Superfish? Never Been a Problem for Us.

If you've been following the tech news this week you will have noticed a breaking story about Lenovo bundling malware with its newlaptops. I think in many ways this is quite a sad story, because for a reputable company to ship laptops which include software like Superfish is a tragic indication of where the industry is at the moment.

Superfish is a piece of software that would euphemistically describe itself as something that enhances your web experience, and it does this by inserting targeted advertising directly into webpages that you are viewing. The average user won't even notice the presence of the software, and will assume that the advertising is embedded in the webpage itself, and it's the mechanism whereby this is achieved that is particularly scary. Without boring you with the technical details, what the software does is inject its own content directly into the data from websites you are visiting, and it's a technique that is also used in something called "man in the middle" attacks, where hackers use the same technique to embed password capture elements into, for example, your online banking website.

This in itself is frightening enough, but because the Superfish software was poorly secured a hacker could hijack the program and use it to fundamentally compromise the security of your computer, so that you next visit to your online bank might actually take you directly to a site in Russia where your banking details would be used to empty your account in pretty short order, and because you're going to see that green certificate flag next to the website address in your browser, your will have absolutely no idea that this is happening.

This isn't actually a new story, with Superfish being a regular topic of conversation in the Lenovo help forums over the last few months, and once the vulnerability was exposed Lenovo were quick to pull the software from all new laptops. What we don't know is whether its inclusion resulted in any real-world attacks.

You might be wondering why Lenovo were bundling this software in the first place, and the reason is quite simply because of the microscopic margins on consumer laptops. When manufacturers may only be making a profit of $5 on every laptop they sell, the temptation to include third-party software (for which they paid) is a strong one. That's why most new consumer laptops come bundled with all sorts of software that, if you know what you're doing, you will remove as soon as you turn on the computer.

This is a practice that's been going on the decades in what many see as a race to the bottom, and we've even created a word for it in the industry; crapware. You are statistically likely to be using a computer that still contains crapware that the manufacturer was paid to install. It's a business model that sees companies such as McAfee and Norton enjoying a far greater share of the antivirus market than they should based on the technical excellence of the products, so clearly it's a sustainable business model for some, and if at the end of the day it means that consumers are able to buy excellent laptops like the £300 LenovoEssential B50-70 then I've no problem with that for reasons I've given below.

So what should you, as a Computer Angels customer do? Well, if you bought your laptop through us, or if we prepared it for you then the answer is absolutely nothing. That's because the first thing we do when we’re preparing at Lenovo laptop for use is wipe the hard drive clean and reinstall everything from scratch. Not only does this removes the risk posed by this crapware, it also substantially increases the performance of the computer.

And if we didn’t prepare your laptop for you, and you’re worried that you might have a copy of Superfish lurking somewhere on your hard drive you can check for it here.

Rotten Apple

Today the Apple online store refused to sell me a laptop.

I was more than a little surprised when this happened because I'm clearly not from North Korea, and as a regular Apple customer I really didn't foresee any problems with my purchase. My mistake when I tried to telephone in my order was in telling Apple that we, a business, were going to resell the laptop to a customer. Apparently Apple doesn't allow this, though whether they can legally refuse to sell me a laptop on this basis is an altogether different question.

As a business we regularly act as resellers of hardware. We are for example Dell Partners, and we buy Dell hardware in our own name which we sell on to customers, often at cost if it's a bespoke order, charging only for the time it takes us to specify and procure the hardware. This model works extremely well for some of the larger orders that our customers want to place, particularly ones involving servers, because our customers don't have to worry that we are over specifying the hardware in order to increase our margins. It's a model that is quite unusual because most companies see large hardware orders as extremely attractive business; we on the other hand would rather concentrate on the service we are offering, and we are also avoiding the temptation of simply becoming box shifters. If you have visited one of our service centres you'll also see that we keep Dell computers in stock, and you're buying one of these you'll find that our price is generally less or equal to Dell's consumer price, because Dell allow us sufficient profit margins to justify holding stock.

