Tuesday, October 09, 2007

Eircom Wireless Security

If you are an Eircom customer you are no doubt now aware of a security flaw in relation to their Netopia wireless routers. The security risk arises as a result of a combination of factors.

When a customer receives a Netopia wireless router, WEP encryption is enabled. WEP (Wired Equivalent Privacy) is a system of encryption that requires a user to enter a code (a 26-digit code in the case of Eircom of the form 879411b4f741e806a275565e16, which is a hexadecimal (base 16) number) before their computer can connect wirelessly to the router. When an Eircom customer receives a Netopia router, the specific 26-digit code will be provided to them, and known only to them, which allows them to connect to the wireless router. All good stuff to keep the bad guys out and your network private. So far so good.

In addition to a pre-assigned WEP encryption key, the customer's Netopia wireless router also has another pre-assigned parameter programmed into it called an SSID (Service Set IDentifier). The SSID is, in effect, the broadcast name of the wireless network which appears in the View Available Networks window. This can be anything you want but Eircom Netopia routers have an SSID of the format eircomxxxx xxxx e.g. eircom1242 9777. The problem arises due to the fact that the default WEP key and the part of the SSID after the eircom part are derived using the same algorithm. This has allowed some clever people to analyze the relationship between the WEP key and the SSID and come up with a small program called a key generator. Since the SSID is broadcast by default on the Netopia wireless router anyone can see the SSID of a router within range. All one needs to do to connect to that router is enter the 8-digits after the eircom part of the SSID into the key generator program and, voilĂ , the 26-digit WEP code is presented. Enter this code when required and you are connected to the network. PC Medic has seen this program in action and can confirm that it takes less than 1 minute to connect to a "secure" network.

What to do? It's actually quite simple to totally eliminate this security risk by either (a) changing your SSID or (b) changing your WEP code. Unfortunately, many customers don't feel comfortable connecting to their Netopia router to do this (Eircom should have contacted you if you have an "at risk" Netopia unit, and provided you with instructions to remedy the situation). If you're concerned and don't want to undertake this procedure on your own, contact PC Medic and we'll help you out.

Friday, October 05, 2007

Blast from the Past

Earlier this week we picked up an old Dell Dimension from its owner who purchased the computer in January 2001 with Windows 98 installed. Up until the failure of his hard disc he hadn't a day's trouble with the PC (probably mainly due to the fact that it wasn't on-line). We installed a new hard disc and reinstalled Windows 98 from the Dell recovery CD (he had all his original Dell-supplied CDs after 6 1/2 years - how many people lose them after 6 1/2 months?!). What surpised me and prompted me to post this blog was just how fast Windows 98 can run. Start up time was 40 seconds from button push to full systray. Shutdown time was an incredible 3, yes 3 seconds! All applications opened in a flash and this is on a P3 box with 128MB of RAM.

When I see how long it takes for Vista to boot and shutdown on our Dual Core box with 2GB of RAM you start to wonder are we going in the wrong direction. Time is the one thing we have less of as the years go by, so do we really want to spend that time looking at an hourglass? Perhaps we should be pushing for stripped down operating systems and streamlined applications (hands up all those who actually understand pivot tables, VBA macros and VLOOKUP in Excel, let alone use them). The term "Less is More" comes to mind.

Wednesday, September 19, 2007

Nice PC


Dell are offering a new range of PCs called the Vostro range which we have installed quite a few of. These come in a range of configurations and offer extremely good value for non-power home users and small businesses. For example, we've just purchased a system with a 1.8GHz Dual Core processor, 1GB RAM, 160GB hard disc and 19" wide screen for €495, including VAT and delivery! One of the key issues about the Vostro range is that, as they are aimed at the business community, you can still order them with Windows XP instead of Vista (all Dell's home PCs now come with Vista). You'll find them under the small business section at www.dell.ie. Recommended.

Monday, September 17, 2007

Badder Malware

IBM has reported an increase in malware volume and sophistication as part of its security statistics report for the first half of the year.

So far this year, its X-Force research and development team has identified and analyzed more than 210,000 new malware samples, which is more than the total number of malware samples observed over the entirety of last year.

