The Thurston, Pierce, Lewis, and Mason Counties IT Experts

The URL

Before we get into the manipulation of the URL, let’s define its parts. 

At the beginning of the URL there is the protocol. This tells the computing network which language is being used. For most Internet-based directions, the protocol will be HTTP, for Hypertext Transfer Protocol. Other protocols you’ll see include File Transfer Protocol (FTP), News, and Mailto.

The next part is the ID and password. Since most people don’t want their login credentials exposed, they leave this information out of the URL. Safety first. 

The next part of the URL is the server name. The server name provides users a path to access information stored on specific servers whether they are loaded through a domain or through the IP address associated with that server.

The fourth part of the URL is the port number. This number is associated with the services on the server and tells them what type of resources are being requested. The default port is port 80, which can be left off the URL as long as the information that is being requested is associated with port 80. You’ll often not see the port number during day-to-day surfing, because most legitimate sites use the standard port 80.

The final part of the URL is what is called the path. The path gives direct access to the resources found tied to the IP (or domain).

Manipulating the URL

When a hacker looks to manipulate a URL, he/she does so by changing parts of the URL to test access. Since most users navigate a website through traditional means--that is that they use the links provided on the website--sometimes hackers can find vulnerabilities by a trial and error approach. 

By manipulating the parameters to try different values, hackers can test directories and file extensions randomly to find the resources they are after. This provides access to resources that typically wouldn’t be available and would otherwise be protected. Today, hackers have tools that allow them to automate these penetrations, making it possible to test a website (and more specifically, find vulnerabilities) in seconds. With this method, these hackers can try searching for directories that make it possible to control the site, scripts that reveal information about the site, or for hidden files. 

Directory traversal attacks, also known as path traversal attacks, are also popular. This is where the hacker will modify the tree structure path in a URL to force a server to access unauthorized parts of the website. On vulnerable servers, hackers will be able to move through directories simply.

What You Can Do?

By securing your network against URL attacks, you are eliminating major vulnerability points. One thing you can do is to ensure that all of your Internet-based software is updated and patched with the latest threat definitions. In doing so you gain a lot more control over your network and data. 

The IT experts at PC Technologies can help you keep your business’ IT infrastructure from working against you. Call us today at 360-491-2227 for more information about how to maintain your organization’s network security.

Typically, Microsoft releases patches on “patch Tuesday”, or every second Tuesday of the month, but because of the threats these vulnerabilities created, they went ahead and patched them. Let’s take a look at the two patches they released in their rare out-of-band patch. 

Internet Explorer Zero-Day

The major vulnerability that was patched was a zero-day vulnerability found in their antiquated Internet Browser, Internet Explorer. Being a zero-day vulnerability, it had already been exploited in the world, explaining the need for the unscheduled bug fix. 

Not much is known about the vulnerability, but Microsoft has suggested it was a remote code execution exploit that, if taken advantage of, could give an attacker complete control over the account of another user. The exploit requires that the hacked party click on a link in a phishing email while using Internet Explorer. 

Fortunately, IE is only used by under two percent of users, but attacks have already happened so remaining vigilant about any use of IE is important. Stay away from IE and you won’t have to worry about security problems coming from the old browser. 

Microsoft Defender DOS Bug

The second patched issue in the out-of-band patch was a denial of service exploit in Microsoft Defender, the antivirus shipped with Windows 10. The bug doesn’t seem to be overly troubling, as a hacker would need unfettered access to a computer and the ability to execute code. The code would disable Windows Defender’s components enough to give hackers access, and the ability to take over the system with malware or ransomware. 

Keeping your software patched and running smoothly is extremely important. Reach out to our expert IT technicians today to see how PC Technologies can help you manage your system updates and software management at 360-491-2227.

Understanding G Suite

G Suite is effectively Google’s collection of applications that businesses can leverage to assist their operations. Originally released as “Google Apps for Your Domain” about 12 years before the time of this writing, this solution was slowly added to over the years - eventually being rebranded to “G Suite” in September 2016. Today, the solution is kept free of any advertisements, and even better, none of the data stored within is used to inform advertisements, either.

What’s Included in G Suite?

G Suite includes a wide variety of solutions under its blanket, so this will not be a comprehensive list. Instead, we will focus on the commonly known highlights, as these are the ones that can clearly deliver value for you and your users.

Gmail

Gmail is Google’s email software, first released in 2004. As a part of a G Suite plan, it offers each user 30GB of storage and assorted email options. For instance, not only can you have unlimited Google Group email addresses (so instead of listing everyone in your customer service department as an email’s recipient, you can send one email to your entire customer service department), you can also customize your email addresses to match your business’ domain. This looks much more professional than having “@gmail” at the end of a business email.

Docs, Sheets, and Slides

Added to the platform in 2006, these solutions make up Google’s answer to the word processing, spreadsheet generating, and presentation building programs that have a useful place in just about any business. Featuring full collaborative capabilities, these solutions encourage your team to work together to accomplish their objectives by giving them the tools to do so simply. With all progress automatically saved - including a complete, restorable revision history - working on tasks as part of a larger, collaborative group becomes that much easier to pull off successfully.

Drive

Launched in 2012, Google Drive is the cloud storage platform included with G Suite. With this platform, your business users can have access to all of the content and files that they need to fulfill their responsibilities. It is also compatible with assorted file formats, eliminating the need to install plugins or additional pieces of software to view its contents. Thanks to Drive, collaboration is much more simple to accomplish, and different plans offer different storage options based on your business’ specific needs.

Calendar

Integrating with Gmail, Google Calendar is an easy way for your team to keep their schedules and responsibilities straight. Let’s say a user has to arrange a meeting with a few coworkers. Google Calendar permits them to see their coworkers’ availability, preventing the productivity-killing, “No, that time doesn’t work for me… how about...” discussions.

Other Capabilities

With a Business account, you are able to access your own G Suite Admin Panel. Essentially your control room, the Admin Panel allows you to manage each and every setting. Here’s a brief overview of just a few of the options available on the Admin Panel:

Users

This is where you add new users to your account. From here, you can also manage what attributes your users have (or essentially, the details about them that you have recorded - like start date, location, job titles, et cetera) and when they last signed in.

Groups

You can organize your users in this section into mailing lists and, well, groups. These groups make it easier to schedule meetings and manage events, as they allow you to bundle users together as a means of communicating with them en masse. 

Company Profile

This section allows an admin to brand their company’s G Suite solution with the company logo and update other information pertaining to the business. It also allows you to set up custom, branded URLs for your company’s Drive, Calendar, and Gmail accounts.

Admin Roles

As the lead admin, you can add additional roles and grant permissions, as well as set permissions for particular groups, devices, and services. This section also allows you to review what admins you have, and the permissions that these admins have as well.

Billing

Any charges that your G Suite account and its licenses have incurred can be reviewed and managed here. This section should also display the G Suite plan you have subscribed to.

Reports

Here, you can track how your G Suite services and apps are being used, and what your users have been doing on G Suite. Within this section, you can review a general overview of your applications under Highlights, while Reports allows you to run reports and audits on specific services, devices, and users.

Other functions include the capability to manage device permissions, enable security features, manage other locations your business may operate out of, and many more.

Want to learn more about how you can leverage G Suite as a business tool? Reach out to PC Technologies! Our professionals can help implement and integrate its functions into your processes. Call today at 360-491-2227 to learn more, or to get started!