MoviePass is effectively dead and will shut down September 14

If you’re still a Movie Pass subscriber for some reason, it appears tonight is your last chance to use the service. In an “I hope no one notices” late Friday press release, the company announced it “would be interrupting the MoviePass service for all its subscribers effective September 14, 2019,” and it is “unable to predict if or when the MoviePass service will continue.”

It’s one of the most dramatic tech flops in recent memory. Once upon a time, MoviePass offered film aficionados the ability to pay $10 a month and see almost any film as often as they’d like. As it turns out, you can’t make a profit by allowing people to see unlimited movies for little over the price of an average single movie ticket every month.

window.jwLibrary = "chM58Ml7";

MoviePass promptly ran out of money, angered its few remaining subscribers by constantly changing its benefits and pricing, and at one point already shut down because it couldn’t pay its creditors.

As it stands, parent company Helios and Matheson is looking into a potential sale. Given MoviePass hacked away at what little goodwill it had left, I wouldn’t hold my breath.

 

Read next:

Now that MoviePass is dead, can we please start funding sensible businesses?

Now that MoviePass is dead, can we please start funding sensible businesses?

Ding dong, the completely unsustainable witch is dead.

As we reported earlier today, MoviePass is shutting down. It leaves behind a few now-useless cards, and several major VC funds out of pocket to the tune of $68.7M.

window.jwLibrary = "chM58Ml7";

Make no mistake, this was a completely predictable turn of events. For over a year, MoviePass has struggled with cash-flow struggles, primarily because it had an utterly doomed business model. In short, it sold a product (movie tickets) for far less than it cost to acquire, with no concrete plans to reach profitability, save for vague postulations about “analytics” and “partnerships.”

At first, the only issue MoviePass had to content with was the fact that its business model was fundamentally unsustainable without raising prices (which it didn’t do in any meaningful sense) or by finding other avenues for monetization (ditto).

Later in its life, it contended with a catastrophic security breach that saw hackers access the private data of thousands of users, as well as day-to-day operational issues that saw customers unable to use their cards.

I don’t want to gloat. Today’s news is devastating for MoviePass’s employees, as well as those customers who still had active subscriptions which they’ll no longer be able to pay for. My heart breaks for them.

That said, I do think MoviePass is a wonderful demonstration of everything wrong with how startups are funded. All the clues were there that MoviePass would ultimately fail. Indeed, we’ve been predicting the eventual downfall of MoviePass for years.

Silicon Valley and the wider US tech scene (MoviePass was based in New York) is awash with cash. This has fostered an environment where companies are able to gain funding despite lacking a sustainable business model, or indeed, any prospect of eventually reaching profitability. Rather than trying to build viable businesses, many of today’s VCs seem more akin to gamblers in a Monte Carlo baccarat hall. And that’s bad news for innovation.

It means companies trying to do genuinely interesting and worthwhile stuff must compete with drooling morons with business models cribbed almost entirely from that South Park episode about underwear gnomes.

And it entrenches the geographic inequalities surrounding VC funding. There are worthwhile companies outside of the Silicon Valley and New York bubbles that could genuinely use the cash, and they don’t get a second glance. Or a first one, for that matter.

MoviePass is the perfect cautionary tale. All the clues were there that it would end in tears. Nobody listened.

And while I hope that VCs will learn from history, I somehow doubt it.

Read next:

Satoshi Nakaboto: ‘Cubans resort to Bitcoin to bypass US sanctions’

Attackers actively exploiting ‘Simjacker’ flaw to steal device data and spy on individuals

Cybersecurity researchers have warned of a critical vulnerability in SIM cards that could allow remote attackers to compromise targeted mobile phones and spy on victims without their knowledge just by sending an SMS.

Dublin-based firm AdaptiveMobile Security said the flaw — dubbed “Simjacker” — has been actively exploited for at least two years by a spyware vendor that works with governments to track individuals. The firm didn’t disclose the name of the company nor the individuals who may have been targeted in this way.

window.jwLibrary = "chM58Ml7";

Given the attack works across all platforms, the vulnerability demonstrates the increasing sophistication of threat actors to undermine network security by taking advantage of obscure tecnologies.

“The attack involves an SMS containing a specific type of spyware-like code being sent to a mobile phone, which then instructs the SIM Card within the phone to ‘take over’ the mobile phone to retrieve and perform sensitive commands,” AdaptiveMobile Security said.

The researchers have responsibly disclosed the flaw to GSM association (GSMA) and SIMalliance, the governing organizations overseeing mobile operators worldwide and seeking to improve the security of mobile services.

What is S@T?

The vulnerability resides in what’s called the S@T browser, embedded on most SIM cards as part of SIM Application Toolkit (STK) widely used by GSM mobile operators across the world to provide value-added services to customers.

Credit: AdaptiveMobile Security

How Simjacker works

S@T — short for SIMalliance Toolbox Browser — is a microbrowser (aka mobile browser) designed to be used on mobile devices, especially on phones that support Wireless Application Protocol (WAP), a common standard for accessing the internet since the early 2000s.

The browser — stored as an executable application on the SIM card residing inside a GSM mobile phone — offers mobile service providers an interactive means to allow users access web applications such as email, stock prices, news, and sports headlines.

With modern mobile browsers such as Chrome, Firefox, and Safari now capable of supporting full HTML web pages, WAP — and by extension S@T — has been deemed largely obsolete.

But AdaptiveMobile said it found the S@T browser technology active on mobile operators in at least 30 countries, with a combined population of over one billion. That doesn’t automatically make everyone susceptible, as it’s very much possible that mobile operators are no longer using SIM cards containing the vulnerable S@T browser.

Disclosing that the attacks are happening on a daily basis, the researchers also said a few phone numbers had been tracked hundred times over a 7-day period, implying they were high-profile targets.

How does the attack work?

At a high level, the vulnerability works by leveraging a GSM modem — available for as cheap as $10 — to send malicious messages to handsets that still use the S@T browser functionality in order to trigger specially crafted STK commands.

Here is some comment from the GSMA. It doesn’t have data on which countries were impacted (although others likely will) pic.twitter.com/itTNAXjGAH

— Joseph Cox (@josephfcox) September 12, 2019

The SMS is not the regular kind, but another flavor called Binary SMS that’s used to deliver rich-content, such as ringtones, telephone system settings and WAP push text messages.

The device, upon receiving the SMS, blindly passes on the message to the SIM card without bothering to check its origin, following which the SIM card uses the S@T browser to execute the command — including requesting location and device information such as IMEI numbers.

“During the attack, the user is completely unaware that they received the attack, that information was retrieved, and that it was successfully exfiltrated,” the researchers said.

While the primary attack detected involved the retrieval of mobile phone locations, the scope of Simjacker has considerably widened to “perform many other types of attacks against individuals and mobile operators such as fraud, scam calls, information leakage, denial of service and espionage.”

SIMalliance, for its part, has rolled out fresh recommendations to cellular carriers to implement additional security for S@T push messages by filtering such illegitimate binary SMSes.

As ZDNet notes, Simjacker attacks have been theorized at least since 2011. But this is the first time they have been exploited via complex techniques to enable surveillance.

“Now that this vulnerability has been revealed, we fully expect the exploit authors and other malicious actors will try to evolve these attacks into other areas,” AdaptiveMobile Security’s chief technology officer Cathal Mc Daid said.

Read next:

It's possible to monetize data while respecting consumer privacy — here's how