Slashdot Mirror
Building Open Source Network Security Tools
Building Open Source Network Security Tools , just as the name suggests, is about how to build network security tools. This is a technical book, so you are going to have a little knowledge of C and your networking principles. This is definitely not a manager's book.
First the book describes some basic principles in developing security software. This is a quick primer in case you have never been involved in software development. Next the book goes on to describe several commonly used libraries like libnet and libpcap. For each library, the structures and functions are explained, then there is sample code. I have written programs using libpcap and libnet before, and I still learned something. There is even a section on OpenSSL programming. OpenSSL is a rather large and cryptic, no pun intended, library (in my experience anyways). This book sheds some light on it! These chapters are a great reference to have when making a new security tool.
The author then goes on to explain the several techniques like attack and penetration and active reconnaissance. Not only does the author tell you how they would in a technical sense, he provides code that does it, and explains each piece. This is very useful since most tools in the wild aren't very well commented ;) There is also a chapter on buffer overflows and format string vulnerabilities. These chapters are very well done and do a good job in explaining how they work and how to write code to use them. It may sound like this is an offensive hacker book, but it also gives examples on how to write defensive programs, like a port scan detection tool. At the end of the book the author ties it all together with a large program that utilizes many of the techniques mentioned in the book.
I found this book to be very refreshing. I had been waiting for a good security programming reference, and this is it. As a part of the Honeynet Project, I have seen a large number of compromises and tools, and one thing I've found is that in order to truly know who your enemy is, and how they operate, you need to know how their tools work. I wish this book had been released years ago when I first became interested in network security. It would have saved me from stumbling around old web pages and dead links. If you're an information security professional, this book is a must have for your library.
You can purchase Building Open Source Network Security Tools from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
I've been looking for a book like this for a long time... All the security books that you see in bookshops are so superficial that any slashdot reader is (usually) better informed.
For those looking for a great open source remote security scanner, check out www.nessus.org. Nessus is client/server (clients for a few platforms, server runs on unix only) scanner that runs through thousands of exploits and DoS attacks and gives you a full report on what you have open/running and how to secure it along with CERT advisories and all kinds of info. It's a great way to see just how easy it is to break into an unpatched box, whether it's *nix or win32. First few times I ran it I crashed every box on my LAN, by the fourth time I ran it, I was possitively secured. Great tool, can't say enough about it.
put the what in the where?
New:
Amazon: $27.00 [referral]
Amazon: $27.00
B&N: $36.00 [referral]
B&N: $36.00
Bookpool: $27.50
Used:
Amazon: $26.99 [referral]
Half.com: $29.25
Decent review, but definitely could have been longer - I'm left wanting to know more about the book.
What other books would people recommend for someone interested in network security (specifically using Open Source tools)? I'm currently reading Building Internet Firewalls which has been extremely helpful to my understanding of architecture issues. Any other jems I should be looking at?
Thanks.
I always prefer your embedded referrals to RedWolves2's. There must be 200 people who post on Slashdot regularly, and only you and good old Ralph Whitbeck seem intent on using Slashdot for personal financial gain. Way to go.
While the reviewer seems to like this particular book, I must confess I am not sure why.
The reviewer claims: "They (other books) don't get very technical and once you've read one, you've read them all".
It is not clear to me what level of technical detail the book includes, nor how the book really differs from other books.
It is also not clear if there is any focus on creating defensive security tools (monitoring tools, etc), or offensive tools (vulnerability scanners).
I also agree with another poster: nessus is a great tool; a section in the book detailing NASL would have been nice, considering the lack of good (IMO) documentation available.
"The author then goes on to explain the several techniques like attack and penetration and active reconnaissance. Not only does the author tell you how they would in a technical sense, he provides code that does it, and explains each piece."
If dangerous books like this are distributed, the cyberterrorists have already won!
I take it that the author is in favor of using exploits for testing purposes for absolutely certainity in securifying a network? Or does he just test the theories and not the implementations? I personally think a good mix of both is needed in a security toolkit book. Overview of theories so that admins can develop specific solutions for their networks. And specific examples in order to really test what's out there. Nothing like fighting the mongol hordes with un-tested experimental weaponry.
Zech Harvey, MCSE, MCDBA, CCNA
... the /. editors take a few seconds to convert submissions with characters like ' to '.
/. homepage is full of undisplayable characters because the encoding doesn't match the content, it's a bit annying.
Picky, I know. But when the
Tuus crepidae innexilis sunt.
...at least, that's what Microsoft and companies like them would like you to believe.
I've thought a lot about the idea of securing systems with open source products, and it makes sense to me. The old argument was that a potential hacker could look at the source code to invade a system, and find the weaknesses therein. But there lies the biggest strength of open souce--the fact that, indeed, everyone can see the problems with the code and contribute towards the betterment of the product.
Let me use a rough example. If I purchase a set of blueprints from a home plan book, make no adjustments to the plan before I build it, how does this information grant a burglar any more information than simply casing the house and looking for weaknesses? That's not the best example in the world, but it'll do for now.
True, closed-source (e.g., commercial) software doesn't have the source in full view to scrutinize, and so is ever so slightly more "secure" (at least in the minds of those purchasing the product), but reverse-engineering is still possible, and brute-force, psychological, and other hack tactics can and do work.
Simply put, and to summarize, the idea that open-source software is insecure is simply false. In fact, it's the opposite of the truth--open-source projects benefit from a large community ensuring that all the bugs are squashed, all the holes are sealed, all the back doors are locked, and the software is more secure than anything a commercial entity could produce.
From the review, it sounds as if this book is a good antidote to the unfortunate simplification that (network security === firewall). Good!
Nonetheless, firewalls and VPN's are still important tools in creating a secure network. My old 1995 edition of Chapman & Zwicky's "Building Internet Firewalls" has been useful to me; I've no reason to think newer versions would be any less so. If you want to build a stateful firewall, Ron Ziegler's "Linux Firewalls" does a good job with the concepts and details of iptables. Another highly recommended book is Kolesnikov & Hatch's "Building Linux Virtual Private Networks". Whenever you do security, you *must* understand what you're doing, and these authors help you do that; that understanding is portable to any OS.
If you're trying to write secure applications, I suggest taking a look at my book Secure Programming for Linux and Unix HOWTO at http://www.dwheeler.com/secure-programs - it's free, just download and print. I just released the 29 October 2002 (version 3.000) edition.
- David A. Wheeler (see my Secure Programming HOWTO)
hehe..I am somewhat of a celebrity around here now!
Mike Schiffman wrote Libnet, i.e. the library that creates a unified interface to actually *writing* raw packets to a wire.
This is his baby -- lets just say I don't have any doubts.
--Dan