Category: UNCATEGORIZED

15 Jan 2021

A security researcher commandeered a country’s expired top-level domain to save it from hackers

In mid-October, a little-known but critically important domain name for one country’s internet space began to expire.

The domain — scpt-network.com — was one of two nameservers for the .cd country code top-level domain, assigned to the Democratic Republic of Congo. If it fell into the wrong hands, an attacker could redirect millions of unknowing internet users to rogue websites of their choosing.

Clearly, a domain of such importance wasn’t supposed to expire; someone in the Congolese government probably forgot to pay for its renewal. Luckily, expired domains don’t disappear immediately. Instead, the clock started on a grace period for its government owners to buy back the domain before it was sold to someone else.

By chance, Fredrik Almroth, a security researcher and co-founder of cybersecurity startup Detectify, was already looking at nameservers of country code top-level domains (or ccTLDs), the two-letter suffixes at the end of regional web addresses, like .fr for France or .uk for the United Kingdom. When he found this critical domain name was about to expire, Almroth began to monitor it, assuming someone in the Congolese government would pay to reclaim the domain.

But nobody ever did.

By the end of December, the clock was almost up and the domain was about to fall off the internet. Within minutes of the domain becoming available, Almroth quickly snapped it up to prevent anyone else from taking it over — because, as he told TechCrunch, “the implications are kind of huge.”

It’s rare but not unheard of for a top-level domain to expire.

In 2017, security researcher Matthew Bryant took over the nameservers of the .io top-level domain, assigned to the British Indian Ocean Territory. But malicious hackers have also shown interest in targeting top-level domains hack into companies and governments that use the same country-based domain suffix.

Read more on TechCrunch

Taking over a nameserver is not supposed to be an easy task because they are a vital part of how the internet works.

Every time you visit a website your device relies on a nameserver to convert a web address in your browser to the machine-readable address that tells your device where on the internet to find the site you’re looking for. Some liken nameservers to the phone directory of the internet. Sometimes your browser looks no further than its own cache for the answer, and sometimes it has to ask the nearest nameserver for the answer. But the nameservers that control top-level domains are considered authoritative and know where to look without having to ask another nameserver.

With control of an authoritative nameserver, malicious hackers could run man-in-the-middle attacks to silently intercept and redirect internet users going to legitimate sites to malicious webpages.

These kinds of attacks have been used in sophisticated espionage campaigns aimed at cloning websites to trick victims into handing over their passwords, which hackers use to get access to company networks to steal information.

Worse, Almroth said with control of the nameserver it was possible to obtain valid SSL (HTTPS) certificates, allowing for an attacker to intercept encrypted web traffic or any email mailbox for any .cd domain, he said. To the untrained eye, a successful attacker could redirect victims to a spoofed website and they would be none the wiser.

“If you can abuse the validation schemes used to issue certificates, you can undermine the SSL of any domain under .cd as well,” Almroth said. “The capabilities of being in such a privileged position is scary.”

Almroth ended up sitting on the domain for about a week as he tried to figure out a way to hand it back. By this point the domain had been inactive for two months already and nothing had catastrophically broken. At most, websites with a .cd domain might have taken slightly longer to load.

Since the remaining nameserver was running normally, Almroth kept the domain offline so that whenever an internet user tried to access a domain that relied on the nameserver under his control, it would automatically timeout and pass the request to the remaining nameserver.

In the end, the Congolese government didn’t bother asking for the domain back. It spun up an entirely new but similarly named domain — scpt-network.net — to replace the one now in Almroth’s possession.

We reached out to the Congolese authorities for comment but did not hear back.

ICANN, the international non-profit organization responsible for internet address allocation, said country code top-level domains are operated by their respective countries and its role is “very limited,” a spokesperson said.

For its part, ICANN encouraged countries to follow best practices and to use DNSSEC, a cryptographically more secure technology that makes it nearly impossible to serve up spoofed websites. One network security engineer who asked not to be named as they were not authorized to speak to the media questioned whether DNSSEC would be effective at all against a top-level domain hijack.

