Category: Cybersecurity

What Everyone Should Know Before Facebook’s Q3 Earnings Call

Posted on by io-fund

Facebook’s earnings call today may be the most anticipated call of Q3. The stock has tumbled since the last quarterly earnings call from a high of $217 in July to a low of $142. Three months ago, Street analysts did not think this was possible – and many still have price targets at $200. I believe bullish financial analysts are distracted by Facebook’s security costs, news feed fatigue and Instagram while underestimating the most important number on Facebook’s earnings call tomorrow –user growth rate.

Background on Facebook’s User Growth Trajectory

Facebook’s rampant growth from 2004-2017 was due to a viral coefficient formula which is also known as the k-factor. The k-factor equation was taken from epidemiology, in which a virus that has a k-factor greater than 1 indicates exponential growth. The equation for virality for websites and applications describes the growth rate:

k = i * c

i = number of invites
C = conversion rate

When K is equal to one or greater, you have viral growth.

Facebook’s growth rate trajectory was exponential because people found the network more rewarding when more people they knew joined the network. The same will be true for Facebook’s deceleration, as well. As people start to spend less time on the social network, there will be viral deceleration.

To illustrate, a loss of 1 million users in the United States to Facebook is not a 1:1 loss, like it would be for Netflix or Google, where users are isolated from each other in a “silo.”

  • If I stop using Google, your search results are not affected.
  • If I stop using Netflix, your programming choices are not affected.
  • Even Twitter can withstand user loss as the platform is not based on a reciprocal following structure. This is why a celebrity can have 60 million followers, yet only follow 135 people in return.

If 1 million users close their Facebook accounts in the United States, however, it will be subject to a negative k-factor. These 1 million people who delete their accounts weaken the content on the platform for the 50 million-500 million people who were connected to them (assuming each user has at least 100 friends and some are inter-connected).

Now, if 2 million of the subsequent 50-500 million start to use Facebook less due to the impact the original 1 million had, then another 500 million to 1 billion will have a less enjoyable experience, which will reduce time on site. If 5 million from those 500 million find the platform less interesting because their favorite people have left the platform, the affects will continue to spiral.

My newsletter subscribers get this information first. Sign up here.My newsletter subscribers get this information first. Sign up here.here.

This is why Snap has been a popular short. Snapchat continues to lose daily active users on a quarter-over-quarter basis in North America and Europe. Only last May, Snap began to report a sinking growth rate of 2.13 percent – which was its slowest ever at the time compared to 5 percent in Q4 2017. See below for how Facebook’s user growth rate compares.

It should be noted that this was once Facebook’s strength and Twitter’s weakness. New users on Facebook had a low barrier to entry because total friend count grew relative to how much you reciprocate and follow back. Twitter, on the other hand, has had a tough time attracting new users because there is no reciprocation.

Facebook Reported Slowest-ever User Growth Rate in Q2 2018

The viral-coefficient-in-the-reverse explains why the most important metric for investors to pay attention to in Facebook’s earnings report is the user growth rate. Last quarter, Facebook’s monthly user count grew 1.54 percent compared to 3.14 last quarter. Daily active users grew even slower at 1.44 percent, compared to 3.42 percent last quarter. Previously, the slowest daily active user growth rate was 2.18 percent in Q4 2017. If this number becomes stagnant, the social media platform can decelerate very quickly. This is also why it’s possible for Facebook to report strong earnings and there still be a sell-off. If and when this number goes into the red, Facebook will have reached its peak as a social media platform –and profits will soon follow this trailing decline.

Disclosure: I shorted this stock in April of 2018 and have a put option on this stock as of October 2018 as I expect the user growth rates to continue to decline in the near future. Readers should also note these declines are more likely to occur in high average revenue per user markets (ARPU) such as the United States, Canada, and in Europe.

Read more analysis on how I predicted Facebook earnings prior to Q2 and analyzed Facebook would face GDPR trouble following Q1 2018 here.