According to IBM, the "exploits as a service" industry continues to thrive, with the new practice of "exploit leasing" added to the repertoire of criminals. By leasing an exploit, attackers can now test exploitation techniques with a smaller initial investment, making this underground market an even more attractive option for malicious perpetrators.

According to the report, Trojans (seemingly legitimate files that are actually malware) are the most common form of malware this year, accounting for 28 percent of all malware. Last year, by contrast, Downloaders was the most common category -- a low-profile piece of malware that installs itself so that it can later download and install a more sophisticated malware agent.

"The X-Force security statistics report for 2006 predicted a continued rise in the sophistication of targeted, profit-motivated cyber attacks," said Kris Lamb, director of X-Force. "This directly correlates to the rise in popularity of Trojans that we are witnessing this year, as Trojans are often used by attackers to launch sustained, targeted attacks."

But running counter to historical trends, X-Force reports a slight decrease in the overall number of vulnerabilities uncovered in the first half of 2007 versus the first half of 2006. A total of 3,273 vulnerabilities were identified in the first half of this year, down 3.3 percent year-on-year. However, the percentage of high impact vulnerabilities has gone up since 2006 from 16 percent to 21 percent for the first half of 2007.

A similarly unexpected trend in the report is the decrease in spam message size. IBM said the fall corresponded with a decrease in image-based spam.

"The decrease in spam message size and image-based spam is a result of spammers adopting and experimenting with newer techniques, such as PDF- and Excel-based spam, as a means to more successfully evade detection by anti-spam technologies," said Lamb.

Thursday, August 02, 2007

Getting what you pay for?

From a recent ITPro posting - it relates to UK ISPs, so we can't say whether the same applies to Irish ISPs. What do you think?

Following a study that revealed many customers weren't getting even close to the advertised speeds of their broadband service, the consumer fairness group is asking Ofcom and Trading Standards to step in.

Which? has called on communications watchdog Ofcom and Trading Standards, asking them to step in and investigate the gulf between advertised broadband speed and the connectivity speeds users get in reality.

The consumer fairness group called for the action following research that tested more than 300 customers and discovered that, while they were promised up to 8Mbps or more, they were actually getting 2.7Mbps on average. The lowest speed unveiled during the testing was just 0.09Mbps.

"It's shocking that internet service providers can advertise ever-increasing speeds that seem to bear little resemblance to what most people can achieve in reality. If it's unlikely you'll reach the advertised speed it should be made clear up front, so that you know with some certainty what you're buying," said Which? online editor Malcolm Coles.

"Do your research to check what speed you're likely to get before upgrading, and if you think what you're getting differs vastly from what you've paid for, speak to your provider - or if they won't help, report them to Ofcom."

Broadband comparison service
Broadband Choices echoed Which?'s calls for greater transparency in actual, achievable speeds so that users can make informed decisions. "We carried out over 100,000 of our own speed tests last month, and found that the average customer only got 39 per cent of their promised speed," said Michael Phillips, product director at Broadband Choices. "Factors like distance from the exchange and poor quality wiring degrade the broadband connection and reduce the customer's speed but many people are unaware of this and go for the top packages thinking they will get broadband at 8Mb. However, broadband providers can check this information to see the realistic speed each individual customer should receive. We need transparency from providers on the kind of speeds customers can actually expect to get, rather than flashy advertising and ever increasing 'top speeds'."

Friday, July 13, 2007

CD Recovery

We had a customer last week who was recently back from a gap year travelling the world and had received a CD from a travelling companion which contained photos of their travels in Australia and New Zealand. Unfortunately she couldn't access the files. We tried the disc in a number of CD drives and we had the same problem. Even our recovery software couldn't access the files. Examination of the CD showed the surface to be covered in a myriad of tiny scratches - obviously this CD had had a rough life. Time for a radical approach.

