Slashdot Mirror
Stealing the Network: How to Own an Identity
Scott Pinzon writes "Writing sonnets, screenplays, or an epic poem in your third language is a breeze compared to the toughest of art forms, didactic fiction. That might explain why the various chapters of Stealing the Network: How to Own an Identity range from appalling to exciting. Whether you see the glass of STN: Identity as half empty or half full depends on whether this is your cup of poison -- but on a technical level, it rocks." Read on for the rest of Pinzon's review.
Stealing the Network: How to Own an Identity
author
Raven Alder, Jay Beale, Riley "Caezar" Eller, Brian Hatch, Chris Hurley (Roamer), Jeff Moss, Ryan Russell, Tom Parker, Timothy Mullen, Johnny Long
pages
336
publisher
Syngress
rating
6
reviewer
Scott Pinzon
ISBN
1597490067
summary
Fiction that teaches about network security
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong. (My recent favorite is Jeffrey Deaver's jargon-in-a-blender paragraphs in The Blue Nowhere, where a computer expert can't break a hacker's defenses because "I can't decrypt his firewall!") But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
And these authors do have impeccable Internet security cred. Many of them are stars circling the firmament of Black Hat and Defcon; senior penetration testers; former consultants to No Such Agency; authors of popular books on security; and so on.
Thus, STN: Identity describes attacks with accuracy and depth. The light veneer of fiction gives the networking tips real-world context. (On this point, I agree with Blain Hilton, who reviewed the first STN volume for Slashdot.) Sure, you've heard of all kinds of hacker tools, but do you know exactly when an attacker would use, say, Metasploit Framework, and not Knoppix? Chris Hurley's chapter, "Saul on the Run," stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information.
Another stand-out chapter is Johnny "Google Hacker" Long's "Death by a Thousand Cuts." This rambling episode follows, in part, a forensic cop's efforts to make a disc image of an iPod found at a crime scene. The trouble is, Apple's drivers spring into action whenever the iPod senses it has connected to a computer. If the driver activity changes anything in the iPod, all evidence on it will be inadmissible in court. In unraveling this challenge, STN became so fascinating, I couldn't put it down. Which made showering awkward.
Brian Hatch's chapter, "Bl@ckTo\/\/3r," stood out to me, also, but for the opposite reason: almost all of it went over my head. I thought I had accepted Unix into my heart, but I'm not disciple enough to keep up with Hatch's treatise on X11. Where I thought Hatch was talking only to himself, I had a more senior network security expert read the chapter, and he considered it well written. YMMV.
Other chapters cover basic crypto and code-breaking; how to forge cards that will fool magnetic stripe readers; the dark side of biometric authentication; uses of a Faraday cage; making a QWERTY keyboard type Dvorak letters, and just lots and lots of good undergroundy badness. The technical lessons hold tightly to the stated theme of identity theft. Any network administrator could learn a lot about the enemy's techniques from this volume; and, because of the story-driven format, probably even remember them.
But I've been dodging my opening question: does the fiction part work? Before I answer, I should mention that I've written a lot of fiction. I've had four books of fiction and 60 short stories published, and studied under the editor who removed 500 pages from Stephen King's The Stand. I'm not saying I'm good at writing fiction; I'm just saying I respect the craft. So, can STNs authors write fiction? No. No, they cannot.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement") to characters with no feelings or personality. In Chapter 8, where college students decide to 0wn Hushmail's DNS servers for a man-in-the-middle attack, they work 36 hours straight without a smart remark, a crabby comeback, or, really, any dialog except ad hoc lectures on network architecture. Fiction-wise, it's as if Nancy Drew or the Hardy Boys tried hacking. And a couple of the chapters go so far past "wordy" that they're almost the verbal equivalent of running in place. If you're in a hurry to get to the technical meat [Jedi hand wave], these are not the authors you want. With that said, I admit that some of the chapters clamber all the way up to "adequate." But remember, fiction that teaches is hard for anyone to pull off.
Maybe none of that matters. Is anyone looking for deathless prose when picking up a book subtitled "How to Own an Identity"? Nah. What matters is, the various authors lay down some seriously tricky attacks. If you are more geek than lit critic, the coolness factor is off the charts. If you like to spend your time reading and thinking about network security and hacking, this is for you. And if you still buy into the "romance" of hacker shenanigans, STN can be your little Defcon-away-from-Defcon.
So is this wildly uneven book worth the price? For fiction lovers, no. For white hat security aficionados, yes. For black hat security aficionados, buying it will be the last purchase you make on your own credit card -- so hell yes. #
Full disclosure: I am not personal friends with any of the authors, but I've interviewed a few of them, including the book's technical editor, Timothy Mullen, for my day job. I may also suffer from envy that my own attempts to fictionalize network security have been ignored by most of the world except German Tom's Hardware.