If a customer comes to us and wants to buy an Apple computer we advise them to buy directly from Apple. We have explored the benefits are becoming an Apple reseller, but the margins that Apple allow resellers are ludicrously small, and certainly don't compensate us for the responsibilities we take on as a retailer under the Sale Of Goods Act. It therefore makes sense for us to advise customers to purchase directly; at the end of the day we are a service company and it's our expertise in preparing computers and migrating data and software that customers pay as for. We do the same for other brands that are aimed at consumers, and therefore are sold at extremely tight margins; our favourite budget laptop at the moment is the Lenovo B50-70 which offers a solid specification at a very reasonable price.

There are however some customers who are reluctant to either shop online, even when we’re standing next to them telling them which buttons to press, or who don't want, or are unable to visit a physical store, and in this case we offer them the option of ordering through us because that's what a good value added service provider should do.

As a business, Apple retail stores will generally allow us a discount of around 5% on new computers, and we explain to our customers that we will take this discount to cover our expenses in making the purchase, as well as the responsibilities we undertake as retailer (if there are any problems, we, not Apple are legally their first port of call). At the end of the day the customer is happy because they are still only paying the price that Apple would have charged them had they bought directly, and we’re happy because our customers are happy. As for the onus of being the first port of call when things go wrong, we're quite happy with this and in most cases would rather our customers called us before calling the manufacturer, as we're probably going to provide a better level of service.

In the end I'm happy to report that everything worked out nicely; I phoned the nice people at my local Apple store in White city, and they were more than happy to let me place an order. I'm not going to make any comments about organisational dysfunction, but isn't it nice to know that you can't beat your local retailer

The Problem With Passwords

Selecting a password is an art; hackers attempting brute force attacks will use dictionaries containing millions of known words and common password combinations, so if your password is ‘123456’ or ‘password12’ you will lose control of your account in a few seconds if attacked. Also beware of using the same password in more than one place, as if any single password file is cracked hackers wille routinely try the same username and password combinations on other common sites. If you follow these rules you will, like me, end up with a long list (for me it's hundreds) of different passwords, hopefully containing capitals, numbers and punctuation marks, all of which you need to be able to retrieve at any time. And of course you won’t be storing them as remembered passwords in your web browser as these are generally very easy to access.

This is one of the great problems of the Internet age. How do we manage our passwords? As somebody who has more than a passing interest in hacking, and understands many of the ways in which passwords are cracked, I probably have a bit of a head start. I've also been interested in cryptography for many years, and I've managed to develop a simple and ingenious method for generating passwords that I can then reverse engineer on-the-fly when I need to use them. And if you think I'm telling you what this is then I'm afraid you're going to be disappointed.

This may sound a little smug, but I assure you it's not; I may have been careful in crafting my keys, but as I have little control over the locks they are used in I don't have any illusions about the security my precautions give me. Instead I rely on simple maxim that if I absolutely don't want to share something, then it probably shouldn't be anywhere on-line anyway. That and two step authentication. Always. Let me give you an example of how my thinking has been shaped.

Fully ten years ago my home broadband was provided by Tiscali, who have long since been absorbed by TalkTalk. When I came to cancel my contract with them I was told that I would have to do this by logging in to their portal, using the username consisting of my Tiscali e-mail address which I had never used and a password that I had noted down when I first opened the account one year previously.

You would be right in thinking that this was unnecessarily complicated, as I was already speaking to an agent who had authenticated me. Most people ten years ago wouldn't have known their username or password anyway, unless they were actually using the e-mail address. All in all the cancellation process seemed designed to be as difficult as possible, no doubt in a sad attempt at “customer retention”. Things were easier for me because I had noted down my username, and obfuscated password.

So I logged in to my portal where I was presented with thousands of unread e-mails every single one of which was spam. After cancelling, I contacted Tiscali to ask them how an e-mail address that I had never used had ended up in the hands of every spammer under the sun. They declined to reply.

I'm not in the least bit surprised to read in the Guardian that TalkTalk customers are suffering from the same problem. TalkTalk are being particularly coy about the issue which seems to be resulting in fake service calls on a large scale. 

