Security company Cloudflare have revealed that a leak of sensitive data (nicknamed ‘Cloudbleed’), which was made possible by a bug in their code, could mean that many users of popular services may need to change their passwords.

What Happened?

A bug in the code of California-based Cloudflare’s software appears to have leaked data from perhaps as many as four million domains of the six million websites that using Cloudflare’s performance enhancement, SEO and security services.

Any requests to websites with the HTML rewrite features enabled, triggered the software bug, which then leaked personal data from any other Cloudflare proxy customers that were in memory at the time, to random requesters.

What Kind of Data Was Leaked?

The kind of personal customer data that was leaked included session tokens, passwords, private messages (perhaps including private messages sent on dating sites), API keys, and possibly even credit card details. The full scope of the leaked data is not yet known.

When … and For How Long?

The problem, which was discovered and reported by Tavis Ormandy (a Google researcher), resulted in data being leaked (accidentally) over the last six months by data-crawlers and regular website users downloading files and visiting sites. The worst period for the leak is thought to have been between February 13th and February 18th. During this time, it is believed that a memory leakage took place for 1 in every 3,300,000 HTTP requests through Cloudflare.

Complicated Clean-Up.

Although the leak itself was bad enough, it has been compounded and made much more difficult to clean up because :

1. The leak contained cookies and authentication codes. This means that users can’t clean all of up the mess by themselves, but need website administrators to take action too.
2. Search engines cached the leaked data, thus making it a lot more difficult and time consuming to clean up. For example, authentication cookies for sites affected by ‘CloudBleed’ can be found in web searches. These could potentially allow someone to log into a website without a password, posing as a regular user. To their credit, it has been reported that many search engines including Google, Yahoo, and Bing did what they could to scrub the data before news of the bug was publicly announced.

Popular Websites Affected.

Data from many popular websites is believed to have been leaked. Websites affected include Uber, Fitbit, Ok Cupid, and Yelp.

Do Hackers Have The Leaked Data?

Security commentators say that, to this point, there is no evidence to suggest that the data has fallen into the wrong hands or is being used by hackers.

What Does This Mean For My Business?

The advice from security commentators is to first check whether details of you / your business may have been leaked by checking the list of domains for that appear to have been affected by the Cloudflare leak. These domains have been posted online here : https://github.com/pirate/sites-using-cloudflare 

Other actions that you can take include :

• Ask your vendors and sites to reset / rotate all session tokens.
• If you use websites that have a link / button that allows you to log out of all active sessions, click on it. Then, do the same thing again in week or two week’s time.
• Check your password managers and change all of your passwords, especially those on the named affected sites.
• Make sure that you set up two-factor authentication on important accounts.
• Rotate API keys and Secrets.

Israeli ad-blocking software company Shine is re-positioning itself as a trusted online ad verification hub for both consumers and advertisers.

Ad Verification & Filtering Service

Shine’s new, free ad filtering and verification service provides a way for consumers to agree to receive adverts that meet quality and relevance criteria, and therefore give advertisers a co-operative way to get around the ‘stone wall’ that consumer ad-blocking software presents.

What’s The Problem For Consumers?

For consumers, online advertising has proven to be a problem and an annoyance where:

• There’s a feeling of being bombarded and interrupted i.e. there are too many online adverts, and consumers lives are interrupted, time is lost, data consumption is eaten up, and extra effort has to be made e.g. having to wait due to advert loading / playing and having to actively close or navigate away from adverts. For example, estimates at the amount of a mobile user’s data consumption used up by adverts range from anywhere between 20% and 50%.
• There’s a lack of relevance in the adverts that are displayed.
• The adverts are too large, unwieldy and awkward to deal with.
• There’s a feeling of being ‘followed around’ by adverts for products that a person may have searched for some time ago.

Turning To Ad Blockers

One option for consumers has been to use ad blocking software. The ease of doing so was aided by companies such as Apple and Samsung allowing the apps on their mobile browsers.

