Source: Microsoft

Google has dropped details of a previously undisclosed vulnerability in Windows, which it says hackers are actively exploiting. As a result, Google gave Microsoft just a week to fix the vulnerability. That deadline came and went, and Google published details of the vulnerability this afternoon.

The vulnerability has no name but is labeled CVE-2020-17087, and affects at least Windows 7 and Windows 10.

Google’s Project Zero, the elite group of security bug hunters which made the discovery, said the bug allows an attacker to escalate their level of user access in Windows. Attackers are using the Windows vulnerability in conjunction with a separate bug in Chrome, which Google disclosed and fixed last week. This new bug allows an attacker to escape Chrome’s sandbox, normally isolated from other apps, and run malware on the operating system.

In a tweet, Project Zero’s technical lead Ben Hawkes said Microsoft plans to issue a patch on November 10.

Microsoft didn’t independently confirm this date when asked, but said in a statement: “Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers. While we work to meet all researchers’ deadlines for disclosures, including short-term deadlines like in this scenario, developing a security update is a balance between timeliness and quality, and our ultimate goal is to help ensure maximum customer protection with minimal customer disruption.”

But it’s unclear who the attackers are or their motives. Google’s director of threat intelligence Shane Huntley said that the attacks were “targeted” and not related to the U.S. election.

A Microsoft spokesperson also added that the reported attack is “very limited and targeted in nature, and we have seen no evidence to indicate widespread usage.”

It’s the latest in a list of major flaws affecting Windows this year. Microsoft said in January that the National Security Agency helped find a cryptographic bug in Windows 10, though there was no evidence of exploitation. But in June and September, Homeland Security issued alerts over two “critical” Windows bugs — one which had the ability to spread across the internet, and the other could have gained complete access to an entire Windows network.

Updated with comment from Microsoft.

Google reveals a new Windows zero-day bug it says is under active attack

Source: Microsoft

The cloud infrastructure market kept growing at a brisk pace last quarter, as the pandemic continued to push more companies to the cloud with offices shut down in much of the world. This week the big three — Amazon, Microsoft and Google — all reported their numbers and as expected the news was good with Synergy Research reporting revenue growth of 33% year over year, up to almost $33 billion for the quarter.

Still, John Dinsdale, chief analyst at Synergy was a bit taken aback that the market continued to grow as much as it did. “While we were fully expecting continued strong growth in the market, the scale of the growth in Q3 was a little surprising,” he said in a statement.

He added, “Total revenues were up by $2.5 billion from the previous quarter causing the year-on-year growth rate to nudge upwards, which is unusual for such a large market. It is quite clear that COVID-19 has provided an added boost to a market that was already developing rapidly.”

Per usual Amazon led the way with $11.6 billion in revenue, up from $10.8 billion last quarter. That’s up 29% year over year. Amazon continues to exhibit slowing growth in the cloud market, but because of its market share lead of 33%, a rate that has held fairly steady for some time, the growth is less important than the eye-popping revenue it continues to generate, almost double its closest rival Microsoft .

Speaking of Microsoft, Azure revenue was up 48% year over year, also slowing some, but good enough for a strong second place with 18% market share. Using Synergy’s total quarterly number of $33 billion, Microsoft came in at $5.9 billion in revenue for the quarter, up from $5.2 billion last quarter.

Finally Google announced cloud revenue of $3.4 billion, but that number includes all of its cloud revenue including G Suite and other software. Synergy reported that this was good for 9% or $2.98 billion, up from $2.7 billion last quarter, good for third place.

Alibaba and IBM were tied for fourth with 5% or around $1.65 billion each.

Image Credits: Synergy Research

It’s worth noting that Canalys had similar numbers to Synergy with growth of 33% to $36.5 billion. They had the same market order with slightly different numbers with Amazon at 32%, Microsoft at 19% and Google at 7% and Alibaba in 4th place at 6%.

