Slashdot Mirror
Exploiting Software
What kind of secure are you after? There are many published titles on the topic of software security are numerous, but most of them follow certain patterns. Building Secure Software by Viega and McGraw was mainly concerned with proper techniques and general software engineering mindset without going into specifics. Then there was Writing Secure Code , by Howard and LeBlanc, which provided concrete examples and showed the "right way" to do secure coding. I heard the title instantly became a required reading at world's largest software corporation. It's currently in its second edition.
Secure Programming Cookbook for C/C++ by Viega and Messier, was the hands-on title for those developing C/C++ application with security in mind, as the cookbook recipes generally gave examples of good code, with each chapter providing some general background information on the topic discussed (I reviewed it on Slashdot in September last year).
Just in case you were wondering, the list above wasn't just retrieved by a quick search at Amazon. My Master's degree, completed last summer, dealt with the topic of software security, and those are the titles I've read preparing to write the theoretical part.
From the other side With the variety of books on how to write secure software, and what techniques to use to make existing software more secure, there was a niche for a book targeted specifically to those who wanted to break software. Black hat or white hat, the network security experts always had titles like Hacking Exposed to give them an idea of what was available in terms of techniques and methodologies used out there. For software security most of the articles and books generally would tell you something in the terms "do not use strcpy(), as it introduces buffer overruns".
Great, so I won't use strcpy(), did it make my application more secure? Is it more or less hack-proof? What if I am a tester and required to play with this aspect of the application to ensure the application's security before the product ships? Theoretically hanging out at proper IRC rooms and getting lifetime Phrack and 2600 subscriptions should be enough to cover you at the beginning, however, the learning curve here leaves much to be desired, let alone the fact you will probably be kicked out of the IRC rooms for asking n00b questions. Another path would be to take an expensive training course by someone with a name in the industry, but the price tag for those generally leaves out self-learners and those operating on limited budgets, which adds up to about 99% of software engineers and testers out there.
Exploiting Software to the rescue.
Exploiting Software fills the void that existed in this market. Eight chapters take you through the basics and some advanced techniques of attacking software applications with the purpose of executing arbitrary code supplied by an attacker (you).
The book mainly deals with Windows applications for x86 platforms, and some knowledge of C/C++ and Win32 API is required to go through the example applications. To automate some processes and demonstrate possible attacks the authors use Perl, so knowledge of that would help the reader, too. Some chapters, (e.g. the buffer overflow one) show disassembler output, and while you're not expected to read x86 ASM code as if it were English, knowledge of how the registers work and how the subprocedure calls are handled on this Intel architecture are required. After all, if potential attackers know it, you better familiarize yourself with some low-level code, too.
While discussing various possible attacks, the authors post different attack patterns. The patterns themselves usually appear in gray textboxes and talk about the possible exploit in general terms. After that, a series of attack examples follow, with specific descriptions on what can be done, and how. For example, the attack pattern on page 165 is titled "Leverage executable code in non-executable files." The following attack example is "Executable fonts," and it talks how the font files are generally treated by the Windows systems (they are a special form of DLLs). Thus it's possible to embed some executable code into a font library you're creating, for which the authors provide an example in Microsoft Visual Studio.
What's cool is that all the attack patterns are listed in a separate table of contents (alas, not on the Web site table of contents, which just lists the chapters and subchapters), so you can browse to the attack pattern you decide to learn about, read some general info about it and then study specific examples. The examples themselves are not in the table of contents, which I think is a mistake, as it would make searching for possible patterns much easier. After all, how are you supposed to know that "Informix database file system" (p. 189) is under "Relative path traversal" pattern? Well, unless you know specifically that the line http://[Informix database host]/ifx/?LO=../../../etc/ is the one discussed in the example, you would have to either go through the index hoping no omissions were made, or read the chapter in its entirety.
One of the best chapters of the book, Reverse Engineering and Program Understanding, which provides a good introduction into techniques used throughout the book, is available online from Addison Wesley. By having a free chapter you already have 1/8th of the book, but don't think that the low number of chapters makes this 512-page title an introductory book.
