Matthew Buck’s Blog - Principal Engineer at RatwareUK

Sorry I haven’t been here for some time - we’ve been really busy. Work has begun on the prestigious Cognoscenti Software Project and with it comes a large upgrade to our internal systems to web-manage software projects. This means, that software clients can log directly into our project management system, view milestones, roadmaps, tickets and wiki pages related to their project. This interface is secure and live 24/7 and also allows the user to view trial versions, submit and track bug tickets and generally keep involved through long spells of coding. I will include more details on the main site as soon as I’ve finished setting up permissions, but the benefits are as follows:

• Secure and round-the-clock access to our project management system.
• View project roadmap, timeline and source code in real time.
• Submit and track change requests and bug tickets.
• Set up email notification, so that changes are communicated directly to the client.

The new Project Management System has now replaced Mantis (the old bug tracking system). The new system is not intended to replace face-to-face discussion, but is intended as another level at which our customers can check on progress and keep involved in short to long-term software development projects.

The new system is based on an open-source implementation of Trac. I am really pleased with it so far and we’ve had extremely positive feedback from customers who have tried it out. I’m hoping that in the future, this will serve as another example of our innovative and forward thinking.

More news and an update will follow this week.

This week, the governing body for all the internet assigned names and numbers (ICANN) met to discuss a huge problem that faces the internet in the next decade - the provisioning of IP Addresses and Domain Names.

Whether it’s your mobile phone, internet gateway or website, all of these use an IP address. Plus, they have to be unique. Domain Names like www.ebay.com, which resolve to an IP address, also have to be unique. As you may imagine, companies have been buying up domain names constantly and with more and more consumer devices like MP3 players and phones connecting directly to the internet, the scope for unique IP addresses and domain names is now very small. The world is running out!

In order to combat this issue, ICANN is pushing for the complete implementation of IPv6 (providing approximately 3.403 × 10³⁸ unique host addresses) and also custom TLDs (*.ebay, *.ibm etc.) The custom TLDs are especially interesting as not only will this allow companies to express their brand in a more creative way, but it will also free up a large amount of unique names and combinations which are currently not on the radar.

For more information visit the ICANN website.

Just thought I’d do a quick blog as it’s been a couple of weeks since we secured the new hosting deal with the data centre and things have worked out really well. Since closing the deal, we’ve deployed several Linux servers at the data centre, each hosting our clients special requirements such as online databases, high-dependency web applications and DNS.

The servers each run CentOS - one of my favorite Linux OSs for its stability and scalability. We’ve made sure each server has 4 processors (AMD Quadcore 9500), 2GB Ram minimum (plenty for Linux) and at least 2 hard drives configured in a mirrored Raid array. If one hard disk fails, the other can immediately take over and our Service Level Agreement with the data centre means that the failed drive will be replaced within 30 minutes. If both hard drives fail at once, which is highly unlikely - 0.0004%, all data is backed up every evening, and data periodically is uploaded to another RatwareUK secure server at a different geographic location. We’ve got eveything covered and we are passing on all the benefits to our customers!

The datacentre and RatwareUK co-manage the servers and have set up IP tables, anti-virus, ssh hardening and the centre runs daily security audits for us. The datacentre also offers excellent internet connectivity to our servers. They are now supplied by Tier-1 bandwidth providers and are just 1 hop away from 4,500+ networks. These new servers are fast and secure!

Finally, we have complete root access over the servers here in Wigan and have added them to our Pro-Active monitoring service. This means that, if the server stops responding, a service fails or there is a security alert - we’ll be advised within 60 seconds.

We are currently in the process of migrating data from our old hosting servers to the new ones. The new hosting servers are the pride of the company this month. At RatwareUK we like a good solution. For more information, please contact us.

I’ve just come across a great new video from Microsoft which details the advantages of Windows Mobile deployment on Exchange. Check out Windows Mobile Video for more information!

If anybody needs any advise concerning Windows Mobile deployment at work, please do not hesitate to contact us.

I was doing some research for a third party in relation to accounting software, when I came across this gem. It’s called LessAccounting and it’s a web based accounting package for small businesses. They’ve got a neat CSS website and the product looks packed with functionality such as :

Customer Relations Management
Reporting
Invoicing etc..

