3 web security reminders from the recent Huawei Indictment
The department of Justice announced yesterday that they have indicted Huawei, a Chinese telecommunications company on charges of racketeering and conspiracy to steal trade secrets. The justice department said in a statement that The 16-count superseding indictment also adds a charge of conspiracy to steal trade secrets stemming from the China-based company’s alleged long-running practice […]
What being an introvert taught me about business and automation
Being an introvert is not easy sometimes. As an introvert, I love to focus intensely on whatever I’m doing and get completely absorbed in the task at hand.I can work night and day non-stop on an algorithm to make it not only work perfectly but also be elegant in simplicity. I love to problem solve […]
WordPress gets hacked all the time
If there is one thing we love here at Cytrus Logic it is working on hacked sites. Just got done with a WordPress site that was hacked using a very simple exploit. A file was uploaded to a directory that did not have the right permissions. A couple of back-doors were put in so that […]
Why I Abandoned Corporate Culture
There is a phrase by a well respected religious leader Gordon B. Hinkley that once said: “Life is to be enjoyed, not endured.” When I first started my company Cytrus Logic I was enduring. I was naive. I was an excellent programmer but I had to learn the business. So I did what I thought […]
Web Server Default Banners
Web server default banners are when web servers like Apache, Nginx, and others are configured to show their server type, version number, and operating system. Hackers can use a simple method to get this information. This information is sent in the headers of the HTTP request and looks like this: HTTP/1.1 200 OK Date: Thu, […]
What is the Strict-Transport-Security Security Header
Imagine if you are in a coffee shop and using public wifi. A hacker is also in the same coffee shop on the same wifi. You are purchasing something off of an insecure website. Little do you know that the hacker on the same wifi network is monitoring your traffic with a packet sniffer(a tool […]
How to Prevent Content-Type Sniffing
Content-Type Sniffing is used to protect against MIME vulnerabilities. This happens when a user uploads a file but disguises it as something else. This is potentially dangerous because a malicious file could be upload to the server and then inject malicious code. The Content-Type Sniffing makes sure that files are served as the MIME file […]
What is XSS Protection?
XSS protection is a security header that stops a page from loading when a XSS attack is detected. This header is supported in Chrome.IE, and Safari. An XSS(Cross-site scripting) attack is when malicious code is inserted into a benign site typically in the form of a browser side script. A hacker can use XSS to […]
Directory Listing Enabled Error
Web servers can be configured to automatically list the contents of directories that do not have an index page. This allows people to be able to see sensitive directories and files that are supposed to be private. This can lead to vulnerabilities. It gives hackers information about your files that they should not have.
What is the Trace Method?
The ‘TRACE’ is an HTTP request used for debugging which echo’s back input back to the user. This method allows the possibility for hackers to steal Cookies, and possibly website credentials. TRACE requests can be disabled by making a change to the Apache server configuration file.