Target Audience
Looks like there are two major audiences and reading patterns for this book: those wanting to fix their systems ASAP and thus using Exploiting Software as a reference, and those using it as a text book to learn about security. I've discussed the organization of the book above, and the reference types will probably be more interested in patterns and examples. For a casual reader (although casual readers wouldn't generally pick up a title with C++, Perl, ASM and hex dumps spread around the chapters) this is a book with great educational value, from two authors who have discovered numerous security vulnerabilities themselves.
Exploiting Software is not an easy title to read. Addison-Wesley shipped me the manuscript copy a month before it hit the bookshelves in its final version, and I found myself going through about two pages an hour. The authors bring up sometimes unfamiliar Win32 APIs and occasionally use ready-made tools available on the Web, so generally I found myself visiting MSDN and Google a lot to read through available documentation and download the latest version of the tools used. The book doesn't come with a CD. Some of the stuff, like inserting a malicious BGP packet to exploit a Cisco router (p. 281) is not really testable at home, and I have some reservations about verifying the example with my employer's routers.
The book is probably apt for 2nd or 3rd year computer science students and above. Besides the variety of languages that I mentioned above, you need to be familiar with the basics of Intel architecture, and generally be fluent with terminology like "buffer," "stack," "syscall," "rootkit," etc., as this is not an "Introduction to..." title. From my experience, you probably won't read it from page 1 to page 512 understanding everything perfectly, but for anyone interested in security and those making a career in software development it looks like a bookshelf must-have.
I interviewed Gary McGraw on the current state of software security, the relevance of the topic to the issues beyond C/C++ and improper buffer usage, and future directions in security. Network World magazine also ran an interview with the McGraw in which he talks about the reception of the book at the RSA Conference, whether the economics is right to invest in building secure systems, and whether his book does more harm by providing a compendium of known exploits.
Alex has written numerous reviews of other software and security titles. You can read more of his opinions at his Web site. You can purchase Exploiting Software: How to Break Code from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
***Here are some of the imdb.com reviews for "Gay Niggers From Outer Space":
p hp
Summary: The best homosexual racial minority sci-fi film ever.
"Morten Lindbergs classic cult short, Gay Niggers From Outer Space is one of
the first short films to really stick to what the title suggests. From the
time the first gay nigger walked onto the screen up until the final intense
climax with the Tourette's Syndrome Kingdom in Outer Space, it's filled with
dark comedy, action and plenty of suspense. "
"Gay Niggers from Outer Space is a masterpiece of a film. No other film
portraits emotions as majestically and stunningly since The Legend of Nigger
Charley and Home Alone II. With a cast of all-star African niggers and a
director with Kubrick potential, it is no wonder that Gay Niggers from Outer
Space is marked the greatest film of all time."
"From the very first scene where Gay Nigger Harris throws up on his own face
and commits suicide, to the climactic scene where Nigger Ralph Nader and
Nigger Humphrey Bogart fight over the last hashbrown and pick cotton til
their noses bleed, Gay Niggers from Outer Space is the most magical
portrayal of gay niggers open to the public."
***However, no mention is made of the hazadous lifestyle of gay niggers,
so the following is an attempt to explain those hazards in layman's terms:
Despite cries to the contrary in the media, AIDS is still primarily a gay
and black disease. The media loves to report the "growing epidemic" among
whites, when in fact the rate of infection among heterosexual whites is
dropping off significantly year by year. The media though, reports only the
TOTAL current infection rate, not the RELATIVE. So while there are more
cases each year, the RATE of infection is dropping quickly. Except for the
gay/nigger communities, where it's skyrocketing.
Why does AIDS seem to target gays and niggers so much more so than whites
and straights? Anal sex. The anus was not designed to accommodate vigorous
penetration as occurs in anal sex. Unlike the vagina, the anus has very
delicate membranes, which damage easily. Couple that with the fact that
sperm contains immune system suppressing chemicals. That's why the sperm is
not treated as a foreign protein in the vagina...because of the immune
suppressing effects of the sperm cells. Without this effect, pregnancy
could not occur, as the sperm would be attacked as a foreign protein.
In the anus, sperm has the same immune suppressing effect. During anal sex,
the anal wall is torn and open lesions form. Because there is little if any
sensory nerve endings in the anus, this damage often goes unnoticed. The
sperm then induce their immune suppressing effect, and the stage is set.
Various bacteria both beneficial and infectious dwell in the colon, as well
as viral matter. When the anus is ripped open, exposing the blood to the
immune suppressing chemicals in the sperm, and the viral matter passed
along with it, infection is virtually assured.