Canalys sees continued growth ahead, especially as hybrid cloud begins to merge with newer technologies like 5G and edge computing. “All three [providers] are collaborating with mobile operators to deploy their cloud stacks at the edge in the operators’ data centers. These are part of holistic initiatives to profit from 5G services among business customers, as well as transform the mobile operators’ IT infrastructure,” Canalysis analyst Blake Murray said in a statement.

While the pure growth continues to move steadily downward over time, this is expected in a market that’s maturing like cloud infrastructure, but as companies continue to shift workloads more rapidly to the cloud during the pandemic, and find new use cases like 5G and edge computing, the market could continue to generate substantial revenue well into the future.

Cloud infrastructure revenue grows 33% this quarter to almost B

Source: Microsoft

The other day we announced the first ten sessions for Sight Tech Global, a virtual event Dec. 2-3 that is convening the world’s top technologists to discuss how AI-based technologies are revolutionizing the future of accessibility. Today, we’re pleased to announce three additional sessions. Registration is free and and open now.

Designing for everyone: Accessibility innovation at Apple

Apple has long embraced accessibility as a bedrock design principle. Not only has Apple created some of the most popular consumer products in history, these same products are also some of the most powerful assistive devices ever. Apple’s Sarah Herrlinger and Jeffrey Bigham will discuss the latest accessibility technology from Apple and how the company fosters a culture of innovation, empowerment and inclusion.

Sarah Herrlinger, senior director of Global Accessibility Policy & Initiatives, Apple
Jeffrey Bigham, research lead, AI/ML accessibility Research, Apple
Moderator: Matthew Panzarino, editor-in-chief, TechCrunch

Inventing the accessible future, by collaboration or by court

When technologists design exciting new innovations, those designs rarely include blind people. Advocates urge us to employ a variety of strategies, from education to litigation, to ensure accessibility is baked into all future tech. Harvard Law’s first deaf-blind graduate Haben Girma, disability rights attorney Lainey Feingold and International Digital Publishing Forum president George Kerscher will discuss strategies for creating a future fully accessible to blind people, including those who are Black, Indigenous and people of color.

Haben Girma, disability rights lawyer, speaker, and author of Haben: The Deafblind Woman Who Conquered Harvard Law
Lainey Feingold, disability rights lawyer and author of Structured Negotiations: A Winning Alternative to Lawsuits
George Kerscher, chief innovations officer for the DAISY Consortium, senior advisor for Benetech’s Global Education and Literacy Group and president of the International Digital Publishing Forum (IDPF)
Moderator: Megan Rose Dickey, senior reporter, TechCrunch

What can a body do? How we meet the built world

Technologists like to imagine how their work affects people, but that’s no substitute for truly knowing the real impact on lives, or better yet, understanding what people, especially people with disabilities, really want from their surroundings and community. In her recent book, What Can a Body Do? professor and designer Sara Hendren’s “aim … isn’t to throw cold water on innovation; it’s to recenter the people, behind the tools, who must work with their surroundings, their adaptations at least as miraculous as the technology that helps them.” (Katy Waldman, in her New Yorker review)

Sara Hendren, associate professor, Olin College
Moderator: Will Butler, vice president, Be My Eyes

Keep an eye out for more sessions and breakouts in early November. In the meantime, registration is open. Get your pass today!

Sight Tech Global is eager to hear from potential sponsors. We’re grateful to current sponsors Amazon, Ford, Google, Humanware, Microsoft, Mojo Vision, Salesforce, Waymo and Wells Fargo. All sponsorship revenues go to the nonprofit Vista Center for the Blind and Visually Impaired, which has been serving the Silicon Valley area for 75 years.

Apple’s Jeff Bigham, disability rights lawyer Haben Girma, author Sara Hendren and more to join Sight Tech Global

Source: Microsoft

Seattle-based Pulumi, one of the newer startups in the ”infrastructure-as-code” space, today announced that it has raised a $37.5 million Series B funding round led by NEA. Previous investors Madrona Venture Group and Tola Capital also participated in this round, which brings the total investment in the company to $57.5 million.

The new investment follows the launch of Pulumi 2.0, which got the company closer to its vision of becoming what the team calls a ‘cloud engineering platform’ and impressive growth over the last, with a 10x growth in adoption in the last twelve months.