After an announcement in February 2016, the ‘Three’ network also trialled a network-level block on advertising (in partnership with Shine) last summer because it was believed to be more effective than ad blocking apps (many of which were banned from some app stores anyway).

Although advertisers and publishers feared a huge uptake of ad blocking software, Internet Advertising Bureau (IAB) figures from last year show only 22% of UK adults were using ad blocking software.

The Problem For Advertising Publishers

The problem for advertising publishers and content providers is that ad blockers essentially cut off the source of revenue that they use to fund much of the content they produce.

The response from advertising publishers over the last year has therefore been to deny access to content to people who use ad blockers.

Value Exchange

This situation of consumers realising that they cannot view free content unless they turn ad blockers off, and of publishers accepting that they should produce adverts that consumers are more happy to receive, has led to the current acceptance of the need for a ‘value exchange’ between all parties.

Shine’s New Role

After working with mobile carrier Three, an advertising agency and a media firm for the past six months, Shine’s new role in the value exchange will therefore be to sit between consumer and publisher to offer a mutually beneficial service. Shine’s ‘Rainbow’ platform will therefore mean that ad agencies will send their adverts to the Rainbow platform to be verified and validated. Consumers who sign up to Shine will then only see adverts that have been verified through Shine’s Rainbow platform. Shine will then provide feed back to advertisers and publishers about their adverts. Shine’s platform will be introduced later this summer.

What’s In It For Shine?

Shine stands to benefit from the branding benefits, from occupying a unique and almost essential positioning and from an insights and analytics product based on the data produced that can be sold on to advertisers.

What Does This Mean For Your Business?

For businesses wanting to beat the ad-blockers and get commercial messages through to more receptive consumers, the Rainbow platform is a potential opportunity,and a chance to gain competitive advantage. For those of us in business who have been frustrated by online and mobile advertising (but who don’t want to lose out on accessing favoured content) Shine’s Rainbow platform could offer a more acceptable middle ground.

A team of Dutch researchers have used brain scans of consumers to discover what makes adverts most effective in terms of prompting a person to seek out a product online.

The Research.

The researchers (at Rotterdam School of Management, Erasmus University RSM) showed a group of consumers 11 different adverts, all for the same brand of pain-relieving muscle and joint gel. The research was intended to gain insights into both the reactions of the brain to advertising stimuli, and the resulting online search behaviour.

The researchers studied both the data from the click-through rates and the combination of elements in the adverts for the whole audience group.

From the results of this data, a smaller sub-group of participants were then selected for brain scans, to provide a deeper understanding of the advertising thought-behaviour process.

Why Brain Scans?

Brain scans (also know as magnetic resonance imaging fMRI), were used because the researchers believed that this was the best method to enable them to understand why certain elements of adverts are effective in causing consumers to take to the web to look for a brand / product.

The Results.

Somewhat predictably, the researchers concluded that the effectiveness of a marketing message cannot be explained by simply isolating just one simple brain process, and that a much more complex combination of processes in the brain is actually at the heart of consumer responses to adverts.

The researchers were, however, able to identify some elements that appeared to be present in adverts that got the best responses.

Adverts that communicated the advantages of products were found to trigger the part of the brain that is commonly associated with recognising and identifying objects. The triggering of this area is believed to make people begin thinking about how objects could be used, thereby providing a vital link to behaviour.

The researchers also found that adverts / elements of adverts that appeal to a person’s imagination, or deliver a message in an imaginative way, appear to activate more complex through processes, such as sustained attention, creative thinking, and working memory.

What Does This Mean For Your Business?

There has already been a great deal of research into advertising and its effects and we already know that appealing to human emotions and traits rather than just presenting cold facts, coupled with repetition can help marketing messages to be more effective.

The interesting fact about this research is that it focused directly upon the brain itself, and how the responses to advertising stimuli elements translated into specifically ‘online’ behaviour. This makes the results more current and relevant to businesses, most of which now need to achieve online visibility.

A new anti-piracy voluntary code of practice between search engines Google and Bing could see the filtering out of websites offering pirated films, music and illegally streamed sport.

