Snapchat Breach And The Biggest Security Flaw Ever

Social media photo and video site Snapchat has had its share of headline-grabbing, embarrassing security issues over the years, some intentional and some due to its own inability to plan. When a hacker warned and then exposed nearly 5 million users’ accounts because of a bug that left the info vulnerable, that was bad enough. But when 100,000 or so shared videos and photos were accessed and released online (despite the company insisting that it doesn’t store the messages its users send, while forgetting that the cellular providers’ servers do store that information) some experts wondered if that might have been enough to seal Snapchat’s fate as an untrustworthy platform.

But the news last week that Snapchat has experienced a whole new data breach only highlights what too many companies refuse to accept: your biggest security threat may very well be someone on your payroll.

In an apology post on February 28, Snapchat admitted that an employee had willingly handed over highly sensitive information on the company’s employees–everything needed to steal their identities–because of a phishing attack. The email appeared to come from the company’s CEO Evan Spiegel, requesting the payroll records of all employees. Unfortunately, at this time of year, that’s not an unheard of request since the tax filing deadline for individuals is next month. The recipient dutifully submitted the information; four hours later, Snapchat was on the phone with the FBI to report the breach.

If Snapchat can take any consolation from this, it’s that human error is behind an increasing number of breaches, especially now that more and more companies are realizing (and believing) the need for tighter antivirus and anti-malware software across their entire networks. This is largely why “boss phishing” is becoming more and more common; as low-level hackers find themselves blocked at every turn, what’s easier than masquerading as the boss and getting an hourly-wage employee to hand over the information they want?

A phishing email was behind one of the most infamous recent data breaches, the Target retail chain breach that affected as many as 121 million customers. The source of the bug that infected the store’s POS credit card system (thereby stealing credit card information) was spread via a link in a malicious email sent to one of Target’s air conditioner repair companies.

Who needs to worry about pesky security protocols and tightened cybersecurity when you can get a secretary to install the bug for you by clicking on a link to a cat video?

Unfortunately, the response in these cases is almost always the same: we’re shocked…we don’t know how this happened…we never thought one of our employees would do this. But that begs the question: Why not? Why don’t more companies realize that their workforce is made up of individuals who may or may not have the necessary training to prevent an attack or the right motivation to keep company data secure? More importantly, why are companies still surprised?

Official Linux Mint Distro Download Website Hit By Malware

Anyone who downloaded Linux Mint 17.3 Cinnamon edition last Saturday has more than likely been compromised by hackers.

Clem Lefebvre, Mint Distro’s creator warned in a blog post that a malicious 3^rd party had been found to have hacked the official website and pointed users who wanted to download the open source OS to a modified version that contained an opening that the hackers could exploit. The compromised ISO was said to have been packed with Tsunami botnet malware.

“Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it…What we don’t know is the motivation behind this attack,” said Lefebvre.

The maliciously modified version was only available for a short period of time last Saturday before it was found, but if you happen to be one of the few who downloaded the distro from the official site on the 22^nd February, then you should take action urgently. Lefebvre recommends that if you think your machine might be infected you should:

“Delete the ISO. If you burnt it to DVD, trash the disc. If you burnt it to USB, format the stick.

If you installed this ISO on a computer:

• Put the computer offline.
• Backup your personal data, if any.
• Reinstall the OS or format the partition.
• Change your passwords for sensitive websites (for your email in particular).”

Isn’t it ironic

If, however, you grabbed Mint 17.3 Cinnamon from another source outside of the official website, chances are you’re going to be ok.  Which is ironic, considering that you’d expect the legit vanilla official download site to be the safer option as opposed to torrent downloading.

The official Linux Mint website has also confirmed that its forums database had also been targeted in the hack. Forum users have been directed and urged to change not only their forum logon details, but also any other passwords outside of their usage of Linux related devices and software.

 “If more efforts are made to attack our project and if the goal is to hurt us, we’ll get in touch with authorities and security firms to confront the people behind this,” Lefebvre concluded.

EU Agrees New Cyber Rules For All Europe

Technology firms and those in charge of critical IT services will in future be legally mandated to report successful cyber-attacks under new rules being put forward by the European Parliament.

The new rules are also set to establish effective minimum standards of cyber security for utility firms and financial institutions.