At least in this case, it’s nothing a calendar reminder can’t solve.

15 Jan 2021

How Twitter is handling the 2021 US presidential transition

Twitter has set out its plans for US Inauguration Day 2021, next Wednesday, January 20, when president-elect Joe Biden will be sworn into office as the 46th US president and vice president-elect Kamala Harris will become VP.

“This year, multiple challenging circumstances will require that most people experience this historic ceremony virtually,” the social media firm writes in a blog post detailing how it will handle the transition of power on its platform as the Trump administration departs office.

“As Twitter will serve as both a venue for people to watch and talk about this political event, and play a key role in facilitating the transfer of official government communication channels, we want to be transparent and clear about what people should expect to see on the platform.”

The inauguration will of course be livestreamed via Twitter by multiple accounts (such as news outlets), as well as the official inauguration accounts, @JCCIC and @BidenInaugural.

Twitter will also be streaming the ceremony via its US Elections Hub, where it says it will share curated Moments, Lists and accounts to follow as well.

Once sworn into office, Biden and Harris will gain control of the @POTUS and @VP Twitter accounts. Other accounts that will transition to the new administration on the day include @WhiteHouse, @FLOTUS and @PressSec.

Twitter has also confirmed that Harris’ husband, Douglas Emhoff, will use a new official account — called @SecondGentleman. (It’s not clear why not ‘SGOTUS’; aside from, well, the unloveliness of the acronym.) 

As it did when president Obama left office, Twitter will transfer the current institutional accounts of the Trump administration to the National Archives and Records Administration (Nara) — meaning the outgoing administration’s tweets and account history will remain publicly available (with account usernames updated to reflect their archived status, e.g. @POTUS will be archived as @POTUS45).

However Trump’s personal account, which he frequently used as a political cudgel, yelling in ALL CAPS and/or spewing his customary self-pitying tweets, has already been wiped from public view after Twitter took the decision to permanently ban him last week for repeat violations of its rules of conduct. So there’s likely to be a major gap in Nara’s Trump archive.

Since late last year we’ve known the transitioning @POTUS and institutional accounts will not automatically retain followers from the prior administration. But Twitter still hasn’t confirmed why.

Today it just reiterated that the current (33.3M) followers of @POTUS and the other official accounts will receive a notification about the archival process which will include the “option” to follow the new holders of the accounts.

That’s another notable change from 2017 when Trump inherited the ~14M followers of president Obama’s @POTUS. Biden will instead have to start his presidential tweeting from scratch.

Given the chaotic events in the US capital last week, when supporters of the outgoing president broke through police lines to cause mayhem on the hill and in the House, there’s every reason for tech platforms to approach the 2021 transition with trepidation, lest their tools get used to livestream another historic insurrection (or worse).

Since then Trump has also continued to maintain his false claim that the election was stolen through voter fraud.

Although he avoided any new direct reference to this big lie when he circumvented Twitter’s ban on his personal account earlier this week, by posting a new video of himself speaking on the official @WhiteHouse account.

In the video he decried the “incursion at the US capital”, as he put it; claimed that he “unequivocally condemns the violence that we saw last week”; and called for unity. But Twitter has put tight limits on what Trump can say on its platform without having his posts removed (as well limiting him to the official @POTUS channel). So he remains on a very tight speech leash.

In the video Trump limits his verbal attacks to a few remarks — about what he describes as “the unprecedented assault on free speech we have seen in recent days” — dubbing tech platforms’ censorship “wrong” and “dangerous”, and adding that “what is needed now is for us to listen to one another, not to silence one another”.

There’s a lot going on here but it should not escape notice that Trump’s seeming contrition and quasi-concession and his very-last-minute calls for unity have only come when he actively feels power draining away from him.