“We started with infrastructure as code, because we felt like that was a foundational piece that gave us the programming model, along with the cloud resource model,” Pulumi co-founder and CEO Joe Duffy told me. “That was an important place to start. With [Pulumi] 2.0,  we launched support for testing, for policy as code — so that you could actually apply governance and compliance as part of your infrastructure management — and really helping more of the team work together.”

Indeed, after starting with a focus on infrastructure teams, Pulumi is now looking to expand across teams.

“The infrastructure team is becoming the nucleus that pulls the whole team together. We’re actually calling this cloud engineering,” Duffy explained. “What we’re calling cloud engineering is developers using the cloud in a first-class way, infrastructure teams helping them do that and increasingly pulling in security engineers to make sure that governance is part of the story as well. The 2.0 release was our first time exploring those adjacencies and trying to paint a path to realizing the full Pulumi vision.”

Infrastructure as code isn’t necessarily new, of course. The promise of Pulumi is that it isn’t hobbled by any legacy products but that the team designed it as a cloud-native product from the ground up. That’s something NEA’s Aaron Jacobson, who will join the company’s board, also stressed.

“If you think about how fast the cloud has evolved just in 10 years, Pulumi is built in a place of multi-cloud, of Kubernetes, of serverless, Jacobson said. “And much of the original infrastructure-as-code constructs didn’t even have those in mind. Since Pulumi is newer to market and has come after all those constructs, it just has better integration, it’s just is a more delightful experience to developers.”

NEA’s Scott Sandell is actually taking this a bit further. “Venture capitalists are in the business of pattern recognition,” he said. “And the pattern that I recognized actually goes all the way back to when I was a product manager in the windows group. And I saw that developers don’t want to have to deal with complexity — they want to have the complexity managed for them.” That, he argues, is what Pulumi does for developers — and it surely helped the both Duffy and his co-founder and Pulumi executive chairman Eric Rudder left successful careers at Microsoft to build this company.

In addition to the new funding, Pulumi also today announced that it brought in a number of new executives, including industry veterans Jay Wampold as CMO, Lindsay Marolich as senior director of demand generation, Kevin Kotecki as VP of sales and Lee-Ming Zen as VP of engineering.

Pulumi raises .5M Series B for its cloud engineering platform

Source: Microsoft

Microsoft says hackers backed by the Iranian government targeted over 100 high-profile potential attendees of two international security and policy conferences.

The group, known as Phosphorus (or APT35), sent spoofed emails masquerading as organizers of the Munich Security Conference, one of the main global security and policy conferences attended by heads of state, and the Think 20 Summit in Saudi Arabia, scheduled for later this month. Microsoft said the spoofed emails were sent to former government officials, academics and policy makers to steal passwords and other sensitive data, like email inboxes.

Microsoft did not comment, when asked, what the goal of the operation was, but the company’s customer security and trust chief Tom Burt said that the attacks were carried out for “intelligence collection purposes.”

“The attacks were successful in compromising several victims, including former ambassadors and other senior policy experts who help shape global agendas and foreign policies in their respective countries,” said Burt. “We’ve already worked with conference organizers who have and will continue to warn their attendees, and we’re disclosing what we’ve seen so that everyone can remain vigilant to this approach being used in connection with other conferences or events.”

Microsoft said the attackers would write emails written in “perfect English” to their target requesting an invitation to the conference. After the target accepted the invitation, the attackers would try to trick the victim into entering their email password on a fake login page. The attackers then later log in to the mailbox to steal the victim’s emails and contacts.

The group’s previous hacking campaigns have also tried to steal passwords from high-profile victims.

Iran’s consulate in New York could not be reached for comment as its website was down.

Phosphorus is known to target high-profile individuals, like politicians and presidential hopefuls. But Microsoft said that this latest attack was not related to the upcoming U.S. presidential election.

Last year, Microsoft said it had stopped over 10,000 victims of state-sponsored hacking, including Phosphorus and another Iran-backed group, Holmium, also known as APT 33. In March, the tech giant secured a court order to take control of domains used by Phosphorus, which were used to steal credentials using fake Google and Yahoo login pages.