These leaks are of course entirely predictable; if you're going to pay call centre staff in India a pittance then don't be surprised if they look at other ways of supplementing their income. It's not as if they are being set a shining example by our own governments, who seemed quite happy with the idea of collecting all our data, much of which I am sure will one day be left on the back seat of a taxi.

So there are two things to remember here - firstly beware of callers offering to clean up your PC (Unless it's one of us, of course), and secondly, like I said, it doesn't matter how clever your key is if the lock you are putting it in is made of tissue paper.

What Did You Do in the Cyber War, Daddy?

We often read about cyber-attacks, and some of you may even have heard of the expression zero day vulnerability, but this exotic world is usually pretty far removed from our everyday lives.

If for example you’ve been following the story of the Sony Pictures hack, or FBI reports on the widespread proliferation of Iranian malware, and you would be forgiven for thinking that this doesn’t actually affect you. This week, however, I’m beginning to realise that this may not be the case.

We see computers with malware infections every day, and most of these are actually relatively unsophisticated, regardless of the harm they cause to the system. A typical infection is most likely to come from visiting a compromised website, as these days people are too savvy to risk opening infected attachments. Anybody can radically reduce the risk of what we call drive-by infections by ensuring that their operating system is up to date, and that they have a good (also up to date) antivirus program in place*.

If it is a superficial infection then we use a variety of cleaning tools - the art is in determining which tools to use at any given time, and in which order, and also how the tool is used, and our standard operating procedure will change according to the prevalent threats at any given time. Most customers won't appreciate the level of care that goes into what we call a Level 1 clean.

A proportion of machines, typically 10% to 20% depending upon the threat cycle, will be so badly compromised that we carry out what we call a Level 2 clean, which is where we back up any user data, and completely wipe and reinstall the computer. In most cases this is because we’ve identified a root kit, which is where the operating system itself has been overwritten to mask nefarious activities; in this case wiping the machine is often the only way we can be sure that we are returning the computer with an operating system which has not been compromised.

In the last couple of weeks however, we've seen a fundamental shift in the nature of malware attacks, and while our industry is used to reading over-hyped articles about malware threats in the press, in this case you would be hard pressed to find any mention of this in the mainstream newspapers.

At the start of the week the technical press reported that a widely used plug-in for WordPress had been compromised on a huge scale with more than 100,000 infected sites having been identified. It appears that these attacks were exploiting what’s known as a zero day vulnerability in Firefox and Internet Explorer. The term zero day attack refers to an attack that has not been previously identified, and is therefore one that developers have not had time to address and patch.

Since this happened we have seen a surge in cases of computers misbehaving without any apparent reason, which is to say our scanning tools aren't finding anything to explain this behaviour.

What’s been particularly worrying is the case of a customer who has just narrowly avoided a bank fraud which almost certainly resulted from the interception of his on-line banking credentials. In itself this isn’t unusual, however unlike most victims he didn’t click on a link in some phishing email, but logged on via a bookmark. Most worrying of all is the fact that two weeks ago the machine in question came in with a malware infection and we carried out a level 2 clean, which means that we can be sure that he was using the most up-to-date virus scanner, drivers, and operating system updates.

So this Christmas I’d like to wish you a particularly vigilant holiday, and a cyber safe New Year.

*If you’re on a budget we recommend AVG Free , although the most recent versions have become so insistent in their nagging you to purchase the paid-for version that I’m more inclined to point you towards our preferred paid-for option which is Eset Smart Security, which has consistently been at the top of our A list for a decade.  

Lying is Cheaper than Acting

So if you're wondering what happened with my BT HomeHub let me give you the latest.

I'm sorry to say that I've given up. It's not for want of trying, as I have repeatedly called BT, but each time despite my protestations they carry out the same checks, make the same setting changes, and then trot out the same promises about calling me back at a set time to ensure that everything is working smoothly, which of course they don't. I'm effectively stuck in a loop, and it's a loop which takes about half an hour out of my day each time I fancy taking my support issue for another spin around the block. Given this level of intransigence it just doesn't make sense to persevere, particularly when I can easily replace and configure the HomeHub with a better router, because of course that's what I do for a living.

