TheChek News Flow

Gapping down
In reaction to disappointing earnings/guidance:

Other news:

Analyst comments:

Gapping up
In reaction to strong earnings/guidance:

M&A news:

Other news:

Analyst comments:

Minimizing your Bluetooth usage minimizes your exposure to very real vulnerabilities. That includes an attack called BlueBorne, announced this week by the security firm Armis, which would allow any affected device with Bluetooth turned on to be attacked through a series of vulnerabilities. The flaws aren't in the Bluetooth standard itself, but in its implementation in all sorts of software. Windows, Android, Linux, and iOS have been vulnerable to BlueBorne in the past. Millions could still be at risk.

So, yeah, turn off Bluetooth if you're not using it or if you're near anyone you don't trust. There might be some inconvenience when you bring your laptop to your desk and want it to connect to a Bluetooth mouse and keyboard. You might end up flipping the switch fairly often to use Bluetooth headphones. But you likely don't use Bluetooth most of the time. Even if you lean on it all day at work, you can ditch it at a birthday dinner or when you're asleep. And if you use it 24/7 on your phone because of a peripheral like a smartwatch, you can at least turn it off on your other devices, especially any Bluetooth-enabled internet of things gear.

"For attackers it's Candy Land," says David Dufour, vice president of engineering and cybersecurity at the security firm Webroot. "You sit with a computer with a Bluteooth-enabled radio—just scanning for devices saying, ‘Hey, is anybody out there?’ Then you start prodding those devices to look for things like the operating system and the Bluetooth version. It’s a hop, skip, and a jump to start doing bad stuff.”

BlueBorne

As overall device security improves, researchers and attackers alike have turned to ancillary features and components to find ways in. In July, researchers announced a bug in a widely used Broadcom mobile Wi-Fi chip that put a billion devices at risk before it was patched. And in 2015, researchers found a critical flaw in Apple's Airdrop file-sharing feature over Bluetooth.

And then there's BlueBorne. Apple's iOS hasn't been affected by the flaws since the 2016 iOS 10 release, Microsoft patched the bugs in Windows in July, and Google is working on distributing a patch (though this can take significant time). But in addition to endangering core devices such as smartphones and PCs, BlueBorne has implications for the billions of Bluetooth-equipped internet of things devices in the world including smart TVs, speakers, and even smart lightbulbs. Many of these devices are built on Linux and don't have a mechanism for distributing updates. Or even if they do, they rarely receive them in practice. Linux is working on but hasn't yet issued a BlueBorne patch.

"We wanted get the research community on board with this, because it didn’t take us a long time to find these bugs, one thing kind of led to another and we found eight really severe vulnerabilities,” says Ben Seri, the head of research at Armis. “Our assumption is there are probably a lot more. We want to get eyes and ears on this type of thing because it’s largely gone neglected by the research community and by vendors over the past years."

When Bluetooth is on in a device, it is constantly open to and waiting for potential connections. So a BlueBorne attack starts by going through the process Webroot's Dufour describes—scanning for devices that have Bluetooth on and probing them for information such as device type and operating system to see if they have the relevant vulnerabilities. Once an attacker identifies vulnerable targets, the hack is quick (it can happen in about 10 seconds) and flexible. The impacted devices don't need to connect to anything, and the attack can even work when the Bluetooth on the victim device is already paired to something else. BlueBorne bugs can allow attackers to take control of victim devices and access—even potentially steal—their data. The attack can also spread from device to device once in motion, if other vulnerable Bluetooth-enabled targets are nearby.

As with virtually all Bluetooth remote exploits, attackers would still need to be in range of the device (roughly 33 feet) to pull off a BlueBorne attack. But even with the extensive and productive BlueBorne patching that has already happened, there are still likely plenty of vulnerable devices in any populated area or building.

The Best Defense

The importance of Bluetooth defense has become increasingly clear, and the Bluetooth Special Interest Group, which manages the standard, has focused on security (particularly cryptography upgrades) in recent versions. But attacks like BlueBorne that affect individual implementations of Bluetooth are attracting attention as well. "Attacks against improperly secured Bluetooth implementations can provide attackers with unauthorized access to sensitive information and unauthorized use of Bluetooth devices and other systems or networks to which the devices are connected," the National Institute of Standards and Technology noted in its extensive May "Guide to BluetoothSecurity" update.

You can't control if and when devices get patched for newly discovered Bluetooth vulnerabilities, and you're probably not going to stop using Bluetooth altogether just because of some possible risks. But apply every patch you can, and keep Bluetooth off when you're not using it. "With security everything is kind of like the flavor of the week," Webroot's Dufour says. "So this week it's Bluetooth."

Security's often a matter of weighing risk and reward, defense versus convenience. In the case of Bluetooth, it's an easy call.

