio companies from investment firms like Andreessen Horowitz, Nyca Partners, Ribbit Capital and Trinity Ventures for its program. 

“We see many entrepreneurs with big ideas that can add real value and solve problems in the global payments system; the problem can be the difficulty of distribution and connectivity to the essential infrastructure,” said Hans Morris, Managing Partner, Nyca Ventures, in a statement. “Fast Track solves for this, enabling some of our best companies to start working with Visa right away.”

Many of the firms’ portfolio companies are already partnering with Visa in some capacity. The company has already announced agreements (of an undefined and undisclosed nature) with startups like Currencycloud, Flutterwave, Ininal, N26, PayActiv, Rappi, Razer and Remitly. 

Visa has also invested in startups. In 2019 alone, the company added Anchorage, Bankable, Branch, Finix, Minna Technologies and Paymate to its stable of startups. 

The main thing that startups would get from the Visa Fast Track program is mentorship and access to the company’s experts in payments and fintech. And its effort to tie itself more closely to a financial services ecosystem comes as Visa finds itself under threat from some of the very startup technologies that the company may look to co-opt.

Cryptocurrencies and blockchain technologies offer the possibility of alternative payment mechanisms that don’t rely on the traditional money transfer systems developed decades ago by companies like Visa and Mastercard and can offer potentially faster transaction times and charge lower fees.

To combat that threat, Visa has been aligning with some of the largest technology companies to head off challengers at the pass. The company (along with its largest rival, Mastercard) is collaborating with Facebook on its controversial proposed cryptocurrency, Libra, in an effort to head off any challengers with a new transaction system of its own.

Angelos insists that there’s nothing nefarious in Visa’s efforts to engage with startups and says that the company is merely another actor supporting the movement of trillions of dollars into a digital economy.

“If you look at what’s happening in the fintech ecosystem… Fintechs are reducing friction and adding consumers that are underbanked,” Angelos says. “They can work on any payment rails they choose. [But] all those fintechs… are choosing to build at least part of their products on top of the rails that we built… if you look around the world, fintechs are probably leveraging the existing payment  rails to provide a lot of innovation and remove friction.”

Facetune, a photo editing app that empowers users to cover their gray hairs, refine their jaw lines, and reshape their noses, was first introduced around six years ago, and it quickly climbed to the top of the download charts, becoming Apple’s most popular paid app of 2017. Despite stiff competition, it has remaining highly popular, too.

That staying power hasn’t been lost Goldman Sachs Private Capital Investing, Insight Partners or ClalTech, which just gave Facetune’s parent company, Lightricks, $135 million in Series C funding at a post-money valuation of $1 billion.

The investment firms — two of which led a $60 million round in the company less than a year ago —  are getting much more than Facetune in the deal.

Lightricks, based in Tel Aviv, has 260 employees supporting six products across three divisions, including Facetune, whose second version was rolled out this year; Enlight, a line of mobile photography and editing tools that aims to make photo editing more accessible to amateurs; and the startup’s newest, enterprise-focused brand, Swish, a marketing video editor that helps companies tell their story with video ads.

The separate divisions each come with meaningful mind share. According to cofounder and CEO Zeev Farbman, Lightricks has seen 180 million downloads across it paid apps, which generally cost $3.99 to download. Since the company began offering subscription layers to users who want premium bells and whistles in 2017, it has amassed a respectable number of subscribers, as well. According to Farbman, Facetune now has more than 1 million subscribers; Enlight has roughly 1 million subscribers, and Swish’s subscribers brings the total to roughly 3 million subscribers altogether.

More subscription-based content-creation apps are on the way, says Farbman, who hints they may be coming shortly. (Other developments might take a while, he adds, explaining that Lightworks, originally founded by five PhDs, is “constantly working on things that will be out two or three years down the line.”)

Reshaping features

If it it has been mostly smooth sailing for the company, there have been headwinds from time to time.

Facetune has been accused of taking photo brushing too far, for example, with celebrity model Chrissy Teigen tweeting about the app last year, “I don’t know what real skin looks like anymore . . . everyone looks like an oil painting.”

Asked what he thought of the body image debate the app had prompted, Farbman says the company sees itself as “democratizing retouching, and [educating users about] how powerful image processing can be.

“If you go back 10 years,” he notes, before mobile image processing software was available to everyone, “people didn’t understand that the people they were seeing on magazine covers had undergone the photoshopping process.”