It supports multiple users and as it’s web based you can securely access it from any machine. Less Accounting also handles all the backups and support. I thought it was worth a mention when I saw it, as it appears to be a niche in a corner market. If you’re a small company who basically just invoice and account, this is definately a cheaper and more efficient alternative to Sage - that’s worth considering.

This week, several clients have contacted RatwareUK after purchasing a blackberry-style BT Broadband Anywhere bundle. See the following link BT Broadband Anywhere .

Many customers believe this is a plug and play solution that can be used at their business to give staff access to email whilst on the move. This is not the case. The product above is for home use only. It is linked to a residential BT Hub (which they provide) and it uses BT’s independent mail servers supplying a btconnect.com (or similar) email address. It will not link up to your company’s exampledomain.com or your company’s mail server.

To compound matters, BT are also accidentally sending out residentially configured phones to customers requesting them for business use!

In a nutshell: Rolling out compatible mobile devices which staff can use to access their company email is more complicated. Considering Windows Mobile devices specifically; if you have Microsoft Small Business Server, or Microsoft Exchange Server you have to complete the following steps:

1. Purchase 1 or more Windows Mobile Devices with GPRS connectivity. (See BT Business Product as one example - there are many more).
2. Install Exchange SP2
3. Install ActiveSync 4.2 or higher
4. Enable mobile services for users
5. Configure your company’s firewall and web services
6. Install a secure certificate on the device
7. Configure Windows Small Business Server 2003 for MSFP
8. Configure device synchronization
9. Test the deployment

If anybody requires any assistance with remote working solutions, please do not hesitate to contact us. We’d be more than happy to advise. Remember, don’t just dive in on what looks like a good deal.

Hope this helps!

Matt

Recently, RatwareUK has recommended OpenOffice to some SMEs as an appropriate and a financially sound alternative to Microsoft Office.

OpenOffice is an open-source project, free of costly licensing, which looks and performs almost exactly like Microsoft Office. It’s compatible too. You can open Microsoft files and save Microsoft files seamlessly without requiring any Microsoft Office software.

One great thing about OpenOffice is its ability to generate high-quality PDF files from documents, spreadsheets and presentations. Microsoft Office falls short of this and you have to purchase bolt-on software from Adobe. Sending documents to clients as PDFs via email is a much better solution than using the Microsoft formats.

If you are still undecided, you can try OpenOffice yourself. You can download it, install it, keep it or delete it and the best part is - it won’t cost you a penny.

To find out who’s using OpenOffice and why, visit Open Office - Why?

To download OpenOffice for free visit Open Office - Download

If you have any queries about how OpenOffice can benefit your business, please do not hesitate to contact us.

According to a report from IronPort called “2008 Internet Security Trends” it would appear that if 2007 was a bad year for spam - 2008 will break the record again!

One interesting statistic I found on the internet was from the European Unions Internal Market Commission, which estimates that junk email costs internet users 10billion Euros per year worldwide. For small to medium size businesses, this figure may seem like an incomprehensible fact. However, consider with me for one moment what happens in your business when just one spam email enters your company.

1. Spam email finds its way through your company’s internet gateway. At this point the rogue email will take up a small percentage of the costly bandwidth allocated to your company by your ISP. If the spam e-mail contains an attachment, it will take up even more bandwidth. This reduces the bandwidth available for incoming/outgoing emails, surfing the internet, remote workers, VPN tunnels connecting branch offices… etc.
2. The spam e-mail then penetrates your company’s mail server. If the rogue email is addressed to an invalid user, your company’s mail server will then attempt to reply to the spam sender saying the address has failed. This takes up more processing time and bandwidth. If the rogue email is addressed to a valid user, your mail server will deliver it into that user’s mailbox. Again, taking up more processing time. Remember, if your mail server is also your main domain server - it has other things to do with its time - like serve files and manage print jobs!
3. The end user eventually receives the spam in their inbox. Inevitably, the user will then delete the email. However, when deleting it, due to human error, they often miss legitimate emails because they are caught in a sea of rogue ones. Also, sifting through spam emails takes up an employee’s time and the quality of the spam email is most likely undesirable.

The above is a rather crude view summarising the knock-on effect of one spam email entering your company. However, it’s worth remembering, as imagine the human and computer processing time taken up by 500 spam emails a day, not to mention the drain on bandwidth.

