Useful News for You

If you just bought a smart TV on Black Friday or plan to buy one for Cyber Monday tomorrow, the FBI wants you to know a few things.

Smart TVs are like regular television sets but with an internet connection. With the advent and growth of Netflix, Hulu and other streaming services, most saw internet-connected televisions as a cord-cutter’s dream. But like anything that connects to the internet, it opens up smart TVs to security vulnerabilities and hackers. Not only that, many smart TVs come with a camera and a microphone. But as is the case with most other internet-connected devices, manufacturers often don’t put security as a priority.

That’s the key takeaway from the FBI’s Portland field office, which just ahead of some of the biggest shopping days of the year posted a warning on its website about the risks that smart TVs pose.

“Beyond the risk that your TV manufacturer and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home. A bad cyber actor may not be able to access your locked-down computer directly, but it is possible that your unsecured TV can give him or her an easy way in the backdoor through your router,” wrote the FBI.

The FBI warned that hackers can take control of your unsecured smart TV and in worst cases, take control of the camera and microphone to watch and listen in.

Active attacks and exploits against smart TVs are rare, but not unheard of. Because every smart TV comes with their manufacturer’s own software and are at the mercy of their often unreliable and irregular security patching schedule, some devices are more vulnerable than others. Earlier this year, hackers showed it was possible to hijack Google’s Chromecast streaming stick and broadcast random videos to thousands of victims.

In fact, some of the biggest exploits targeting smart TVs in recent years were developed by the Central Intelligence Agency, but were stolen and published online by WikiLeaks two years ago.

But as much as the FBI’s warning is responding to genuine fears, arguably one of the bigger issues that should cause as much if not greater concerns are how much tracking data is collected on smart TV owners.

The Washington Post earlier this year found that some of the most popular smart TV makers — including Samsung and LG — collect tons of information about what users are watching in order to help advertisers better target ads against their viewers and to suggest what to watch next, for example. The TV tracking problem became so problematic a few years ago that smart TV maker Vizio had to pay $2.2 million in fines after it was caught secretly collecting customer viewing data. Earlier this year, a separate class action suit related to the tracking again Vizio was allowed to go ahead.

The FBI recommends placing black tape over an unused smart TV camera, keeping your smart TV up-to-date with the latest patches and fixes, and to read the privacy policy to better understand what your smart TV is capable of.

As convenient as it might be, the most secure smart TV might be one that isn’t connected to the internet at all.

Figure Technologies, a nearly two-year-old, San Francisco-based fintech cofounded by Mike Cagney, the founder of the more established fintech company SoFi, is raising a whole lot of money — again.

By February of this year, Figure had already raised $120 million in equity funding from a gaggle of investors, including RPM Ventures, partners at DST Global, Ribbit Capital, DCM, DCG, Nimble Ventures, and Morgan Creek. In May, it announced that it had closed an up to $1 billion uncommitted asset-based financing facility on its own custom blockchain with Jefferies and WSFS Institutional Services.

Now, according to paperwork filed with the SEC earlier this month, it appears that Figure has closed or is about to close on $103 million in Series C funding.

Presumably, investors are interested partly in the company’s growing spate of products. While Figure started out providing home loans to older customers who aren’t earning income and have much of their wealth tied up in their homes — a fast-growing demographic — it has more recently begun to chase after a demographic that Cagney knows well through SoFi, younger people looking to refinance their student loans.

According to Figure’s website, it also plans to introduce a money market product soon.

Figure talked recently with American Banker about the company’s interest in competing more directly with SoFi, citing the $1.4 trillion in outstanding loan debt as the primary reason it’s swooping into the space, and with the “same mousetrap” that Figure has developed to quickly process home loans, which it then securitizes and sells.

Specifically, all of Figure’s financial services business is executed entirely on its blockchain, Provenance, which further has a native token, Hash, that’s used to both access the blockchain and to memorialize off-chain exchange of fiat currency.

Cagney co-founded Figure with his wife, June Ou, who was the company’s chief operating officer. She was previously chief technology officer at SoFi, where Cagney lost his job in 2017 as CEO after a board investigation into sexual misconduct at the company.

Others of Figure’s cofounders include Alana Ackerson and Cynthia Chen. Ackerson was previously the CEO of the Thiel Foundation. Chen was most recently a venture partner with DHVC (Danhua Capital), a venture capital firm based in Palo Alto, Ca.

A massive database storing tens of millions of SMS text messages, most of which were sent by businesses to potential customers, has been found online.

The database is run by TrueDialog, a business SMS provider for businesses and higher education providers, which lets companies, colleges, and universities send bulk text messages to their customers and students. The Austin, Texas-based company says one of the advantages to its service is that recipients can also text back, allowing them to have two-way conversations with brands or businesses.