Facetune users have also long grumbled about the second release of the app, not realizing that when they update the app, they lose some of the features that were previously available to them. (You have to subscribe in order to continue using them.)

Clearly, Lightricks and its backers — and one million users — think the company’s products are worth the monthly expense, which ranges depending on the features a user wants to unlock.

A team that includes experts across a number of relevant domains is the reason, says Farbman, who himself previously spent most of his time in academia, studying computer graphics, computer vision, and computational photography.

After the photo editing app Snapseed made its debut and was quickly scooped up by Google, he and four PhD friends “realized that nobody is becoming a great platform for content creation.” They quickly got to work developing their first product — Facetune — and by 2015, the bootstrapped company, which had also by then introduced Enlight, was seeing $10 million in annual revenue.

Still, we “thought we could do better,” says Farbman. Toward that end, Lightricks raised money, and we “started to grow way faster as a company,” he recalls.

It also began rolling out its subscription offerings, and despite continued complaints from some corners (Facetune 2 came out in 2016), Farbman says more people are signing up — and agreeing to pay more — than he initially imagined would be the case.

It makes sense to him now, he suggests. “Our founding team includes PhDs who were at the top of their fields, which allowed us to attract a strong team at the beginning. And once you’re hiring the best people, you’re probably going to build the best software. And if you’re building the best software, you can charge premium prices for that.”

Lightricks’s latest financing brings its total funding to $205 million to date. The new funding will be used to crate more tools, says Farbman. He adds that his team also plans to begin acquiring companies strategically.

Station F is the world’s biggest startup campus and it’s based in Paris. Director Roxanne Varza first unveiled Station F at TechCrunch Disrupt back in December 2016. That’s why I’m excited to announce that Station F director Roxanne Varza is joining us at TechCrunch Disrupt Berlin to give us an update and tell us about future plans.

If you aren’t familiar with Station F, it starts with a beautiful building. Originally built in 1929, it is now classified as a historical monument. But now, it’s also a high-tech building and a cornerstone of the French tech ecosystem.

Varza has managed to create a community of entrepreneurs, VC funds and big tech companies that work, share knowledge and collaborate. In addition to Station F’s own Founders Program and Fighters Program, you can become a Station F member by joining a partner program.

Facebook, Naver (Line), Ubisoft, Microsoft and plenty of others all run their own incubator from Station F. And it’s been working really well as there are over one thousand startups based at Station F.

Station F is also a great signal for the international tech community. If you head over to its Instagram account, you can see that plenty of head of states and major tech CEOs come to Station F whenever they visit Paris, from Jack Dorsey to newly elected president of Ukraine Vlodomyr Zelensky. Around one third of Station F startups come from abroad and 600 members don’t even speak French.

More recently, Station F unveiled Flatmates, a co-living space for Station F members. Station F is creating a lifestyle and has become a cultural phenomenon for Paris. And I can’t wait to see what’s next.

Buy your ticket to Disrupt Berlin to listen to this discussion and many others. The conference will take place on December 11-12.

In addition to panels and fireside chats, like this one, new startups will participate in the Startup Battlefield to compete for the highly coveted Battlefield Cup.

Roxanne Varza is Director of STATION F, the biggest startup campus in the world with more than 1.000 startups, located in Paris. She is originally from Silicon Valley. Before joining STATION F, she led Microsoft Ventures Paris and TechCrunch France. She also worked for several London-based startups and cofounded StarHer, Tech.eu and Failcon France.

Prior to her current role, Roxanne was the lead for Microsoft’s start-up activities in France, running both Bizspark and Microsoft Ventures programs for 3 years. She was also Editor of TechCrunch France from 2010-2011 and has written for several publications including Business Insider and The Telegraph. In April 2013, Business Insider listed her as one of the top 30 women under 30 in tech. She has also been listed in additional rankings by Business Insider, Vanity Fair and Le Figaro, The Evening Standard and more.

Roxanne also co-founded StartHer (ex Girls in Tech Paris) and is the co-organizer of the Failcon Paris conference. More recently, she co-founded Tech.eu, a European tech media backed by Dave McClure, Adeo Ressi, Daniel Waterhouse and more.

Prior to TechCrunch, Roxanne worked for the French government’s foreign direct investment agency helping fast-growing startups develop their activities in France. Roxanne has spoken, moderated, mentored and judged numerous startup events and programs throughout Europe and also helps European startups with content and communications. Roxanne is trilingual and holds degrees from UCLA, Sciences Po Paris and the London School of Economics. She is also an epilepsy advocate.