Slashdot Mirror
Hack Attacks Revealed, Second Edition
The first edition instigated quite a bit of controversy with some glaring errata and misconstrued statements, and the author claims to have alleviated them as well as accommodating critiques:
The primary difference between this second edition and the original Hack Attacks Revealed, aside from some rectified errata, is approximately 300 pages of over 170 new exploits, advanced discovery techniques, malicious code coverage of Myparty, Goner, Sircam, BadTrans, Nimda, Code Red I/II and more, current vulnerabilities, advisories, and hacking labs with additional illustrations, and techniques for routers, operating systems (including Windows 2000/Pro and XP, Solaris, LINUX), and server software daemons. You'll also find a special chapter dedicated to the Top 75 Hack Attacks.This book promises quite a bit in a new edition; let's see what's really in here ...
To accommodate the new material, most of the extraneous information, lists, and most source code was moved from the book to the CD-ROM. In addition to the new material, you'll find a special single license release of the internetworking security toolkit, TigerSuite Pro 3.5. This kit contains modules to discover, scan, penetrate, expose, control, spy, flood, spoof, sniff, infect, report, monitor, and more, plus a special 60-page usage and user guide.'
Okay, there are 914 pages (only about 15 or so with source code this time) and the chapter layout is completely different as the book starts with a Technology section, followed by Discovery, then Penetration, Vulnerabilities, and finally the Toolbox.
The technology section is nicely abridged to about 87 pages. The Discovery part differs greatly in that the source code has been moved to the CD and the author has added more coverage and examples, plus some stealthier techniques and more recent
SNMP, file sharing, DNS, NetBIOS, and CGI stuff. The ports and services sections are still there but I found them to be pretty handy references at any rate. Also, the Penetration section now contains updated material; it's nice to see IDS stuff added in here too.
In addition, the Vulnerabilities section is promising. There's an excellent
chapter in which Chirillo identifies what he considers the top 75 exploits -- examples that have certainly proven to be persistent examples of security weaknesses -- and the newer material especially makes this chapter significant. It contains thorough coverage as well as countermeasures for the listed exploits.
The CD contains some of the same plus full licensed software, an updated repository and all of the source code moved from the original text.
All things considered, Wiley should have waited and released this first; this book pans out to be more of an original than a second edition and well worth the read.
You can purchase Hack Attacks Revealed, 2nd Edition from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The best I've seen was a worm that propogated using a vulnerability in Red Hat Linux 5 systems. When it arrived it opened up a mail relay and started forwarding spam, as well as spawning new copies of itself.
This was a few years ago, before most of the Outhouse Exposed mail worms arrived, so the idea of worms sending spams was new and, uhmm, exciting.
I found the review to be interesting but a bit short in terms of details. The top 75 exploits almost seem worth the price of admission on this book though.
./ land have really been hacked?
However, this brings up a really good question.
How many of the folks out there in
How did you recover?
ACK
To accommodate the new material, most of the extraneous information, lists, and most source code was moved from the book to the CD-ROM. In addition to the new material, you'll find a special single license release of the internetworking security toolkit, TigerSuite Pro 3.5. This kit contains modules to discover, scan, penetrate, expose, control, spy, flood, spoof, sniff, infect, report, monitor, and more, plus a special 60-page usage and user guide.'
in other news... script kiddies on the rise....
Selling software wont make you money, selling a service will.
Did you actually even read the supposed leaked email?
Let me give you some advice.
Firstly, The Register, as a work of literature, is about on par with supermarket tabloids that write about Madonna consulting with alien lifeforms and Elvis' 400th citing outside a Taco Bell in Modesta, California. It's generally 50% drivel and 50% wrong.
Secondly, if you actually read the supposed leaked NSA email, you'll see things such as European style dates (28-02-2003 instead of the America way of putting the month then date then year). Also, British spellings of works like "recognised" and "organised" just simply aren't used here in America. We use the letter "z" instead of "s" in most cases.
I mean, I realize you're trolling hoping to stir up controversy, but I get a little sick of 24/7/365 anti-American bullshit that I read on every liberal-slanted "news" show, magazine, and website.
Background: 28/M/Bi-Sexual; Owner of a Linux company; MBA Harvard 2003; B.S. Comp Sci MIT 2000
You make it sound as though through sheer brainpower these MIT geeks were able to find out info about the phone network.
Please.
I know university is a cult and that it's a knee-jerk reaction to think that MIT students are nearly god-like, but please.
It's mostly through dumpster diving and social engineering that the phone networks got hacked. And fortuitous occurences, like that billing machine tape on the cover of that magazine.
See? YOU try to find out on your own what the hell I'm talking about. Not possible. You have to ask someone.
Please, enough with the MIT students are god bullshit. Have you LOOKED at what these monkeys consider work over there?
One of my previous companies had been hacked several times. Each of those times, we discovered the remnants of a script kiddie "root kit", and an irc server. At the time, what I did was search the net for the root kit (which was quite easy to find) and learned as much about the kit as I could. Once I did that, it was much easier to shield against further attacks. It was also fun to "bug" the irc server and watch what the idiots were doing ;-).