If the proposed new rules are passed into law, it will in effect be the first time that the European parliament will have created a unified single set of laws on cyber security. At present there is no single approach in Europe to deal with data hacks either intentional or through human error.

The intended laws have been agreed upon by MEPs and individual government ministers from across the whole gamut of the EU’s 28 member states.

“The Internet knows no border – a problem in one country can have a knock-on effect in the rest of Europe. This is why we need EU-wide cybersecurity solutions. This agreement is an important step in this direction,”European Commission Vice President Andrus Ansip said.

The Network and Information Security directive is an attempt to unify Europe’s response to the ever increasing threat of hackers. While the directive is primarily aimed at essential state infrastructure such as power stations and airports, it will also apply to some technology firms as well, such as Google and Amazon, to report serious breaches or face penalties if they fail to disclose vital information

ENISA (European Agency for Network and Information Security) has estimated that hackers and cyber breachesaccount for between €260 – €340 billion of revenue loss across Europe each year.

Under the new EU directive, member states will have to work more closely together on improving cyber security and dealing with hacks, while being forced to openly exchange information regarding cyber breaches. Member states will also be called upon to assist member states in ensuring that critical state infrastructure is as protected as possible.

German MEP Andreas Schwab said of the deal that:

‘A milestone has been achieved: we have agreed on the first ever EU-wide cybersecurity rules, which the Parliament has advocated for years.’

That said, it will still be some time before the new proposals will become EU wide law.  The Network and Information Security directive will have to approved by the  national governments that comprise the EU, and also gain approval from European Parliament as well.

After that, EU countries will have around two years to put the new measures in place.

F-35 Radar: Have You Tried Turning It On And Off Again?

The US F-35 Joint Strike Fighter, beset by problems and setbacks since its inception back in 2001, has run into yet another problem with some of its on-board software.

The troubled F-35, in flight

At more than a trillion dollars and what sometimes seems like a trillion glitches, and a trillion bad headlines, the latest issue with the F-35’s software has been found in the software responsible for the Radar it uses.

The solution however is quite simple and straightforward, and one that IT Support staff have relied upon for years to solve problems in first line troubleshooting: Turning it off, and then on again.

In the latest publicly released report on the joint strike fighter, US Air Force major general Jeffrey Harrigian statesthat:

“What would happen is they’d get a signal that says either a radar degrade or a radar fail—something that would force us to restart the radar.”

The latest report into the troubled development of the new fighter jet has been described as damning, listing as it does a multitude of deficiencies that seem to routinely being found as development of the fighter plane creeps ever closer to deployment.

Many of the failures causing headaches for the US military and its designers is the fact that many of the issues are primarily due to buggy software.

Not as crazy as it sounds

It really isn’t.

The F-35 Joint Strike Fighter, built by Lockheed Martin, is currently one of the most advanced and heavily software-driven warplanes ever designed and built. It is therefore also one of the most complicated and difficult IT projects ever undertaken. But it’s not just the software and onboard computer systems that Lockheed Martin have struggled with.

The plane has also struggled with its apparent vulnerability to lightning strikes, landing gear issues, weight issues, and bomb bay door faults, depending on climatic issues in the hotter areas of the world.

Hacker proof?

Apparently not.

The F-35 has yet to undertake any serious cyber security testing, something that could be a real possibility with cyber warfare an increasing threat across the world. something that has caused concern among buyers who have the joint strike fighter on back order, including branches of the US military, and the United Kingdom

The latest Pentagon report quoted above stated that glitches were found…

“…in fusion, electronic warfare, and weapons employment result in ambiguous threat displays, limited ability to respond to threats, and a requirement for off-board sources to provide accurate coordinates for precision attack.”

Speaking to the Guardian newspaper, Keith Joiner, the man responsible for the final evaluation  for procurement by the Australian Defence Force, said that “the only system that has done cyber security, vulnerability and penetration testing is the logistics software. So ordering spares. And it didn’t go very well.”  

ISIS Struck By Internal Data Breach

It seems like you can’t do anything these days without dealing with the bureaucracy of it all. Forms to fill out, regulations to follow, miles and miles of red tape…and of course, the ever-present and usually outdated technology. Everyone from schools to retailers to even the government has to suffer under the weight of policies and procedures.

