Israeli CyberSec Drama, Microsoft’s Security Chip, Best Job of 2022, & “YAU”s – ESW #256

Pentera is either the most metal ballpoint EVER, or someone created a company name by combining pen testing with Pantera (RIP Dimebag). This is an interesting trend though. We all knew point-in-time testing wasn't ideal. If you need to lean on a pen testing firm to catch stuff you're missing, you probably need to lean more than once or twice a year...

Herjavec Group and Fishtech combine - Gary Fish's second big merger (Accuvant + Fishnet = Optiv was his first) seems solid on paper. Both founders remain on with significant stakes (CEO and Chairman, respectively). One US-based, one in Canada. Looks like Herjavec group was acquired by a PE firm about a year ago (Apex Funds), which also fits the mold - Blackstone engineered the Optiv deal, which seems like it would have been much larger than this one.

This is an interesting one. We've seen some interesting acquisitions over the past few years. Acquisition by an organization best known for its chain of grocery stores is not the typical cybersecurity exit. Once you start digging into it, it starts to make sense. This company has a number of subsidiaries and has centralized many core business functions, including IT. They also make investments, so the XM Cyber acquisition ticks two boxes: Schwarz adds a high-growth investment to its portfolio, and gets preferred pricing (and maybe roadmap placement) for other Schwarz Group companies.

Another bootstrapped security company gets acquired! RBS is most notably, the home of VulnDB - one of the most comprehensive vulnerability databases in the industry, boasting tens of thousands more vulns than MITRE's CVE.

Attack surface management is heating up! We're approaching half a dozen companies acquired in this area and there are still plenty more to go! $65m for a bootstrapped company? I'd take it.

https://www.calcalistech.com/ctech/articles/0,7340,L-3925876,00.html

A developer of a few popular NPM libraries was upset about a general unwillingness to pay for free software by heavily funded startups and chose to sabotage his own stuff to... teach everyone a lesson? There's a thin line between idealism and extortion here that's worth discussing. Ideally, sure - profitable companies should donate to open source libraries that helped them build products, grow quickly, and become profitable (whether that's actual profits, or repeat rounds of investment). On the other hand, how upset can you be if you create free software and no one pays for it? Another factor here is that the author tried creating a SaaS/PaaS service out of one of his projects and one company simply copied it (which was completely legal, given the license he was using).

#1 on the list: Security Analyst! (yaaay, we're number one) (wait, is that a good thing?)

Pluton is effectively a TPM, but Microsoft is partnering with chip manufactures to bake it into the CPU, as I understand it. A good move in terms of design, considering we've seen some fairly straightforward attacks succeed in stealing secrets from a TPM by tapping the bus it traveled on towards the CPU. Overall, totally makes sense, given that Windows 11 now requires a TPM - something Apple has been doing for a while with their Macs and mobile devices.

End of an age.

I'm not sure if attackers changing up tactics is a good sign or a bad one. Whichever the case, they're now sending USB devices similar to the HAK5 rubber ducky - it shows up as a keyboard when you plug it in, and proceeds to execute pre-programed keystrokes to do something nasty. In this case - download and install ransomware.

Some might call it a bit late, but Salesforce requiring MFA for all users is a significant move that could encourage others to follow suit.

This will go smoothly. Brave already does this, and it's annoying there also.

A CSPM that's also a spreadsheet???

T-Pot effectively combines a wide variety of other honeypots, all into one meta tool. Kinda like the Security Onion of deception.

The latest startup to use shock marketing to promote its brand raises a significant round. "Murder your thirst" is their tagline. One customer posted a video each day, of him drinking the product, for a year. The CEO and founder responded by getting a tattoo of the customer's FACE on his ARM. These hijinks got me interested in the VC and other companies they've founded. One that caught my eye is Lambs - a company that makes clothing that proposes to make you healthier by blocking the radiation from Bluetooth, Wi-Fi, and 5g signals. It also claims to improve your sleep, increase "HRV", reduce brain fog, and give you clearer, healthier skin. That's a pretty fancy t-shirt. They even give the name "Faraday" to much of their clothing line. Guess how much you have to pay to buy a Faraday T-Shirt.