What Did You Do in the Cyber War, Daddy?

We often read about cyber-attacks, and some of you may even have heard of the expression zero day vulnerability, but this exotic world is usually pretty far removed from our everyday lives.

If for example you’ve been following the story of the Sony Pictures hack, or FBI reports on the widespread proliferation of Iranian malware, and you would be forgiven for thinking that this doesn’t actually affect you. This week, however, I’m beginning to realise that this may not be the case.

We see computers with malware infections every day, and most of these are actually relatively unsophisticated, regardless of the harm they cause to the system. A typical infection is most likely to come from visiting a compromised website, as these days people are too savvy to risk opening infected attachments. Anybody can radically reduce the risk of what we call drive-by infections by ensuring that their operating system is up to date, and that they have a good (also up to date) antivirus program in place*.

If it is a superficial infection then we use a variety of cleaning tools - the art is in determining which tools to use at any given time, and in which order, and also how the tool is used, and our standard operating procedure will change according to the prevalent threats at any given time. Most customers won't appreciate the level of care that goes into what we call a Level 1 clean.

A proportion of machines, typically 10% to 20% depending upon the threat cycle, will be so badly compromised that we carry out what we call a Level 2 clean, which is where we back up any user data, and completely wipe and reinstall the computer. In most cases this is because we’ve identified a root kit, which is where the operating system itself has been overwritten to mask nefarious activities; in this case wiping the machine is often the only way we can be sure that we are returning the computer with an operating system which has not been compromised.

In the last couple of weeks however, we've seen a fundamental shift in the nature of malware attacks, and while our industry is used to reading over-hyped articles about malware threats in the press, in this case you would be hard pressed to find any mention of this in the mainstream newspapers.

At the start of the week the technical press reported that a widely used plug-in for WordPress had been compromised on a huge scale with more than 100,000 infected sites having been identified. It appears that these attacks were exploiting what’s known as a zero day vulnerability in Firefox and Internet Explorer. The term zero day attack refers to an attack that has not been previously identified, and is therefore one that developers have not had time to address and patch.

Since this happened we have seen a surge in cases of computers misbehaving without any apparent reason, which is to say our scanning tools aren't finding anything to explain this behaviour.

What’s been particularly worrying is the case of a customer who has just narrowly avoided a bank fraud which almost certainly resulted from the interception of his on-line banking credentials. In itself this isn’t unusual, however unlike most victims he didn’t click on a link in some phishing email, but logged on via a bookmark. Most worrying of all is the fact that two weeks ago the machine in question came in with a malware infection and we carried out a level 2 clean, which means that we can be sure that he was using the most up-to-date virus scanner, drivers, and operating system updates.

So this Christmas I’d like to wish you a particularly vigilant holiday, and a cyber safe New Year.

*If you’re on a budget we recommend AVG Free , although the most recent versions have become so insistent in their nagging you to purchase the paid-for version that I’m more inclined to point you towards our preferred paid-for option which is Eset Smart Security, which has consistently been at the top of our A list for a decade.  

Lying is Cheaper than Acting

So if you're wondering what happened with my BT HomeHub let me give you the latest.

I'm sorry to say that I've given up. It's not for want of trying, as I have repeatedly called BT, but each time despite my protestations they carry out the same checks, make the same setting changes, and then trot out the same promises about calling me back at a set time to ensure that everything is working smoothly, which of course they don't. I'm effectively stuck in a loop, and it's a loop which takes about half an hour out of my day each time I fancy taking my support issue for another spin around the block. Given this level of intransigence it just doesn't make sense to persevere, particularly when I can easily replace and configure the HomeHub with a better router, because of course that's what I do for a living.

It has at least give me some insight into the frustrations that our customers face, and BT should hang their heads in shame at the service they are offering their customers.

What is worse is that this behaviour seems to be becoming more common. You may recall that last month I also discussed the problems I was having with my Nokia Lumia 930. As I predicted I was simply unable to get Carphone Warehouse to budge from their position, and given that I'd rather live with defective camera on my phone than lose the smart phone capabilities that I've come to depend upon, I'm still in exactly the same position that I was two weeks ago. One would think that this adequately demonstrates the level of inconvenience that I would suffer if I were to lose my smart phone, but Carphone Warehouse don't seem in the least bit concerned.

If you want any further examples of this sort of behaviour let me tell you the story of a client of ours who recently suffered a power outage. As it wasn't in an internal problem they called out UK Power Networks who are responsible for the incoming mains supply. UK Power Networks determined that the problem was a break in the cable between the cut-out and the meter, and that our client would need to get an electrician to run a new cable, and then contact EDF to connect it. 