The database stored years of sent and received text messages from its customers and processed by TrueDialog. But because the database was left unprotected on the internet without a password, none of the data was encrypted and anyone could look inside.

Security researchers Noam Rotem and Ran Locar found the exposed database earlier this month as part of their internet scanning efforts.

TechCrunch examined a portion of the data, which contained detailed logs of messages sent by customers who used TrueDialog’s system, including phone numbers and SMS message contents. The database contained information about university finance applications, marketing messages from businesses with discount codes, and job alerts, among other things.

But the data also contained sensitive text messages, such as two-factor codes and other security messages, which may have allowed anyone viewing the data to gain access to a person’s online accounts. Many of the messages we reviewed contained codes to access online medical services to obtain, and password reset and login codes for sites including Facebook and Google accounts.

Because some of the two-way message conversations contained a unique conversation code, it’s possible to read entire chains of conversations. One table alone had tens of millions of messages, many of which were message recipients trying to opt-out of receiving text messages.

TechCrunch contacted TrueDialog about the exposure, which promptly pulled the database offline. Despite reaching out several times, TrueDialog’s chief executive John Wright would not acknowledge the breach nor return several requests for comment. Wright also did not answer any of our questions — including whether the company would inform customers of the security lapse and if he plans to inform regulators, such as state attorneys general, per state data breach notification laws.

The company is just one of many SMS providers that have in recent months left systems — and sensitive text messages — on the internet for anyone to access. Not only that but it’s another example of why SMS text messages may be convenient but is not a secure way to communicate — particularly for sensitive data, like sending two-factor codes.

Read more:

• A leaky database of SMS messages exposed two-factor codes
• Mixcloud data breach exposes over 20 million user records
• StockX was hacked, exposing millions of customers’ data
• DoorDash confirms data breach affected 4.9 million users
• Stop saying, ‘We take your privacy and security seriously’
• Capital One breach also hit other major companies, say researchers
• Macy’s said hackers stole customer credit cards — again

Hey everyone. Thank you for welcoming me into you inboxes yet again.

Hope you all had a wonderful Thanksgiving. After dodging your inboxes for a couple weeks as I ventured off to China for a TechCrunch event in Shenzhen, I am rested up and ready to go.

If you’re reading this on the TechCrunch site, you can get this in your inbox here, and follow my tweets here.

The big story

When Apple announced details on their three new subscription products (Apple TV+, Apple Arcade and Apple News+ — all of which are now live) back in March, the headlines that followed all described accurately how Apple’s business was increasingly shifting away from hardware towards services and how the future of the company may lie in these subscription businesses.

I largely accepted those headlines as fact, but one thing I have been thinking an awful lot about this week is how much I have loved Disney+ since signing up for an account and just how little I have thought about Apple TV+ despite signing up for both at their launches.

It’s admittedly not the fairest of comparisons, Disney has decades of classic content behind them while Apple is pushing out weekly updates to a few mostly meh TV shows. But no one was begging Apple to get into television. The company’s desires to diversify and own subscriptions that consumers have on their Apple devices certainly make sense for them, but their strategy of making that play without the help of any beloved series before them seems to have been a big miscalculation.

At TechCrunch, we write an awful lot about acquisitions worth hundreds of million, if not billions, of dollars. Some of the acquisitions that have intrigued me the most have been in the content space. Streaming networks are plunking down historic sums on series like Seinfeld, Friends and The Big Bang Theory. The buyers have differed throughout these deals, but they have never been Apple.

That’s because Apple isn’t bidding on history, they’re trying to nab directors and actors creating the series that will be the next hits. And while that sounds very Apple, it also sounds like a product that’s an awfully big gamble to the average consumer looking to try out a new streaming service. Why pick the service that’s starting from a standstill? Apple has ordered plenty of series and I have few doubts that at least one of the shows they plan to introduce is going to be a hit, but there isn’t much in the way of an early favorite yet and for subscribers that haven’t found “the one” yet, there’s very little reason to stick around.

Other networks with a half-dozen major series can afford a few flops because there’s a library of classics that’s filling up the dead space. Apple’s strategy is bold but is going to lead to awfully high churn among consumers that won’t be as forgiving of bad bets. This is an issue that’s sure to become less pronounced over time, but I would bet there will be quite a few consumers unsubscribing in the mean time leaving those on freebie subscriptions responsible for gauging which new shows are top notch.