***So does the skyrocketing rate of AIDS infection mean that there are
skyrocketing rates of gay niggers???
***Not exactly, because most White people don't realize that a large
percentage of nigger males are bisexual. It's a great irony considering all
of their macho posturing and affectations. They tend to admire the male
physique, and when no women are present, they will hip-hop dance with each
other. Any port in a storm will do, because da' brotha's just gots ta
have it!!! Then they pass along the virus to their wives, girlfriends, and
family members.
***Here is a story about this phenomenon from "The Village Voice":
http://www.villagevoice.com/issues/0123/wright.
And for the Toronto Gay Niggers:
Please close your Italics tag.
rimjob on teh spoke? what does that mean exactly? anyone? help?
+-+-+-+ +-+-+-+ +-+-+-+
|Y|o|u| |A|r|e| |G|a|y|
+-+-+-+ +-+-+-+ +-+-+-+
Looks like you forgot a closing tag...
</i>
This just in... the user "GneccoBoy" at The Network Ministry of Disinformation is a supporter of SCO.
Hello? An AC claiming to work with the author? First post?
Quel naive.
Editors - please fix the non-closed italic tag in the entry so the front page of the site doesn't show up in all italics. Thanks :)
Introduction
Electrons in germanium are confined to well-defined energy bands that are separated by "forbidden regions" of zero charge-carrier density. You can read about it yourself if you want to, although I don't recommend it. You'll have to wade through an obtuse, convoluted discussion about considering an arbitrary number of non-coupled harmonic-oscillator potentials and taking limits and so on. The upshot is that if you heat up a sample of germanium, electrons will jump from a non-conductive energy band to a conductive one, thereby creating a measurable change in resistivity. This relation between temperature and resistivity can be shown to be exponential in certain temperature regimes by waving your hands and chanting "to first order".
Experiment procedure
I sifted through the box of germanium crystals and chose the one that appeared to be the least cracked. Then I soldered wires onto the crystal in the spots shown in figure 2b of Lab Handout 32. Do you have any idea how hard it is to solder wires to germanium? I'll tell you: real goddamn hard. The solder simply won't stick, and you can forget about getting any of the grad students in the solid state labs to help you out. Once the wires were in place, I attached them as appropriate to the second-rate equipment I scavenged from the back of the lab, none of which worked properly. I soon wised up and swiped replacements from the well-stocked research labs. This is how they treat undergrads around here: they give you broken tools and then don't understand why you don't get any results. In order to control the temperature of the germanium, I attached the crystal to a copper rod, the upper end of which was attached to a heating coil and the lower end of which was dipped in a thermos of liquid nitrogen. Midway through the project, the thermos began leaking. That's right: I pay a cool ten grand a quarter to come here, and yet they can't spare the five bucks to ensure that I have a working thermos.
Results
Check this shit out (Fig. 1). That's bonafide, 100%-real data, my friends. I took it myself over the course of two weeks. And this was not a leisurely two weeks, either; I busted my ass day and night in order to provide you with nothing but the best data possible. Now, let's look a bit more closely at this data, remembering that it is absolutely first-rate. Do you see the exponential dependence? I sure don't. I see a bunch of crap. Christ, this was such a waste of my time. Banking on my hopes that whoever grades this will just look at the pictures, I drew an exponential through my noise. I believe the apparent legitimacy is enhanced by the fact that I used a complicated computer program to make the fit. I understand this is the same process by which the top quark was discovered.
Conclusion
Going into physics was the biggest mistake of my life. I should've declared CS. I still wouldn't have any women, but at least I'd be rolling in cash
I just used a public toilet and there was shit on the fucking seat! I sat down in someone elses fucking shit!!
I'd rather exploit wetware.
The italics have invaded and taken over.
Looks like your closing tag can't handle it either, you ic!!
Nobody expects the Spanish Inquisition... O_o Nobody, I say!
"The interface is too cluttered! Hide file name extensions!"
r mation.html
A little OT rant - file extensions are a horrid beast which should never have been allowed to surface. The MacOS method is much better. In fact, computer designers really need to rethink metadata handling from the ground up. I did a short thinking exercise on this here:
http://www.eskimo.com/~johnnyb/computers/MetaInfo
Engineering and the Ultimate