I consult for financial firms. Inquire here.

Who is Responsible for the Data Security of 50 Billion IoT Connections?

Posted on by io-fund

This article originally appeared on IAPP.org, the International Association of Privacy Professionals.

“No matter what happens, don’t panic,” were the words used by hackers just before they hacked a 2014 Jeep Cherokee. It wasn’t your typical hack, where credit card information is stolen, or a denial of service attack is propagated, or a website is taken down. This incident involved disabling the transmission and brakes of a vehicle driving 70 mph. In other words, this is the kind of hack that could take someone’s life.

Car hacks make juicy headlines, but dating back as far as 2007, we saw researchers demonstrate how a generator could be destroyed. In 2014, hackers broke into a German steel mill and prevented a blast furnace from being shut down. As recent as last year, Norse and the SANS Institute released a study revealing 375 U.S. health care organizations were actively compromised between September 2012 and October 2013.

As the Electronic Frontier Foundation recently pointed out, the old security paradigm “felt that human beings were the problem and tech is the solution.” What the internet of things pushes forward is a reversal on the old paradigm that humans are the solution to the problem that technology creates.

If we look closer at the human supply chain and data security for IoT, there are three key players: manufacturers, developers and end users.

Here’s how they can advance the future with foresight (rather than the proverbial hindsight):

1)   Manufacturers

We are finding that many manufacturers can engineer connected parts but do not have the security staff or experience to protect the features. Automotive and medical device companies release embedded systems with no one on staff to respond to a vulnerability report.

The product cycle typically looks like this: The manufacturers have a limited budget, as with all product releases, their primary goal is user adoption – not security. As the researchers and hackers find security flaws, user adoption is increasing, and the manufacturer has to release a patch or issue a recall. By this time, cybercriminals have an open opportunity to exploit the embedded system or flawed IoT gateway.

Original equipment manufacturers should focus on security from the product design stage, which will involve additional in-house security professionals or dedicated partners. With an average of 25 vulnerabilities per device, interconnectivity demands rigorous protection. One approach to improve the R&D cycle is to generate more revenue from the IoT device in order to invest early in more security checkpoints. One medical device company saw 10 to 20 times the revenue when opting to give a device away for free and charge monthly, moving from charging for IoT products to IoT services. This move helps incentivize the manufacturer to keep the device or embedded system on the market.

Also, to lump all manufacturers together would be a mistake. Many large software companies who have always handled security well will continue to do so – no matter the number of connections or level of proliferation. Apple tends to be a front runner on how they handle security, however, manufacturers can learn to lean more on legacy-level security companies to help test, iterate or secure, post-production, the connections and systems they release. “Leave it to the experts” is as true now as ever.

2)   Developers

Nearly 40 percent of large companies, including Fortune 500 companies, are not taking proper precautions to secure the apps they build for customers. On average, large organizations spend $34 million on mobile app development, of which only 5.5 percent is allocated to ensure that mobile apps are secure. Much more attention and focus is given to design even as we see the number of cyber attacks grow. And if those numbers seem shocking, consider that 50 percent of the organizations devote zero dollars to mobile security.

The mobile hackers we see today are able to break into highly valuable data through the insecure app or public WiFi networks. The mobile app hacks of tomorrow are those of embedded automotive IoT systems, flying drones (weighing up to 50 lbs), medical devices and other high-risk devices. Fundamentally, the IoT is about core components such as sensors for measuring temperature or wind speed and actuators to initiate driving a car or injecting insulin. As more and more gateways and apps connect to these core components, especially those in motion such as vehicles and drones, we will have a sudden and urgent need for developers to consider security testing imperative.

