Cyber Spying Tracking Your Family's (Sometimes) Secret Online Lives Review

Average Reviews:

(More customer reviews)This is not a book about security and defending yourself from spying but the basics of why one might consider spying on other members of their family. Whether because they suspect infidelity, criminal activity or some other concern there are a lot of reasons why people might want to find out what others are doing on their computer. A very important point made in the beginning of the book is the question of the ethics of spying including the effect it has on the trust of a relationship. The authors also point out that sometimes spying is much less of an ethical consideration. Sometimes it might be part of protecting your children from online predators or other real dangers.
The book covers the basics of spying including creating a plan, getting the right software or hardware to implement the plan and actual implementation. The authors do a good job of pointing out how we leave tracks behind and how to get rid of those tracks as well as how to exploit them.
Written for the novice user it starts at the very beginning with things like how to open the command prompt and running explorer. From there it goes on to look at more basic as well as intermediate level techniques. The authors even include information on some rather advanced software such as ethereal (one of my personal favorites). It does give you a solid understanding of what the different software is capable of doing but really doesn't provide a thorough treatment of any of them. In the case of Ethereal and Snort both have complete books written about how to use them effectively so obviously part of a chapter barely scratches the surface of what can be done.
For the most part it teaches the easier ways of finding out information without using difficult advanced tools. It includes how to access areas where passwords, usernames, etc. are stored as well as directories and files that do not show up in explorer unless you know how to hand-enter the path to them.
Whether you are spying on someone's web browsing, e-mail, internet chat, or instant messaging the basics are all here. They even include information on how to remove evidence of your activities and ways to tell if you are being watched.
These techniques are mainly for local network spying and not for use over the Internet. Although still subject to many ethical and other considerations, for the purpose of finding out what is going on within your local network Cyber Spying is highly recommended.

Click Here to see more reviews about: Cyber Spying Tracking Your Family's (Sometimes) Secret Online Lives

This book shows everyday computer users how to become cyber-sleuths. It takes readers through the many different issues involved in spying on someone online. It begins with an explanation of reasons and ethics, covers the psychology of spying, describes computer and network basics, and takes readers step-by-step through many common online activities, and shows what can be done to compromise them. The book's final section describes personal privacy and counter-spy techniques. By teaching by both theory and example this book empowers readers to take charge of their computers and feel confident they can be aware of the different online activities their families engage in.Expert authors have worked at Fortune 500 companies, NASA, CIA, NSA and all reside now at Sytex, one of the largest government providers of IT services. *Targets an area that is not addressed by other books: black hat techniques for computer security at the personal computer level. *Targets a wide audience: personal computer users, specifically those interested in the online activities of their families.

Click here for more information about Cyber Spying Tracking Your Family's (Sometimes) Secret Online Lives

Read More...

UNIX and Linux Forensic Analysis DVD Toolkit Review

Average Reviews:

(More customer reviews)The title may mislead readers to believe that this book discusses actual forensics of Unix and Linux systems. It does not. The authors waste precious pages in this short book discussing their favorite cool Linux apps like Nessus and Metasploit but don't have any meaningful discussion about the various flavors of Unix: AIX, Solaris, *BSD, etc. Their "Unix and Linux" forensic book is almost entirely about Linux. There is no thoughtful discussion about filesystem forensics; no technical detail helpful to Forensic Examiners.
The few moments where the authors approach a meaningful forensic topic, the reader is redirected to an online resource rather than provided an analysis or explanation within the book.
The book title may lead readers to believe that an accompanying DVD contains a Unix forensic toolkit of some kind. In fact, there is only 1.8 MB of documents and no tools save for a few (4) short Bash scripts that hardly cover a thorough forensics examination: live or otherwise. One of the scripts is only one line. One of these documents is an incomplete 3.5 page summary of Sleuthkit tools. By "incomplete" I mean that it is apparent that the author decided to quit writing. Apparently there was no room in this 236 page, 14-gauge font book to cover in any detail the different Unix filesystems, data acquisition, data carving or static filesystem analysis. But the authors make plenty of room to discuss scanning with Unix tools (nmap, nessus, etc.).
There is a section entitled "Malware" except that no malware sample is actually examined. The reader is briefly introduced to Panda's AV scanner and is walked through how to use ClamAV as if that is the only AV scanner available for either a Unix user or Forensic Examiner. Forensic Examiners should pay very close attention to AntiVirus product comparative reviews.
The book cover boasts that this is the "only digital forensic analysis book for *nix". Indeed there may be little in the way of books solely dedicated to Unix forensics but other books cover Unix forensics with greater detail than this one. For example, Brian Carrier's "Filesystem Forensic Analysis" or Jones, Bejtlich and Rose's "Real Digital Forensics".
The book cover also boasts that readers can "Hit the ground running" with the information within. Unfortunately, if readers expect the content to help them bridge a gap between Windows and Unix, they will hit the ground with a resounding thud. If any Forensics Examiner finds value in the content of this book for actual Unix forensic investigations, I would question that examiner's experience and training.
If the authors wanted to write a book about cool Linux tools or network scanning, they should have entitled the book differently. Perhaps "A Beginner's Guide to Using Linux and Linux Security Applications".
I felt the title was misleading and false advertising. The authors take advantage of the word "Forensics" to sell a book that is not about forensics. For $53.95 I expected much more and was extremely disappointed and disgusted at the inferiority of the content.

Click Here to see more reviews about: UNIX and Linux Forensic Analysis DVD Toolkit

This book addresses topics in the area of forensic analysis of systems running on variants of the UNIX operating system, which is the choice of hackers for their attack platforms. According to a 2007 IDC report, UNIX servers account for the second-largest segment of spending (behind Windows) in the worldwide server market with $4.2 billion in 2Q07, representing 31.7% of corporate server spending. UNIX systems have not been analyzed to any significant depth largely due to a lack of understanding on the part of the investigator, an understanding and knowledge base that has been achieved by the attacker. The companion DVD provides a simulated or "live" UNIX environment where readers can test the skills they've learned in the book and use custom tools developed by the authors.The book begins with a chapter to describe why and how the book was written, and for whom, and then immediately begins addressing the issues of live response (volatile) data collection and analysis.The book continues by addressing issues of collecting and analyzing the contents of physical memory (i.e., RAM).The following chapters address /proc analysis, revealing the wealth of significant evidence, and analysis of files created by or on UNIX systems.Then the book addresses the underground world of UNIX hacking and reveals methods and techniques used by hackers, malware coders, and anti-forensic developers.The book then illustrates to the investigator how to analyze these files and extract the information they need to perform a comprehensive forensic analysis.The final chapter includes a detailed discussion of Loadable Kernel Modules and Malware. The companion DVD provides a simulated or "live" UNIX environment where readers can test the skills they've learned in the book and use custom tools developed by the authors.Throughout the book the author provides a wealth of unique information, providing tools, techniques and information that won't be found anywhere else.Not only are the tools provided, but the author also provides sample files so that after completing a detailed walk-through, the reader can immediately practice the new-found skills.* The companion DVD for the book contains significant, unique materials (movies, spreadsheet, code, etc.) not available any place else.* This book contains information about UNIX forensic analysis that is not available anywhere else. Much of the information is a result of the author's own unique research and work.* The authors have the combined experience of Law Enforcement, Military, and Corporate forensics. This unique perspective makes this book attractive to ALL forensic investigators.