At RatwareUK, we have our own mail relay server. In a nut-shell, this means that spam can be filtered off-site and legitimate emails can then be passed through to your company, thus completely saving on a company’s bandwidth and human/computer processing times. Not only will our relay server eliminate spam, it will also scan all inbound emails for viruses!

If you are receiving 500 spam emails a day, knocking those out of the equation will definitely allow your server to perform daily tasks faster and save bandwidth. For more information, visit our Anti-Spam Services page.

I’m writing this post because in the last month two security issues on our customer’s websites have come to light. Before I continue, it’s worth mentioning that neither of these issues relate to customers on RatwareUKHosting. Both customers were using different third party web hosts. For obvious reasons I’m not going to name any of the companies involved.

Security Issue 1:

RatwareUK were asked to do some general housekeeping on a client’s web space. Upon logging in we noticed an odd looking file called phishing.tar. On investigation somebody or something had uploaded a zip file to the root of the hosting package, unzipped and installed a mini Bank of Scotland login page! It became instantly apparent that a little corner of this customer’s web space was being used to collect valuable bank login details from those people foolish enough to click through from spam emails! How did it get there? We have no idea and as we didn’t have control over the server, we passed it up to the third party web hosts. Eventually they returned our call saying it was nothing to do with them and we should just deal with it. Nothing in the logs or in the permissions to be worried about then?

We removed the zip file, changed the root passwords and also made sure the file permissions were locked down. However, this is pretty basic stuff and we felt quite helpless. We are now monitoring the site for the customer and if this happens again we’ll recommend they move web hosts. Nasty files like these must get uploaded due to a generic security weakness on the web server. Totally unacceptable and I can’t believe the web hosts weren’t concerned.

Security Issue 2:

Recently a client made us aware of a strange occurrence when they accessed their corporate homepage; when they loaded the page in their browser, a small command prompt window opened and closed quickly and their Sophos AV system sent out alerts. On inspection, RatwareUK discovered that a script had been injected into their index.html which executed a download and install! Upon further inspection, the new files were running processes and attempting to open ports - typical trojan behaviour. I hadn’t seen anything like this in action before and it was particularly concerning how smooth the infection was.

For a script to be injected into an HTML file, there must be vulnerabilities in the web server’s software, enabling the remote administrator to change the permissions and upload the “cuckoo’s egg”. RatwareUK changed all the passwords, permissions and removed the script. Since then there hasn’t been a problem, but without knowing your vulnerabilities, how do you plan your security?

Similar to the issue above, we contacted the web hosts and they didn’t want anything to do with it. They wouldn’t alter the file or shed any light on the incident. Almost as if they didn’t want to admit liability or in fact confirm the issue. There certainly was an incident though and these recent events would only lead you to believe cybercrime is on the increase. Especially with web hosts not prepared to look into them.

With the new release of Back Track 3 BETA; RatwareUK now have a vast range of security auditing tools. If you are concerned about your company’s firewall, VPN, wireless or network security, please get in touch and we’d be only happy to advise.

I’ve spent most of the weekend testing out a distribution of Linux called Back Track. The latest version is a BETA release and from what I’ve seen so far, it is the most convenient and comprehensive set of security and vulnerability tools I’ve seen. Expect a full review of this distro on my blog at some point in the future.

The rest of the weekend has been dedicated to meeting an old business partner and long time friend of mine, Chris Bishop. Chris is Hotel Chocolat’s Online Marketing Manager turned e-business guru. He’s now moving onto House of Fraser leaving behind a 200% increase in online sales at Hotel Chocolat through his affiliate marketing schemes and Google traffic engineering. Truly inspiring.

We spoke for a while about life-cycles and eventually touched on Microsoft’s aspirations to go virtual within the next decade, but the most surprising topic, which I knew nothing about, was the use of technology and the Internet by large corporations to categorise individuals and market their products dynamically. Chris tells me that Tesco are developing their clubcard so that their computer systems know when you are in the stores; know when you are passing the small aisle displays and know what your product choices and moods may be. Through the displays they can visually alert you to a product you were probably 50/50 on the way to buying and help you make up your mind. I guess it’s easy when you know a person’s sex, age, address and weekly buying habits. There is a lot of information an artificial intelligence system can derive. Our conversation was a timely reminder of how the Internet and technology has only just been born and we have not yet even begun to understand its potential.