It has at least give me some insight into the frustrations that our customers face, and BT should hang their heads in shame at the service they are offering their customers.

What is worse is that this behaviour seems to be becoming more common. You may recall that last month I also discussed the problems I was having with my Nokia Lumia 930. As I predicted I was simply unable to get Carphone Warehouse to budge from their position, and given that I'd rather live with defective camera on my phone than lose the smart phone capabilities that I've come to depend upon, I'm still in exactly the same position that I was two weeks ago. One would think that this adequately demonstrates the level of inconvenience that I would suffer if I were to lose my smart phone, but Carphone Warehouse don't seem in the least bit concerned.

If you want any further examples of this sort of behaviour let me tell you the story of a client of ours who recently suffered a power outage. As it wasn't in an internal problem they called out UK Power Networks who are responsible for the incoming mains supply. UK Power Networks determined that the problem was a break in the cable between the cut-out and the meter, and that our client would need to get an electrician to run a new cable, and then contact EDF to connect it. 

I only got involved in this because the power surge that took out the cable also took out one of their PCs, but as I unravelled the story I pointed out that my client was being lied to. The rules are quite clear; the cable at fault is not his responsibility, and it's up to the two electricity companies to repair it. As I'm not an electrician I posted the problem on a specialist forum where this position was confirmed as correct by experts, however the consensus was also that the chances of getting these two parties to affect a repair would cause so much disruption, and take so long, that my client would be better off doing the repair themselves, and footing the bill, rather than waiting for the power companies to do the right thing. 

The power companies know that this is the position, which is why they are being so obstructive. Worse still is the fact that they know they're going to get away with this, because the complaints procedures are so time consuming and convoluted that, like my efforts to get my HomeHub replaced, they are simply not worth the effort. All I can do is name and shame the companies involved, so if by chance anybody who works for British Telecom, the Carphone Warehouse, UK Power Networks or EDF happens to read this I would just like you to know that you really suck. As for the various ombudsman services, you are not only useless, but we're paying your salaries to be useless which in some ways is even worse.

The only positive in this story is that at least small businesses can beat the big boys by providing far better levels of customer service, and above and beyond that by treating our customers with respect.

It's All About Data

I spend more time than most talking to help lines – it’s not a particularly enjoyable task, but I find that by sticking to a few simple rules I can minimise the tedium. First off remain polite regardless of how frustrated you are getting – you are at the mercy of a call centre operative, and they are far more likely to make an effort to help you if you treat them with courtesy. I like to make it clear that I’m technically trained quite early on and then try to treat them as fellow techies. In between tasks I’ll often ask where they are working from, and what the weather is like there (usually a lot warmer).  These people have what I’d consider to be pretty horrible jobs, and take a lot of abuse from angry callers, so if I can make their day a little better then I’m doing us both a favour.

This week, however, has tested my patience to the limit. The problem has been a failing BT Home Hub 3 – twice a day or more it needs to be rebooted to restart the wireless services, and as is common with these routers the signal strength has dropped off so that I’m lucky if I can get a working connecting from 10m away. And worst of all is that it’s my own Home Hub, so I have to live with this problem myself.  I considered replacing it with a nice fast Netgear router, which is what I’d suggest to a customer, but pennies are short this month, and out of some perverse sense of masochism I also wanted to see just what it takes to work my way through the labyrinthine BT fault finding service.

This problem itself is a common one – Home Hubs fail often enough that we Angels have all seen this problem before, and it’s going to be something that is well documented on BT’s knowledgebase. You’d think therefore that it would be a relatively straightforward job to get them to replace it – but actually no.

The first obstacle is their insistence that this is caused by wireless interference. I'm pretty sure that they are working to a script because I've heard exactly the same things said twice now, and as these technicians have been taught this is part of their training the clearly believe it. Wireless interference can be a problem, particularly in neighbourhoods with lots of wireless routers, but there is an excellent little tool called inSSIDer that allows you to map the levels and frequencies of any interference, and once you know which frequencies to avoid you can set a channel for your network that you can be sure will minimise interference. When interference does occur you wireless won't stop working except in the most severe cases (think embassies making burst transmissions which are probably damaging you health as well as you wireless signal), but you will notice a performance drop as your wireless connection slows.

