WestmorelandCollege.ie

Largely a brochure web site with some customisations.

This is the first real outing for Tina MVC (our in-house Wordpress plugin framework). Wordpress manages all content and templating, making ongoing maintenance a breeze.

Customisations are coded using Tina MVC:

• contact us form
• page widgets for showing sub pages of the current page
• page widgets for random testimonials

The result is a much accelerated development time. Not including the content (which will always be supplied by the client) development time was just a few days.

Hard to believe, but get a load of BT Irelands policy on DNS changes…

1. Fax a request into them on company headed paper (“for security, don’t you know?!”)
2. Wait for 24 hours (“we only reload our DNS twice a day”).

In fact they are so protective of their DNS servers that they will not break their 2-reloads-a-day rule even in cases where they have made a mistake.

Exercise for the reader:

Figure out how to spoof a DNS change request to BT Ireland using nothing but a PC, a screen grabber and an Internet connection (you shouldn’t even need a physical fax machine).

The ultimate irony: Security guru Bruce Schneier is the Chief Security Technology Officer for BT (but I bet he doesn’t know about the fax-on-headed-paper security initiative)!

Update on getting stale DNS entries removed:

Four days! After becoming frustrated with tech support drones, I had to escalate it to the complaints department.

You cease your contract with your hosting company, cancel your contract and move your web site. People start to complain that they cannot reach your web site. Nothing seems out of order.

The problem:

You were hosting with a major ISP (like Eircom, Magnet or BT Ireland). They put DNS entries into their servers for your web site. When you cancel your contract they should remove these entries. Magnet and BT Ireland are two companies that are negligent in this regard. If they don’t remove these DNS entries, then their customers can have problems reaching your new web site.

Continue reading ‘Beware: ISP’s as Hosting Companies – watch your DNS’ »

Delivery and packaging

I opted for the self-install option which is delivered by courier in a large jiffy envelope. Inside was an Imagine banded Motorola Wi-Max unit, a telephone handset adapter and a network cable.

The box itself is about the size of a hard-back novel (think a John Grisham airport edition), with a small swivel foot on the base to facilitate standing the device upright. It feels solid and well built. All antennae are internal, and there a series of four green LEDs on the front to show Wi-Max signal strength and one for Wi-Fi operation.

Connectivity: 1 x RJ-54 (Ethernet), 2 x Telecom (RJ-11), Wi-Fi. Disappointingly there is no hub built into the device.

Initial Set-up

Plug in and go (almost). According to the manual, as long as you have two of four signal strength LEDs lit, you are good to go. I had four, so I cannot comment on what performance would be like in marginally serviced areas.

Once up and running you plug in your PC (using the supplied network cable), open a web browser and you are automatically redirected to a set-up screen. From there you go through a series of five screens to confirm your PIN number (supplied by Imagine) and confirm your email address and activate the service. After that you are set up for Internet access. There is an additional step to activate and secure the Wi-Fi connection.

Annoyingly, the device kept dropping its’ Internet connection during the browser set-up phase and I was forced to start again from step 1. It took me several attempts to get through this step. This is a major irritation – I am in an area of high signal strength, so if you live in a marginally serviced area this step might get very frustrating.

Wi-Fi set-up was painless – just pick an SSID, a Wi-Fi radio channel and add a security password/key. However the limited access that Imagine give you to the device doesn’t really allow you to make a mistake here (See LAN Set-up).

Once I was through the set-up the device settled down and I was getting 7.5MB down and 0.5MB up with ping times of about 100ms. I’ll do a more rigorous test of this later.

I did not have a telephone handset to try out the VoIP service.

LAN Set-up

This is a major disappointment – if you want to customise anything for your local network, well, you just can’t. This includes setting your LAN network subnet (set to 192.168.15.x with no indication of what subnet mask is in use), port-forwarding, DMZ set-up, DHCP server settings.

I queried this with Imagine technical support and received two conflicting responses:

Access to the control panel and other features is restricted as changing some of these settings can cause the Wimax unit to cease functioning correctly.

and

There is proprietary technology there that we can’t let you see…

In my opinion both of these statements smell of bullshit – look at this review of Wi-Max and you can see screen shots of the Motorola browser interface.

What concerns me is that I see screen shots in that review for things like uPnP, firewall, enabling administrator access to the device  (“Enable web login from Internet”) and port forwarding, but no indication from Imagine as to what the default settings are.

The rather idiotic response from Imagine is:

If you wish any ports forwarded please contact us either via email or phone and we can arrange that.

Seeing as you have very basic access to your own LAN using Imagine Wi-Max, this raises questions of liability if your network is compromised – especially in light of recent legal news over the “three strikes” agreement between Eircom and IMRA.

From a privacy and security standpoint there is no way of knowing what access to your LAN Imagine have given themselves.

Initial Conclusion

For a home user Imagine Wi-Max shows great promise. However the retarded attitude Imagine have towards the control panel, and the uncertain security set-up, make this of little use to the business or the technical user.

To be fair calling it a vulnerability is being overly generous – the method used to generate the passwords was totally flawed. I would expect more from a 16 year old script kiddie with a Corn Flakes packet code wheel.

As an academic exercise and to publicise the vulnerability we converted some Perl scripts to PHP and published them to our web site. Believe it or not, almost four years hence, there are still a load of routers that are vulnerable. You can even get an iPhone app for it!

If you suspect you are affected, then follow the link below and see if we can deduce your password. If you are affected contact us and we will be happy to help. You can also find DIY instructions on how to secure your Netopia router here.

Go to the Eircom WEP password cracker page here.

BornToRunAsh.com
born-to-run-ash.com

Ash is a runner, cyclist and general fitness freak who wins the Death Valley Marathon and runs extreme 70km marathons around Connemmara in his spare time.

His web site (built on Wordpress) is a simple enough visual affair – he wanted it up quickly and Wordpress themes allow you do do that and more. Because we were able to get the site up with a minimum of fuss (from a design point of view) we were able to concentrate on integrating the site with the various social networking bits and pieces that Ash uses.

The site is linked up to a Facebook account, a Twitter account and his Garmin training log.