The IoT gateway is a device in the field responsible for gathering data from sensors and communicating with actuators. These are installed in homes, control systems and automobiles. One solution is to create a security framework that uses public key cryptography to authenticate communication between remote devices and gateways. This will prevent both data access and also unauthorized signals. Another fix for developers, according to Luca Dazi, who presented at the JavaOne Conference in October 2015, is to employ a framework that uses public-key cryptography to certify new software updates before installation. Lastly, another security step is to generate unique passwords for each device to provide different variants that are combined to generate the master password.

Beyond individual efforts, open source communities also cannot be underestimated. The idea of inviting your peers to help you find the vulnerabilities in your software or app build is quite powerful, and an open source community may be the right antidote for a porous ecosystem of this magnitude.

3)   End Users

What responsibility does the end user have, if any?

It would be difficult to rely on end-user education, rather than a push for open standards, protocols and industry organizations playing the role in IoT privacy and security. For instance, when you buy a phone charger, you don’t expect to have to do your own testing to make sure it is safe, you just look for a Underwriter’s Laboratory code on it. The way this would translate into IoT security would be to bake the open standards and protocols into the products as a matter of course, and standard bodies would then make sure the devices comply with security.

As always, end-user trust will be a key differentiator in the IoT marketplace.

5 Ways Hackers Attack Mobile Devices and Applications

Posted on by io-fund

Hackers go about achieving their goals with reverse engineering software to find vulnerabilities they can exploit, data they can extract, or ways to modify the software to do something it was never intended to do. The primary consequences of applications getting hacked include financial loss, destroyed brand reputation, exposure to liability, and regulatory risk.

Over 7 billion identities have been stolen in data breaches over the last eight years equal to one data breach for every person on the planet. 

Why do Hackers Attack Mobile Devices and Applications?

In order to understand threats, we must understand what hackers are trying to achieve. Hackers will mount different kinds of attacks to achieve different kinds of goals. And so, defending against hackers in the context of application security may involve defending against many different kinds of attacks on your mobile device.

Hackers might be interested in bypassing business logic. For example, they might want to bypass controls that let them cheat at a video game or violate the terms of a software license. Of more serious concern is the potential for hackers to bypass controls in safety critical systems. It is not inconceivable that lives could be at risk if a hacker were able to hack a medical device, connected car or some component of critical infrastructure, such as a wind farm, a coal or nuclear power plant, a power grid, or a water treatment facility.

According to a recent study, automobiles today run systems that have more than 100 million lines of code. Those applications often contain valuable intellectual property, which hackers would rather steal than develop. For example, they might be a competitor or a nation state with inferior technology attempting to improve their own products in order to compete more effectively.

Hackers might also be interested in obtaining valuable pieces of data that are managed within the application, such as music or video, financial data, or privacy sensitive health data.

While data can be protected with cryptography, this only shifts the problem from protecting the data directly to protecting the cryptographic keys. Cryptographic keys are not only used to protect data. They can also be used to create a secure identity for a device.

A device may need such a key to authenticate to a cloud service. If a hacker were able to obtain this secret, they might be able to masquerade as that device or as the owner of the device. Cryptographic keys are also used to establish secure communications. For example, HTTPS is a familiar protocol that uses SSL/TLS to secure communication to websites. If a hacker were able to obtain these keys, they could snoop on or alter supposedly secure communications.

For all of these reasons, hackers are highly motivated to steal cryptographic keys embedded in or controlled by an application.

Sometimes hackers aren’t interested in the application itself, but using the application as a digital stepping stone to try to achieve some other goal. Hackers are often interested in obtaining root access on the device the application is running on, so they can install malware or use the device as a launch pad to attack something else.

Consider the 2016 Mirai botnet that infected web enabled cameras and installed a piece of malware that launched the largest distributed denial of service attack in history against the dynamic domain name service Dyn, causing wide spread internet outages. Those 100,000 cameras were able to launch 1.2 terabytes per second of data at a major piece of the global internet infrastructure. Here the goal of the attacker was not to compromise the webcam directly, but rather to bring down the web services of many companies whose DNS was controlled by Dyn.