Click here for more information about UNIX and Linux Forensic Analysis DVD Toolkit

Read More...

Stealing the Network: How to Own a Shadow Review

Average Reviews:

(More customer reviews)Did you enjoy the previous three Stealing the Network books? Are you looking for more? Then move along now, nothing to see here.
The prior books were interesting because they introduced the reader to new ideas or new angles on old ideas, then moved on without belaboring them. If you wanted more details, there were often URLs provided. The last two tied the stories together with the intriguing Knuth character. But the folks running the project chose to switch to a new format, with fewer characters and stories, not to mention fewer authors, and fewer ways to split the profits.
After three books with the same (proven) formula, it's understandable the authors would want to try something new. Alas, it's a disaster.
Welcome to "How to Own a Shadow," aka "The SQL Injection Adventures of Pawn." Pawn is one of the new characters in this volume, and is the first StN character I hoped would get shot to death by the cops in a mini-mall parking lot. Yes, he's that irritating. Particularly after reading 40 pages about his childhood as a high-functioning autistic (or something like that), and around 100 pages of him performing SQL injection attacks. Most of which is totally unrelated to Knuth. Note to the authors: SQL injection is interesting, but if you want to write a book about it, just write a book about it. I even gave you a title, what more do you want? You can even recycle much of this book, like you recycled part of the last one here.
Oh, you noticed the real subtitle of the book, "The Chase for Knuth." First, one chases _after_ fugitives, and hunts or searches _for_ them. Not that it matters, because there's not much chasing or hunting going on in this book. There isn't much Knuth, either. We see him in the first hundred pages, which is mostly about his son analyzing poker software. That's the last we see of either of them. Because, really, this is "The Biography of Pawn." We do get 50 pages of Knuth at the end of the book, but don't get excited: it's all from the last book, added as obvious filler.
Speaking of filler, there's a 17 page advertorial thrown in for BiDiBLAH, which is commercial software by SensePost. Oddly enough, they're listed as technical advisors for the book. I'm sure it's a fine app, but the authors have forgotten about Knuth again, since it has nothing to do with the story. If it had been relevant, it might have been a less obnoxious addition.
Not everything is bad. There's a brief bit about RFID, which of course turns into how to use RFID for SQL attacks. We get to meet Knuth's supposedly dead wife, and a charming shrew she is. All in all, though, this book isn't worth reading unless you're a truly devoted fan of the series, or SQL. I'm still a fan of the previous books, and I hope the authors can recapture what made them so intriguing for their next book. I won't be buying that one until I'm sure it's not Book Two of the Pawn Saga, however.

Click Here to see more reviews about: Stealing the Network: How to Own a Shadow

The best-selling Stealing the Network series reaches its climactic conclusion as law enforcement and organized crime form a high-tech web in an attempt to bring down the shadowy hacker-villain known as Knuth in the most technically sophisticated Stealing book yet.Stealing the Network: How to Own a Shadow is the final book in Syngress' ground breaking, best-selling, Stealing the Network series. As with previous title, How to Own a Shadow is a fictional story that demonstrates accurate, highly detailed scenarios of computer intrusions and counter-strikes. In How to Own a Thief, Knuth, the master-mind, shadowy figure from previous books, is tracked across the world and the Web by cyber adversaries with skill to match his own. Readers will be amazed at how Knuth, Law Enforcement, and Organized crime twist and torque everything from game stations, printers and fax machines to service provider class switches and routers steal, deceive, and obfuscate. From physical security to open source information gathering, Stealing the Network: How to Own a Shadow will entertain and educate the reader on every page. The book's companion Web site will also provide special, behind-the-scenes details and hacks for the reader to join in the chase for Knuth. The final book in the Stealing the Network series will be a must read for the 50,000 readers worldwide of the first three titles The companion Web site to the book will provide challenging scenarios from the book to allow the reader to track down Knuth Law enforcement and security professionals will gain practical, technical knowledge for apprehending the most supplicated cyber-adversaries

Click here for more information about Stealing the Network: How to Own a Shadow

Read More...

CWSP Guide to Wireless Security Review

Average Reviews:

(More customer reviews)Like how the information is presented throughout the book. Easy to read and contains good images. Many essential terms/subjects and a very good book for anyone wanting to learn about wireless networks and security.

Click Here to see more reviews about: CWSP Guide to Wireless Security

CWSP Guide to Wireless Security is a hands-on guide to defending wireless networks against attacks. It prepares students for the Certified Wireless Security Professional (CWSP) certification from Planet3.

Click here for more information about CWSP Guide to Wireless Security

Read More...

Hacking Wireless Networks For Dummies (For Dummies (Computers)) Review

Average Reviews:

(More customer reviews)Think your wireless network is secure from unauthorized use or attack? It's probably not. I just finished reading Hacking Wireless Network For Dummies by Kevin Beaver and Peter T. Davis, and this is one of the most practical books I've ever read for testing a network against attack.
Contents:
Part 1 - Building the Foundation for Testing Wireless Networks: Introduction to Wireless Hacking; The Wireless Hacking Process; Implementing a Testing Methodology; Amassing Your War Chest
Part 2 - Getting Rolling with Common Wi-Fi Hacks: Human (in)Security; Containing the Airwaves; Hacking Wireless Clients; Discovering Default Settings; Wardriving
Part 3 - Advanced Wi-Fi Hacks: Still at War; Unauthorized Wireless Devices; Network Attacks; Denial-of-Service Attacks; Cracking Encryption; Authenticating Users
Part 4 - The Part of Tens: Ten Essential Tools for Hacking Wireless Networks; Ten Wireless Security-Testing Mistakes; Ten Tips for Following Up after Your Testing
Part 5 - Appendixes: Wireless Hacking Resources; Glossary of Acronyms
Index
The target of this book is the security professional involved in testing networks to make them more secure. There's a heavy emphasis on "ethical hacking", or learning how to test a network's security without doing harm or using the information in a destructive fashion. A security consultant using this book would learn how to pre-plan a test, work with the company to make sure they were properly authorized, and then write up the results in a professional manner. That aspect of the book is impressive, and it helps to frame the information in the right light (not as a textbook on how to break into networks).
From a practical standpoint, this book excels. Each of the chapters covers the theory behind how or why a certain aspect of a wireless network would be vulnerable to an attack or exploit. Then the authors cover a number of open source and commercial software packages that are available to focus on that area. For instance, chapter 14 goes into why WEP encryption is flawed and how it can be broken with relatively little effort. It's followed by an explanation on how WPA addresses some of those issues. Finally you get coverage on available tools that are used to crack WEP and how you can use them to test your own network.
Highly practical and heavy on application... If you're a security professional with responsibility for your organization's wireless network, you need to read this book. And if you're a techno-geek with your own wireless network, you'll want to get this book to play around. I know I will be doing a little hacking at Chez Duffbert...