Most notably, his call for unity has only come after powerful tech platforms acted to shut off his hate-megaphone — ending the years of special dispensation they granted Trump to ride roughshod over democratic convention and tear up the civic rulebook.

It’s very interesting to speculate how different the 2021 US inauguration might look and feel if platforms like Twitter had consistently enforced their rules against Trump from the get-go.

Instead we’re stuck in all sorts of lockdown, counting the days til Biden takes office — and above all hoping for a smooth transition of power.

So Twitter CEO Jack Dorsey is quite right when he said this week that Twitter has failed to promote healthy conversation. His company ignored warnings about online toxicity for years. And Trump is, in no small part, the divisive product of that. 

In a brief section of Twitter’s transition handling blog post, entitled “protecting the public conversation”, the company refers back to a post from earlier this week where it set out steps it’s taking to try to prevent its platform from being used to “incite violence, organize attacks, and share deliberately misleading information about the election outcome”.

Including permanently suspending ~70,000 accounts it said were primarily dedicated to sharing content related to the QAnon conspiracy theory; aggressively beefing up its civic integrity policy; and applying interaction limits on labeled tweets plus blocking violative keywords from appearing in Trends and search.

“These efforts, including our open lines of communication with law enforcement, will continue through the inauguration and will adapt as needed if circumstances change in real-time,” it adds.

15 Jan 2021

OneWeb picks up $1.4B more from SoftBank and Hughes to help fund its first satellite fleet

After a troubled year that saw broadband satellite operator OneWeb file for bankruptcy, get rescue finance from the UK government and Bharti, and then emerge out of that with a launch of part of its fleet last month, the London-based company today announced a another $1.4 billion in funding — money that it says will be enough to (finally) get the rest of its first-generation fleet of 648 satellites off the ground.

The 36 new satellites OneWeb launched in December brought the total number in orbit to 110 satellites, so there are still more than 500 left to launch.

SoftBank Group Corp. and Hughes Network Systems are providing the financing, the company said. The news comes about a month after OneWeb launched 36 satellites, its third launch to put more of its fleet into orbit. At the time, its executive chairman Sunil Bharti Mittal said that it was on track to raise $400 million — so this represents a more-than threefold increase on that amount.

“OneWeb’s mission is to connect everyone, everywhere. We have made rapid progress to re-start the business since emerging from Chapter 11 in November,” said Neil Masterson, CEO of OneWeb, in a statement. “We welcome the investments by SoftBank and Hughes as further proof of progress towards delivering our goal.”

SoftBank and Hughes are both past backers and partners in OneWeb, so this is something of an insurance policy to make sure that its previous investment doesn’t go completely to waste. (At least some of it has already been written down: SoftBank years ago posted an eye-watering loss of $24 billion due in part to that OneWeb bet.)

Hughes, meanwhile, invests via its parent company EchoStar and inked a deal with the company way back in 2017 to build the terrestrial infrastructure that would work with OneWeb’s satellites. Deals, building and rollouts in the world of satellite technology play out over a number of years, and often face delays, so being three years out — or even more — on seeing any fruits from that deal is not hugely surprising.

OneWeb acknowledged the long-time connection between the investors and confirmed that the ground network is still being built by Hughes.

“We are delighted to welcome the investment from SoftBank and Hughes. Both are deeply familiar with our business, share our vision for the future, and their commitment allows us to capitalise on the significant growth opportunity ahead for OneWeb,” said Mittal in a statement. “We gain from their experience and capabilities, as we deliver a unique LEO network for the world.”

Originally, Hughes had planned for the first services to start running in 2019 — although that was when OneWeb and its fleet of LEO (low-earth orbit) satellites was still a very shiny idea, backed by $1.7 billion in venture funding.

The company’s original idea was always great but (no pun intended) also something of a moonshot: LEO satellites have already been proven to be a strong and useful complement to terrestrial networks for providing broadband connectivity to more remote areas that couldn’t be reached in other ways. The idea with OneWeb was to make that service something useful and used by a much bigger group of on-the-ground users, with the promise being 400Mbps for everyone.

