REVIEW: "Hacking Exposed", Stuart McClure/Joel Scambray/George Kurtz

From: Rob Slade, doting grandpa of Ryan and Trevor (rslade@sprint.ca)
Date: 10/10/02 

From: rslade@sprint.ca (Rob Slade, doting grandpa of Ryan and Trevor)
Date: Thu, 10 Oct 2002 16:59:46 GMT

BKHCKEXP.RVW 20020911

"Hacking Exposed", Stuart McClure/Joel Scambray/George Kurtz, 2001,
0-07-219381-6, U$49.99
%A Stuart McClure stuart@hackingexposed.com
%A Joel Scambray joel@hackingexposed.com
%A George Kurtz george@hackingexposed.com
%C 300 Water Street, Whitby, Ontario L1N 9B6
%D 2001
%G 0-07-219381-6
%I McGraw-Hill Ryerson/Osborne
%O U$49.99 905-430-5000 fax: 905-430-5020
%P 729 p. + CD-ROM
%T "Hacking Exposed: Network Security Secrets and Solutions, 3rd Ed"

Yes, I know that this book has the most sales for any security work,
ever. And, for the life of me, I still can't figure out why.

Part one looks at gathering data for an attack. Chapter one discusses
company information that is generally available. However, while it
may alert some to the fact that a lot of information can be obtained
about them, most of the material deals with facts that you either want
to make available, or that you must make available. Some suggested
countermeasures are useful, while others strain the topic, such as the
protection against domain hijacking. Scanning for weaknesses and
loopholes, mostly with individual tools, in this edition, is the topic
of chapter two. Enumeration, or finding weak user accounts and
unprotected system resources (mostly on Windows 2000) is covered in
chapter three.

Part two looks at details of specific systems. Chapter four touches
on Windows 9x. NT gets a fair amount of detail in chapter five, but
such vital and standard topics as disabling the Administrator account
and setting up auditing are barely mentioned. Windows 2000 now has
its own chapter: six. Some common NetWare attacks are listed in
chapter seven. UNIX has the most extensive coverage, in chapter
eight, but it is hardly comprehensive.

Part three deals with network weaknesses. Most of chapter nine
discusses wardialling and dial-up, but there is a brief mention of
Virtual Private Networks (VPN). Some device weaknesses (vendor
specific bugs, that is) are listed in chapter ten. (There is also a
very brief mention of wardriving and detecting wireless networks.)
Firewalls, in chapter eleven, are primarily addressed in terms of
scanning to (for identification) or through. Chapter twelve describes
a few denial of service attacks. (Something has been lost in the
update: a discussion of IP fragmentation attacks refers to "earlier"
material on teardrop that no longer appears in the book.)

Part four looks at software. Chapter thirteen deals with remote
access software in fair detail. Hijacking and backdoors are discussed
in chapter fourteen. Miscellaneous Web site bugs are reviewed in
chapter fifteen. Chapter sixteen is a confusing amalgam of ActiveX
design flaws, Internet Explorer implementation bugs, and random
discussions of malware.

The original preface (which no longer appears in the work) stated that
the book was intended for system administrators, but it did, and still
does, read more like a cookbook for security breaking. The authors
defend themselves against this charge in advance, and certainly "keep
quiet" versus "let it all hang out" is a constant debate in security
circles. However, the attack descriptions are far more detailed than
the countermeasures sections, and many attacks are presented without
any specific protections being mentioned. There are a number of
points in the book that can be helpful in identifying specific
security weaknesses. However, the book can't be comprehensive in that
regard, and what it fails to do is give an overall concept of, or
framework for, security on an ongoing basis. The examples given are
frightening and stimulating, but the authors present them as the
entire picture. In fact, even the picture as presented is not entire.
A number of descriptions given in the book either do not mention, or
gloss over, the fact that, for example, sniffers must be placed on a
local, promiscuous, network, and session hijacking requires that the
attackers somehow get "between" two systems.

On the other hand, the book is quite readable and can give you some
tips. And, I wouldn't mind seeing a few sysadmins a little more
scared than they are at the moment. As long as they don't think that
this is *all* you need to do.

copyright Robert M. Slade, 2000, 2002 BKHCKEXP.RVW 20020911 

-- 
======================
rslade@vcn.bc.ca  rslade@sprint.ca  slade@victoria.tc.ca p1@canada.com
Find virus, book info http://victoria.tc.ca/techrev/rms.htm
        Mirrored at http://sun.soci.niu.edu/~rslade/rms.htm
Review mailing list: send mail to techbooks-subscribe@egroups.com
Robert Slade's Guide to Computer Viruses, 0-387-94663-2 (800-SPRINGER)
Viruses Revealed               http://viruses-revealed.org.uk or
                     http://www.amazon.com/exec/obidos/ASIN/0072130903

Relevant Pages

  • [NEWS] Multiple Red-M 1050 Blue Tooth Access Point Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... compatible devices looking to obtain IP network access. ... * Red-M 1050 Access Point Management Web Server DoS ... A number of other IP/Layer2 based attacks for traffic redirection ...
    (Securiteam)
  • Auditors: Health records for millions at risk of improper disclosure
    ... WASHINGTON - Security weaknesses have left millions of elderly, ... The Government Accountability Office said it discovered 47 weaknesses in the ... network that is privately owned and operated. ... administrator for the Centers for Medicare and Medicaid ...
    (soc.retirement)
  • Re: Fwd: Penetration test of 1 IP address
    ... the client had asked him if they could test the "security" of the boxes ... on his network, and they agreed that they could. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
    (Pen-Test)
  • repost from the blackhat convention about web parts/apps
    ... a South African security consultant. ... Chief of Staff," provides an overview showing what attacks have ... commonly trying to intrude upon your network ... Web apps can encapsulate complex business ...
    (microsoft.public.sharepoint.portalserver.development)
  • Re: Need help to find web server attacks signature
    ... IT Security Consultant ... >> I see some attacks that seem to be a security scanner tool, ... Better Management for Network Security ... >> - Ensure robust IP security through policy-based management ...
    (Incidents)