Click Here to see more reviews about: Hacking Wireless Networks For Dummies (For Dummies (Computers))

Become a cyber-hero - know the common wireless weaknesses
"Reading a book like this one is a worthy endeavor toward becoming an experienced wireless security professional."--Devin Akin - CTO, The Certified Wireless Network Professional (CWNP) Program
Wireless networks are so convenient - not only for you, but also for those nefarious types who'd like to invade them. The only way to know if your system can be penetrated is to simulate an attack. This book shows you how, along with how to strengthen any weak spots you find in your network's armor.
Discover how to:
Perform ethical hacks without compromising a system
Combat denial of service and WEP attacks
Understand how invaders think
Recognize the effects of different hacks
Protect against war drivers and rogue devices

Click here for more information about Hacking Wireless Networks For Dummies (For Dummies (Computers))

Read More...

Steal This Computer Book 4.0: What They Won't Tell You about the Internet Review

Average Reviews:

(More customer reviews)Overall this is a good book. The first part is sorta stupid, though. It talks mainly about how not to only listen to one person but to get information from multiple sources. It could be summed up in about a page.
Chapter 4 talks about buying computers and software. It helped me out by giving me some tricks to do next time I buy a computer.
Chapter 5 tells you about keeping your files secure with encryption. It tells you about some different types of encryption algorithms and how to write your own encryption programs. It also shows you how to play some dirty tricks. It talked about using anonymous remailers to send anonymous email and talked about just how anonymous they were. It even told you how to surf the web anonymously so that people couldn't receive information about your computer, browser, and more.
Chapter 6 told about phone phreaking history such as captian crunch. Wallace then goes on by telling you possibly things that could've happened but didn't. When telling these stories he tries to make himself sound like a phreaker but he didn't even do anything. Then, he tells your some really obvious stuff like "To start phone phreaking, you need access to a telephone." and "phreaking from your own phone will let the telephone company trace it to your house." I don't know if he couldn't think of anything else or he thinks you are really stupid. After that, he talks about phreaking color boxes and then goes on to voice mail hacking. Then, he talks about cellular phone fraud and tv satellite descrambling.
Chapter 7 talks about defeating windoz 3.1/95/98 screen saver passwords which if you ever tried you should've done it on the first or second try. It also talks about cracking program passwords and then it goes on to defeating parental control software. If you can't access certain web pages, Wallace tells you how by having the html code emailed to you. He also shows you how to read banned books in secret.
Chapter 8 talks about harassing online services, how pedophiles stalk innocent children and what you can do to stop them. He tells you about generating fake credit card numbers and making your own online harassment program.
Chapter 9 talks about stopping spam. It shows you multiply ways to take revenge on spammers. If the spammer used a forged email address, Wallace shows you how to track down the spammer like two magnets attracting each other.
Chapter 10 shows some pictures of acctual hacked web sites and how to hack them.
Chapter 11 shows you how to track people down by using specific things about them. For example if you only had their SSC# how you could still find them no matter where they were. At the end of the chapter, he shows you how to hide yourself if you don't want to be tracked down or how to let someone easily find you if, for example, you gave your child up for adoption years ago and you don't want to contact him/her but you do want to let them find you if they ever wanted you.
Chapter 12 shows you about ConGames on the Internet. It shows you how to do them and how to protect yourself from them.
Chapter 13 Viruses Part I. ( I heard that the plural form of virus is exposed to be virii, just like the plural form or fungus is fungi but in the book it is written viruses so that's how I will spell it.)
This chapter expains what viruses are, the parts of them, how to tell if you have a virus on your computer, the different infection methods, if all viruses are bad and how to learn more about them.
Chapter 14 Viruses Part II.
This chapter shows the different methods of how an antivirus program works and what to do if you find a virus ( If you say any idiot knows that if you find one you should delete it, but you could also send it in to an antivirus program if you think it is a uncommon virus, keep a copy of it, modify the virus and make a new one and many other things.)
Chapter 15 tells you about writing your own computer virus. Wallace also tells you to watch out because viruses sometimes attack their own creators. He tells you some true things about antivirus companies like how they hire virus writers to help them detect viruses (makes sense, doesn't it) and how that their isn't any evidence of this, but that they may hire the virus writers to write a virus that only they have the antidote for so people will buy their program to detect it.
Chapter 16 is about Java applets. I haven't read all of it but so far so good.
Appendice A is the glossary with a decent amount of terms covered in the book. I really haven't used it too much because I never needed to.
Appendice B is Visual Basic 3.0 ( a very easy programming language that I suggest you learn ) source code for altering Mega$hack. A program he discusses in 12. ( it is used by cons but he alters it so they get a taste of their own medicine.) The source code is written on the page so you will have to type it into your Visual Basic Compiler.
Appendice C is about additional resources. It is compiled of online magazines, webpages, hacker conventions and more.
Summary: This book is for you if you are interested in the above things. The websites and newsgroups in the book lead to nothing except for a few like metacrawler that he obviously was paid to advertise for. If you are still unsure after unreading all the reviews, go to a local bookstore and see if they have this book there. If they do then look at it, see if you like it and if so, compare the prices of Amazon plus the shipping and time to the prices of the bookstore. I hope that this review helped you because I know what it is like to have one person rate it 5 stars and another person rate it 1 star. Sinse this is a pain, I figured that instead of giving my opinion, I would tell you what the book had in it.

Click Here to see more reviews about: Steal This Computer Book 4.0: What They Won't Tell You about the Internet

Click here for more information about Steal This Computer Book 4.0: What They Won't Tell You about the Internet

Read More...

Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD Review

Average Reviews:

(More customer reviews)I have just finished a marathon session of reading "Stealing the Network: The Complete Series Collector's Edition" and I have a very conditional review of it: It's a must-have if you don't already own the previous editions of these guilty pleasures. If you are already a fan, however, prepare to be let-down by the compilation.
The stories of the Stealing the Network series entertain in the same way that "war stories" from fellow hackers and security professionals often keeps a more intimate audience's interest: by mixing intriguing situations with juicy technical detail that can serve as a useful take-away. No one will accuse these books of containing fine literature, but that's not really the point. The stories are well written enough to keep you wanting to know what will happen next, while the technical information is as accurate as you're likely to see in fiction. Segments involving hacking are written and illustrated with enough attention to detail and length to serve as introductory educational tutorials for the topics (including web application hacking, reverse engineering, and wireless security). Most of these scenarios are believable as parts of larger-scale operations.
The first book of the series consists of independent short-stories based around characters of the authors' creation. The other three books in the compilation tell an over-arching story of a larger "operation", which involves many characters and their independent stories. The second book, "How to Own a Continent", is probably my favorite, along with the first ("How to Own a Box"), for keeping things simple, technical, and focusing on the individual stories. The third book, "How to Own an Identity" suffers from having worse editing then the rest of the series, and may lose some readers' interest. The fourth book ("How to Own a Shadow") reads a lot better, and wraps the overall story up well, however it focuses only on a relative handful of the series' characters.
As a compilation, this Collector's Edition leaves much to be desired. While the original description for this edition described the books contained within as being "author-annotated", this is not the case. The individual books are reproduced exactly as they were in their original editions, with no additional commentary from the authors, and with all the same problems as the originals. For example, screenshots in the first chapter of the first book are the same illegible black squares that were in the original edition of the book published 7 years ago. The annotations along with other features described in the original description (emails, photographs) that would provide a lot of interesting background material, would have made this compilation a must-buy.
The extra content that you are receiving is a brief new forward by Jeff Moss, and a "Final Chapter" by Ryan Russell. The new chapter is about 20 pages long, and gives the story-line a proper ending. I won't ruin anything about it, but I will say that I enjoyed it. Syngress has promised in the description of the book to make this content available separately in electronic form in six months.
The included DVD is described on the back-cover copy as being "full" of behind-the-scenes stories. In reality, you will only find 20 minutes of interviews with a few of the authors. I enjoyed these interviews, however, much like the print companion, I felt like more should have been done. Also beware that there are problems with the audio on the DVD. When played on my MacBook, there was noticeable crackling/popping in the audio of the DVD. The same noise was present, but less noticeable when played through a stand-alone DVD player through a television.
To summarize, I like the books, and find them as entertaining as I did when they were originally published, and I like the new hardcover binding. I do think that it is unfortunate that the "Stealing the Network: The Complete Series Collector's Edition" does not meet its potential to be more than the sum of its parts. There seems to have been intent at some point to add value to the set, but it wound up simply being a rough concatenation of the individual books.
If you haven't read these books, then I very much recommend picking up this set. It's 1,000 pages of interesting stories and technical material. If you already have the previous editions of the Stealing the Network Series, however, you might find it hard to justify paying for them again.

Click Here to see more reviews about: Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD


"Stealing the Network: How to Own the Box is a unique book in the fiction department. It combines stories that are fictional, with technology that is real. While none of the stories have happened, there is no reason why they could not. You could argue it provides a road map for criminal hackers, but I say it does something else: it provides a glimpse into the creative minds of some of today's best hackers, and even the best hackers will tell you that the game is a mental one." - from the Foreword to the first Stealing the Network book, How to Own the Box, Jeff Moss, Founder & Director, Black Hat, Inc. and Founder of DEFCON

For the very first time the complete Stealing the Network epic is available in an enormous, over 1000 page volume complete with the final chapter of the saga and a DVD filled with behind the scenes video footage!

These groundbreaking books created a fictional world of hacker superheroes and villains based on real world technology, tools, and tactics. It is almost as if the authors peered into the future as many of the techniques and scenarios in these books have come to pass.

This book contains all of the material from each of the four books in the Stealing the Network series.

All of the stories and tech from:


How to Own the Box

How to Own a Continent

How to Own an Identity

How to Own a Shadow

Plus:


Finally - find out how the story ends! The final chapter is here!

A DVD full of behind the scenes stories and insider info about the making of these cult classics!
* Now for the first time the entire series is one 1000+ page book* The DVD contains 20 minutes of behind the scenes footage* Readers will finally learn the fate of "Knuth" in the much anticipated Final Chapter

Click here for more information about Stealing the Network: The Complete Series Collector's Edition, Final Chapter, and DVD

Read More...

Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition Review

Average Reviews:

(More customer reviews)Hardly a week goes by that CNN does not report a high-profile Web site being defiled or an e-commerce site being penetrated. While most people know why these incidents occurred, Hacking Exposed explains how they occurred and, more important, how to prevent them from occurring.
The cover of Hacking Exposed announces that "Network security is Y2K without the deadline." That alarmist statement, however, is the only hype in the book. The work is packed with real-world examples and links to tools needed to assess the security of any type of client/server and Web system. As they detail the myriad vulnerabilities in different types of systems, the authors provide countermeasures for each of them.
Well organized, the book progresses in an orderly fashion. It methodically goes through the process of exploiting a target to penetrate a system--from identification and enumeration to actual penetration. The authors provide detailed instructions and explanations for many security features and flaws in Unix, Linux, Windows, NetWare, routers, firewalls, and more. Topics covered include state-of-the-art computer and network penetration, as viewed by both the attacker and the defender; remote system identification; vulnerability identification; war dialers; firewall circumvention; and denial-of-service attacks. An appendix explores the security characteristics of Windows 2000.
Some may argue that books such as this one only serve to motivate and educate hackers. The truth is that hackers are already aware of the book's contents. This book is designed for system administrators and managers who need to know their systems' risks and vulnerabilities and how to address them. When they are done with this book, system administrators and managers will be familiar with such critical topics as back channels, port redirection, banner grabbing, and buffer overflows. Hacking Exposed is a must-read for anyone who wants to know what is really happening on their network....

Click Here to see more reviews about: Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition

Click here for more information about Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition

Read More...

Google Hacking for Penetration Testers Review

Average Reviews:

(More customer reviews)This review mainly focuses on evaluating how valuable is to get a copy of "Google Hacking for Penetration Testers - VOLUME 2" if you already own a copy of the first edition, and the scores rates exactly that. If you don't have neither of them, I strongly encourage you to acquire Volume 2 (see details below), no matter what area of the information security field you work in (and specially if you are a penetration tester), as the contents affect to you in multiple ways. On my day-to-day security consulting practice, I'm still very surprised about how many IT people don't know about these techniques. The book is a masterpiece for information disclosure and mining from public sources, such as (but not only) Google. If I had to evaluate the book on itself, not comparing between editions, it would definitely get a score of 5/5.
The first edition was released in 2005 and opened the world of the Google Hacking techniques to the general public, together with the GHDB. The second edition title is (at least) confusing, as Volume 2 seems to denote it is a complementary book to the first edition. It is not, so I do not recommend you to get the first edition today. Volume 2, or the second edition as it should have been called, has been thoroughly updated (including most of the screenshots) to cover the latest changes and Google applications. I did a major update to the SANS "Power Search with Google" course on the first half of 2006, when some of the new Google functionality (not in the first edition) was already available. The second edition reflects those updates I identified and put back together then, even the tiny ones, such as the maximum search terms, that changed from 10 to 32. Additionally, all the statistical references, covering number of results returned by Google, and main contents have been reviewed and updated to reflect the current state of the art.
Some chapters have been kept from the previous edition (chapters 1 to 3, and chapters 6 to 9, and chapter 12), although they have suffered updates. Others have been moved (such as the old chapter 10, now chapter 4) or redesigned (like the new chapter 5). Besides, there are brand new chapters, like 10 and 11.
I specially like the updates on chapter 5, with the new tools and scripts to query Google and, specially, to parse and process the results, including several Perl and User-Agent tricks. The book, obviously, covers the Google API changes and provides solutions to overcome them, such as Aura. Chapters 6 and 8 include relevant updates to the Google code search engine and new capabilities to locate malware and binaries, plus new techniques to track down login portals and network embedded devices and reports, respectively.
The new chapter 10 is a great reference covering the new Google services from a hacking and "malicious" perspective. It is a required update given the pace Google releases new functionality and information sources, such as the AJAX capabilities and API, the source code search engine, calendar, blogger, and alert services.
The new chapter 11, "Google Hacking Showcase", includes the real-world Google Hacking samples and cases Johnny Long has been presenting in several hacking conferences during the last years. A found having a printed copy of it within the book very valuable, as it is an eye-opener, and it is a fun read. Definitely, if you have not seen Johnny's presentations and talks, I encourage you to access the archives from BlackHat and DefCon and enjoy them.
Finally, chapter 12 (the old chapter 11), covers new techniques and tools from a defensive perspective. The new additions increase the defender arsenal in order to mitigate the old and new threats covered throughout the book.
The influence of multiple authors in this edition is evident, something good for the new contents and material, but not so good for the chapter layout, as some do not follow the original format with a final summary, solutions, links and FAQ. Chapter 10 is a good example of both.
The complementary appendixes from the first edition, not directly relevant to the book topic from my perspective, have been removed. Overall, I feel some of the waffle has been left out, a smart decision (but not always easy) in order to keep the book size reasonable, and make room for the new contents.
I would like to see some of the pages that simply provide long listings from the GHDB moved to an appendix and simply referenced from the associated chapter. It might be useful to have these lists full of query samples on the book, but not just in the middle of a chapter. Another improvement would be to have a book webpage consolidating all the code samples, such as the Blogger submission script, as I'm not sure they are all available on a single website.
To sum up, if you don't have a copy of this book, go and buy Volume 2! (not to mention Johnny's involvement with charities). If you are a professional penetration tester, the new material in this second edition is highly recommended, so update your shelves and start applying the new contents on your daily practice. If you are an infosec pro, not directly involved in Google Hacking tasks, and you already own a copy of the first edition, I think you do not need Volume 2, as you already understand the threat, risks, and what is all this about.
At some point I was almost involved in co-authoring this 2nd edition, but finally it didn't happened. A pity, as definitely, this is one of today's reference books that should be on any infosec shelves.