Apple has also made the weird move of not housing their content inside an app so much as the Apple TV’s alternative UI inside the TV app. One one hand, this makes the lack of content less visible, but it also pushes all of the original series to the back of your mind. If you’re a Netflix user who has been subconsciously trained never to use the TV app on your Apple TV because none of their content is housed there, you’re really left forgetting about TV+ shows entirely when using the traditional app layout.

We haven’t received any super early numbers on Apple News+, Apple Arcade or Apple TV+, but none of the three appears to have made the sizable cultural splashes in their debuts that were hoped for at launch. Apple’s biggest bet of the three was undoubtedly TV+ and while their first series haven’t seemed to drop any jaws, what’s more concerning is whether the fundamentals of the service have been arranged so that unsatisfied subscribers feel any need to stick around.

Send me feedback
on Twitter @lucasmtny or email
lucas@techcrunch.com

On to the rest of the week’s news.

Image via AMY OSBORNE/AFP/Getty Images

Trends of the week

Here are a few big news items from big companies, with green links to all the sweet, sweet added context:

• Facebook buys a game studio building Light saber Fruit Ninja
  One of the things I wrote about this week was Facebook buying the game studio behind one of virtual reality’s most popular titles, Beat Saber. No details on a price tag for the deal, but the buy brings the hop IP underneath Facebook’s corporate umbrella which seems poised to be eying more VR content acquisitions.
• Twitter plans for account memorials
  Almost any time Twitter decides to make a big product change, one gets the feeling it was either snuck through or brute-forced by the CEO or another exec. That’s because there often doesn’t seem to be a lot of consideration for caveats that users seem to collectively identify almost immediately. This week was time for another one of these situations, after Twitter announced it was planning to deactivate old unused Twitter accounts en masse, something users realized was just going to lead to deactivating deceased people’s accounts and erasing what they had ever tweeted. Twitter, to their credit, decided to pause and rethink things.

GAFA Gaffes

How did the top tech companies screw up this week? This clearly needs its own section, in order of badness:

1. Google appears to bring the hammer down on activism:
   [Google employee activist says she has been fired]

Disrupt Berlin

It’s hard to believe it’s already that time of the year again, but we just announced the agenda for Disrupt Berlin and we’ve got some all-stars making their way to the stage. I’ll be there this year, get some tickets and come say hey!

• Learn how to win customers and influence consumers
• Three of the best tackle the thorny issue of Brexit for startups
• Learn how to raise your first Euros

Sign up for more newsletters in your inbox (including this one) here.

Following swiftly on the heels of a Thanksgiving that broke records with $4.2 billion in online sales, Black Friday also hit a new high, although it just fell short of predictions. According to analytics from Adobe, consumers spent $7.4 billion online yesterday buying goods online via computers, tablets and smartphones. The figures were up by $1.2 billion on Black Friday 2018, but they actually fell short of Adobe’s prediction for the day, which was $7.5 billion.

Salesforce, meanwhile, said that its checks revealed $7.2 billion in sales (even further off the forecast).

Popular products included toys on the themes of Frozen 2, L.O.L Surprise, and Paw Patrol. Best selling video games included FIFA 20, Madden 20, and Nintendo Switch. And top electronics, meanwhile, included Apple Laptops, Airpods, and Samsung TVs.

A full $2.9 billion of Black Friday sales happened on smartphones. These conversions are growing faster than online shopping overall, so we are now approaching a tipping point where soon smartphones might outweigh web-based purchases through computers.

“With Christmas now rapidly approaching, consumers increasingly jumped on their phones rather than standing in line,” said Taylor Schreiner, Principal Analyst & Head of Adobe Digital Insights, in a statement. “Even when shoppers went to stores, they were now buying nearly 41% more online before going to the store to pick up. As such, mobile represents a growing opportunity for smaller businesses to extend the support they see from consumers buying locally in-store on Small Business Saturday to the rest of the holiday season. Small Business Saturday will accelerate sales for those retailers who can offer unique products or services that the retail giants can’t provide.”

Adobe Analytics tracks sales in real-time for 80 of the top 100 US retailers, covering 55 million SKUs and some 1 trillion transactions during the holiday sales period. Salesforce uses Commerce Cloud data and insights covering more than half a billion global shoppers across more than 30 countries.

One of the reasons we may be seeing slightly less fervent sales than the analysts had predicted is because the holiday sales season is starting earlier and earlier. Black Friday, the day after Thanksgiving when many people have days off, has for a long time been seen by retailers as the start of holiday shopping season. That has changed as retailers hope to catch more sales over a longer period of time.

As more people shop, they are also shopping for more expensive items. Adobe noted that Average Order Value was $168, a new record level yesterday for Black Friday, up 5.9% on a year ago.

Smartphone sales were up 21% over last year and those who were not buying were, as a start, browsing, with whopping 61% of all online traffic to retailers coming from smartphones, up 15.8% since last year.