What are Cryptocurrencies? Recently, a number of sell-side market strategies and researchers opined on the merits of investing in Bitcoin and other cryptocurrencies. Some went as far as introducing price targets and making relative value calls on cryptocurrencies vs. other asset classes. The number of cryptocurrencies now existing is in the hundreds (~$150bn total assets), and there are dozens of cryptocurrency hedge funds launched (e.g. here). Developments arounds distributed ledgers and the concept of digital currencies are fascinating from a technological point of view. It is likely that some of these technologies will become very valuable. The supply of cryptocurrencies is not controlled by central banks, and they can be used to avoid capital controls, enable tax evasion, or fund transactions on the dark web. As such, cryptocurrencies may ideologically appeal to proponents of small government (however, a paradox is that distributed ledger technology in principle enables unprecedented centralized access to the digital records of any and every transaction). In this note, we want to highlight the risks of cryptocurrencies. Cryptocurrencies cannot be reliably valued and they have significant ‘tail risk’ that could come in the form of a regulatory ban. Moreover, the whole cryptocurrency market exhibit some parallels to fraudulent Pyramid schemes.

Are they Currencies? Currently, there are few legitimate reasons to use cryptocurrencies apart from speculation (e.g. any transactions can be done electronically in country currencies such as USD, EUR, etc.). The claim that cryptocurrencies have lower transaction costs is inaccurate as an asset’s transaction cost is almost always driven by its volatility rather than processing fees (e.g. bitcoin volatility is ~100%, or ~15 times the average currency volatility). Valuing cryptocurrencies as traditional currency is not possible as there are no underlying ‘economy’ to assess supply/demand for its goods and services, there is no fundamentally driven inflation, there are no ‘rate differentials’, etc. Perhaps more importantly, there is no organized power behind this currency to e.g. ensure its long term viability, secure trade, enforce its convertibility into other goods and services, or provide investor fraud protection.

Are they Commodities? Of course, having a government behind a currency is not a guarantor for its survival. In fact, on a long enough timeline, all currencies that were not made of a valued commodity such as gold or possessed exceptional artistic value and rarity became worthless. Should one look at cryptocurrencies as an alternative to Gold rather than country backed currencies? While there is no government to back up either gold or cryptocurrencies, gold has a track record of outliving governments and being use as a store of value going back to the beginning of civilization (at least ~7,000 years). Unlike gold, cryptocurrencies are not engrained in human psychology and backed up by the longest possible backtest. The claim of scarcity of cryptocurrencies via specific code implementation that limits their production is bogus as well. There is no scarcity as virtually anyone can create a new cryptocurrency, and existing algorithms can be modified (e.g. hard forks) to increase the amount of cryptocurrencies.

Can they ‘Default’? If the use of cryptocurrencies were to increase to an extent that they start competing with traditional ‘country’ currencies (e.g. start interfering with the ability of central banks to control money supply, governments to collect taxes, impose sanctions or capital controls, etc.) they would be quickly regulated or outlawed. While similar attempts were made historically on the use of precious metals, cryptocurrencies don’t have multi-millennial track record and place in human history to ensure survival. Even if the cryptocurrencies don’t threaten governments’ primacy on monetary issues, their use may be irritable enough (e.g. avoiding capital controls, evading taxes, dark web, etc.) to prompt a government crackdown. We are already seeing this with recent developments from China and this trend is more likely to continue.

Are they Pyramid Schemes? another worrying aspect of cryptocurrencies are some parallels to fraudulent pyramid schemes. Initiator of a pyramid scheme often ensures ownership of a disproportionally large share of future profits. For instance, in the case of bitcoin, it is believed that an unknown person (or persons) known as ‘Satoshi Nakamoto’, before disappearing, mined the first 1-2M coins or ~10% of the coins that will ever exist ($4-8bn USD current value). While initial mining requires a negligible effort, the benefits for subsequent participants start diminishing. Mining becomes progressively more difficult, and eventually unprofitable, marking the likely end of a scheme. A way around this in Pyramid schemes is to bypass the original chain and start a new one of your own. The cryptocurrency analogy would be to start a new coin if it is more profitable than mining the existing one. This can work as long as there are enough willing and uninformed buyers.

While we don’t know whether the price of cryptocurrencies will go up or down in the near-term, the history of currencies, governments and financial fraud tells us that the future for cryptocurrencies will likely not be bright.

One day after the JP Morgan Chase chief called the digital currency a “fraud,” the bank released a scathing report on the red-hot investment, calling its legitimacy into question and comparing it to “pyramid schemes.”

The price of bitcoin, the largest digital currency, fell 6.5 percent on Wednesday, to $3,916.66 — the sixth straight day of losses. It still remains up 550 percent over the past 12 months.

The JPM report, written by analyst Marko Kolanovic, is a skeptical take on the entire $150 billion cryptocurrency market.

“While we don’t know whether the price of cryptocurrencies will go up or down in the near term, the history of currencies, governments and financial fraud tells us that the future for cryptocurrencies will likely not be bright,” Kolanovic wrote.

One of the central selling points of cryptocurrencies is negated when someone creates a brand-new bitcoin knock-off, Kolanovic wrote.

That makes it so a coin’s creator can own the most with little effort, while everyone else scrambles for a decreasing slice of what’s left — a classic attribute of a pyramid scheme, he wrote.

On Tuesday, Dimon compared the rising price in bitcoin to a bubble, and something that was only useful for drug dealers and countries like North Korea.