Click Here to see more reviews about: Google Hacking for Penetration Testers

A self-respecting Google hacker spends hours trolling the Internet for juicy stuff. Firing off search after search, they thrive on the thrill of finding clean, mean, streamlined queries and get a real rush from sharing those queries and trading screenshots of their findings. I know because I've seen it with my own eyes. As the founder of the Google Hacking Database (GHDB) and the Search engine hacking forums at http://johnny.ihackstuff.com, I am constantly amazed at what the Google hacking community comes up with. It turns out the rumors are true-creative Google searches can reveal medical, financial, proprietary and even classified information. Despite government edicts, regulation and protection acts like HIPPA and the constant barking of security watchdogs, this problem still persists. Stuff still makes it out onto the web, and Google hackers snatch it right up. Protect yourself from Google hackers with this new volume of information.-Johnny Long.Learn Google Searching BasicsExplore Google's Web-based Interface, build Google queries, and work with Google URLs..Use Advanced Operators to Perform Advanced QueriesCombine advanced operators and learn about colliding operators and bad search-fu..Learn the Ways of the Google HackerSee how to use caches for anonymity and review directory listings and traversal techniques..Review Document Grinding and Database DiggingSee the ways to use Google to locate documents and then search within the documents to locate information. .Understand Google's Part in an Information Collection FrameworkLearn the principles of automating searches and the applications of data mining..Locate Exploits and Finding TargetsLocate exploit code and then vulnerable targets..See Ten Simple Security SearchesLearn a few searches that give good results just about every time and are good for a security assessment..Track Down Web ServersLocate and profile web servers, login portals, network hardware and utilities..See How Bad Guys Troll for DataFind ways to search for usernames, passwords, credit card numbers, social security numbers, and other juicy information..Hack Google ServicesLearn more about the AJAX Search API, Calendar, Blogger, Blog Search, and more.

Click here for more information about Google Hacking for Penetration Testers

Read More...

1337 h4x0r h4ndb00k Review

Average Reviews:

(More customer reviews)No, this isn't a malfunctioning keyboard, nor have I decided to join the ranks of kiddie hackers by starting to use "elite" language. It's the title of a new book by Sams... l337 h4xor handbook by tapeworm. For those of you not into "l337", that translates to "Elite Hacker Handbook". Having gotten *that* piece of information out of the way, I can get on to the review. And my review is that I really don't know what group this author is trying to target, and I think it fails regardless...
Content: fitting in; shortcuts; customize; browsing/e-mail; fundamentals; get the f@*! out of my chat room!; advanced automation; paranoia; networks; beyond windows; conclusion
I wanted to like this book based on the title. Sort of a gritty view of the hacker underworld, revealing "secrets" not commonly written of. What we get instead is a book that can't decide what it wants to be. People who are new to computers or confused by jargon (one of the targets from the back cover) won't see much useable info here. If you're new to computers, the whole "elite" form of typing and word creation will be lost on you, and you'll wonder what the (#@# this person is trying to tell you. If you already know enough to understand the type of style the author is trying to use, then you'll find most of the information far too basic. Desktop overviews? Running defragger? This isn't news, folks...
Parts of the book try to go into basic HTML coding and scripting languages. Again, if you don't know this stuff, this book isn't going to appeal to you in the first place. If the book appeals to you, you already know this stuff. "Advanced Automation" gets into more scripting, but again, not at a level which is going to advance the knowledge base of someone who already understands it. It seemed that with every chapter, the content was at odds with the style and tone of the book, thereby missing the target regardless of what side he chose...
The whole "l337" format really started to annoy me big time after the first chapter. I admit to not having much tolerance for that anyway. There were some cute phrases and humorous lines in places, but not enough to make me want to recommend it to anyone. I can't even recommend it as a parody of hacker culture, because I think the author is really trying to convey useful info. I just don't think the audience that would find it useful would read the book, and those who would read the book won't find it useful.

Click Here to see more reviews about: 1337 h4x0r h4ndb00k


This is your ticket into the elusive underworld of the Internet, home to millions of elite computer hackers. 1337 h4x0r h4ndb00k will show you how to walk-the-walk and talk-the-talk of this exclusive community. Soon, you too will be able to go into a chat room and carry on conversations speaking the cryptic 1337 language. 1337 h4x0r h4ndb00k will also review the nature of computer viruses, different practical jokes to play on your desktop and tips on how to live the hacker lifestyle. Join the elite society of computer hackers with 1337 h4x0r h4ndb00k as your guide.

Click here for more information about 1337 h4x0r h4ndb00k

Read More...

Guide to Computer Forensics and Investigations Review

Average Reviews:

(More customer reviews)I use the book in class. It is an excellent book. In particular I liked its explanation of the Master File Table in Windows NTFS. It is the first explanation that I actually understood.


Click Here to see more reviews about: Guide to Computer Forensics and Investigations

Master the skills necessary to launch and complete a successful computer investigation with the updated fourth edition of this popular book, GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS. This resource guides readers through conducting a high-tech investigation, from acquiring digital evidence to reporting its findings. Updated coverage includes new software and technologies as well as up-to-date reference sections, and content includes how to set up a forensics lab, how to acquire the proper and necessary tools, and how to conduct the investigation and subsequent digital analysis. It is appropriate for students new to the field, or as a refresher and technology update for professionals in law enforcement, investigations, or computer security. The book features free downloads of the latest forensic software, so readers can become familiar with the tools of the trade.