While broadband usage has certainly exploded in the interim, what OneWeb perhaps didn’t bank on was that those building non-satellite systems for providing connectivity would also be progressing in their network advances; nor how long it might take, or the financing needed, to get its fleet off the ground on the timelines it was promising.

These days, OneWeb says that growing ubiquity of 5G, Internet of Things and connectivity needs overall still present a strong use case for its approach — which it says “includes a network of global gateway stations and a range of user terminals for different customer markets capable of delivering affordable, fast, high-bandwidth and low-latency communications services.”

Secretary of State, BEIS, The Rt. Hon. Kwasi Kwarteng, said in a statement: “Our investment in OneWeb is part of our continued commitment to the UK’s space sector, putting Britain at the forefront of the latest technological advances. Today’s investment brings the company one step closer to delivering its mission to provide global broadband connectivity for people, businesses and governments, while potentially unlocking new research, development and manufacturing opportunities in the UK.”

SoftBank is getting a seat on OneWeb’s board with this deal.

“We are excited to support OneWeb as it increases capacity and accelerates towards commercialisation,” said Masayoshi Son, Representative Director, Corporate Officer, Chairman & CEO of SoftBank, in a statement. “We are thrilled to continue our partnership with Bharti, the UK Government and Hughes to help OneWeb deliver on its mission to transform internet access around the world.”

Pradman Kaul, President of Hughes, added: “OneWeb continues to inspire the industry and attract the best players in the business to come together to bring its LEO constellation to fruition. The investments made today by Hughes and SoftBank will help realise the full potential of OneWeb in connecting enterprise, government and mobility customers, especially with multi-transport services that complement our own geostationary offerings in meeting and accelerating demand for broadband around the world.”

15 Jan 2021

Trump Administration adds Xiaomi to military blacklist

Chinese smartphone maker Xiaomi is the latest to be added to the Trump Administration’s military blacklist. On Thursday, the Department of Defense added nine more companies to its list of alleged Chinese military companies, including Xiaomi, the world’s third-largest smartphone maker as of Q3 last year.

More to come…

14 Jan 2021

A theory about the current IPO market

As expected, shares of Poshmark exploded this morning, blasting over 130% higher in afternoon trading from the company’s above-range IPO price of $42. The enormous and noisy debut of Poshmark comes a day after Affirm, another IPO, was treated similarly by the public markets.

Both explosive debuts were preceded by huge December debuts from C3.ai, Doordash and Airbnb. It seems today that any venture-backed company that can claim some sort of tech mantle is being treated to a strong IPO pricing run and a huge first-day result.

This is, of course, annoying to some people. Namely, certain elements of the venture capital community who would prefer to keep all outsized gains in their own pockets. But, no matter. You might be wondering what is going on. Let’s talk about it.

Here’s how you get a 130% first-day IPO pop

TechCrunch has covered the IPO window as closely as we can over the last few years. And the late-stage venture capital markets, along with the changing value of tech stocks and the huge boom in consumer (retail) investing.

Based on my participation in as much of that reporting as I could take part in here’s how you get a 130% first-day IPO pop in a company that has actually been around long enough for investors to math-out reasonable growth and profit expectations for the future:

  1. Exist in a climate of near-zero interest rates. This leads to super-cheap money, bonds being shit and no one wanting to hold cash. Lots of dollars go into more speculative assets, like stocks. And lots of money goes into exotic investments, like venture capital funds.
14 Jan 2021

Daily Crunch: Samsung unveils Galaxy S21 line

Samsung lowers prices with its latest Galaxy S phones, Google completes its Fitbit acquisition and Beyond Meat is coming to Taco Bell. This is your Daily Crunch for January 14, 2021.