After two weeks the engineers have repeatedly change my channel (although without once resorting to any channel analysis), and all this has at least taught me is that the Home Hub’s intelligent channel selection feature is a complete joke. Yesterday for the first time one of the engineers actually agreed that we might need to replace the Home Hub, but he then kept me on hold so long that I actually forgot I was still supposed to be waiting on the phone and went out. This should allow them to drag out my misery for another few days at least. All the while the shiny new Netgear router is beckoning and I have to admit my resolve is weakening, which is probably what British Telecom are depending on.

In separate news I've been getting along very well with my Nokia Lumia 930, but last week I suddenly noticed that I was getting a blemish on all my photographs. The camera on this phone is pretty amazing, especially for such a tiny device and I'm guessing that there is a speck of dust inside the lens assembly itself which is causing the problem, however trying to get this resolved has been another uphill battle. I purchased the phone from Carphone Warehouse a couple of months ago and according to the advice given by the OFT in their publication ‘Sale Of Goods Act Explained’:

“Any refund, repair or replacement you arrange with your customer relating to faulty goods must not cause them too much inconvenience and you will have to pay for other costs, for example, collection or delivery”.

The problem here is that Carphone Warehouse wants to give me a dumb phone (as in one without any data) as a replacement while they sort out my phone, which will cause a great deal of inconvenience as I pretty much run my business from my phone now I don't have a permanent desk in either of our service centres. At the moment I'm pushing for them to replace the phone as the only viable solution that complies with their obligations under SOGA, but something tells me that this is will be a case where what should happen will fall short of what actually happens, and I'll be the one losing out. Where we've faced similar problems ourselves as the retailer we've either bent over backwards to expedite a rapid repair so the customer isn't inconvenienced, or taken the hit and replaced the equipment - this isn't a case of us trying to keep to the letter of the Sale Of Goods Act, but rather just a demonstration of good customer service.

One thing that both these stories demonstrate is our total and utter dependence on a data connection both at home, in the office, and on the road. In the old days we used to think of data loss as being one of the greatest risks to a business, but with all the cloud services employed these days that risk has moved into the background: the new risk is not being able to access all that data. So what's your disaster recovery plan?

Two Thousand Reasons to be Cheerful

Although we’re still enjoying a spectacular Indian summer I can't help but notice that the leaves on the trees are starting to turn glorious shades of gold, bronze and copper, and it's a sure indication that it's that time of year again.

I'm talking of course about the Hammersmith and Fulham Brilliant Business Awards for which we are this year defending our position as Best Business Supporters of the Community. If you can spare a moment, and of course if you think we deserve it, we would be delighted if you could vote for us here.

If you're still uncertain and you happen to run a retail business in the Borough then perhaps I can give you two thousand reasons to change your mind by informing you about the Retail Rates Relief scheme. 

If you follow this blog you'll know that we have two shops, one in Fulham and one in Surbiton, but neither of these councils seems to have publicised the scheme yet, so congratulations to Wandsworth Council who have kicked off a pink envelope campaign to inform local shops, cafes, and other small retail businesses about the scheme; as I live in Putney I was lucky enough to read about this in the council magazine that comes through my letterbox.

All you need to do is ensure that you qualify as a retail business which is fairly self-explanatory, but do check the list of exceptions which is on page 2 of the form, and if you do qualify then download the form from here:

http://www.lbhf.gov.uk/Images/BRATES_RETAIL_PRICE_RELIEF_2014_15_2015_16_tcm21-187787.pdf

Then it’s just a case of filling it in and sending it to the council's Business Rates Department at:

London Borough of Hammersmith & Fulham

Town Hall

King Street

London W6 9JU

A single application will allow you to claim the rebate for 2014/15 and 2015/16.

If your business is based in another Borough then you should be able to find details on your councils website if you search for 'retail rates relief'; I believe the scheme is being run nationally.