Unless you’re a terrorist organization, in which case you can apparently toss all your information on a memory stick and leave it lying around an office somewhere. That’s the case with an ISIS faction, at least, and the end result was the loss of 22,000 registration forms for its members after a memory stick with the information was taken from the office of their head of security. These forms contained names, addresses, birth dates, phone numbers, even blood types on individuals who’d been recruited or volunteered for the terror organization.

According to the Guardian, “The documents, thought to be from a border crossing into Syria, are questionnaires of each would-be recruit. There are 23 questions, including names, date and place of birth, hometown, telephone number, education and blood type.”

Two different sources both claim to have possession of the information. A German intelligence agency acquired the forms, and Sky News reports being given the unencrypted memory stick after it was stolen by a former member who became disillusioned with the terror network’s practices.

While security watchers were aware of a number of the names on the registration forms, there were also more than a few surprises. What is known is there were specific numbers of US, UK, and Canadian citizens who’d signed on to join ISIS’ efforts. Members from more than forty different countries were included in the leaked data.

As with any data breach, the real concern now is what happens with the information. In a standard consumer data breach, citizens have to worry about monitoring their credit reports for any signs of suspicious financial activity; it’s not hard to imagine what the repercussions will be after handing over the names and addresses of known ISIS members and their families to the government.

Economics: China in the new world

For nearly 15 years, China's economic and construction boom, coupled with high commodity prices, has driven soaring demand for steel, copper and other commodities. Latin America has been a crucial partner, with Chile, for instance, accounting for 40% of raw copper imports and Brazil responsible for 49% of soya imports. China's mounting concerns about food and energy security have also prompted engagement with resource-rich Venezuela, Peru and Argentina. The China-fuelled 'super-cycle' has left a path of environmental destruction and social conflict in Latin America. Now, China's economic slowdown and a slump in commodity prices spell bleaker economic prospects for exporting nations. For instance, Chilean copper company Codelco announced massive lay-offs in 2015 as copper prices dropped.

As one of the first accounts of post-“China boom” Latin America, Kevin Gallagher's The China Triangle adds much to a profusion of books on China–Latin America relations. By skilfully framing Latin America's development challenges — such as lack of highly skilled labour — in a historical context, Gallagher reminds us that commodity-led growth is hardly a new phenomenon in the region. The end of the nineteenth century saw the first boom, when Europe and the United States began to import raw materials in serious quantities. Years of dependence on exporting natural resources led to wide-ranging policy outcomes in Latin America, from state-led industrialization to the Washington Consensus, a set of US prescriptions for economic development in the region in the 1990s and 2000s. The China Triangle is largely premised on the idea that the most recent phase in Latin America's economic development was as much a rejection of the consensus as an embrace of China.

As Gallagher shows, that relationship has been rocky in many ways. Gallagher documents the negative effects of booming trade and investment by Chinese and other firms in extraction of natural resources. Growth in mining alone has led to increased chemical leaching, improper disposal of waste and acidic runoff from mines. Chemical leaching has killed fish and caused economic damage in Peru. Deforestation and related flooding in Argentina are thought to stem from the rise in soya production for export to China.

Gallagher is careful to note that Chinese companies have shown their capacity to adapt to Latin American laws and norms. In Peru, US company Doe Run performed much worse on a number of counts than Chinese mining firms. But the vast majority of trade, 90% of Chinese investment in Latin America and 80% of its loans to the region's governments are focused in sectors linked to environmental degradation. Hence China has, on average, more environmental impact in Latin America than do other partners.

Concerns surround China's hydroelectric-dam projects in the region, including the Coca-Codo Sinclair dam, Ecuador's largest energy project. Although this is expected to address a critical energy deficit, many Ecuadoreans are concerned about water diversion from the San Rafael Falls, a prominent tourist destination, and the construction of access roads in the Amazon. The Néstor Kirchner and Jorge Cepernic dams in Argentina were touted as key energy projects by former president Cristina Fernández de Kirchner, but they are far from the grid and about 2,750 kilometres from Buenos Aires, where energy needs are high. A 2006 feasibility study of 30 dam projects by Argentina's energy ministry ranked them 23rd and 25th, respectively.

