CriticalBlue

Lucio Lanza


, industry = IT, Cybersecurity
, products = SECaaS
Dynamic Analysis Tools
Profiling Tools
Verification Tools
, production =
, services = API Security
Application Security
Software Optimization
Performance Tuning
Performance Prediction
Multicore Programming
, revenue =
, operating_income =
, net_income =
, aum =
, assets =
, equity =
, owner =
, num_employees = 25 (2016)
, parent =
, divisions =
, subsid =
, homepage =
, footnotes =
, intl =

Approov (formerly CriticalBlue) is a Scottish software company based in Edinburgh that is primarily active in two areas of technology: anti-botnet and automated threat prevention for mobile businesses, and software optimization tools and services for Android and Linux platforms.

Approov recently issued findings showing that 92% of the most popular banking and financial services apps contain easy-to-extract secrets such as API keys that could be used in scripts and bots to attack APIs and steal data, devastating consumers and the institutions they trust. The Approov Mobile Threat Lab downloaded, decoded and scanned the top 200 financial services apps in the U.S., U.K., France and Germany from the Google Play Store, investigating a total of 650 unique apps. Ninety two per cent of the apps leaked valuable, exploitable secrets and twenty three per cent of the apps leaked extremely sensitive secrets.

History

In 2001, David Stewart, Richard Taylor, and Ben Hounsell founded the software company, under the name CriticalBlue, in Edinburgh, Scotland. The company won a Smart Scotland Award in 2002 for "Electronic design automation tools for improved design of demanding multimedia applications." Approov received $2 million in seed funding and assembled a core team in 2003.

In May 2008, Approov joined the Multicore Association, where CEO David Stewart would eventually co-chair the Multicore Programming Practices workgroup in 2009. The company received $4 million funding in September 2008 from European, Silicon Valley, and Japanese venture capitalists and corporate investors, and started a close collaboration with Toshiba Corporation.

During 2010, Approov extended Prism product support for MIPS, Cavium, and Freescale. In 2011, the company added support for TI C66x DSPs and second generation Intel Core processors."CriticalBlue announces support for TI C66x DSPs"
Texas Instruments, 4 October 2011. Retrieved on 23 June 2014. The company expanded the range of supported Renesas platforms in 2012.

In 2013, Approov refocused on mobile Android and embedded Linux platforms.McLellan, Paul
"Kathryn Kranen Joins CriticalBlue's Board"
SemiWiki, 5 February 2013. Retrieved on 23 June 2014.

Products

Approov service

Approov continued to work in the mobile software optimization market while it started the analysis of mobile data security opportunities, followed by the launch of the Approov app authentication service in 2016. Approov is an app authentication service that allows API backends to positively identify that requests are being made by a legitimate mobile app.

Kristopher Sandoval, an author for Nordic APIs, conducted a fully independent review of Approov in February 2017 and noted that "... the threat to public-facing APIs in the mobile space is real, dangerous, and often inefficiently mitigated.""Review of Approov for mobile API Security"Nordic APIs
2 February 2017. Retrieved on 8 February 2017. After evaluating the Approov service, he concluded that "Its approach to securing applications in the mobile environment is novel, and the way CriticalBlue goes about this is perhaps one of the more secure ways of doing so. While using cloud services for authentication is often highly questionable, their implementation in this case looks rock solid."

While pointing out that "... preventing the types of reverse engineering issues that Approov is designed to stop is vitally important" he recommends that companies should consider the possible savings of integration.

According to Steven Puddephatt, Business Solutions Architect at the Racing Post:"CriticalBlue Launches Approov, Next Generation Mobile API Abuse/Misuse Prevention System"
PR Newswire, 13 December 2016. Retrieved on 17 January 2017.

Bill Buchanan, Professor of Computing, The Cyber Academy, Edinburgh Napier University, stated, " have analyzed Approov for both its cryptography strength and also for an initial penetration test. The current system has very good levels of assurance which provide significantly reduced risk within the key application areas." The Approov mobile app authentication technology has been described at the AppsWorld London 2016 event as "a baked in plan for success in your app such that you avoid service downtime costs, distributed attack risks, and cloud resource wastage due to illegitimate app requests from automated botnets." According to the Approov White Paper from the product website, " e Approov service uses a unique challenge-response cryptographic protocol between the mobile app and ... cloud based attestation server. A local attestation library is seamlessly integrated into a mobile app ... When the mobile app launches, the attestation process is initiated to prove to the attestation service that it is an authentic app using a one-time non-replayable cryptographic hash of the app code."

Prism

First released in 2009, Prism dynamically traces software applications at runtime and captures data that can be used to analyze and identify the causes of poor performance. Prism received the "Best of Show" Award at the 2009 Silicon Valley Embedded Systems Conference.

Bryon Moyer, in ''Real World Multicore Embedded Systems'', states that Prism's objective is "to provide analysis and an exploration and verification environment for embedded software development using multicore architectures." Moyer also describes the Prism interface as a set of integrated views in the GUI that display interactions between threads, data dependencies, cache analysis, along with the microprocessor pipeline.

Matassa and Domeika, in ''Break Away with Intel Atom Processors'', similarly state that Prism is a "toolsuite aimed at optimized software development for multi-core and/or multithreaded architectures." While mentioning the same analysis views in the Prism GUI described by Moyer, they also describe the dynamic tracing approach, whereby "traces of the user's software application are extracted either from a simulator of the underlying processor core or via an instrumentation approach where the application is dynamically instrumented to produce the required data."

Cascade

Finalized in 2003 and commercially released in 2004, Approov's Cascade is a C to RTL synthesizer.Goering, Richard
"CriticalBlue releases coprocessor synthesis tool"
EETimes, 19 May 2004. Retrieved on 23 June 2014. Richard Taylor and David Stewart, from Approov itself, provided a chapter in ''Customizable Embedded Processors'', describing Cascade as a "solution hatallows software functionality implemented on an existing main CPU to be migrated onto an automatically...generated coprocessor." They stated that this is realized as an automated design flow from an embedded software implementation onto a coprocessor described in RTL. They identified offloading computationally-intensive algorithms from the main processor as the primary usage of such a coprocessor. Cascade was awarded "Best Wireless Design Tool" in 2003 by the ''Wireless Systems Design'' magazine.

Patents

* .

* .

* .

* .

* .

Publications

# Hounsell, Ben & Taylor, Richard.
Co-processor Synthesis: A New Methodology for Embedded Software Acceleration
', Proceedings of the Design, Automation and Test in Europe Conference and Exhibition (DATE'04), 16 February 2004. Retrieved on 23 June 2014.
# Taylor, Richard et al.

', codes-isss, pp. 39–44, Third IEEE/ACM/IFIP International Conference on Hardware/Software Codesign and System Synthesis (CODES+ISSS'05), 19 September 2005. Retrieved on 23 June 2014.
# Morgan, Paul & Taylor, Richard.
ASIP instruction encoding for energy and area reduction
', DAC '07 Proceedings of the 44th annual Design Automation Conference, Pages 797-800, 4 June 2007. Retrieved on 23 June 2014.

References

{{Reflist, 30em

Companies based in Edinburgh
Software companies of Scotland
Software companies established in 2001
British companies established in 2001
Software companies of the United Kingdom
2001 establishments in Scotland