Slashdot Mirror
Hacking Linux Exposed
While the recent Code Red worms and their offspring have taken center stage, it is not time for Linux administrators to sit on their behinds and say 'told you so.' Yes, our Unix systems may have been immune, but let us not forget the flurry of worms that came after Ramen made the scene early this year.
Most folks have heard of Hacking Exposed, the ground-breaking security book that is now coming out with a 3rd edition. One of the HE authors, George Kurtz, teamed up with two leading security experts to bring us Hacking Linux Exposed which was released in April of this year.
Hacking Linux Exposed teaches you about security from the cracker's point of view. to give you all you need to know to protect your own systems. It is written by security experts who have seen these attacks in the wild and have been protecting their own systems from them. It gives many examples of attacks, but it also teaches you how attacks of various forms occur in general, giving you a true understanding of vulnerabilities current, future, and theoretical.
The book itself is organized into four parts, each discussing a specific aspect of system security in depth.
Contents Part I begins with Unix permission models, such as passwords, file (user/group/other) modes, capabilities, limits, and other security features built into Linux. Though the authors claim this chapter is 'to get those Windows users up to speed' I found details about things I didn't know about, having been administering Linux systems for several years.
The authors then move onto proactive measures that can be taken to protect your system, under the theory that you shouldn't be reading the entire book before you start securing your systems. This section primes you with security procedures that will be referenced later in the book multiple times, and keeping it all contained seems a very logical organization. Topics include log analysis, system security scanners, hardening tools and patches. The chapter is ended with a step-by-step discussion of what to do should you suffer a break-in. While they strongly suggest a reinstall, and describe all the problems and pitfalls that brings, they acknowledge when business needs may conflict, and how to deal with differing requirements.
Rounding out the first part we move onto a chapter showing how crackers find out information about your machines and network. Naturally it includes the standard port-scanning tools, ping sweepers, and OS detection software, as well as network (in)security scanners such as SAINT, Nessus, and SARA. New administrators will learn a lot from discussions of information leakage through SNMP, DNS, whois, and even newsgroups. I believe this is the only book I have ever read to start a chapter with a piece of email Spam for educational purposes.
Part II talks about how crackers can get into your machine from the outside. We begin with a chapter entitled "Social Engineering, Trojans, and Other Hacker Trickery." This chapter is dedicated to various methods that are not necessarily code-related. The social-engineering angle is broken down into several categories, explaining the human insecurities that are most effective at getting people to give out inappropriate access or information, complete with frighteningly simple examples. The discussion of Trojans reminds us that everything may not be what it seems, such as the trojaned version of tcpd back in 1999, and explains how not to be taken advantage of by using checksums, pgp signatures, and the like. It ends with a discussion of worms. A discussion of the Ramen worm is included (the book was published very soon after this worm was released) as is a prediction that other worms may be on the horizon, which turned out to be all too true.
Next we move onto physical attacks that are used to gain access to systems, or helpful information. You are reminded how lax your office environment is (yes, we all have at least one sticky note with some password, somewhere) perhaps more than necessary. However when discussing console access, the authors return to instantly-implementable countermeasures to keep folks from walking up, rebooting, and dropping into single user mode, including a bit on encrypted filesystems.
Next comes a chapter devoted to attacks launched over the network. True to the overall style of the book, this isn't simply a list of the various POP/IMAP/Sendmail hacks over the years, but rather examples of different classes of attacks, such as wardialing, X servers, buffer overflows, denial of service attacks, sniffers, and automated password guessers. The information provided should help you prevent the known attacks and those that haven't been written yet that operate on similar principles.
The last chapter of Part II discusses attacks based on abuse of the network and network protocols themselves. We learn about abuses of DNS, routing protocols, and advanced sniffing and session hijacking that can be used to funnel your traffic through an attacker's machine without your knowledge, often without any loss in service. Man in the middle attacks against SSH and SSL are also well explained, and critical for anyone to understand before blindly clicking 'ok' to PKI-based warnings. The chapter ends with a discussion of the hazards IP-based trust relationships, and how to properly implement ingress and egress filtering.
All the topics to this point have been geared to keeping the attacker off of your system. In Part III, the authors move on to how an attacker that has already gotten onto your machine in some way will ultimately hack the root account.
We begin with PATH and permissions problems, insecurities with suid/sgid and custom root-run scripts, and common problems with poor sudo configuration (including a script you could use to allow limited editing of /etc/passwd via sudo safely.) It continues with local buffer overflow, format string vulnerabilities, race conditions, and hard/symbolic link problems. A very good chapter for anyone writing code, in addition to security administrators.
Chapter 9 is devoted to password cracking techniques and programs, such as Crack, John the Ripper, and pointers to useful word lists. Shadow passwords, including expiration information, is explained, as well as other systems that use passwords such as Apache .htpasswd files. Lastly, they describe good methods of choosing and enforcing strong passwords via PAM.
