Borders Book Reviews: Steal This Computer Book, Google Hacking, Honeypots

[I.M.O.G.]

I spent some time at borders this weekend and investigated their computer security section a bit, and here are my brief thoughts on what I gathered for those interested...

Steal This Computer Book by Wang (http://www.nostarch.com/frameset.php?startat=stcb3)
IMOG's Conclusion: http://www.ocforums.com/oc_images/images/icons/icon13.gif

Primer: Covers many topics about the culture and methods used by hackers.

Pros: Many links for further personal research on topics covered.

Cons: This was the first book I paged through, and I found it mildly interesting... If I were on the toilet with limited literature options, after eating bad chinese the night before, I could find some entertaining entries to get me by in my time of need. Light reading, wouldn't consider it actually technical, written by a technical person/comic who, very occasionally, manages to be comedic in this text.

Conclusion Details: An alright coffee table/****house book, but not anything I would consider reading front to back. It didn't inspire me to check the price on the back, but its available online for between $12-$20 at many places. I wouldn't bother getting it, but it serves as a fine gateway to further online research for many of the topics it covers.

Google Hacking for Penetration Testers by Long (http://www.syngress.com/catalog/?pid=3150)
IMOG's Conclusion: :thup:

Primer: What is Google Hacking? (http://news.com.com/2100-7349_3-5289486.html)

Pros: Entertaining somewhat technical book. Reading goes fairly quick, very well organized for use as a reference manual. Useful for anyone who's site is crawled by Google and is interested in the security of their website. The author is a leading professional at the forefront of both whitehat and blackhat activity.

Cons: Questionable actions can follow from reading this text. Covers many methods which can be, and everyday ARE, misused.

Conclusion Details: I spent a solid enjoyable hour glancing through the topics of this book. This paperback is thick - lift with the legs, not with the back. It covers all aspects of anything interesting about the utility, and threat, which can be raised from Google. This book would interest both the white or black hat out there, and should probably be owned by both if they have any interest in online security. Definetly recommended, entertaining, informative. Available from Borders for $45, and online for around $30, and used for a little more than $25.

Honeypots - Tracking Hackers by Spitzner (http://www.aw-bc.com/catalog/academic/product/0,,0321108957,00%2ben-USS_01DBC.html)
IMOG's Conclusion: :thup:

Primer: What is a Honeypot? (http://www.tracking-hackers.com/misc/faq.html)

Pros: Highly technical. Covers planning, software options, deployment, and legal considerations. Written by a security professional from Sun Microsystems, with assistance from legal advisors for legal considerations.

Cons: Involved. If you aren't interested in security and the role of honeypots specifically, probably more information here than you are really interested in. A solid understanding of everything contained would require technical know-how and training to be successful in following through in real life.

Conclusion Details: Out of my 4 hours, I probably spent a good 2 and a half reading a few selected excerpts in this book. This is also a weighty book, though paperback. I found this book thoroughly interesting - it details the most basic aspects of what honeypots are all about, and takes you all the way to making decisions in implementation in a business environment. I would expect that after reading this book, any support person reasonably comfortable with their technical skills would have the ability to deploy a low-interaction honeypot as part of their business's security suite. Very real world applicable, and very friendly to the n00b despite offering more than enough for the otherwise skilled technical individual looking to add to the security of their site. Made me want to setup a honeypot on my home network - and I will be looking into it further for sure. Also available for $45 from Borders, $30 from Amazon, and even as little as $10 used (likely due to limited interest group in this topic - quality of information contained is Excellent).

[nahmus]

nice. I need some new reading material.

[UlicBelouve]

I read the first one a while back. I agree with you there. And the one pro you have I would also agree with. Very useful for future resarch, gives you a lot of directions to go to. I'm also going to get a couple other books I have previewed, one of them is "The Art of Intrusion". I was wondering if you had any takes on that.

We should definately have some sort of book review sticky thread.

I'll look into that Google one.

[9mmCensor]

please post further on honeypots if you set one up.

[I.M.O.G.]