In 2015, Chinese company MMG Ltd modified its environmental-impact study for the Las Bambas copper-mining project in Peru's Cotabambas province without consulting local communities. Although compliant with newly modified Peruvian law, the decision provoked demonstrations by local residents that ended in 4 deaths and led Peruvian President Ollanta Humala to declare a 30-day state of emergency in the province.

Despite China's slowing growth and some bad press, the country will — Gallagher reveals — remain one of the region's key economic partners. Last year saw Chinese finance to Latin America and the Caribbean rise to a level surpassed only in 2010, much of it focused on oil, gas and transport infrastructure. Just as US investors did in the decades straddling the turn of the last century, China is seeking to develop transport networks to carry commodities to port, such as the Peru–Brazil railway proposed during Chinese Premier Li Keqiang's 2015 visit to the region.

Latin America also stands to benefit from China's sustained presence. In The Dragon in the Room(Stanford University Press, 2010), Gallagher and Roberto Porzencanski advised nations to capture China's windfall by investing in export diversification. They did not, but Gallagher insists in The China Triangle that it is not too late. He prescribes greater partnerships between countries and markets, and policies that promote equality and environmental stewardship. But post-boom, Gallagher foresees a Latin America with less room to manoeuvre, economically and politically. The region would need to appeal to both the United States and China to ensure future growth. Gallagher's 'China triangle' refers to this shift.

The value of diversified partnerships, whether with the United States and China or a wider variety of partners, is increasingly clear to Latin Americans. The region should avoid dependency on raw-materials exports — and beware of reliance on big powers with deep pockets.

24 Conversion Rate Optimization Tools for Research, Feedback, Analytics & More

In some cases, these optimization techniques might be as basic as changing the color of a CTA. In other cases, there's a lot more that can be improved. 

The list below outlines a ton of helpful tools for marketers who are looking to optimize their conversion rates. To help you understand which tools are used for what, we’ve also broken this list into a few major categories: lead capture tools, research tools, analytics tools, mouse tracking and heat maps, feedback tools, and experiment tools. 

From high-level changes like landing page and email design and inspiration to in-depth insights on how your visitors navigate through your content, these tools will help you improve the performance of your site.

Ready? Let's get converting ...

Lead Capture Tools

These are the tools that you will use to capture more leads on your site, thus improving your CRO. While most conversion-focused content has a built-in form or CTA, these tools act as additional lead capture mechanisms to boost the number of leads that convert on your content.

1) HelloBar

Price: Free for Basic, $12/mo for Pro, $83/mo for Enterprise

HelloBar is a lead capture tool that allows you to add a popup form to your website to grow your email list, promote your social pages, showcase a sale, or other lead generation strategies. The free version allows you to create one modal that'll be shown to every tenth visitor. However, premium plans offer more advanced call-to-action options. 

2) SumoMe

Price: Free for Basic, $10/mo for Starter, $100/mo for Pro

SumoMe offers a suite of free tools to help you increase your site conversions. For lead capture, it offers a 'Welcome Mat' popup CTA, a 'Smart Bar' to increase email subscribers, a scroll-triggered box, and a 'Contact Us' form. Along with their Google Analytics research tools, the SumoMe suite helps you gain on-page insights and increase your email list. 

3) Leadin

Price: Free!

This tool is like Google Analytics meets SumoMe meets a CRM. Sounds cool, right?

Leadin starts with a popup CTA, then syncs with your website’s existing forms to learn about your site visitors and their path through your pages. It gives you in-depth contact insights on both prospects and current contacts in your database. Leadin also pairs its contacts database with a dashboard that shows you on a high-level view of which marketing efforts are paying off and converting, and which ones aren’t. 

Research Tools

Before you create any content, you'll want to call upon these tools to draw inspiration and check out what other smart marketers have seen success with in the past.

4) BuzzSumo

Price: $99/mo for Pro, $299/mo for Agency, $999/mo for Enterprise

The best content is the content that gets shared and linked to the most, right? So what better way to gain preliminary insights than to compile all of the most shared content on your particular topic?

With BuzzSumo, all you have to do is enter the keyword or topic you're focusing on and it will pull together all of the most shared and linked to content on that topic from the last day, week, month, or year. So if you’re trying to optimize the landing page for your new webinar on cat fashion, all you have to do is enter ‘cat fashion,' and BuzzSumo will spit out all of the best articles, resources, videos, and more on the fascinating topic of cat couture.