Scott Pinzon, CISSP, is Editor-in-Chief for WatchGuard's LiveSecurity Service, and writes about network security on the free RSS news feed WatchGuard Wire. You can purchase Stealing the Network: How to Own an Identity from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong. (My recent favorite is Jeffrey Deaver's jargon-in-a-blender paragraphs in The Blue Nowhere, where a computer expert can't break a hacker's defenses because "I can't decrypt his firewall!") But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
And these authors do have impeccable Internet security cred. Many of them are stars circling the firmament of Black Hat and Defcon; senior penetration testers; former consultants to No Such Agency; authors of popular books on security; and so on.
Thus, STN: Identity describes attacks with accuracy and depth. The light veneer of fiction gives the networking tips real-world context. (On this point, I agree with Blain Hilton, who reviewed the first STN volume for Slashdot.) Sure, you've heard of all kinds of hacker tools, but do you know exactly when an attacker would use, say, Metasploit Framework, and not Knoppix? Chris Hurley's chapter, "Saul on the Run," stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information.
Another stand-out chapter is Johnny "Google Hacker" Long's "Death by a Thousand Cuts." This rambling episode follows, in part, a forensic cop's efforts to make a disc image of an iPod found at a crime scene. The trouble is, Apple's drivers spring into action whenever the iPod senses it has connected to a computer. If the driver activity changes anything in the iPod, all evidence on it will be inadmissible in court. In unraveling this challenge, STN became so fascinating, I couldn't put it down. Which made showering awkward.
Brian Hatch's chapter, "Bl@ckTo\/\/3r," stood out to me, also, but for the opposite reason: almost all of it went over my head. I thought I had accepted Unix into my heart, but I'm not disciple enough to keep up with Hatch's treatise on X11. Where I thought Hatch was talking only to himself, I had a more senior network security expert read the chapter, and he considered it well written. YMMV.
Other chapters cover basic crypto and code-breaking; how to forge cards that will fool magnetic stripe readers; the dark side of biometric authentication; uses of a Faraday cage; making a QWERTY keyboard type Dvorak letters, and just lots and lots of good undergroundy badness. The technical lessons hold tightly to the stated theme of identity theft. Any network administrator could learn a lot about the enemy's techniques from this volume; and, because of the story-driven format, probably even remember them.
But I've been dodging my opening question: does the fiction part work? Before I answer, I should mention that I've written a lot of fiction. I've had four books of fiction and 60 short stories published, and studied under the editor who removed 500 pages from Stephen King's The Stand. I'm not saying I'm good at writing fiction; I'm just saying I respect the craft. So, can STNs authors write fiction? No. No, they cannot.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement") to characters with no feelings or personality. In Chapter 8, where college students decide to 0wn Hushmail's DNS servers for a man-in-the-middle attack, they work 36 hours straight without a smart remark, a crabby comeback, or, really, any dialog except ad hoc lectures on network architecture. Fiction-wise, it's as if Nancy Drew or the Hardy Boys tried hacking. And a couple of the chapters go so far past "wordy" that they're almost the verbal equivalent of running in place. If you're in a hurry to get to the technical meat [Jedi hand wave], these are not the authors you want. With that said, I admit that some of the chapters clamber all the way up to "adequate." But remember, fiction that teaches is hard for anyone to pull off.
Maybe none of that matters. Is anyone looking for deathless prose when picking up a book subtitled "How to Own an Identity"? Nah. What matters is, the various authors lay down some seriously tricky attacks. If you are more geek than lit critic, the coolness factor is off the charts. If you like to spend your time reading and thinking about network security and hacking, this is for you. And if you still buy into the "romance" of hacker shenanigans, STN can be your little Defcon-away-from-Defcon.
So is this wildly uneven book worth the price? For fiction lovers, no. For white hat security aficionados, yes. For black hat security aficionados, buying it will be the last purchase you make on your own credit card -- so hell yes. #
Full disclosure: I am not personal friends with any of the authors, but I've interviewed a few of them, including the book's technical editor, Timothy Mullen, for my day job. I may also suffer from envy that my own attempts to fictionalize network security have been ignored by most of the world except German Tom's Hardware.
Scott Pinzon, CISSP, is Editor-in-Chief for WatchGuard's LiveSecurity Service, and writes about network security on the free RSS news feed WatchGuard Wire. You can purchase Stealing the Network: How to Own an Identity from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
STN: Identity
Is that a new Star Trek movie I didn't know about?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
"'Saul on the Run,' stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information. "
I think comprimising someone's birth certificate, and thus all government issued documents is a bit more serious than cracking a home network.
Saskboy's blog is good. 9 out of 10 dentists agree.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement"
I gather the book was made by copy/pasting Slashdot posts then? Tssk tssk, plagiarism, not good that...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Mr. Pinzon
I'm writing to ask for your advice since you seem to know about stealing. I was recently at a friends house, and he showed me his new Linux. It had a lot of interesting "features" like windows and firefox and tcpip. He even showed me dirty pictures with it.