What Was The Problem?

At the moment, search engine filtering is not in place to the point where search engine users clicking on high ranking search engine results don’t end up unwittingly arrive websites which present a possible security risk and/or offer illegal/pirated content.

Online piracy means that providers of content (e.g. films and sport) are currently losing out on significant amounts of potential income, as well as wasting part of their marketing spend and losing control over quality.

In terms of what anti-piracy action can currently be taken by and on behalf of UK content providers, court orders can be taken out to block certain sites, advertising can be restricted on illegal websites, and initiatives are in place to educate and gain support from consumers, such as the ‘Get it Right From A Genuine Site’ campaign.

Google Already Has Some Measures in Place.

Google already takes some anti-piracy measures, such as removing links from search engine results where rights holders are able to provide proof that their copyright has been infringed. Google also punishes web pages that have large numbers of takedown requests by giving them lower search engine ranking positions.

Government-Brokered Talks Produce ‘World First’ Code.

The two search engine titans and representatives of the entertainment industry reached agreement on the new code during talks brokered by the UK government. The talks brought the main UK interested parties together to reach a mutually beneficial solution, which is thought to be a world first code of practice.

Although the talks were led by the Intellectual Property Office, the Department for Culture, Media and Sport, and Ofcom also provided advisory support and assistance.

What Will The Code Mean in Practice?

Content commentators seem to broadly agree that a joined-up approach that takes into account the interests of multiple parties is a positive step. It is thought that adoption of the code by Google and Bing, which looks likely to begin this year, will mean fewer security risks for consumers online, and a greater likelihood that consumers will more quickly be able to access high quality content on fairer sites, and avoid any legal risks associated with downloading copyright-infringed content

What Does This Mean For Your Business?

This can only be good news for businesses investing in and providing high quality and original content. Although it is not an out-right screening out of piracy, it looks likely to make life more difficult for those seeking to benefit financially from the work and investment of legitimate content providers.

Businesses will now also need to be more thorough in checking to make sure that any content they publish online is not infringing any copyrights.

Online retailer Amazon has announced that is going to create 5,000 new full-time jobs in the UK this year.

The new jobs will boost Amazon’s total, permanent UK workforce to 24,000.

What Kind of Jobs?

It has been reported that Amazon is going to be hiring people in a range of roles, including anything from software developers to warehouse staff. The new UK jobs will also include hundreds of apprenticeship opportunities.

Where?

It looks likely that the jobs will be created at Amazon’s new head office in London (where many of the most technical roles are situated) as well as at their Edinburgh customer service centre plus three more new warehouses / fulfilment centres in Tilbury, Doncaster and Daventry.

Why The Expansion Here?

The UK market is Amazon’s second biggest outside the US, behind Germany. The extra 3 fulfilment centres are reported to be needed to allow Amazon to cope with its existing rate of growth and to help speed up deliveries. Amazon also needs more space and staff because it will be handling more deliveries for third-party retailers who use its website for sales and who need its delivery services.

Some analysts have also mentioned a possible move into clothing plus there are reports that Amazon may be close to launching an own-brand fashion label.
These reports have been fuelled by news of Amazon creating a fashion photography studio in London. It is not inconceivable therefore that some of the new jobs may be related to this new area of the business.

Signs Last Year.

The signs of Amazon’s popularity and expansion appeared to be everywhere in the UK last year. For example, Amazon launched a grocery delivery service in parts of the UK last summer (thought to be a test for the US). Last September, Amazon also increased its locker collection / delivery points by getting a presence in Morrisons stores.

What Does This Mean For Your Business?

Amazon’s scale (and its economies thereof), the success of its business model plus the strength and reach of its delivery network, coupled with the power of its brand and the ease of online shopping for customers make it a serious competitor for many companies, which now include grocers and fashion retailers. Some businesses, however, benefit as third-parties using Amazon’s network, or through acting as hosts for Amazon’s collection points. News of new jobs being created by large international companies in the UK (particularly after Brexit) is welcome, particularly if the jobs are secure.