You’ll then be able to dig in and explore some of the key elements that made these pages popular so that you can go back and incorporate them into your own content.

5) SimilarWeb

Price: $199/mo for Basic

Knowing where your website visitors came from can (and should) have a big impact on the type of content you create. With SimilarWeb, you can see where your traffic is coming from, which keywords are fueling your organic traffic, and what other sites are considered most similar to yours.

With this information, you’ll be able to optimize your content for your biggest traffic sources, and dig in to see what competitor sites and doing to drive conversions.

6) LandBook

Price: Free!

If you’re creating a landing page from scratch, getting started can be difficult. Luckily there’s LandBook: a free collection of the web’s best designed landing pages.

With LandBook, you can explore all of the ways that top companies are using elements like copy, positioning, layout, and design to drive conversions. Pick and choose your favorite elements from the LandBook database, and then incorporate them into your own landing page.

7) Really Good Emails

Price: Free!

Today, the average attention span of an adult is eight seconds, which means if you want to get your message across, you’d better know a thing or two about visual communication and design.

Don't know a thing or two about either? Enter ReallyGoodEmails.

Similar to LandBook (see above), ReallyGoodEmails is a database of the web’s best designed emails from the world’s most innovative companies. Use this as a resource to see how you can design your email to get your message across in the best way possible, as fast as possible.

(Check out this post for even more resources where you can find great marketing examples.)

8) SubjectLine.com

Price: Free!

When sending email, the subject line can either make or break your performance. Before you choose which ones to ship, check them out using this awesome resource. SubjectLine.com has tested over three million subject lines and has a tool to evaluate your potential options. It gives a deliverability and marketing score, plus advice on improving.

9) Headline Analyzer

Price: Free!

CoSchedule’s headline analyzer gives you a score of 1–100 to gauge how effective your title will be. The score is calculated based on word usage, grammar, vocabulary, which type of headline it is, as well as character and word count.

The tool also shows you what your headline looks in like Google search, in an email subject line, and more. While we still recommend that you always test your headlines, this tool serves as a great litmus test to find out generally how well your headline will perform.

Analytics Tools

These are the tools that you will use to measure and track your content's performance. You can use them to fully analyze the dips, jumps, and fluctuations in your conversion rate.

10) Kissmetrics

Price: $200/mo for Starter, $700/mo for Basic, $2,000/mo for Pro

Kissmetrics is a complex tool that integrates with your email service provider to make it easy for you to analyze your audience and email them in specific cohorts. With Kissmetrics, you can learn the path that your customers have taken through your website, conduct A/B tests, build data sets (without SQL), and figure out the ROI from your campaigns. 

11) Google Analytics

Price: Free for Basic, Contact Sales for Premium

Google Analytics is a free way to track your website visitors. You can see how long it takes visitors to bounce from your pages, if visitors complete goals from a certain path, and which sources are bringing people to your website. What's great about Google Analytics is that is allows you to see which keywords people are searching to find your page, track which device people are searching for your website on, and uncover demographic data. However, there are no specific emails/contacts associated with your site visitors.

12) HubSpot Website Grader

Price: Free!

Website Grader is a great way to get a quick snapshot of a website’s overall performance. It gives insights on performance factors (including speed, page size, and page requests), mobile responsiveness and appearance, SEO (page titles, meta descriptions, headings, and site map), and security. From there, the tool devises a grade and provides suggestions on how to improve, which makes it easy to come up with some quick wins that'll help you boost conversions. 

Mouse Tracking & Heat Mapping Tools

These are the tools that you will use to see how people are interacting with your content, including how they scroll and where they click.

13) Hotjar

Price: Free for Basic, $29/mo for Pro, $89/mo for Business

Once you’ve nailed the basics like landing pages, CTAs, popups, and content, you’re ready for some more advanced conversion rate optimization.

Hotjar offers heat maps and screen recordings, which enable you to track how much of your page is being viewed, as well as how visitors are navigating your website. 

14) Clicktale

Price: Pricing is based on solution (contact sales for a demo)

Clicktale is similar to Hotjar, as it also offers heat maps to help you determine the most valuable real estate on your pages, scroll depth (where is the “fold” on your website?), click tracking, and also link analysis.