As with yesterday, e-commerce “giants” with over $1 billion in sales annually were doing better than smaller sites: they had more smartphone sales, and 66% conversions on browsers on smartphones, Adobe said. They have overall also seen a 62% boost in sales this season, versus 27% for smaller retailers.

As with the Thanksgiving sales patterns — when bigger retailers also appeared to do better than their smaller counterparts — there are a couple of reasons for this. One is that the bigger sites have a wider selection of goods and can afford to take hits with deep discounts on some items, in order to lure users in to add other items to their shopping cars that are not as deeply discounted. Or, bigger online retailers can simply afford to give bigger markdowns.

The other is that the bigger stores often have more flexible delivery options. Adobe noted that those using click-and-collect orders, or buy online, pick up in store / curbside grew by 43 percent.

It will be interesting to see how and if patterns change for smaller retailers on Sunday, which is being dubbed “small business Sunday” to focus on buying from smaller and independent shops. Shoppers have already spent $470 million, and Adobe believes it will pass the $3 billion mark. Cyber Monday, the biggest of them all, is expected to make $9.4 billion in sales.

Ockam, a two-year-old, Bay Area-based company that’s selling tools to developers to they can establish an “architecture for trust” within their connected device applications, has raised $3.2 million in seed funding, including from Core Ventures, Okta Ventures, SGH Capital, and Future Ventures.

This serverless platform for IoT development is being led by CEO Matthew Gregory and CTO Mrinal Wadhwa, two cofounders with noteworthy backgrounds.

Before launching Ockam in the fall of 2017, Gregory was an “intrapreneur” at Microsoft, where he says he helped lead Azure’s pivot into open source software and container services. He also spent a couple of years at Salesforce as a product manager and, interestingly, spent a few years years ago as a system engineer working for Stars & Stripes, a syndicate of the yacht-racing competition America’s Cup where he tells us he led an engineering effort to build custom systems of sensors, analytics software and wireless communications tools needed to help the racing team make better decisions.

Madhwa was meanwhile the CTO of another privately held IoT company, Fybr, that promises real-time data analytics capable of decision making at the edge (versus in the cloud).

Some of what the startup is promising is that, using its technology, IoT systems developers will be able to build more scalable connected systems — as well, crucially, as more secure ones How? Partly through crytpographic keys and partly by assigning credentials to different entities, from devices to people to assets to services (among other things).

The company is one of a growing spate of companies hoping developers will increasingly turn to them instead of building out their own software infrastructure. For example, Particle, a seven-year-old, San Francisco-based platform for Internet of Things devices that has ambitions similar to those of Ockam, recently closed on $40 million in funding in a round that brought its total funding to $81 million).

Ockam has now raised $4.9 million in seed funding altogether, having raised a smaller amount of seed funding from Future Ventures back in May.

Storm Ventures, a now 19-year-old, Sand Hill Road venture firm in Menlo Park, Ca., has closed on $130.4 million, shows a new SEC filing. The outfit began its fundraising late last, according to an earlier filing. It had closed its previous fund with $180 million in 2015.

Storm distinguishes itself in numerous ways, including its exclusive focus on seed and Series A stage enterprise startups, including mobile, SaaS and cloud infrastructure companies.

The partners also have a penchant for helping far-flung startups grow the footprint around the blog. Tae Hea Nahm, for example, a founding managing director of the firm (and cofounder of four mobile companies before that, including Airespace and MobileIron), was born in Seoul, he has told us in the past that he spends a considerable amount of time in South Korea to attend startup board meetings but also to visit with Samsun and others of Storm’s LPs, which includes Korea Telecom.

Ryan Floyd, another of the firm’s cofounders, meanwhile recently posted about his “hunt” for European founders, partly because they are more focused on revenue from the outset than some of their U.S. peers (an increasingly attractive quality in all startups suddenly).

Some of Storm’s most notable bets at the moment include Workato, a Cupertino, Ca.-based work automation platform, which two weeks ago announced $70 million in Series C funding led by Redpoint.

Storm — which was involved in the company’s Series A  and B rounds — also participated in the financing.

Another bet is Honeycomb, a three-year-old, San Francisco-based startup whose product promises developer teams that they can see production more clearly so they can resolve issues more quickly. The company raised $11.4 million in Series A funding led by Scale Venture Partners in September; Storm, which had participated in the company’s seed round, also participated among others.

Among Storm’s other, more recent first-time investments, the outfit joined the $6.75 million Series A round of Talview, a two-year-old, Palo Alto, Ca.-based talent assessment and hiring platform, that announced its newest funding in August. More on the company here.