Click here for more information about Guide to Computer Forensics and Investigations

Read More...

PGP & GPG: Email for the Practical Paranoid Review

Average Reviews:

(More customer reviews)This really is a terrific book if you're at all interested in learning how to secure information. It's very well-written in a clear, *concise* manner.
Two great introductory chapters lay out the fundamentals of cryptography and OpenPGP in plain English. There's nice coverage on terminology, the differences between OpenPGP/PGP/GPG, and the basics of using them.
The first chapter has also got a terrific chart laying out specific actions for things you want to do with your messages, like "I want to send a message that only my intended recipient can read" which is answered by "Encrypt the message with the recipient's public key." Much of the rest of the book follows this same clear vein as the author moves through the details of implementing PGP/GPG.
The book is full of small tidbits of very useful information, such as considerations for selecting expiration periods for your keys, or how to decide on what levels of trust to give family and friends, or even how to increase your paranoia by worrying about whether or not a hardware keystroke probe is monitoring your passphrase as you enter it.
The sections covering implementation of GPG are particularly well done. GPG isn't the easiest thing to work with, but Lucas does a great job of pointing out potential pitfalls and working readers past the rough spots.
A terrific work that lays out lots of good information in a small, well-written package.

Click Here to see more reviews about: PGP & GPG: Email for the Practical Paranoid


OpenPGP is the most widely used email encryption standard in the world. It is based on PGP (Pretty Good Privacy) as originally developed by Phil Zimmermann. The OpenPGP protocol defines standard formats for encrypted messages, signatures, and certificates for exchanging public keys.

PGP & GPG is an easy-to read, informal tutorial for implementing electronic privacy on the cheap using the standard tools of the email privacy field - commercial PGP and non-commercial GnuPG (GPG). The book shows how to integrate these OpenPGP implementations into the most common email clients and how to use PGP and GPG in daily email correspondence to both send and receive encrypted email.

The PGP & GPG book is written for the moderately skilled computer user who is unfamiliar with public key cryptography but who is nevertheless interested in guarding their email privacy. Lucas's trademark informal and relaxed tone makes public key cryptography as simple and clear as possible, so that any reasonably savvy computer user can understand it.

Click here for more information about PGP & GPG: Email for the Practical Paranoid

Read More...

Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions Review

Average Reviews:

(More customer reviews)Hacking Exposed: VoIP (HE:V) is the sort of HE book I like. It's fashionable to think HE books are only suitable for script kiddies who run tools they don't understand against vulnerable services they don't recognize. I like HE books because the good ones explain a technology from a security standpoint, how to exploit it, and how to defend it. I thought HE:V did well in all three areas, even featuring original research and experiments to document and validate the authors' claims.
HE:V is a real eye-opener for those of us who don't perform VoIP pen testing or assessments. It's important to remember that the original HE books were written by Foundstone consultants who put their work experience in book form. HE books that continue this tradition tend to be successful, and HE:V is no exception. Good HE books also introduce a wide variety of tools and techniques to exploit weaknesses in targets, and HE:V also delivers in this respect. HE:V also extends attacks beyond what most people recognize. For example, everyone probably knows about low-level exploitation of VoIP traffic for call interception and manipulation. However, chapter 6 discusses application-level interception.
HE:V goes the extra mile by introducing tools written by the authors specifically to implement attacks. In at least one case the authors also provide a packet capture (for the Skinny protocol) which I particularly appreciate. HE:V also looks ahead to attacks that are appearing but not yet prevalent, like telephony spam and voice phishing. Taken together, all of these features result in a great book. You should already be familiar with the common enumeration and exploitation methods found in HE 5th Ed, because the HE:V authors wisely avoid repeating material in other books (thank you).
If you want to understand VoIP, how to attack it, and how to defend it, I highly recommend reading HE:V. The book is clear, thorough, and written by experts.

Click Here to see more reviews about: Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions


Sidestep VoIP Catastrophe the Foolproof Hacking Exposed Way

"This book illuminates how remote users can probe, sniff, and modify your phones, phone switches, and networks that offer VoIP services. Most importantly, the authors offer solutions to mitigate the risk of deploying VoIP technologies." --Ron Gula, CTO of Tenable Network Security

Block debilitating VoIP attacks by learning how to look at your network and devices through the eyes of the malicious intruder. Hacking Exposed VoIP shows you, step-by-step, how online criminals perform reconnaissance, gain access, steal data, and penetrate vulnerable systems. All hardware-specific and network-centered security issues are covered alongside detailed countermeasures, in-depth examples, and hands-on implementation techniques. Inside, you'll learn how to defend against the latest DoS, man-in-the-middle, call flooding, eavesdropping, VoIP fuzzing, signaling and audio manipulation, Voice SPAM/SPIT, and voice phishing attacks.

Find out how hackers footprint, scan, enumerate, and pilfer VoIP networks and hardware

Click here for more information about Hacking Exposed VoIP: Voice Over IP Security Secrets & Solutions

Read More...

Google Hacking for Penetration Testers, Volume 1 Review

Average Reviews:

(More customer reviews)While Google is a researcher's friend, it is a hacker's dream. The subtitle of Google Hacking for Penetration Testers is "Explore the Dark Side of Googling". The dark side of Google is that far too many networks are insecure with inadequate security and enable unauthorized information to leak into Google. This leakage creates the situation where significant amounts of password files, confidential information, and configuration data and much more are easily available.
After reading Google Hacks: Tips & Tools for Smarter Searching, the real power and potential danger of Google is easily understood. Author Johnny Long details how penetration testers can harvest information that has been crawled by Google. The need for Google to be an integral part of any penetration test is now easily understood.
In a similar manner, when Dan Farmer wrote SATAN in 1995, it was met with significant consternation in that many felt he was wrong to release such a powerful program into the wild. Silicon Graphics, his employer at the time, considered his conduct unprofessional and summarily fired him. Ironically, in 2005, a security administrator can be fired if they don't run a vulnerability scanner akin to SATAN. Running scanning tools is now part of security due diligence and any administrator not running such a tool is careless.
With that, some may think author Johnny Long gives far too much ammunition to those seeking to peruse corporate data, but those were the same mistaken objections to SATAN. The book is not meant to be a crutch for script kiddies, its aim is rather to show how Google can be used to uncover data that most companies would rather remain secured. It is simply a matter of time until such Google searches will be considered due diligence for any basic security endeavor.
The book's 12 chapters show how one can plunder and pillage corporate data via Google. Chapters 1 and 2 provide a basic introduction to Google searching, including building Google queries, URL and operator syntax, search reduction, and more.
Chapters 3 through 10 detail the internals of Google hacking. The avenues of attack are nearly endless and various methods are detailed from traversal techniques, site crawling, tracking down Web server logins, and much more. With the sheer amount of data produced on corporate Web sites, it is hard not to have information leakage. The problem is that Google is the perfect glue to bond those disparate pieces of data together to form a dangerous set of connected data. Google is now gluing isolated data, which is dangerous data when in the wrong hands.
Chapter 11 details what can be done to protect an organization from Google hackers. While author Johnny Long may be a hacker, he is quite mainstream when he writes that the best hardware and software configuration money can buy can't protect computing resources if an effective security policy is not in place. Long observes that a good security policy, when properly enforced, outlines the assets the organization is trying to protect, how the protection mechanisms are installed, the acceptable level of operational risk, and what do to in the event of a compromise or disaster.
Chapter 11 details the use of the robots.txt file, which can be used to block Web crawlers such as Google. The chapter also recommends the use of various tools to secure an internal Web site. Tools from Foundstone are detailed, in addition to Gooscan, a tool created by Long that enables bulk Google searches to determine how much information has leaked.
A decade ago, Google was the type of powerful search tool that was rumored to be used within the NSA. Today, petabytes of data are only a few clicks away on Google, and with the Google API, all of that information can be seamlessly integrated into a few scripts. The challenge companies face is to take security seriously and stop making it easy for their password files, payroll data, and other confidential information to be entered into Google's server farm.