Chapter 10 shows you all the evils an attacker can do to your system after having cracked root. This chapter reads like a ringing wake-up call if you think a machine can be properly resecured once it has been compromised. The authors show some simplistic methods a hacker can use to maintain access, such as modifications of .rhosts, read/write nfs exports, and suid root shells, to more advanced methods such as the use of SSH authorized_keys which are suprisingly still not part of most script-kiddies arsenal. It then moves onto several methods of creating a network-accessible root shell (a wacky custom one is written in perl and netcat). The rest of the chapter is devoted to trojaning a system by replacing/recompiling new versions of system programs (netstat/ls/etc) which can be used to hide an attacker's activities. Loadable kernel modules which can do the same, but are potentially undetectable are discussed, complete with code. This chapter could have been titled 'How to build your own rootkit' given the detail they provide.
The last main part of the book discusses firewalls, web, mail, and ftp servers in detail. The server room is still where Linux is most often deployed, and the authors decided to give extensive detail about how to secure these commonly-provided services.
Chapter 11 discusses mail and ftp security, services that are most frequently run by the buggiest of software. However, the authors don't waste their time listing the insecurities that have existed in each product over the years (which would have taken several books) but instead look at current problems in implementations and the protocols themselves. For the mail section, it was refreshing to see that Postfix and Qmail were given equal air time along with Sendmail The authors described attacks that affect Sendmail, Postfix, and Qmail, showing the necessary fix for each mail server. The FTP section began the actual workings of the FTP protocol in both Active and Passive modes to allow you to understand the problems with the protocol itself and how it can be used for FTP bounce attacks, penetrating poorly-designed firewalls, and how data hijacking can occur.
Chapter 12 discusses both webserver configuration issues (Apache being the most prominent) and server-side dynamic content insecurities. The authors show you how to trim overly-permissive configuration options that are enabled by default, protect your HTTP authentication files, tighten proxy settings, decide where symlinks are appropriate, and more. The CGI (mod_perl, etc) section does a good job of showing you common pitfalls you or the programmers you support make every day that can lead to a compromise.
The last chapter of the book discusses how you can enable access controls and firewall rules to keep the bad guys off of your machine. They discuss TCP Wrappers along with inetd, xinetd, and even how to integrate them into your own daemons. They give detailed examples of how you can implement packet filters on your machine. It was nice to see iptables described as prominently as ipchains, especially since the 2.4 kernel was barely out when they released the book.
The last section of the book is the appendices. The first discusses the package management systems of various Linux distributions (RedHat, Debian, Slackware) and how to install/upgrade/verify your packages. The next details how to see what services you are running and how to turn them off, again describing distribution-specific methods where appropriate. The last appendix consists of three actual-hack case studies. If you've read Hacking Exposed then you're familiar with the 1-2 page case study at the beginning of each chapter. Here they included much lengthier case studies, including the code the attackers used. The increased length works much better, and provides a good view into these attacker's methods.
Presentation This book is very well organized, and includes the right combination of discussion and code. They made frequent use of special 'Caution', 'Note' and 'Tip' graphics to emphasis specific issues, and each attack begins with a 'Risk Rating' that lets you understand which attacks should be secured first as you attempt to implement all the countermeasures they make. No issue was brought up without a specific countermeasure you can implement today.Many security books out there focus on various tools available to attackers, and read like a shopping cart with occasional text interspersed. This book focuses on the attack methods themselves, rather than the tools. As such it contains information about cracking programs where appropriate, and reads more like an educational journey of hacking methods. When many similar tools are available, only a few are described in depth, and eliminating duplication when possible, leaving you with the right information to decide which tool or tools are best for you.
One of the things that I really appreciated about this book is how the authors will start off topics with home-grown examples before discussing advanced security tools. For example, the authors give you a simple shell script that could function as a crude file integrity checker to provide you a clear method of understanding the concept before going onto detailed configuration examples of tripwire, Aide, and others. While they do not take up much space for these primers, usually half a page or so, they are excellent examples of speaking through code, rather than magician wave-of-the-hand explanations.
Conclusion Hacking Linux Exposed is a very good read. It does a great job of staying focused and interesting, without skimping on the actual details you need to secure your systems and understand the threats. The countermeasures are real and specific, allowing administrators to use this book as a tool to secure their own systems.
At many times I wished that the book were more Unix-centric than simply Linux centric. Many of the issues are similar, and the countermeasures would simply be broken down into *BSD vs Linux vs Solaris, etc. However that would have made reading the countermeasures a bit more difficult. As it is, many of the issues have similar or identical countermeasures, regardless of OS, so administrators should be able to extend what is said to their Unix OS of choice without too much trouble.