Very popular slashdot journal for adul
I'm suprised that this (and other books like it) haven't been beaten down by the DMCA. I would have thought that giving specific information on hacking a Microsoft O/S would piss MS off, and I'm sure that there is at least one example in the book where the hacking involves decryption of some sort. Isn't that bypassing a security measure, and therefore against the DMCA, or does the DMCA only matter when the point of the attack is to duplicate a copyrighted work?
When I was brand new to Linux (Mid '97), I was 0wned by a script kiddie. Here's what happened:
... I tried to change to .. and, of course, was changed to the parent directory. After I changed back I did a long directory listing and saw that the directory was actually ".. ". After puzzling over how to get into the directory, rather than up to the parent, I realized I could put quotes around it and I cd'd into it. The contents were very interesting.
:) I of course killed the bots and removed the eggdrop software. Then I checked out the ftp exploit. This was obviously how the user had gotten into the system. I'm not sure why he uploaded the exploit code to my box. Perhaps so he could 0wn other systems from our server? Probably. In any case, the code was written by a guy known as "wile coyote" (I just googled and couldn't find the exploit). I don't know the details of how the code worked; I think it exploited a SITE EXEC vulnerability. In any case, I saw that the code was written for the version of Wu-FTP that I was running. I e-mailed "wile" and he replied telling me that the code only worked for wu's that were "poorly configured =p". Hehe. I knew I wasn't any good so I just laughed :).
/etc/inetd.conf. I had no idea! At this point I decided I couldn't know what else he had done. I decided to redo the system (with a focus on security this time). I learned my lesson and now I know a great deal more about securing a network. I don't run wu-ftp anymore :)
I had a Red Hat 6.0 box running 2.2.12. I was running Apache, Sendmail, wu-ftpd (2.6?) and bind, as well as all the default services that were running on a stock Red Hat box (all the RPC stuff, portmap and such). I was poking around on my system one day and I saw a user that I didn't create. The name was interesting (can't remember exactly what it was) so I decided to check it out. I first shutdown the gateway interface so the user was disconnected (this wasn't a big deal at the very small business that I worked for at the time). I went into his home directory and didn't see anything obvious - at first. After giving it a second glance I saw two directories with the title
The contents were very interesting. There were two items of interest - an eggdrop IRC bot and the code for a wu-ftpd exploit. I knew I had been 0wned and called up a friend who was familiar with Unix. He showed me how to check what services were running. The eggdrop had spawned about 8 processes that were connecting to various IRC networks and were advertising warez/pr0n ftp sites! It was interesting logging into an IRC channel and seeing a bot running off of MY hardware
I thought I had cleaned up the mess after I'd removed the user, the exploit, and patched wu. I was wrong. I had been foolish and hadn't run a port scan. After a week or so I saw another user on my system that I wasn't aware of! Same deal as before; running eggdrop code, this time no exploit. I killed the user and asked some local guru's about what to do. One of them introduced me to nmap. After running it (and seeing many, many unessential services wide open), there was a very interesting one: a bash shell exposed to some high port (~50000). I telnetted to the port and I was r00t, just like that. No password authentication or anything (who knows the command to do this?). The guru helped me find where the exploit was. The guy had left a backdoor for himself in
Ben
"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
I got egg on my face when I took my laptop with shiny new wireless nic to H2K2 last summer. They had a NOC with both wired and 802.11b networks where I met up with some PSU alums.
Within a matter of minutes, my laptops caps/num lock lights flashed and the machine shut down. Turns out that sendmail (which I left on like a dumbass) was overflowed to a root console, where the leet script kiddy typed halt to shut off my laptop.
Wasn't an all-out attack, but a lesson learned. Now I'm much more consciencious about keeping rpms up to date and keeping unnecessary services from running.
Where does the school board find them and why do they keep sending them to ME?
Clearly Chrillo is keeeping bad reviews out of amazon and probably the other online bookstores, and spamming with hundreds of fake ones. I will never buy his books again, and I'm ashamed of Wiley for publishing second editions. I brought this up to them and they promised to investigate, and I never heard another thing.
I did look at hack attacks rev #2 in the store, and it's still pretty crappy. I can understand the media folks not taking a fine toothed comb to the books, so while I can be sure Carmadara's review was legit, it's still pretty innacurate.
I worked for a small academic department within a large teaching hospital. We had been running Solaris using NFS for file sharing between Win 3.1 clients (With PCNFS client software). At the time, we were migrating to Win95 and it didn't have built in NFS support, and I couldnt get that iteration of Samba to work on our solaris box. I wanted to save money from buying client software for the new Win95 boxes.
Long story short, I had two 486's running RedHat (5.0 I think) with the Solaris NFS shares exported to the RedHat boxes, then those shares exported as SMB shares to the Win boxes. This was my first experience with Redhat, and I had no real background in IS. Our boxes sat behind the hospital firewall, and I didnt think there was a problem with internal hacking. So i basically had the box wide open to internal threats.
