Monthly Archives: February 2019

A vast data breach has been announced, that is said to possibly be the biggest breach ever posted on the internet. Cyber security experts have warned that this could just be the beginning.

Cybersecurity expert Troy Hunt reported a list of more than 2.6 billion records had been exposed. These contained around 773 million unique email addresses and more than 21 million unique passwords. The stolen details are likely to be in use for years as hackers attempt to take over affected users accounts.

It is becoming apparent that there are a host of similar collections being passed around the web, many of which are far bigger than the Collection #1. Cyber security journalist Brian Krebs reported, after speaking with a seller of such collections, that Collection #1 is just one part of a numbered series, that taken together dwarfs the initial data breach that has been posted publicly. Collection #1 is roughly 87GB in size. Altogether, the whole collection is said to total more than ten times that.

Experts have said that those hacks were just the beginning, and that further email addresses and logins were likely to be discovered.

“This is a start of something far more significant than anything we have seen before,” said Jake Moore, cyber security specialist at ESET. “Hackers are becoming even more sophisticated and, hopefully, this is a massive wake-up call to anyone with an email address.”

The speculation that Collection #1 is that start of something bigger is highlighted by a new Collection leak, dubbed Collection #2-5. This leak, which contains 2.2 billion unique usernames and passwords, was first reported by Heise. In total it contains 845GB of data and more than 25bn records.

Over 1,000 downloads of private information has been reported. The increase of information is a serious consideration, and now there is more than one copy of the information makes it impossible to completely remove from the web.

We recommend to always use Two-Factor Authentication wherever it’s available. This method requires a password and further validation from another source (e.g. email or text). Two-Factor Authentication is highly recommended to secure and protect your personal data.

We also advise for maximum security to regularly change and update your passwords.

Deliveroo have encountered a common security problem for over a month, where customers have had their accounts broken into, with orders for huge quantities of food sent to seemingly random addresses. This is due to a cyberattack known as ‘credential stuffing’.

Credential Stuffing automates the logins for thousands to millions of accounts. This involves hackers obtaining usernames and passwords from previous data hacks and testing the details garnered from this against a user’s other online accounts. This is made possible by people reusing passwords for different accounts. “Sadly cyber criminals rely on the fact that people reuse the same passwords on multiple online services and use data breaches elsewhere to try gain access to other accounts on the web,” a spokesperson for Deliveroo said.

It is common for people to regularly use the same passwords across the web. Credential stuffing can be a straightforward way for hackers to gain access to your online t services and accounts. It’s not something that is unique to Deliveroo, there has been a huge surge in attacks using this method recently.

In January, the world’s biggest database of compromised email addresses and associated passwords was found circulating online. Dubbed Collection #1 and Collection #2-5, these vast collections contain more than two billion accounts totalling 845 Gb of data.

Reddit has also warned about an increase in credential stuffing attacks this month. Reddit admins said they saw “unusual” activity and locked people out of their accounts. “The most common explanation for this is the use of very simple passwords or the reuse of credentials across multiple websites or services,” admins wrote in a blog post, “If another site is compromised and those lists of usernames and passwords become available, it’s very likely that they will be tried against other popular sites”.

There is little services and companies can do to prevent credential stuffing. To be secure and protect yourself against a credential stuffing attack, you should never use the same passwords across different accounts – at least not those which are important and contain payment details, such as your email, banking, shopping, etc.

You can use the following tools to see if you details have been previously compromised: haveibeenpwned? and Info Leak Checker.

We are pleased to announce the launch of the first phase of the new Sound Reading System (SRS) website.

The Sound Reading System is a carefully constructed advanced ‘synthetic phonic’ reading programme that teaches children how to read and teachers how to teach the complex English spelling code in simple, logical steps.

We were tasked with updating the SRS brand and online presence. The SRS has international trademarks to preserve their method and teaching materials, so we needed to adhere to certain aspects of the existing brand for legal reasons, whilst also modernising it.

We have since refreshed the brand with a redrawn logo for digital (web safe colours for accessibility) and print, as well as typefaces to complement the existing brand type and a colour palette.

The website itself is key to raising awareness and explaining the key facets of the SRS programme and method.

We undertook a review of the previous website, its content and as well as all print content. From this we developed a rationalised structure for the content and thereby the site. As well as being user-friendly, the new site now incorporates responsive design, SEO friendly build, online previews of extracts of print materials, and full CMS editing capabilities.

We look forward to working on the next phases soon with SRS, which will include a press/information pack and e-learning modules for the programme itself.
View the site.

Facebook has announced plans to integrate WhatsApp, Instagram and Messenger. No official details have been released, however The New York Times reported that the merger is expected to take place by early next year.

The merger is intended to create “the best messaging experiences” for the billions of users around the world who use the Facebook-owned apps.

It has been stated that the apps will remain distinct from each other, although the underlying messaging infrastructure would be unified. A spokesperson for Facebook said the merger would deliver a messaging platform that was fast, simple, reliable and private.

Data experts have, however, warned it could have an impact on people’s privacy. Currently WhatsApp users are not required to provide any identifying information beyond their phone number to use the messaging app. Merging WhatsApp with Facebook Messenger and Instagram, could result in users being forced to share information about themselves that they would prefer to keep private.

Data privacy expert Tim Mackey, who works at the software firm Synopsys, stated “Merging personal information and privacy configurations from three significant applications won’t be trivial…Facebook development teams would do well to look at this precedent and prioritise user privacy”.

Facebook acquired Instagram for approximately £761m in 2012, before taking over the messaging app WhatsApp in 2014 for an estimated £14.7bn. Since the acquisition, both apps have rapidly grown. Instagram has around 1 billion monthly active users and WhatsApp has 1.5 billion users. Despite the expansion, it has been noted that all original founders of the apps have since left Facebook.