I only got involved in this because the power surge that took out the cable also took out one of their PCs, but as I unravelled the story I pointed out that my client was being lied to. The rules are quite clear; the cable at fault is not his responsibility, and it's up to the two electricity companies to repair it. As I'm not an electrician I posted the problem on a specialist forum where this position was confirmed as correct by experts, however the consensus was also that the chances of getting these two parties to affect a repair would cause so much disruption, and take so long, that my client would be better off doing the repair themselves, and footing the bill, rather than waiting for the power companies to do the right thing. 

The power companies know that this is the position, which is why they are being so obstructive. Worse still is the fact that they know they're going to get away with this, because the complaints procedures are so time consuming and convoluted that, like my efforts to get my HomeHub replaced, they are simply not worth the effort. All I can do is name and shame the companies involved, so if by chance anybody who works for British Telecom, the Carphone Warehouse, UK Power Networks or EDF happens to read this I would just like you to know that you really suck. As for the various ombudsman services, you are not only useless, but we're paying your salaries to be useless which in some ways is even worse.

The only positive in this story is that at least small businesses can beat the big boys by providing far better levels of customer service, and above and beyond that by treating our customers with respect.

It's All About Data

I spend more time than most talking to help lines – it’s not a particularly enjoyable task, but I find that by sticking to a few simple rules I can minimise the tedium. First off remain polite regardless of how frustrated you are getting – you are at the mercy of a call centre operative, and they are far more likely to make an effort to help you if you treat them with courtesy. I like to make it clear that I’m technically trained quite early on and then try to treat them as fellow techies. In between tasks I’ll often ask where they are working from, and what the weather is like there (usually a lot warmer).  These people have what I’d consider to be pretty horrible jobs, and take a lot of abuse from angry callers, so if I can make their day a little better then I’m doing us both a favour.

This week, however, has tested my patience to the limit. The problem has been a failing BT Home Hub 3 – twice a day or more it needs to be rebooted to restart the wireless services, and as is common with these routers the signal strength has dropped off so that I’m lucky if I can get a working connecting from 10m away. And worst of all is that it’s my own Home Hub, so I have to live with this problem myself.  I considered replacing it with a nice fast Netgear router, which is what I’d suggest to a customer, but pennies are short this month, and out of some perverse sense of masochism I also wanted to see just what it takes to work my way through the labyrinthine BT fault finding service.

This problem itself is a common one – Home Hubs fail often enough that we Angels have all seen this problem before, and it’s going to be something that is well documented on BT’s knowledgebase. You’d think therefore that it would be a relatively straightforward job to get them to replace it – but actually no.

The first obstacle is their insistence that this is caused by wireless interference. I'm pretty sure that they are working to a script because I've heard exactly the same things said twice now, and as these technicians have been taught this is part of their training the clearly believe it. Wireless interference can be a problem, particularly in neighbourhoods with lots of wireless routers, but there is an excellent little tool called inSSIDer that allows you to map the levels and frequencies of any interference, and once you know which frequencies to avoid you can set a channel for your network that you can be sure will minimise interference. When interference does occur you wireless won't stop working except in the most severe cases (think embassies making burst transmissions which are probably damaging you health as well as you wireless signal), but you will notice a performance drop as your wireless connection slows.

After two weeks the engineers have repeatedly change my channel (although without once resorting to any channel analysis), and all this has at least taught me is that the Home Hub’s intelligent channel selection feature is a complete joke. Yesterday for the first time one of the engineers actually agreed that we might need to replace the Home Hub, but he then kept me on hold so long that I actually forgot I was still supposed to be waiting on the phone and went out. This should allow them to drag out my misery for another few days at least. All the while the shiny new Netgear router is beckoning and I have to admit my resolve is weakening, which is probably what British Telecom are depending on.

In separate news I've been getting along very well with my Nokia Lumia 930, but last week I suddenly noticed that I was getting a blemish on all my photographs. The camera on this phone is pretty amazing, especially for such a tiny device and I'm guessing that there is a speck of dust inside the lens assembly itself which is causing the problem, however trying to get this resolved has been another uphill battle. I purchased the phone from Carphone Warehouse a couple of months ago and according to the advice given by the OFT in their publication ‘Sale Of Goods Act Explained’:

“Any refund, repair or replacement you arrange with your customer relating to faulty goods must not cause them too much inconvenience and you will have to pay for other costs, for example, collection or delivery”.

The problem here is that Carphone Warehouse wants to give me a dumb phone (as in one without any data) as a replacement while they sort out my phone, which will cause a great deal of inconvenience as I pretty much run my business from my phone now I don't have a permanent desk in either of our service centres. At the moment I'm pushing for them to replace the phone as the only viable solution that complies with their obligations under SOGA, but something tells me that this is will be a case where what should happen will fall short of what actually happens, and I'll be the one losing out. Where we've faced similar problems ourselves as the retailer we've either bent over backwards to expedite a rapid repair so the customer isn't inconvenienced, or taken the hit and replaced the equipment - this isn't a case of us trying to keep to the letter of the Sale Of Goods Act, but rather just a demonstration of good customer service.