Using these tools, you'll have the information you need to organize content, CTAs, and page design in a way that makes the most sense for engagement. 

15) Clicky

Price: Free for Basic, $9.99/mo for Pro, $14.99/mo for Pro Plus, $19.99/mo for Pro Platinum

Clicky gives you real time analytics on the visitors on your website. It tells you where people are accessing your site from, how long they’ve stayed on each page, and how many visitors are actively online. The resource also offers heat maps and scroll tracking. 

16) Crazy Egg

Price: $9/mo for Basic, $19/mo for Standard, $49/mo for Plus, $99/mo for Pro

Crazy Egg offers a full suite of heat maps and click tracking, with the additional functionality of being able to segment clicks by source and evaluate link effectiveness. The basic package is fairly inexpensive and gives great insights on how effective each page of your website is.  

17) Heatmap.me

Price: Free for Basic, $100/mo for Premium, $200/mo for Enterprise

Heatmap.me is a great free option for anyone looking to start exploring heat maps, responsive web design tests, and real-time page statistics. Heatmap.me can also track dynamic elements on your site in the heat map tool -- think: slider bars, photo galleries, and other interactive sections.

Feedback Tools

These are the tools that you will use to engage and receive feedback from your visitors. Feedback tools include surveys, polls, messaging, and user testing programs. 

18) Intercom

Price: $49/mo for Basic (in each product- Acquire, Engage, Learn, Support) + package plans

You can use chat tools to both acquire new customers and chat with existing customers. As a CRO tool, you can use Intercom to communicate with website prospects to learn if they need additional help, find out how their experience is going, and learn how you can improve. It also allows you to track leads and use a shared inbox with your team.

19) Qualaroo

Price: $63/mo for Small Business, $199/mo for Professional, $499/mo for Enterprise

Using chat windows doesn’t just have to be for live chat. Qualaroo offers popups to collect live feedback from website viewers. With this information, you can tailor a site experience, target certain customers, and learn what issues people may be experiencing. This tool is extremely helpful at all stages of the funnel, and is especially utilized in the ecommerce space. 

20) SurveyMonkey

Price: Free for Basic, $26/mo for Select (month to month), $25/mo for Gold (annual), $85/mo for Platinum

SurveyMonkey has a free option for those just starting out with survey research. You can use this tool to learn demographic information, discover which types of content your prospects and blog subscribers prefer, and get product feedback. 

21) Five Second Test

Price: Free for Basic, $99/mo for Pro

UsabilityHub has an awesome community-fueled tool called 5 Second Test that allows users to upload a product, app experience, or design and have the community test it out. You get responses about recall, general feedback, and UI thoughts. This is a great way to get opinions, and they also offer click tests, preference tests, question tests, and navflow tests for other website and UI questions. 

Experiment Tools

These are the tools that you will use to manage, plan, and execute A/B and multivariate tests. Some of these tools will help you turn ideas into experiments, while others will help you create the variations and run the actual tests on your site.

22) Optimizely

Price: Free for Starter, $49/mo for Pay As You Go

Testing is hard: It’s hard to come up with a good control group, find a large sample, and determine if your experiment is statistically significant. Luckily, Optimizely helps a lot with all of that ... and then some. With Optimizely, you conduct tests across all devices and platforms, then figure out if it is significant or not. The software offers A/B, multiple page, and multivariate tests.

23) ABTesting.net

Price: Free!

Act-On software offers a free A/B testing tool that walks you through the process of trying out your first A/B test of a site page. It helps explain the basics of A/B testing, and allows you to confidently publish your winning variation (if your content management system doesn’t already include an A/B testing tool).

24) Effective Experiments

Price: Free Trial + Contact Sales for Pricing

Effective Experiments is a concise way to track all of your experiments. If you have tons of Excel spreadsheets cross-referenced with Google Analytics data, you are probably going crazy trying to keep track of everything. This tool puts it all in one place and helps you determine statistical significance. 

Hopefully you’re armed and ready to start improving conversion rates across your website and marketing efforts. These tools range from free and for beginners to robust and more advanced. Feel out which options seem right for you and soon you’ll be upgrading to the more complex tools when you’ve mastered the basics.