We had read on a tech forum some time previously that a remedy for scratched CDs was - wait for it - toothpaste! With nothing to loose we squeezed a small amount of toothpaste (with whitener and added fluoride!) on to a cotton bud, added a little water and proceeded to rub the paste onto the CD in a radial fashion. After about 5 minutes the whole surface of the disc had been treated and the CD was rinsed under cold running water to remove all traces of the toothpaste. Examining the surface of the disc after the treatment showed all the scratches still to be present, so it was with little expectation that we popped the CD into a CD drive. But, suprise, suprise, the CD was immediately recognized and all files were present and correct. Now we only recommend this treatment when all else has failed, but when you have nothing to lose...

Wednesday, July 04, 2007

Vista Upgrade Part 2

We've been very busy over the past few months so I've had to put the blogging on hold for a while. But now that we're back from vacation I decided to deploy the Dell Vista Upgrade Kit that arrived the second week in June - 7 months after we ordered the Dell machine.

The "Kit" comprise four items: a Vista Upgrade Assistant DVD, a Vista Operating System DVD, a Vista Certificate of Authenticity and an Instruction Pamphlet. First off you insert the Vista Upgrade Assistant DVD whose function is to check the comaptibility of the existing hardware and software on your PC and remove or upgrade what isn't compatible with Vista. When we inserted this disc and clicked Next to perform the check we were told that "The item listed below is not compatible with Vista" and that the upgrade could not proceed. The item in question was the operating system which was showing as NA. So at the very first hurdle we fell down.

Contact was made with Dell support who initially told us that the Upgrade Assistant DVD was not needed for upgrading the OS and to just proceed with the Vista Operating System CD. When I pointed out that this was exactly the opposite of what the Instruction Pamphlet recommended and that the Upgrade Assistant DVD updated the Bios as well as software with known compatibility issues the Dell support person changed tack and offered that the DVD was probably defective and he would send out another one. Now we just happened to have a second upgrade kit in the workshop which was ordered for a customer and we had tried with the Upgrade Assistant DVD from that kit, to no avail. When I put his to the support person he said that he would have to talk to his supervisor and get back to me.


Four hours later he called back with the recommendation that I expected from him - reinstall your original OS and then try the upgrade process. In other words, they didn't know exactly what the problem was but hoped that a clean install of XP would make it go away. And it did. Now remember, our PC was only 7 months old and had a minimum of additional software installed on it. In fact, most of the installed software was either Dell-supplied or Windows updates. So it wasn't that big a deal for us to do a clean reinstall. However, the upgrade was originally sold on the basis that you could happily use your PC until the upgrade was available, install it and, presto, you now had all your old software working on a Vista platform. Imagine if you had installed a serious amount of software such as Microsoft Office, payroll and accounting packages, utilities, photo management, music management, video editing etc. etc. I would be seriously bummed if Dell support could only offer the "reinstall the original OS" solution, leaving me with the task of rebuilding the PC post-Vista.

Moving along, we did the clean reinstall after which the Upgrade Assistant DVD seemed to be working fine. It proposed updating the Bios and a number of Dell-installed pieces of software. It also removed Roxio and other software which was incompatible with the upgrade process, promising to reinstall them when Vista was in place. After about 30 minutes and a number of reboots it was ready for the Vista OS upgrade disc. Vista took about 70 minutes to install and after rebooting we were back to the Vista Upgrade Assistant, which was good to its promise and began reinstalling the software it had previously removed.

After about two hours we had a Vista Business Edition OS in place and we were ready to install a wireless network card to get Windows updates. Apart from the inital problem with the Upgrade Assistant DVD the upgrade process was reasonably smooth, if somewhat tedious. If at any point in the future we need to reinstall Vista we are faced with reinstalling XP and repeating the upgrade process all over again. If we knew this at the time of ordering the PC we would have waited until the PCs were shipping with Vista. We would have had Vista 4 months sooner and no upgrade hassles. Not one of Dell's better ideas.

Wednesday, May 09, 2007

More Non-Genuine Operating Systems

Seems like we've come across a number of non-genuine versions of Microsoft XP in the last couple of weeks. What all of the PCs had in common is that they went into small repair shops for repair with Windows XP Home Edition on them and came out with XP Professional installed. Most of the customers didn't notice the difference between the two while one customer who did, was told by the repair shop that they "upgraded" Windows while it was in for repair.