The big story: Samsung unveils Galaxy S21 line

Samsung’s new line of phones includes the S21, S21+ and S21 Ultra, priced at $799, $999 and $1,119 respectively, an across-the-board price cut of $200. Brian Heater writes that the Ultra, in particular, “has one very important trick up its sleeve” — namely compatibility with the S Pen.

All three phones are available for pre-order now and start shipping on January 29.

In addition, Samsung announced the Galaxy Buds Pro, which cost $199 and come with a stated five hours of battery life. And it’s launching a Bluetooth locator, dubbed the Galaxy SmartTag.

The tech giants

Google’s Fitbit acquisition is official — This follows regulatory scrutiny on both sides of the pond.

Amazon’s Ring Neighbors app exposed users’ precise locations and home addresses — The bug made it possible to retrieve the location data on users who posted to the app.

Beyond Meat shares soar after inking deal with Taco Bell on new menu items — Taco Bell announced that it would work with Beyond Meat to come up with new menu items due to be tested in the next year.

Startups, funding and venture capital

Medium acquires social book reading app Glose — Glose has been building iOS, Android and web apps that let you buy, download and read books on your devices.

Tiger Global is raising a new $3.75B venture fund, one year after closing its last — Despite being named Tiger Private Investment Partners XIV, this is actually the firm’s thirteenth fund.

Carbyne raises $25M for a next-generation platform to improve emergency 911 responses — The Israeli startup aims to help emergency services get more complete information about callers, and to provide additional telemedicine services.

Advice and analysis from Extra Crunch

Five consumer hardware VCs share their 2021 investment strategies — Investors are generally bullish on at-home fitness startups.

Poshmark prices IPO above range as public markets continue to YOLO startups — This is the late-2020, early-2021 IPO market in action.

Twelve ‘flexible VCs’ who operate where equity meets revenue share — Founders seeking non-dilutive funding: start here.

(Extra Crunch is our membership program, which aims to democratize information about startups. You can sign up here.)

Everything else

Tech and health companies including Microsoft and Salesforce team up on digital COVID-19 vaccination records — The so-called “Vaccination Credential Initiative” includes a range of big-name companies from both the healthcare and tech industries.

2020 was one of the warmest years in history and indicates mounting risks of climate change — 2020 either edged out or came in just behind 2016 as the warmest year in recorded history, according to data from U.S. government agencies.

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 3pm Pacific, you can subscribe here.

14 Jan 2021

The end of Plaid-Visa, and Palantir’s growing startup mafia

Hello and welcome back to Equity, TechCrunch’s venture-capital-focused podcast, where we unpack the numbers behind the headlines.

This week we — Natasha and Danny and Alex and Grace — had a lot to get through, as the news volume in early 2021 has been rapid, and serious. Sadly this means that some early-stage rounds missed the cut, though we did make sure to have some Series A material in the show.

So, what did we the assembled crew get to? Here’s your cheat-sheet:

  • As is Talkspace, the tele-therapy startup that you’ve heard of.
  • And then there was SoftBank, of course, which has its own SPAC in the market now, confirming earlier reports. Which makes perfect sense.

There are so many SPACs and bits of IPO news and funding rounds to pick through and cover that we’re already straining the time limits of the show to even cover half of the material. This week that meant that we excised a chunk of the show to a forthcoming Saturday episode that is focused on e-commerce.

So, we will talk to you again soon!

Equity drops every Monday at 7:00 a.m. PST and Thursday afternoon as fast as we can get it out, so subscribe to us on Apple PodcastsOvercastSpotify and all the casts.

14 Jan 2021

Capsule raises $2 million for its video Q&A platform aimed at brands

Capsule, a video Q&A platform aimed at brands, emerged last year in direct response to the challenges companies were facing in terms of reaching consumers during the pandemic. Now, the business has closed on $2 million in pre-seed funding. The round was led by Array Ventures and included participation from Bloomberg Beta and other angels.