Click Here to see more reviews about: Google Hacking for Penetration Testers, Volume 1

Google, the most popular search engine worldwide, provides web surfers with an easy-to-use guide to the Internet, with web and image searches, language translation, and a range of features that make web navigation simple enough for even the novice user. What many users don't realize is that the deceptively simple components that make Google so easy to use are the same features that generously unlock security flaws for the malicious hacker. Vulnerabilities in website security can be discovered through Google hacking, techniques applied to the search engine by computer criminals, identity thieves, and even terrorists to uncover secure information. This book beats Google hackers to the punch, equipping web administrators with penetration testing applications to ensure their site is invulnerable to a hacker's search. Penetration Testing with Google Hacks explores the explosive growth of a technique known as "Google Hacking." When the modern security landscape includes such heady topics as "blind SQL injection" and "integer overflows," it's refreshing to see such a deceptively simple tool bent to achieve such amazing results; this is hacking in the purest sense of the word. Readers will learn how to torque Google to detect SQL injection points and login portals, execute port scans and CGI scans, fingerprint web servers, locate incredible information caches such as firewall and IDS logs, password databases, SQL dumps and much more - all without sending a single packet to the target! Borrowing the techniques pioneered by malicious "Google hackers," this talk aims to show security practitioners how to properly protect clients from this often overlooked and dangerous form of information leakage. *First book about Google targeting IT professionals and security leaks through web browsing. *Author Johnny Long, the authority on Google hacking, will be speaking about "Google Hacking" at the Black Hat 2004 Briefing. His presentation on penetrating security flaws with Google is expected to create a lot of buzz and exposure for the topic. *Johnny Long's Web site hosts the largest repository of Google security exposures and is the most popular destination for security professionals who want to learn about the dark side of Google.

Click here for more information about Google Hacking for Penetration Testers, Volume 1

Read More...

Hacking Exposed Linux, 3rd Edition Review

Average Reviews:

(More customer reviews)I will probably take a lot of heat for this, so let me start by putting on my asbestos suit.
To quote the beginning of this book, page About the authors:
This book was written by multiple authors, reviewers, and editors - too many to all be listed here - who collaborated to create the best Linux hacking book they could.
The best Linux hacking book! Wow I will probably like this book, having already read and used the OSSTMM from ISECOM before.
Then I got very excited reading the praise of the book from Jake Kouns on the front cover, reading praise by Clement Dupuis on the back cover book and browsing the Table of Contents. This book is going to be so much fun reviewing and will probably have me recommending it for future training and courses about Unix/Linux security.
The reason I start saying Unix/Linux, and will soon only say Unix - is that this book tries to cover more than just Linux. Examples include appendices with information about BSD security, listing FreeBSD, NetBSD and OpenBSD information, and also including references to other Unix systems in the book.
I will also use the term Unix, because lets face it there is a lot in common between Unix systems, from Linux to Mac OS X - as anyone will know from reading a real Unix Security book like Practical Unix and Internet Security from O'Reilly - THE BOOK about Unix security.
I was very disappointed, and I have to be true to the wording - the best Linux hacking book. This book is not about hacking Linux, it is more about hacking WITH Linux. Will all respect for the authors I will try to explain why this review is not outright positive.
Let me start by get some problems sorted out immediately.
It is not a problem that this book is written by multiple authors, there seems to be more or less the same writing proficiency - quite good writing actually.
It is not a problem that this book includes relevant security information. This information could alert the reader to different attack vectors or enhance the experience while reading the book. Great to have a setting and presenting the reasons why we should secure our infrastructures based on Unix.
What is a problem then
The problem is that this book is really about general information security. Having just taught a week of CISSP CBK I recognize a lot from this book, and there is a lot of good advice in this book. I am also teaching a lot of penetration testing USING Linux for doing hacking, so I can recognize a lot of good stuff about hacking WITH Linux and Linux programs.
It is a problem that this book use a lot of prose to explain that some things are important, and when they should get down to doing the actual work they reference How To documents or existing projects doing the actual stuff.
Let me give a few examples.
BIOS password security is vital for Linux, and disk encryption - go read a howto
Chapter 4 includes about 4 pages about BIOS passwords and how to circumvent these. Then a single page is presented with the title Whole Disk or Partition Encryption, which is supported by two half page screenshots and links to existing howtos and mentioning that you can use tools like Truecrypt and BestCrypt. Great stuff, really taught me how to use that! BTW the link for the howto is: http://tldp.org/HOWTO/html_single/Disk-Encryption-HOWTO/
Another example.
Unconventional Data Attack Vectors - does X.25 still matters?
Chapter 6 includes a very nice treatment of wardialing and accessing modems using programs that run on Unix. This is related to Unix, but actually not specific to hacking Unix. Then we have more than 25 pages of X.25 - an old technology. The author proclaims early in the chapter that X.25 is being used, but other pages on the internet say that use is in "dramatic decline".
Since I have actually used X.25 I feel compelled to say that this technology IS dead, like SNA it requires bad configuration magic and a lot of voodoo to get a basic connection, and I would not even dream of trying to do scanning using this technology. Further I am told in this chapter that of four tools, only two of these can be downloaded - the rest are PRIVATE! Yeah great, that will help me a lot.
One tool listed is by the guy writing this chapter, Marco Ivaldi and I am sure the tool is great, the writing is great - but I don't believe that a reader searching for the best Linux hacking book really appreciates 8,5 pages of country calling codes in a book containing only about 500 pages. (Amazon list this book as having 800 pages, but from 530 til 591 are appendices, and index stop on page number 613.)
Yet another example
OpenSSH is vital, but why have options listed all over the book?
A thorough description of the OpenSSH configuration is a subject that most Unix people need. Only a few options are listed, and actually placed in different places of the book, some listed on page 535 in Appendix A: Management and Maintenance and others listed on page 576 in Appendix C: BSD. And ohhh if you need privilege seperation it is on page 78, during chroot description. To be fair, the index does list two of these - but why under SSH and not OpenSSH.
OpenSSH is vital to the security of your Linux or Unix system. There is no doubt that the best Hacking Linux book should cover this in more detail. I actually also noticed a very common error, specifying that PasswordAuthentication is the option to disallow password loging at all is wrong. To turn off password login you need to have both of these options.
PasswordAuthentication no
ChallengeResponseAuthentication no
and what about PAM! Pluggable Authentication Modules are used on Linux, and some Unix systems, and is vital to the security of your system. This subject is not in any way described in a proper way that would allow a reader to secure a Unix system. Neither are a lot of other Unix related technologies described, even though they are found and used in real life environments with Unix. To be the best you will have to at least describe the common attack vectors like NFS attacks, FTP attacks and more in some detail.
These examples unfortunately got a bit long, so to get back on track. This book does not present Unix security efficiently, so perhaps ISECOM and me do not agree what a hacking Linux book is?
What is a Hacking Linux book
I would assume the book would use tools to hack into Linux and show the options I could change to prevent these. This is what I have come to expect from reading books in the Hacking Exposed series like Hacking Exposed: Network Security Secrets Solutions. Listing attacks, tools and countermeasures basically.
If the authors wish to push a testing methodology while doing so, go ahead! You have a great testing methodology the ISECOM OSSTMM and you have the skills from the authors. Unfortunately you have failed to provide that along with the Hacking Exposed feeling and I consider the outcome messy and mediocre.
Messy because the goal of the chapters become unclear and mediocre because more specialized books already talk about hacking using the tools presented.
Having other books in the Hacking Exposed giving tools for breaking INTO the system and how to protect, while this book is about USING Unix to break into - anything. Having a wardriving program running on Unix will find modems, no matter if they are connected to Unix or Windows.
To summarize, the things that work for this book are:
* It treats information security nicely in some parts and will give you some overview from physical security through some parts that may be relevant. The information is for the most part not specific to Unix systems nor Linux systems and certainly not targeted even at a specific Linux distribution. The BSD parts listed in the appendices are actually more focused on specific features available than the rest of the book.
* The chapters and parts about Analysis of C code, wardialing, wireless security, Voice over IP and others do actually work. The chapter about Voice over IP is dense with information and the chapter about wireless presents nicely detailed information with nice balance between attack, tools and defense.
Things that do not work are:
* Having a 40 page introduction before getting to anything Unix specific is not working, other Hacking Exposed book dive right into technical stuff.
* Listing the reasons to have protection, but not explaining HOW TO secure the Linux server, pointing to existing howto documents that the reader must fetch to be able to do anything usefull is not right.
* The organization with real good vital information in appendices, do not work. The meat of a book is part of the chapters and appendices are supplemental information, period.
* The index does not work. You can look up SSL or TLS, both are not explained, but you are directed to page 399 - which do not explain those as Secure Sockets Layer and Transport Layer Security. During the writing of my review I was unable to locate a reference to these protocols in the book, but there SHOULD be one in the book.
* Having a mail services chapter without listing a comparison of some popular mailservers for Unix is not working. You may only be running Sendmail but the mail servers like Postfix, Qmail, Exim has a lot of users and warrant a fair treatment. Actually I would go as far as arguing that a high percentage of security consultants would be happy to put Sendmail to sleep and never recommend it for new installations.
* X.25 - is this really needed today - spending 25 pages listing arcane stuff that...Read more›