The reason that most non-genuine versions of XP encountered are the Professional version is because of the existence of Volume License versions of XP Pro for use by businesses. A Volume License is a special version of a Windows OS, most commonly XP Pro, that is sold to big businesses, governments and educational bodies for installation on hundreds or thousands of PCs. Because it is not practical for such large numbers of PCs to go through the Windows activation procedure post-installation for each PC, a Volume License installation does not require activation. All Windows XP installations do require a product key, the 25-digit alpha-numeric code that must be entered from the certificate of authenticity during the installation process. However, if a product key corresponding to a volume license (a so-called Volume License Key or VLK) is entered then the installation does not require product activation.

What has happened in the past, and no doubt continues to happen, is that Volume License Keys are passed on from IT staff to individuals and they get into general circulation for use by less than scrupulous individuals. When Microsoft becomes aware of these they are blocked and marked as non-genuine in their database. Beginning April 25, 2007, Microsoft began distributing Windows Genuine Advantage Notifications as "critical update" KB905474 to Windows users. If you downloaded this update and have a blocked VLK installed on your PC you will get the nag screen that you have a non-genuine copy of Windows installed ever more. We expect to see more of these in the weeks to come.

Friday, May 04, 2007

Less than perfect OOTBE

Most computer manufacturers work hard to give you a good Out-Of-The-Box-Experience (or OOTBE), which is what happens when you turn on your brand new computer for the first time. A good OOTBE should see you having to take very few actions to get you to your operating system's desktop - perhaps accept a license agreement and input your name for your user account. Once at the desktop a good OOTBE continues with your computer behaving in a predictable fashion and it is in this regard that we were disappointed with a new Dell Inspiron Laptop that we set up for a customer during the week.

All went well until we got to the desktop and Vista's messaging announced that a problem had occurred with the sidebar which would now shut down. Hmmm, not what you expect when you turn on your PC for the first time and not a great OOTBE. Vista's messaging went on to inform us that the problem was caused by Google Desktop and that the vendor may have a more up-to-date version available on their website that might address this issue. And maybe they did, but we didn't wait to find out. Instead we uninstalled Google's application and the sidebar problem was resolved.

What we can't figure is why Dell bundles Google's Desktop application with their PCs when the version they bundle causes a feature of Vista to crash. You begin to wonder what level of testing Dell performs on the configurations they sell. Or, do they know about these issues before they ship them but leave it to their customers to resolve them. Take your pick.

Tuesday, April 24, 2007

Dell's Vista Upgrade Fiasco

In order to continue to shift PCs in the latter months of 2006 and early 2007, in advance of the launch of Microsoft Vista, Dell introduced the Vista Express Upgrade scheme (my italics). The commitment made by Dell was that if you bought a PC during this period with Windows XP, Dell would send you a free Vista upgrade kit (but charge €16 for shipping/handling) as soon as Vista launched. Now in case you may have missed it, Vista was launched in Europe on January 30th of this year, so how has Dell done in getting out those Express upgrades? Well, it hasn't. Initially Dell posted on their website that they would be shipping by the end of February, then mid-March. It now claims to have begun the shipping process (I don't know anyone who has received the upgrade yet - let me know if you do) and hopes to have completed all shipments by the end of May!

Now PC Medic purchased a new Dell in November in the hope that we would have a Vista PC in the workshop from early February. However, had we just waited until February and purchased a Dell with Vista pre-installed we would have had our hands on Vista a lot earlier. (In the end we installed an OEM license on an existing box as we saw a screw-up like this as a possibility with Dell.) With Dell's recent turnaround decision to continue to sell PCs with XP installed instead of Vista, one wonders if there are ongoing compatibility issues with Dell and third-party hardware that could see the Express upgrade further delayed. Frankly, it has been a major embarrassment for Dell and, like their policy of off-shoreing customer support, suggests that despite producing good, value-for-money PCs they have lost focus on their customers. With Michael Dell back at the helm one can only hope that this will change.