The startup was founded by the same team that originally created the animated GIF capture tool and social network Phhhoto, which eventually lost out to Instagram’s clone, Boomerang. Phhhoto shut down in 2017 and the team pivoted to work on an experiential marketing business, Hypno. The new company had been working with brands that hosted live events and experiences as a way to connect with customers. Hypno would offer them things like photo booths and other camera platforms that allowed for interactivity.

The COVID-19 pandemic essentially killed Hypno’s business as live events dried up. However, the brands Hypno had worked with still had the same needs — they just had to go about reaching their customers in a different way.

Image Credits: Capsule

That’s how Capsule came to exist. Launched last year, the startup offers a full platform for hosting Q&A sessions, where the brand starts with a template that they then customize to match their campaign by changing the logo, colors, buttons, background and URLs — sort of a like a Squarespace for the video Q&A format.

The brand will then write their questions and prompts for consumers to answer, in the form of short video responses. This Q&A URL is distributed however the company chooses — like on social media, for example. A new feature also allows a “capsule” to be embedded on the website.

The consumers’ responses to the Q&A are curated for the final video product. What makes the technology even more interesting is how Capsule assembles this footage.

Capsule instantly and automatically processes the video, adding elements like music and graphics, pre-roll or post-roll, which makes the resulting video appear professionally edited. The startup does this by using its own JavaScript-based programming language that automates mixing of things like color, audio, graphics and dynamic type. All the customer has to do is select the kind of video they want — like one with an energetic feel or a more somber one, for instance.

Today, Capsule has grown its library to about 20 base templates. But each of these can be edited by changing colors, styles and even the music — including either from direct uploads or from thousands of royalty-free tracks Capsule provides.

 

According to Capsule co-founder Champ Bennett, the platform’s flexibility has led to a wide range of use cases. Though the company’s first customers had come from the live events space that Hypno had catered to, new customers soon began to adopt the product.

“What we immediately started to hear from both our existing customers and then, suddenly, a bunch of new customers that were coming our way, is that the platform was useful in so many different contexts,” he explains. “For example, UGC [user-generated content] campaigns or generating social content to promote a business, or awareness, or product reviews and testimonials, or even creators who just wanted a faster way to make content that looked and felt a little bit more professional,” Bennett says.

At launch, Capsule was used by companies like Netflix and organizations like OkayAfrica. It’s since landed contracts with hundreds of customers, including teams inside larger organizations like Google, Samsung, Salesforce, Deloitte and The Wall Street Journal, along with other small-to-medium businesses, like Paloma Health. The USO has also used Capsule.

These brands and others are especially hungry for tools that help them create original, short-form video content, which is becoming a key way businesses are marketing their products and services. Capsule notes that studies have indicated video click-through rates are two-three times higher than static images and 95% of businesses are reporting an increase in their video spend year-over-year.

The pandemic had accelerated the existing demand for video content, but brands faced challenges in terms of video being difficult to scale.

“Increasingly, brands have started to kind of hack the way that they can create video,” says Bennett. “And one of the ways they’re doing that is by tapping into different creators within their organizations — whether it’s employees or founders or partners or influencers or fans of the brand or whatever it is — then activating them to create content on their behalf,” he continues. “We call this community-generated content, which is sort of like an iteration on user-generated content. It’s this idea that content can come from anywhere.”

Capsule says it wanted to work with Array Ventures GP Shruti Gandhi, who has an engineering background, because she very deeply understood the core technology. She introduced the team to Bloomberg Beta in New York, which also immediately understood what Capsule was building, Bennett says.

With the additional funds, Capsule will be hiring a product designer and will be developing new collaboration features, like the ability to upvote content.

Longer-term, the company believes its platform will enable more people to get involved with video creation.

“It turns out that there are so many different people within businesses who are capable of creating video content. They just don’t have the technical know-how to do it. They’re not video editors,” Bennett says. “So what we’re really doing is untapping this creative potential that exists inside of businesses everywhere, small and large.”