Hacking Mobile Devices: Reverse Engineering and Tampering

Hackers employ two fundamental techniques when attacking: reverse engineering and tampering. If the hacker is trying to bypass business logic, they have to find where in the application the business logic resides. That requires reverse engineering. Then they typically must tamper with the application to bypass that logic.

If the hacker is trying to steal intellectual property, sensitive data or cryptographic keys from an application, they have to know where to look in the application. Unless those secrets are obvious, hackers need to reverse engineer the application to find them.

If the hacker is trying to create a stepping stone attack, they often use the workflow shown in Figure 1:

  • First, they find some vulnerability in the application, which again requires reverse engineering;
  • Then, they craft an exploit that takes advantage of that vulnerability;
  • Finally, they attack by launching the exploit to the application.

In a remote attack like the popular SQL injection attack, this may involve sending the message to the application over the internet. But if they have physical access to the device, which with mobile and IoT based systems can be as easy as a trip to the store, then they can directly tamper with the device.

Should We Build a Backdoor into Mobile Devices?

Posted on by io-fund

Two years ago the San Bernardino shooting stirred a debate within the security community regarding warrant-proof encryption. The debate, known as “mobile backdoor access,” refers to exceptional access to encrypted communications and data by law officials. In theory, the Department of Justice wants technologists to “hide a key under the door mat” for law officials to access when they have the proper warrants. However, many security professionals and technologists have resisted this request due to creating weaknesses that are irreversible and require falsified automatic updates which may introduce other vulnerabilities.

Perhaps the biggest conflict for technologists, as pointed out by Herbert Lin, the Senior Research Scholar of Cyber Policy and Security at Stanford, is that anything less than deploying the best security (that is technologically possible) could constitute a neglect of professional obligation and ethics. Last November at the Intertrust LINE event, I had the opportunity to interview Lin, who is on the front lines of this debate. The conflict, as he pointed out in his keynote, exists in whether you can technologically design a system allowing exceptional access that is also secure. The security community says this is not possible while law enforcement says it is possible. Lin argues the parties are not talking about the same thing, as to talk about the same thing will require less-than-maximal security for users and less-than-desired capability for law enforcement (the proverbial grey area). In other words, maximal security is a technology issue, and adequate security is a policy issue — and it’s impossible to use a technical argument to solve policy.

Watch this 2 minute clip by Herbert Lin briefly covering the topic of mobile backdoor access: “Should We Build a Backdoor Into Mobile Devices?”Should We Build a Backdoor Into Mobile Devices?”

In his keynote, Lin poses questions that all sides must eventually answer during this debate and inevitable compromise, including tech vendors and the privacy community.

Questions we must answer for mobile backdoor access:

Questions for Law Enforcement:

· Why is law enforcement unwilling to acknowledge they’re asking the public to accept a lower level of cybersecurity?

· Why has a technical proof of concept not been provided? You think it can exist. Then prove it.

· How often and for what purposes are exceptional access capabilities expected to be used? If it begins for terrorism, when will it end?

Questions for Tech Vendors:

· Why do vendors provide password features if they’re against backdoors? This proves there situations where technologists have decided the benefits outweigh the consequences.

· How would exceptional access stifle innovation? Why should information technology not be subject to regulation? Lin points out technology is often subject to regulatory measures such as seat belts in cars.

Questions for the Privacy Community:

· What is the actual harm of having a back door? There are many people who are worried about being harmed that would not actually be harmed.

· How often are improper exceptional accesses expected to occur? The privacy community has the understanding there are to be zero improper uses, while one in 1 million or one in 10 million is more reasonable.

Click here to view the full keynote by Herbert Lin, entitled “Unresolved Issues Regarding Exceptional Access to Encrypted Data and Communications.”

Thanks for reading.

p.s. Don’t forget to follow me if you enjoyed this article!  On Twitter @Beth_Kindig and on Medium