Monday, April 16, 2007

Vista - second impressions

We've been using Vista for a couple of months now and in general like what Microsoft have done. However, a few issues have come to light, particularly with hardware. It seems that a number of hardware manufacturers are slow in releasing Vista drivers to allow their products to work with the new OS.

A point in case came to light last week when a customer asked us to install his newly-purchased Hewlett-Packard 1018 Laserjet printer. When we got it hooked up and inserted the driver disk it came to light that there were no Vista drivers supplied. OK, we thought, they probably have them posted on the HP website. After a bit of a rummage about we found a listing of Vista-supported printers and the 1018 was not on it. Further rummaging found a listing of soon to be supported printers and the 1018 was on that list. In the absence of a Vista driver you can try the XP driver which might work, the website declared, So we did, and it didn't.

The customer's only solution was to return the printer and exchange it for a Samsung 2010 printer which had downloadable Vista drivers. So, the message is, before you run out and buy a Vista PC, check whether your existing peripherals (printer, scanner, webcam, mp3 player, etc.) will be supported, otherwise you may have to budget for replacement peripherals as well.

Sunday, March 11, 2007

Really Nice PC For Sale

We have just finished refurbishing a Compaq Presario PC and it's a great buy for someone looking for a second PC for practically everything except serious gaming. We've upgraded the memory, reinstalled Windows XP Home with all Microsoft service packs and updates, and installed a range of software that more than meets the needs of a home PC. Details are as follows:

Hardware:
Pentium P4 1.8GHz CPU
512MB RAM
60GB HDD
DVD ROM Drive
CD-R Drive
Floppy Drive
6 x USB 1.0
Firewire Port
10/100 ethernet port
modem

Software:
Windows XP Home Edition, Service Pack 2, fully patched
AVG Free 7.5 anti-virus
Windows Defender anti-spyware
Internet Explorer 7.0
Firefox 2.0 (alternative internet browser to IE 7.0)
Thunderbird 1.5 (alternative e-mail client to Outlook Express)
Microsoft Word
Microsoft Works
Serif PhotoPlus 6.0 (photo management)
Compaq WinDVD (DVD player)
Skype 3.0
Windows Media Player 11
Paragon Drive Backup 8.0 (backup software)

Hardware comes with a 90-day no quibble warranty (if it breaks, we fix it, replace it or fully refund you, no problem).

This is a great package that has a very attractive price of only €220. Add a keyboard, mouse and monitor (or ask us to quote you for them) and you have a very nice home PC that will take on any home PC task.

Interested? Let us know at info@pcmedic.ie

Wednesday, February 14, 2007

Vista - First Impressions

We've been getting ourselves familiar with Microsoft's new operating system here in our workshop and I thought that I'd give you our first impressions. And, so far, it's all good.

First up, the installation process is much smoother than before with almost all of the user input being front loaded so that you can leave the installation process to run unattended - a pleasant change from XP where user input is required at multiple separate times during the install. All told, it took approximately 45 minutes to complete the basic install.

Next there was the issue of drivers. We were doing the install into a PC Medic-built box with a 3.2GHz P4 and 1Gb of RAM. The motherboard was fitted with a nVidia 6600GT video card, a Hauppauge WinTV PVR card and a Ralink-based wireless lan card. After the install, the TV and Wireless lan cards were not recognized, but Windows Update commenced dowloading drivers for these. After a reboot, all hardware was up and running without the need for a single driver to be installed by us, pretty impressive.

Putting aside the eye-candy provided by the Aero interface, which is pretty but hardly essential, one of the features that we were most impressed with initially was the enhanced security that encourages you to set up standard accounts for all users, rather than administrator accounts. There is also a new system called User Account Control, which alerts you anytime you are making a change that has any system-wide or security implications. Some may find this a bit of a pain on a day-to-day basis, but we see it as an added layer of control from stopping the user making a bad decision.

