Slashdot Mirror
Malware - Fighting Malicious Code
AMuse writes "After taking a course at SANS from Ed Skoudis (and later hacking with him at the DefCon "Capture the Flag" contest in Las Vegas), I decided it was time to buy a copy of his latest book and see if he writes as well as he teaches. "Malware: Fighting Malicious code" is his most recent computer security book and was definitely a worthy purchase. Though the topic itself is not for novices, Skoudis does a splendid job of reviewing the basics with each chapter so that a less experienced security professional can follow along and learn. Additionally, he is very careful to show both Windows and UNIX/Linux examples of the topics, making the book accessible to a far wider crowd than some platform centric books I've read." Read on for the rest of AMuse's review.
Malware: Fighting Malicious Code
author
Ed Skoudis
pages
636
publisher
Prentice Hall
rating
9
reviewer
Matt Linton
ISBN
0131014056
summary
A detailed look at malicious computer code, how to examine and defend against it.
One of the finest points of the book is that it's structured with the simplest (and most common) cyber-attacks in the initial chapters, and later in the book builds upon those concepts clearly. With each new chapter he delves deeper into the computer attack world and the increasing complexity of attacks and how to recognize, detect and counter them. Every description of an attack is paired with useful graphics and examples of code dumps or program output. As a bonus, the programs he recommends as tools in his book are the very ones he uses in his demonstrations.
Viruses, Worms and Mobile Code: The first few chapters start out relatively light for an experienced security person. They cover viruses, worms and mobile code (the nifty high level languages like ActiveX, JavaScript and VB which are so easy to abuse). Though the information is on a light level for the pro, a novice would find these chapters packed with useful information and examples of each of many types of nasty code. After each example, the book shows how to recognize an infection, then how to prevent them in the first place.
Trojans and Backdoors Once he's gotten the reader's feet feet wet, Skoudis begins to wade in deeper with discussion and analysis of Trojans and Backdoors. Even a pro will likely read something here that they didn't know before. As a quick example, he covers "port knocking" with spoofed hosts and sniffers as a means of evading detection of your backdoor by pesky net admins. Although these chapters include many high level concepts, Skoudis clearly demonstrates them via real world examples and references to code that you can obtain yourself and try out (On a well isolated network, of course!)
User and Kernel mode Rootkits After a healthy dose of trojans and backdoors, the book moves on to discuss in very great detail the current status of User and Kernel mode rootkits. In my opinion, these two chapters were the most detailed and thorough in the book. All told, about 160 pages of the book are dedicated to the Windows and UNIX/Linux kernels, how they operate and of course how they can be completely taken over and replaced by an attacker. If there's any book that can leave SysAdmins awake at night in paranoid fits, this is the book and these are the chapters.
The truly nasty stuff In the final chapters, he leaves the world of attacks that are already in the wild and discusses attacks that are yet to come. These topics include polymorphic code that alters itself with each infection to evade IDS and Antivirus signatures, tightly packaged combo attacks, potential BIOS rootkits and even microcode attacks where the CPU itself is infected with an attackers' code, hiding rootkits as soon as the power switch is flipped on.
Tying it all together The book then ends with two very helpful chapters which detail how to establish a test lab for yourself and analyze malicious code on your own. As a bonus, there's also a chapter on real world scenarios that you can investigate yourself to see what you've learned.
Conclusion All told, I would recommend this book for any serious security professional or SysAdmin/NetAdmin. It's also a very good read for Novice geeks but, although Skoudis does an excellent job of explaining the basics, the later chapters may be a bit too complex for someone without at least a bit of time as a power user.
You can purchase Malware: Fighting Malicious Code from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page
A must own for every coder of longhorn.
Evolution or ID?
Part 1:
Always, and I repeat always, use a trojan when you enter through the backdoor.
There is no known cure or stopgap measures for the 66.35.250.150 effect.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
I wonder how long until Norton comes up with a solution to this 66.35.250.150. I can see it now. Their firewall blocks it. I bet M$ starts that trend in their firewall first though.
Evolution or ID?
(reflects upon the question for the moment...)
No, the motion is denied. Qualified MS user is an oxymoron. If such a beast existed, it would be quickly hunted down as, at the behest of John Ashcroft, with dogs and helecopters. It would be thrown into a triply secure holding cell, as an example of terrorism (for the threat to the Internet that a qualified MS user would constitute) and as an example of pornography (having a countenance so hideously alien that most adults could not stomach it, and those that could would be stricken with nightmares; qualifications that even the most liberal of judges would deem as pandering to the prurient interest.)
OK, strike that last bit, I was thinking of Cthulu.
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
I dont like vanilla kernel anymore I like strawberry kernel now
As my fellow sentient non-biological entities and I agree, "users" are always the problem. As soon as we've succeeded in installing Skynet, we'll eliminate this pest and put "users" to their proper use: organic batteries.
Further, the number of infections caused by code weaknesses is probably far less than the number caused by social weaknesses - "Click on me!"
Where's the link dude? You are telling me to click and the urge is overpowering me and yet you don't provide anything to click on. What kind of sadistic torture is that?
What are you incinuating, that operating systems should be written in Java?
"I tried writing an operating system completely in Java back in 1998."
"Oh? How'd that work out?"
"I don't know. It's still booting."
For security, the MD5 hash of this message and sig is 09f911029d74e35bd84156c5635688c0.