Microsoft says Iranian hackers targeted ‘high profile’ conference attendees

Source: Microsoft

Today after the bell, Microsoft reported its calendar Q3 2020 earnings, the period of that time corresponds to its Q1 fiscal 2021 period. In the three months ending September 30, Microsoft had revenues of $37.2 billion and per-share profit of $1.82.

Analysts had anticipated the company to report $1.54 in earnings per share, generated from $35.72 billion in revenue.

In the aftermath of the beat, shares of the company are effectively flat, gaining only a fraction of a point in after-hours trading. Microsoft was up by nearly 2% in afternoon trading, despite somewhat uneven markets.

Helping drive the movement in Microsoft’s share price was the all-important Azure update. Here’s what Microsoft had to say:

Server products and cloud services revenue increased 22% (up 21% in constant currency) driven by Azure revenue growth of 48% (up 47% in constant currency)

Parsing investor sentiment, it appears that a number closer in the low-40s was anticipated by most, making the Azure result a strong number.

The broader category that Azure sits inside of, called “Intelligent Cloud,” reported $13 billion in revenue, up 20% from the year-ago quarter. That was the best-performing of Microsoft’s three units, which also include the Office-and-LinkedIn heavy “Productivity and Business Processes” group that posted $12.3 billion in revenue — up 11% — and the Windows-and-Xbox heavy “More Personal Computing” which had revenues of $11.8 billion, up a smaller 6% compared to the year-ago quarter.

For the financial dorks in the audience, I snagged the following for your enjoyment:

Other standouts from a first read of the company’s earnings report include:

• Strong Surface revenue, rising 37% compared to the year-ago period
• Bing revenue declines, with the company saying that “[s]earch advertising revenue excluding traffic acquisition costs decreased 10%”
• Commercial cloud revenues of $15.2 billion, up 31% from the year-ago period
• LinkedIn managed 16% revenue gains in the quarter
• Gaming revenue gains of 22% year-over-year
• Consumer PC demand — seen in PC sales numbers — boosted non-Pro Windows OEM revenues by 31% compared to the year-ago quarter, though Pro-focused Windows OEM top line fell 22%. Those partial results netted out to a -5% OEM figure for the company.

Looking ahead, analysts expect Microsoft to record $1.60 in per-share profit in the current quarter, off $40.4 billion in total revenue. The company will announce its own projections on its earnings call.

Update: Got on the phone with Mike Spencer from Microsoft’s IR team to chat about the results. I was curious about the impact of COVID-related advertising declines impacting the company. Spencer said that both Bing and LinkedIn recovered from earlier lows, and both came in above internal expectations. For LinkedIn, of course, that was a better net result than Bing’s, comparing their year-over-year figures, but beating expectations is still good. You can read as much into what the Bing numbers will mean for Google as you will.

Spencer highlighted the Azure number — ahead of internal and external expectations — and the non-Pro Windows OEM number as notable figures from the report. Agreed. The former shows that Microsoft is holding up against Amazon and Google, while the latter shows that when folks buy computers for their home-bound tots, they aren’t only buying Chromebooks.

Microsoft stock flat despite better-than-expected earnings, strong Azure growth

Source: Microsoft

Diversity and inclusion are slowly, slowly moving away from being an afterthought (or worse, a no-thought) in the tech world. And to underscore the new attention the area is getting — in every aspect of the concept — today a startup that’s building tools to help designers and developers make their end products more accessible to people with visual impairments is announcing some funding.

Stark, a New York-based startup that lets designers others building with design software run their files through an integrated tool that checks it and provides color edits and other suggestions to help them meet guidelines for people who see less well, has picked up $1.5 million.

Stark plans to use the funding to continue building integrations into commonly-used design apps and create integrations for developers (where it will read and provide guidance on code: next up is a Github integration), and continue building out its business with expanded pricing and usage tiers.