A lot of parents will be happy to see a built-in Parental Control system that is not only effective, but also extremely easy to use, something we can't say about many commercial software pakages that try to do the same thing. Parental Controls can only be applied to Standard Accounts, and this will hopefully encourage parents to set up their young children with such accounts. Parental Control can be set to allow user accounts to access the internet at only certain times and days each week. It can restrict the type of websites that can be visited e.g. no nudity, no violence, no drugs, etc., or certain websites can be blacklisted (Bebo, anyone?). You can also determine whether games can be played or not and, if so, the age rating of the games that can be played. Finally, you can restrict which programs on the computer the account can use, so you could restrict the use of messaging programs such as MSN Messenger if you so desired. On top of all this, the administrator can view activity logs for each standard account that has Parental Controls applied to, so you can track the websites they visited, as well as the ones that were blocked. When you consider that some companies charge $40 or more per year for less well implemented versions, this is a high-value inclusion in Vista.

Outlook Express has been replaced/upgraded to Windows Mail and the big news on this e-mail client is the inclusion of a spam control system and it appears very good at its job. We downloaded 183 mails and Windows Mail's spam filter correctly identifed 146 pieces of spam. A total of 7 pieces of spam got through to the Inbox, while no false positives were detected (i.e. no genuine emails were sent to the spam folder). This is quite an impressive result and, as with Parental Controls, we guess that a lot of makers of anti-spam software will be wondering how these new features are going to hit their sales.

There are some other interesting features in Vista that we'll come back to in future posts, but for now you can take it that we like what we see.

Monday, February 05, 2007

More on Spam - Cloudmark

In my previous post I advocated changing to Mozilla's Thunderbird as your e-mail client in order to better manage spam. If you use Microsoft's Outlook as your e-mail client you may also be using its Calendar, To Do and Contacts features, which are not available in Thunderbird, and therefore don't want to change your e-mail client. This is the situation one of our customers was in last week, but still wanted to be able to manage the spam that they were receiving.

We looked at a number of plug-in solutions for Outlook and the one we opted for was Cloudmark Desktop which costs $39.99 for a 12-month subscription. Installation is simple after downloading the software from their downloads site. Once installed, Cloudmark integrates a simple toolbar into Outlook as shown in the picture and creates a Spam mail folder. As mail comes in from the mail server, Cloudmark evaluates it and moves it to the spam folder if it is known spam. If junk mail arrives in your inbox then you can mark it as spam by clicking on the Block Spam button in the toolbar. When a specific number of people report a particular e-mail as spam it is added to the Cloudmark database and will henceforth be treated as spam.

The attraction of Cloudmark Desktop is its simplicity, requiring a minimum of user interaction, and its success rate in detecting spam straight out of the box. A recommended addition if you want to use Microsoft Outlook and successfully manage spam. Note that a version is also available for Outlook Express.

Sunday, January 21, 2007

Managing Spam

One of the most frequent questions we get asked is how do we stop spam arriving in our inbox. The bad news is that it's almost impossible to stop. You start receiving spam once your e-mail address gets out into the public domain. You don't necessarily have to engage in on-line commerce for this to happen. You may only send e-mails to two or three friends and believe that it's impossible for your e-mail to get into the public domain. Not so. All it takes is for your friend's PC to become infected with a virus that harvests e-mail addresses and, voilĂ , your e-mail address is up for sale to the spammers.

You can manage spam in one of two ways - sign up for a server-based service, such as Eircom's Email Protector, or use a local solution. A server-based solution screens all e-mail as it passes through a computer known as a mail server and checks the email's content and/or point of origin and thereby decides whether it is spam or not. If it is deemed to be spam it is not forwarded on to your inbox and will never arrive on your PC. These services are rarely 100 percent effective and we have found with Eircom's service, for which there is a monthly charge, that it eliminates approximately 70% of the spam destined for our Eircom e-mail account.

To deal with the remainder that slips through the server-based solution will require a local solution installed on your PC. There are a wide variety available, both commercial and freeware, and a quick google of "spam solutions" will provide you with a number of options.

Here at PC Medic our way of dealing with spam is to use Thunderbird, available for free from http://www.mozilla.org/ , as our e-mail client. Thunderbird has a built-in spam filter which, after a week or so of training, achieves almost a 100% hit on spam. It is simple to install, will import all your existing Outlook Express folders and mail settings, and does a great job of managing the spam that does get through. Check it out. For more on spam check out this link.