One thing that both these stories demonstrate is our total and utter dependence on a data connection both at home, in the office, and on the road. In the old days we used to think of data loss as being one of the greatest risks to a business, but with all the cloud services employed these days that risk has moved into the background: the new risk is not being able to access all that data. So what's your disaster recovery plan?

Two Thousand Reasons to be Cheerful

Although we’re still enjoying a spectacular Indian summer I can't help but notice that the leaves on the trees are starting to turn glorious shades of gold, bronze and copper, and it's a sure indication that it's that time of year again.

I'm talking of course about the Hammersmith and Fulham Brilliant Business Awards for which we are this year defending our position as Best Business Supporters of the Community. If you can spare a moment, and of course if you think we deserve it, we would be delighted if you could vote for us here.

If you're still uncertain and you happen to run a retail business in the Borough then perhaps I can give you two thousand reasons to change your mind by informing you about the Retail Rates Relief scheme. 

If you follow this blog you'll know that we have two shops, one in Fulham and one in Surbiton, but neither of these councils seems to have publicised the scheme yet, so congratulations to Wandsworth Council who have kicked off a pink envelope campaign to inform local shops, cafes, and other small retail businesses about the scheme; as I live in Putney I was lucky enough to read about this in the council magazine that comes through my letterbox.

All you need to do is ensure that you qualify as a retail business which is fairly self-explanatory, but do check the list of exceptions which is on page 2 of the form, and if you do qualify then download the form from here:

http://www.lbhf.gov.uk/Images/BRATES_RETAIL_PRICE_RELIEF_2014_15_2015_16_tcm21-187787.pdf

Then it’s just a case of filling it in and sending it to the council's Business Rates Department at:

London Borough of Hammersmith & Fulham

Town Hall

King Street

London W6 9JU

A single application will allow you to claim the rebate for 2014/15 and 2015/16.

If your business is based in another Borough then you should be able to find details on your councils website if you search for 'retail rates relief'; I believe the scheme is being run nationally.

Customer Service with a Sting

Many of our customers, both businesses and individuals, will have heard that Westminster are to change the providers of their pay-by-phone service, which as we all know is extremely popular with Londoners, particularly for the way in which it doesn’t try to profit from drivers.

The new suppliers of this service are a company called Ringgo, who are part of a sizeable corporation servicing over 500 cities, yet when I tried contacting them to discuss how to register multiple vehicles for our business I couldn’t find any number listed on their website. I tried arguing with their automated payment system and after a few minutes of robot I managed to get through to an what I assume was a human only to find out that my options were either to send an email or call a 09 (premium) number at a pound a minute.

I have nothing against 09 numbers – there are lots of suitable applications for premium services, but as a policy we bar these from our phone system because there is no situation in which our employees should be calling them. Our reasoning is that any supplier who wants to charge us to talk to them isn’t really interested in our business anyway, and we are happy to find an alternative supplier. Except of course where this service is being provided by a public body such as Westminster Council, where choice isn’t a luxury we are offered, and the ‘service’ allegory doesn't really work because we aren’t the customer, we’re the hostage.

I’m not alone in thinking that the use of a premium number for a customer service line is unreasonable – The Cabinet Office seems to agree so rest assured that I’ll be taking this up with Westminster’s CEO, Charlie Parker.

In the meantime I’m looking forward to finding out how quickly Ringgo respond to support emails when we find out this Thursday that we can’t park our scooters, and specifically whether it’s going to be faster that the reaction time of Westminster’s friendly parking enforcement officers.

The Right to be Forgotten

Until today I’d never heard of  Stan O'Neal, but this gentleman has succeeded in making the news despite trying to achieve exactly the opposite.

O'Neal is suspected of using the new "right to be forgotten", following a ruling in May by the European Court of Justice that Google must delete "inadequate, irrelevant or no longer relevant" data from its results when a member of the public requests it. I say suspected because he is the only person mentioned in the linked article, and if that’s the case he gets very little sympathy from me.

When Google received the take-down request it contacted Robert Peston who wrote the original article informing him of this development, which is a clever move because it’s galvanising the press into exposing the ECJ ruling as utter nonsense.

Peston points out that his reporting shouldn’t be classified as inadequate, irrelevant or no longer relevant, and I believe the same goes for all factually accurate reporting – and remember that the original article is remaining in place – it’s Google’s link to it that is being removed. So we’re not actually burning books here, just making them inaccessible.