I was leaving my job and we were in the process of hiring a new part time IS person for the department. Posted an ad through a local linux users group, and interviewed a potential, qualified candidate. Unfortunately, the candidate was from Canada and not a US citizen. This posed a problem cause my job was funded through the UAW (United AutoWorkers union) and the position had to go to a US citizen. We told this to the candidate and he was not hired.
About 3 weeks later, the hospital was hit with a substatial DOS attack necessitating the entire hospital network being shutdown. When it was traced, it was coming from inside the hospital, and yes, from one of my RedHat boxes. It turned out the hospital IS dept. had left some backdoors in through the firewall. The hacker had used that hole to get access to the hospital network, then finally once in, my unprotected Redhat boxes were prime pickings.
We certainly never could prove anything, but I certainly had my suspicions about the culprit. Fortunately, at a team meeting of dept. heads and and IS people, as they tried to blame our dept, it came out that these backdoors had been purposefully left in the firewall, and IS had held shared responsibility.
It was not pleasant as there were substantial numbers of staff (doctors included) trying to access the hospital network from home who couldn't get in for an entire weekend as the hospital network had to be taken offline.
Well, the windows stuff is pretty lame. It has lots of pages dedicated to it, but mostly describes things that were old before they started compiling (not writing) the book.
The linux part is laughable. Lists of cracks that are worthless on any machine that was installed in the last five years. Does anyone run WU-FTPD from before 1995 now? I don't think so. Why waste the space? Besides, we want to understand how to hack/crack systems, not how to run an outdated exploit. If he took time to teach how an exploit worked, that'd be one thing, but as is this book is really really lame on the unix side. THe windows readers probably don't care, since they'd best be able to be script kiddies anyway.
My recomendations are as follows:
Hacking Linux Exposed second edition for all thing Linux/Unix. Can't be beat.
Hacking Windows 2000 Exposed. Do not get Hacking exposed, it tries to cover everything, and does them all poorly. The Windows 2000 edition is the only one you should get if you need windows information. (Applies to older and XP also in many cases.)
Hack Proofing your Network, edited by Blue Boar. Covers many of the same topics of the two books above, but by different experts. Multiple voices is good...
Any of the SANS books put out by NewRiders, most of which are written in part by Steven Northcutt. Lots of IDS and security titles by that publisher.
And you can't go wrong with Building Internet Firewalls, now out in a second edition.
I'd recommend any of the books above - they are accurate, informaaive, and either up to date or timeless. Any of these is worth 500 copies of Hack Attacks Revealed.
I bought it when I was new to Linux and trying to learn a bit about security.
::Shrug:: I threw away the CD and got better books to read.
I was looking at the source CD when my virus scanner on my NT box went off. Turns out one of the password cracking utilities he had on the CD was a trojan.
All I wanted was a rock to wind a piece of string around, and I ended up with the biggest ball of twine in Minnesota
I had this book in my car, sitting on the panel above the backseats near the rear window, when a police officer stopped me. Granted my car was somewhat messy at the time (I was moving so it was full of boxes). The officer stopped me for a brake light, and decided that the book was probable enough cause to search my car. I laughed, said sure and let him go at it (I had nothing to hide). Ignorance, can be quite funny sometimes.
For a bit over two months I tracked the reviews at Amazon (October 3 - Dec 10) and found the following:
- Every time a negative review was posted, three to five 5 star reviews were posted in the next two days. This effectively removed the negative review from the first page of reviews.
- Negative reviews were purged from the list within a week 70% of the time. Another 5% were purged within the following week, and after that messages tended to stay around.
- Positive reviews were also purged, at a rate of 5% the first two weeks, seldom thereafter.
- Any review with 3 or less stars had a purge likelyhood of 95% within the first two weeks.
- On separate occasions there were 5-star reviews that were clearly fake because:
- The same review was posted on the same day by different names
- The same review was posted days later by different names
- Reviews were posted that simply copied the front or back cover text of the book
- Posts by non-existant people claiming to know Chrillo's computer prowess
- And some that were likely fake but not guarenteed:
- Posts to HAR and HAD that had the exact same text but changed the book title, even though the two books were very different.
- Reviewers who gave HAR praise and gave 1 star reviews to multiple HAR competitors using the same text that could have applied to any book, even those not related to security at all.
- Multiple reviews in one day by different names that all lived in the same city (probably an error in the review-spamming script)
Read that again - 95% of the negative reviews were removed from the Amazon reviews. Can you really trust what's up there now? Do you want to buy a book by an author who astroturfs, rather than taking the time to write something good?Yes, I have a copy of the Second edition. I read every page. I politely dissagree with anyone in this forum who says some miraculous change has occured. (And I suspect several are Chirllo in disguise.) HAR is still full of errors, repetition, unneeded screen shots, age old hacks, and can't explain what any of these technologies do and how you can use them either as a white or black hat. Go out and buy any other hacking book and you're better off.
And yes, I wrote a well worded review for Amazon, and they took it off the site, no explanation available.