The Linux focus allows the authors to get much more in depth than they were able to in Hacking Exposed, which was disjointed at times, unable to really probe each issue. However the opposite is also true --- since they wanted to focus on Linux-specific attacks, they do not go into general attacks, such as JavaScript, cross site scripting, and other browser-related problems, for example. For these types of attacks you should look elsewhere. I think keeping the focus clean is very much worth it.
Beginning administrators may find some of the lead-up lacking in places. For example someone who is not very knowledgeable about IP may have trouble understanding some of the sophisticated network abuses and malformed packets described. However this is to be expected. This book is not standalone, nor should it be. If the HLE authors included enough information to adequately describe every nuance of IP packets then that'd be a disservice to those who already have a copy of W. Richard Stevens, and would needlessly add weight to a book that is supposed to stay focused on hacking.
The book has a website that includes all the source code in the book, released under the GPL, as well as some tools they wrote which they didn't feel belonged in the book itself. They also have book corrections on the website, as well as sections they had wished to put in the book that were rejected by the editor, such as their stance on the "Hacking vs Cracking" semantics debate, and why "Linux is Securable" (as opposed to Windows.) Needless to say, these folks won't be employed by Microsoft in the near future.
I highly recommend this book. You'll have ready-to-implement measures that can keep you busy for some time securing your systems. You'll learn a lot on the journey. And I look forward to seeing "Hacking Windows 2000 Exposed" later this year --- I can only assume it'll say "Install Linux."
You can purchase this book at FatBrain.
I love the previous books from these guys though, very detailed, and great info. Everyone should pick it up.
What, me worry?
I thought cracking linux exposed would be a more elegant title, as I was hoping it had a bit more about the ins and outs of coding the linux kernel.
This gives all the Hackers in the world a bad name. Just because we right code for a living/hobby doesn't mean we are trying to break into your system.
It should be Crackering Linux Exposed.
Hacking Linux Exposed should be a book about how to modify the kernel or maybe how to make drivers in the linux kernel.
~Anonymous Coward
Wow, such prescience! I, for one, would never have guessed that! ;)
Omnes arx vestrum sunt adiuncta nobis.
So, who'll be the first to complain that it should have been called "Cracking Linux Exposed" ..?
My favorite security book to come out lately has been:White-Hat Security Arsenal: Tackling the Threat by Aviel Rubin
I sawm mcclure and kurtz at usenix. They were doing a talk about network security. Not a whole lot of new info but they are a good team for presentations. The original Hacking Exposed was pretty good too...
Douglas Calvert
Hey, is the rank of "8.5" hard coded into Slashcode? Why is it that almost every book reviewed here gets an 8.5? Hows about some diversity? Give a book a 5 for a change...
Tell him to put his clothes back on. Perv.
So I checked my web server error logs last night, and counted up how many times my box has been attacked. I have over two thousand individual hits from a single IP address (you'd think that the scanner would give up after one try.) About 170 distinct IP's have tried scanning me.
Mailing abuse seems to be ignored these days; are all of the ISPs scaling back their security staff at the same time as more virulent attacks are released to the net? If anyone has any other suggestions of what to do with these attacks, I'd love to hear it.
LibBT: BitTorrent for C - small - fast - clean (Now Versio
I just think that people who have been using linux enough to write that book should be able to tell the difference between cracking and hacking. Then again, perhaps it was the publisher that forced this title? I mean, the word "hacking" has been so popularized, it's without a doubt going to generate more sales.
You. ;-)
Best Slashdot Co
"The book has a website that includes all the source code in the book, released under the GPL,"
Then why do I need a username and password to download the stuff? I think this is not very GPL-like...
Baal
I think it is time to GIVE UP the hacker title. The original meaning is lost forever. Call yourself a 'Computer Programmer' instead and everyone will be happier and will not be confused anymore.
Everyone knows that Hackers are all terrorists, anyways!
--jeff
ipv6 is my vpn
"I look forward to seeing "Hacking Windows 2000 Exposed" later this year --- I can only assume it'll say "Install Linux."
no, try learning a little about how to administer Win2K instead.
asshole.
Well, I don't know whether the "hacker" title is a lost cause, but the "computer programmer" title is just not a good idea. Hackers are not all computer programmers, nor are all computer programmers hackers!
it should be unhackable or at least extremely difficult to do so.
They also have book corrections on the website, as well as sections they had wished to put in the book that were rejected by the editor, such as their stance on the "Hacking vs Cracking" semantics debate, and why "Linux is Securable" (as opposed to Windows.)
Give it a rest, the only people who feel that "hacking" and "cracking" are two different things is you. Turn your attention to making things better.
Lucky you... I've had over 17000 hits from 800+ unique IP's using Nimda.
My Apache error log has gone from an average of 80k/week (mostly robot.txt hits) to 2.6MB in 1.5 days!
Oh well, it could be worse, I could be running IIS.