I see this as an ominous development, and would go so far as describing it as Orwellian because Orwell knew that once you control the news a person sees, you control what they think. I also think that sleaze bags - especially those in public life - shouldn't be allowed to crawl away from their sordid pasts.

Free speech aside, I am reminded of my first forays onto the internet in the early nineties primarily because it was utter rubbish. Unless you knew exactly where you wanted to go you were unlikely to find anything relevant because the search engines of the day were useless. Admittedly there wasn’t actually much content out there in those days, but now we’ve finally got so tantalisingly close to the font of all knowledge it seems we are looking for ways of turning off the tap.

It’s not just the right to be forgotten that jeopardises our future – most governments want to control us by restricting what we see; censorship starts by targeting the universally abhorrent, but pretty soon you’re into grey areas  and then it’s back to quoting Orwell (or Heine) again.

I’m passionate about the freedom of the internet because it transcends governments and borders – it’s the ultimate medium of communication; all we need to do is make sure we keep talking. And in the meantime we can use it to answer all the important questions like is there vitamin C in oatmeal (no), and is Stan O'Neal a total dickhead (you know the answer to that).

The Outlook is Cloudy

I had  problem with iCloud that I couldn’t solve, which is ironic as I don’t actually use iCloud. Every time I plug my iPhone into my PC, iTunes starts, which is fine as I like to back up my iPhone regularly. The problem is that each time it started, up popped a message asking me if I wanted to install the iCloud Control Panel, which I really didn’t, and nor did I want to be 'reminded later', which was the only other option. It’s a very Apple thing – you do it their way or you don’t do it at all. What’s wrong with a ‘No thanks’ option – or even better now I’ve seen the message a few dozen times, a ‘shove your iCloud where the sun don’t’ shine button. Then one day the same message popped up with a slight difference –the ‘Later’ button read ‘No Thanks’. I clicked on it. It was magical.

I’ve never been a big fan of Apple’s iCloud and in particular the way it works with Outlook– it makes no attempt at logically synchronising data but instead duplicates data, and every time I’ve worked with it I’ve started by doing a full backup of the Outlook data files which more often than not has saved my bacon. I’m told that even Apple themselves regard iCal as a joke. Probably the only useful feature of iCloud is that it can back up my devices wirelessly, but as the limit is a paltry 5GB before I start having to pay for the service I’m quite happy to stick with Microsoft’s OneDrive which happily backs up the Photostream from my iPhone, and rely on backing up the rest via iTunes.

OneDrive is part of the Office 365 family of products which in the past 12 months has matured into a robust and reliable platform, and for some time it’s been our solution of choice for both SMBs and home users who want to seamlessly synchronise their contact, calendars and data across multiple devices.

This is a market that is all about 365 Hosted Exchange, which is the preferred back-end of Outlook. Whatever Microsoft’s competitors would like to think, Outlook is what we see being used on pretty much every business computer and a fair proportion of home ones too. Mobile devices may not use Outlook, but they work seamlessly with Exchange, and even Blackberry devices manage to work reasonably reliably with it.

It’s been interesting to see the marketplace evolve – 365 is displacing Google Apps for Business almost completely; a couple of years ago Google ruled the roost, but their offering has hardly changed, and their delay in supporting Outlook 2013 was disastrous.

Before 365 the other option was to use Hosted Exchange which we regarded as the Rolls Royce solution – solid and reliable but expensive. This is still a sizeable market in our industry, but this has more to do with the profit margins offered to resellers than value to the customer. We still regularly meet customers who are paying hundreds of pounds a month for a mailbox that would fit nicely into a 50Gb £3.30 a month 365 Small Business subscription. To be sure, you’ll have trouble getting rich on the miniscule commission that Microsoft pays their Cloud Partners, but if it’s value to the customer you’re looking for then this is really the only choice.

As a result a lot of our work right now involves migrating customers to 365 Hosted Exchange, and this includes many of our customers who were using POP or IMAP email via our decrepit old 1and1 server. I’m looking forward to turning this server off – we haven’t actually used it for hosting for over a year, after 1and1 proved incapable of installing a secure image on it for us to work with (or for that matter to offer any support), and as they offered no migration path for the associated mailboxes we’ve been stuck with an expensive white elephant for far too long. For me the retiring of POP and IMAP marks a fundamental change in the way we use computers. It’s indicative of the move away from a single fixed device to multiple mobile devices, but it’s also about the move from locally stored (and easy-to-lose) data to cloud hosted systems.

Right now I’d love to spend some meaningful time living with a Windows phone to see how much of a difference this cross platform integration makes with a ‘native’ device, but the sad fact is that while I’d love to dump my iPhone 4 which has become rather lethargic since I reluctantly updated from iOS5 (and yes – I hate Apple maps as much as I expected to), I can’t because I’m too heavily invested in apps that aren’t available on the Windows Phone platform – yet…