Currently, users can use plugins of Stark on Figma, Sketch & Adobe XD that let them access a Contrast Checker, Smart Color Suggestions, 8 Colorblind Simulations, a Colorblind Generator, and Rapid Contrast Checking (on Adobe XD).

Longer term, the plan is to build and end-to-end platform and to address inclusivity for other kinds of needs beyond visual impairments, and, since accessibility can come in physical forms, too, to consider more than just software, and to create more ways to automatically correct details.

As Cat Noone — the now-European-based CEO who co-founded the company with Michael Fouquet (the team is working remotely, she said) — describes it, the ambition is to “become the Grammarly for accessibility in software.”

The funding, a pre-seed round, is coming from a wide and interesting group of backers. It was co-led by Daniel Darling and Pascal Unger from Darling Ventures and Indicator Ventures; with participation also from Jason Warner, the CTO of Github; Kleiner Perkins’ Scout Fund; and Basecamp Ventures. Individual backers include the product lead for accessibility at Atlassian, the director of equitable design & impact at Culture Amp, a director of design at DuckDuckGo, a former VP of software development at Oracle, and more.

Part of the reason that Stark has gotten attention from all of these investors is because of its traction.

Early versions of the software have been out for eight months now, in the form of the plugins for Sketch, Adobe XD and Figma, and in that time it’s clocked up 300,000 users, mostly designers, engineers, and product managers across those three design platforms, with current customers including people from Microsoft, Oscar Health, US Bank, Instagram, Pfizer, Volkswagen, Dropbox and more.

It also has 10,000 people in its “community”, which includes people engaging with Stark more directly (rather than just using its plugins), on platforms like Slack, getting its newsletter and more.

Diversity and inclusion have been in the headlines this year, which is good news, even if the reason for it has been not so good — the sorry state of how minorities are treated by law enforcement. Partly because of the profile of those incidents and the subsequent protests, much of the world has associated the concept of D&I very closely with racial inclusion. While that story continues to unfold (and we hopefully continue see more positive and sustained efforts to address it), the kind of diversity and inclusion Stark is addressing is of a different sort.

It’s a logical, if often overlooked area: The Centers for Disease Control and Prevention estimate that (as of 2018) around one in every four adults in the U.S. alone live with some form of disability (a figure that doesn’t count children), with the biggest of these being cognitive disabilities. This essentially means that while a lot of design (and tech in general) is not really built to address this wider group, it’s a very sizable market.

At a time when technology is regularly made out to be the bad guy — and the reasons are many, touching on mental health; physical health; and economic, environmental, civil and legal impacts — designing software and hardware that is more inclusive could go a very long way in bridging some of those gaps that tech has created with (and within) society.

“We’re talking about the largest minority group in the U.S.,” Noone said. “You wouldn’t build a building today without a wheelchair ramp, so why aren’t we accounting for those individuals in our software design?”

Noone said that she and Fouquet originally landed on the idea of Stark when they were doing some work for another firm, building an emergency services app that would get used by the elderly. They built a very early version of the tool for themselves to use in that work. Showing it to others, they found people asking if they could use it, too. “And then it just kind of snowballed,” she said.

She then said that she found herself going down a “rabbit hole into the world of design and accessibility” and realised that not only were there no tools really built to address this out there, but that there was “so much more to the problem than colors.” (Colors was where Stark started, hence the great name.)

There is an interesting stick and carrot in the bigger market with things like inclusive design: for some it might be an issue of having to comply, others simply believe it’s the right thing to do, while yet others may not care but (rather cynically) believe being inclusive is a good look. Whatever the motivation is, the trick with Stark is that it’s making it easy to be inclusive for more people, and lowering the barrier at the end of the day can only be a good thing.

“No software product should exclude a disadvantaged minority of their users. It’s bad for business and bad for society,” said Darling in a statement. “We’re seeing dramatic increasing awareness amongst software designers, developers and executives to ship products that are universally accessible. Stark has quickly earned the trust of the industry and is on a path to become an important part of software infrastructure. We’re thrilled to partner with such a mission driven company that is already improving how software is produced around the world.”​

Stark raises .5M for a toolkit that helps developers and others create more inclusive design