Click Here to see more reviews about: Hacking Exposed Linux, 3rd Edition


The Latest Linux Security Solutions

This authoritative guide will help you secure your Linux network--whether you use Linux as a desktop OS, for Internet services, for telecommunications, or for wireless services. Completely rewritten the ISECOM way, Hacking Exposed Linux, Third Edition provides the most up-to-date coverage available from a large team of topic-focused experts. The book is based on the latest ISECOM security research and shows you, in full detail, how to lock out intruders and defend your Linux systems against catastrophic attacks.

Secure Linux by using attacks and countermeasures from the latest OSSTMM research

Click here for more information about Hacking Exposed Linux, 3rd Edition

Read More...

The Myths of Security: What the Computer Security Industry Doesn't Want You to Know Review

Average Reviews:

(More customer reviews)Let me start by saying I usually like John Viega's books. I rated Building Secure Software 5 stars back in 2005 and 19 Deadly Sins of Software Security 4 stars in 2006. However, I must not be the target audience for this book, and I can't imagine who really would be. The book mainly addresses consumer concerns and largely avoids the enterprise. However, if most consumers think "antivirus" when they think "security," why would they bother reading The Myths of Security (TMOS)?
TMOS is strongest when Viega talks about the antivirus (or antimalware, or endpoint protection, or whatever host-centric security mechanism you choose) industry. I didn't find anything to be particularly "myth-shattering," however. I have to agree with two of the previous reviewers. Many of the "chapters" in this book could be blog posts. The longer chapters could be longer blog posts. The lack of a unifying theme really puts TMOS at a disadvantage compared to well-crafted books. I was not a huge fan of The New School of Information Security or Geekonomics (both 4 stars), but those two titles are better than TMOS.
If you want to read books that will really help you think properly about digital security, the two must-reads are still Secrets and Lies by Bruce Schneier and Security Engineering, 2nd Ed by Ross Anderson. I would avoid Bruce's sequel, Beyond Fear -- it's ok, but he muddles a few concepts. (Heresy, I know!) I haven't read Schneier on Security, but I imagine it is good given the overall quality of his blog postings.
If you want to shatter some serious myths, spend time writing a book on the "80% myth," which is stated in a variety of ways by anyone who is trying to demonstrate that insider threats are the worst problem facing digital security. If you're going to pretend to debunk open source security, why not back it up with some numbers? Studies have been published recently, and original research and results would be welcome. How about demonstrating that user awareness training wastes money, because enough marks fall prey anyway? I'd also like to see research showing that frequent password changes are worse for security, not better. Wrap all of that in a coherent manner with substantial chapters and you have a real TMOS book.

Click Here to see more reviews about: The Myths of Security: What the Computer Security Industry Doesn't Want You to Know


If you think computer security has improved in recent years, The Myths of Security will shake you out of your complacency. Longtime security professional John Viega, formerly Chief Security Architect at McAfee, reports on the sorry state of the industry, and offers concrete suggestions for professionals and individuals confronting the issue. Why is security so bad? With many more people online than just a few years ago, there are more attackers -- and they're truly motivated. Attacks are sophisticated, subtle, and harder to detect than ever. But, as Viega notes, few people take the time to understand the situation and protect themselves accordingly. This book tells you:



Why it's easier for bad guys to "own" your computer than you think
Why anti-virus software doesn't work well -- and one simple way to fix it
Whether Apple OS X is more secure than Windows
What Windows needs to do better
How to make strong authentication pervasive
Why patch management is so bad
Whether there's anything you can do about identity theft
Five easy steps for fixing application security, and more

Provocative, insightful, and always controversial, The Myths of Security not only addresses IT professionals who deal with security issues, but also speaks to Mac and PC users who spend time online.

Click here for more information about The Myths of Security: What the Computer Security Industry Doesn't Want You to Know

Read More...