14 Jan 2021

12 ‘flexible VCs’ who operate where equity meets revenue share

Previously, we introduced the concept of flexible VC: structures that allow founders to access immediate risk capital while preserving exit and ownership optionality. We list here all the active flexible VCs we have identified, broken into these categories:

  • Revenue-based
  • Compensation-based
  • Blended-return streams

Revenue-based flexible VCs

These investors are paid back primarily based on a percentage of revenues.

Capacity Capital

Chattanooga, TN-based Capacity Capital was launched in 2020 with a primary focus on the southeastern U.S. Jonathan Bragdon, its CEO, describes Capacity as “a team of founders-turned-funders making non-dilutive, founder-aligned investments of $50,000-$300,000 in post-startup, post-revenue businesses planning to 2x revenues in 12-24 months. Investments are typically in exchange for a capped, single-digit revenue share and a right to equity under certain circumstances.

If the company sells or raises enough capital, the investment converts into an agreed-upon percentage of equity. If the company grows without raising additional equity funding, founders redeem most of the equity right, based on a pre-agreed return amount. With a portfolio that includes food, tech and services, the fund is industry-agnostic and focused on the overlooked and underrepresented with high-margin business models.”

Jonathan sometimes refers to their investments as “micro-mezzanine” because “mezz is typically structured as a contractual periodic payment, with some equity-like upside, but subordinate to other debt … so most lenders look at it like equity. But, it is typically shorter term with fewer control mechanisms than equity (i.e., not VC). I wanted [a term for] something similar (between debt and equity) but on an extremely small scale.”

In addition to a fund, the overall Capacity organization provides direct mentorship, consulting and connects founders to a broad network of talent, diverse forms of capital and existing resources focused on the post-startup stage of growth. The founders, LPs and venture partners have a long history in local startup ecosystems in the Southeast including LaunchTN, The Company Lab, CO.STARTERS and several other regional funds and resources.

Greater Colorado Venture Fund

Greater Colorado Venture Fund (GCVF) is a $17 million seed fund that invests in high-growth startups in rural Colorado using equity and flexible VC structuring.

A typical GCVF flexible VC investment is $100,000-$250,000 for up to 10% ownership, of which 9% is redeemable, with a sub-10% revenue share and 12-month-plus holiday period. GCVF specializes in providing critical support to founders based in small communities, while connecting them to an unfair network well-beyond their small-town headquarters.

GCVF is pioneering the future of venture capital and high-growth startups for all small communities. With Colorado as an ideal pilot community, the GCVF team (which includes Jamie Finney, a co-author of this article) has helped grow multiple staple initiatives in the rural Colorado startup ecosystem, including West Slope Startup Week, Telluride Venture Accelerator, Startup Colorado, Energize Colorado Gap Fund and the Greater Colorado Pitch Series.

Recognizing the need for creative investment structures in their Colorado market, they co-founded the Alternative Capital Summit, creating the first community of flexible VCs and alternative startup investors.

They share their learnings on flexible VC and pioneering rural startup ecosystems on the GCVF blog.

14 Jan 2021

Home services platform Porch acquires four companies

Only a few weeks after its SPAC IPO, Porch today announced that it has made four acquisitions, worth a total of $122 million. The most important here is probably the acquisition of Homeowners of America for $100 million, which gets Porch deeper into the home insurance space. In addition, Porch is also acquiring mover marketing and data platform V12 for $22 million, as well as home inspection service Palm-Tech and iRoofing, a SaaS application for roofing contractors. Porch did not disclose the acquisition prices for the latter two companies.

You may still think of Porch as a marketplace for home improvement and repair services — and that’s what it started out as when it launched about seven years ago. Yet while it still offers those services, a couple of years after its 2013 launch, the company pivoted to building what it now calls a “vertical software platform for the home.” Through a number of acquisitions, the Porch Group now includes Porch.com, as well as services like HireAHelper, Inspection Support Network for home inspectors, Kandela for providing services around moving and an insurance broker in the form of the Elite Insurance Group. In some form or another, Porch’s tools are now used — either directly or indirectly — by two-thirds of U.S. homebuyers every month.