MadCow.
I used to have a sig, but I set it free and it never came back.
unix code red chicken head
command processing overhead
Hacking linux oyster bed
go ahead
Great Review!
I have read previous versions(In Portugese) and one of the main reasons I bought the book was because it had documentation via examples of issues I was trying to resolve on my own machine.
So while in Brasil I saw a copy and snagged it...
Oddly enough, all 'code examples' were in english while the explanations were in Portugese...anyhow, the book is a GREAT resource and your review definately did justice to the time and experience illustrated in the book.
Kudos!
"Just Smile and Nod." --Huck
In case you haven't noticed, the media doesn't like making distinctions that may confuse them or their readers. Though we may think the subversion of 'hacker' into 'cracker/attacker/script kiddie/etc' is a genuine loss, they don't understand. And I don't know how to fix it, especially since most publishers aren't willing to make the distinction either.
And I look forward to seeing "Hacking Windows 2000 Exposed" later this year --- I can only assume it'll say "Install Linux."
But of course, an easy way to score cheap points around here.
Seems like a Really sweet book though, it goes straight up to top three on my wish list!
English:
Most script kiddies will not have the attention span or coding skills to successfully trojan all the programs that are necessary to hide themselves.
Portugese via Babelfish:
A maioria de kiddies do certificado não terão as habilidades da extensão ou do coding da atenção com sucesso a Trojan todos os programas que são necessários para se esconder.
Back to English:
The majority of kiddies of the certificate nao terao the abilities of extensao or coding of atencao successfully the Trojan all the necessarios programs that sao to hide itself.
Yeah, that's bad.
URL, please!
I for one am glad to see the word used correctly.
*after* I hit "submit" I saw the heading on your message. If these are attacks from Nimba the people on the other end are sure to be clueless about the problem and advertising their IP address will, uh, do no good.
You might try a phone call the the administrative contact for the host.
While reading a review for a hacking book on this VA-Linux-owned site, I saw a banner ad for hacking books at another VA-Linux-owned site (thinkgeek).
While one might think ThinkGeek would be selling the book, they are not.
Oh well, over to amazon I guess....
___
The way to see by faith is to shut the eye of reason. --Ben Franklin
Call yourself a 'Computer Programmer' instead and everyone will be happier and will not be confused anymore.
Katzian as it sounds, I prefer "geek" as a replacement for the tarnished term "hacker." It conveys the same sense of fixity and focus on a subject to the exclusion of other things.
--saint
(who can't program too well.)
From
password-protected source downloads
is a bit silly?
Sheesh, I just wanted to see what their spam.txt was.
and if you're an IEEE member you get an additional 5% discount. :) I have edition 1 already. I ordered Hacking Linux Exposed and Hacking Exposed: Network Security Secrets & Solutions edition 2 earlier this week. Excellent books.
they've got links to the major online booksellers that sell it here
Another good book in the same vein is "Maximum Linux Security" by Anonymous (ISBN: 0672316706 ). Lots of good, concrete desciptions of potential security holes, guides to using a variety of tools, etc.
** The opinions expressed here are my own, and do not reflect those of my employers - past, present, or future**
Take a look at Bookpool, this book is going for $24.95 there, rather than the $31.95 from Fatbrain.
I am not associated with Bookpool. I like to save money. So do others. Bookpool is cheaper. Their service is also excellent.
There is a steady flow of exploits from almost all platforms. It is quite misleading to treat non-Windows systems as monolithic -- or Windows even for that matter, they are composed of many subsystems which from time to time contain exploits.
Linux, FreeBSD, HPUX, IRIX and the rest have heaps of explits out in the wild. Sure patches are developed, but there are quite a few lame users that just install *nix off the CD, just like they do with Windows.
Please, please, please be more objective!
I am not a robot. I am a unicorn.
You geek morons want to tell us all that code is art and speech and should be protected, but god forbid that anyone ever express themself in a manner that offends YOU. Apparently you don't understand what free speech is. You do NOT have the right to tell other people that their chosen form of expression is morally wrong. YOU are the one who is at fault, and it is YOU who needs to examine your attitudes towards others.
Furthermore, I suspect strongly that your closing insults are a case of you projecting your own feelings of inadequacy onto others as a means of maintaining the state of denial in which you live.
Your post implies that you actually want to hear what slashdot has to say about fixing security problems. I can't imagine a forum less suited to this task. Slashdot readers mix incompetence with egotism. Reading what they have to say on any matter is non-productive. If you think you are learning anything here, you need to seek medical help. There is no real difference between reading what a slashbot thinks about security and reading what a slashbot thinks about goatsex.
It already exists. At least amazon says it does.
2 3/ qid=1001196177/sr=1-1/ref=sr_1_3_1/002-2092565-984 9639
http://www.amazon.com/exec/obidos/ASIN/00721926