Sure thing 9mm, I already have the starter version setup... My machine is in the virtual DMZ of my Microsoft MN-100 router now, but I haven't gotten any hits yet. :cry:

I'm running the freely downloadable version of back officer friendly - originally created by the cult of the dead cow hacking group, who's claim to fame is back orifice. You can get BOF here:

http://www.nfr.com/resource/downloads/back-officer-friendly.tar

This client watches for probes and sends false replies for various popular services, so if anyone probes my machine for these services, it will appear as though I'm behind a firewall to the n00b. It will log the IP and any actions that were attempted so that I can check them out later. If someone actually knew what they were doing at all though, my machine could probably get pwn3d right now. So yeah, if you want to attack me, my IP is 127.0.0.1. ;)

This software is for personal clients basically, and is terribly easy to setup and get running, but is very low-interaction, and doesn't let you really play with any options. It just doesn't have many features. Pretty boring so far - I have confirmed that everything is setup correctly though with the security scan here:

http://scan.sygatetech.com/prestealthscan.html

When running that, it reports that the correct ports are open and not closed or blocked - and this is reflected in back officer friendly.

So ya, if you want to play around, maybe shoot me a PM and I can hook you up with my IP and we can try some stuff to see what happens. I'm really not sure how vulnerable I am right now, but I would bet I'm pretty damn open for an attack. I can get you hooked up with a back orifice client and you can see what you can find out about me perhaps, if you are interested.

I read the first one a while back. I agree with you there. And the one pro you have I would also agree with. Very useful for future resarch, gives you a lot of directions to go to. I'm also going to get a couple other books I have previewed, one of them is "The Art of Intrusion". I was wondering if you had any takes on that.

We should definately have some sort of book review sticky thread.

I'll look into that Google one.

Cool man. Ya, I saw the art of intrusion in borders, but I just didn't have sufficient time to check out anything else... Maybe I'll try again this weekend. Post up if you get a chance to evaluate it at all, and I will do the same.

[UlicBelouve]

Will edit further to do more of a review.....

Art Of Intrusion
UlicBelouve's Conclusion-- :cool: x4

Art of Deception
UlicBelouve's Conclusion-- :cool: x5

Art of Intrusion, by Kevin Mitnick (arrested for some computer crimes, didn't delve into what) is a pretty interesting read. Multi-chapters broken into three good parts:
The Story
The Insight
The Countermeasures

The Story is great, a fun read, mostly goes like an action film, for the most part, no real insight here, you just hear the story. One of my favorite parts is when the investigators call up an admin (for the US District Court) because they have 26 Passwords off that server. Admin swears that the comp is not connected to the Internet.....
"Is your root admin password 2ovens ?"
::sound of admin's head hitting the desk::

Insight tells you more specifically what they did, but mainly, not too much detail, for obvious reasons. For this, I feel that there is only so much the reader can follow.

Countermeasures is great if you are looking to secure anything important. Some readers are, but most are just reading this for fun, and have no real authority to access the systems that are vulnerable, much less have the ability to remedy these items. Would be great for anyone that does have such access. Still useful for some overall security points that are made.

Great stories and insight, but it is hard to really get into, for me, mostly because a lot of the tools and tricks are beyond me. A reader is given knowledge of WHAT they did, but not really HOW they did it, except in vague terms. Really hard to follow "they modified the ROM, watched the hexadecimal numbers, and figured out the algorithim that the video poker machine ran, so that they would know when a royal flush would occur, and they got a lot of money." It's specific enough to not be a "they figured out the machine and won money", but not too much more detailed than that. It's hits a middle-point that is not too worthwhile.

I'll review Art of Deception later, which is a better book of the two. But both are good, Art of Intrusion is a good "entertainment book", as in "I can't believe they did that, that they did it in this undetailed method, and this is how we guard against it." There is nothing too specific in the how they broke it, or really how you protect against it. It just doesn't sit, the lack of real insight to the crimes, but I guess that is difficult to do, so not really going to ding them on that point, because if it were detailed, it would not be on the shelves.

[I.M.O.G.]

Cool. :)