Porch founder and CEO Matt Ehrlichman. Image Credits: Porch

As Porch founder and CEO Matt Ehrlichman told me, he had originally planned to take his company public through a traditional IPO. He noted that going the increasingly popular SPAC route, though, allowed him to push his timeline up by a year, which in turn now enables the company to make the acquisitions it announced today.

“In total, we had a $323 million fundraise that allows us now to not only be a public company with public currency, but to be very well capitalized. And picking up that year allows us to be able to go and pursue acquisitions that we think make really good fits for Porch,” Ehrlichman told me. While Porch’s guidance for its 2021 revenue was previously $120 million, it’s now updating that guidance to $170 million based on these acquisitions. That would mean Porch would grow its revenue by about 134% year-over-year between 2020 and 2021.

As the company had previously laid out in its public documents, the plan for 2021 was always to get deeper into insurance. Indeed, as Ehrlichman noted, Porch these days tends to think of itself as a vertical software company that layers insurtech on top of its services in order to be able to create a recurring revenue stream. And because Porch offers such a wide range of services already, its customer acquisition costs are essentially zero for these services.

Image Credits: Homeowners of America

Porch was already a licensed insurance brokerage. With Homeowners of America, it is acquiring a company that is both an insurance carrier as well as a managing general agent..

“We’re able to capture all of the economic value from the consumer as we help them get insurance set up with their new home and we can really control that experience to delight them. As we wrap all the technology we’ve invested in around that experience we can make it super simple and instant to be able to get the right insurance at the right price for your new home. And because we have all of this data about the home that nobody else has — from the inspection we know if the roof is old, we know if the hot water system is gonna break soon and all the appliances — we know all of this data and so it just gives us a really big advantage in insurance.”

Data, indeed, is what a lot of these acquisitions are about. Because Porch knows so much about so many customers, it is able to provide the companies it acquires with access to relevant data, which in turn helps them offer additional services and make smarter decisions.

Homeowners of America is currently operating in six states (Texas, Arizona, North Carolina, South Carolina, Virginia and Georgia) and licensed in 31. It has a network of more than 800 agencies so far and Porch expects to expand the company’s network and geographic reach in the coming months. “Because we have [customer acquisition cost]-free demand all across the country, one of the opportunities for us is simply just to expand that across the nation,” Ehrlichman explained.

As for V12, Porch’s focus is on that company’s mover marketing and data platform. The acquisition should help it reach its medium-term goal of building a $200 million revenue stream in this area. V12 offers services across multiple verticals, though, including in the automotive space, and will continue to do so. The platform’s overall focus is to help brands identify the right time to reach out to a given consumer — maybe before they decide to buy a new car or move. With Porch’s existing data layered on top of V12’s existing capabilities, the company expects that it will be able to expand these features and it will also allow Porch to not offer mover marketing but what Ehrlichman called “pro-mover” services, as well.

“V12 anchors what we call our marketing software division. A key focus of that is mover marketing. That’s where it’s going to have, long term, tremendous differentiation. But there are a number of other things that they’re working on that are going to have really nice growth vectors, and they’ll continue to push those,” said Ehrlichman.

As for the two smaller acquisitions of iRoofing and Palm-Tech, these are more akin to some of the previous acquisitions the company made in the contractor and inspection verticals. Like with those previous acquisitions, the plan is to help them grow faster, in part through integrating them into the overall Porch group’s family of products.

“Our business is and continues to be highly recurring or reoccurring in nature,” said Porch CFO Marty Heimbigner. “Nearly all of our revenues, including that of these new acquisitions, is consistent and predictable. This repeat revenue is also high margin with less than 20% cost of revenue and is expected to grow more than 30% per year on our platform. So, we believe these deals are highly accretive for our shareholders.”