My friend told me that he downloaded his Linux for free! He even showed me the web site. I think it was linuxtorrent.com. I freaked out! He's stealing form Linux! He told me that it was OK and that Linux is free, but I didn't believe him.
What should I do? My friend is stealing from Linux. A lot of people worked very hard to make Linux, and he's taking it without even saying thanks. I want him to stop, but I don't want him to go to jail!
Writing evangelical fantasy and young adult novels is a breeze compared to the toughest of art forms, didactic fiction.
And you'll own it. No really.
Where is that guy who'd die defending what I had to say when I need him?
It's actually all written by one person, but you don't find that out til the last chapter.
if the glass was in the forest and no one was there to see it, would it be half anything?
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong.
Shashdotters call b.s. on anything because they like to do this! They are natural born devil's advocates and kill-joys who look for the flaws in things. And it makes them happy, if not on the outside then deep on the geeky inside.
But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
The same thing would happen. Slashdotters are nitpickers because they can be. Slashdotters, while a majority of them are tech heads, are not limited to tech heads. Nerd and geeks take many forms, including literary geeks. Enough of them exist in the slashdot base to properly rend a poorly written and poorly thought-out story to quivering shreds.
"All great wisdom is contained in .signature files"
I know eff all about computer security over and above what I need to lock down my own computers - and I have no doubt I could do a better job of that. I really think fiction is one of the best ways to teach while you entertain. Despite myself I have picked up a large amount of history from reading the Richard Sharpe novels by Bernard Cornwall.
1. Get born.
2. Get issued a state sanctioned Identification Number.
3. Get a job
4. Profit.
Cb Qw frg hgoy dak. yr mat. ogp. yday yd. _QtxNafrcgy_ rlycrb cb yd. t.fxrape o.jycrb co o.y yr _ekrpat_ cboy.ae ru _go_ rp ,day.k.pv
Ru jrgpo.w p.an daq0po ap. jrmmabe ncb. go.pow or frg ,aby yr go. _nraet.fo ekrpat_ cboy.aewv C dak. ydco cb mf i.byrr oyapygl ojpclyov
Yd. ucpoy ydcbi C gogannf er ,d.b C i.y a b., t.fxrape co yr lrl ruu ann yd. jalo abe p.appabi. yd.m cb Ekrpat nafrgyv Rbj. C dak. yd. t.fo o.y gl pcidyw C jab rbj. aiacb nrrt ay mf ucbi.po ,dcne C yfl.v d.d.v
Cy-o dape x.cbi or 1337v
A republic cannot succeed till it contains a certain body of men imbued with the principles of justice and honour.
No wonder this guy's so crafty, he used to get kids out of trouble with flash pots and prayer.
Terminate and stay resinous.
How To Steal AND Own A Country
by Cheney, R. B., Rove, K., Rumseld, D., and Rice, D.
Regards,
K. Trout, CEO
What is the moral being propagated in this work? None? Is it just a wapper for tech knowledge? Then why read it? Most geeks just want the facts. As the reviewer points out /. ers do well at calling bs. Why read poorly crafted fiction when the tech details are readily at hand?
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
"Shashdotters call b.s. on anything because they like to do this! They are natural born devil's advocates and kill-joys who look for the flaws in things. And it makes them happy, if not on the outside then deep on the geeky inside."
I call B.S. Let me be the devil's advocate and put to you that you're nitpicking on Slashdotters' habits.
Saskboy's blog is good. 9 out of 10 dentists agree.
The STN series is unique in that it focuses on technical details. Some of the fiction itself might be lacking in form, but the reality is that this is not what the authors are really trying to do. They're trying to educate about various techniques in an entertaining way, and in that department I think they do a pretty good job.
One of the criticism about STN: How To Own A Continent that I had, though, was that there didn't seem to be enough technical details. I'd much rather read a book like this and have it go over my head than be able to understand everything without much thought. From this review, it looks like they might have addressed this in STN: How To Steal an Identity.
Most likely, I'll be ducking into a bookstore to buy this thing.
The beginning mistakes listed here, except for lack of characterization, could all have been fixed if the book had been run past a competant editor. Just using a spelling checker and (maybe) a grammer checker isn't enough. You need to make sure the words are the right words, and a computer just can't do that. Blame the publishers for that, not the authors.
Good, inexpensive web hosting
I don't think this will be worth picking up.
After all, how can the authors be truly 1337 if they can't even spell pwn?
Well, available for pre-ordering. Check it out here: Stealing the Network: How to Own an Identity
You forgot Ariel Sharon - and he doesn't even live in D.C. - and the guys at AIPAC, a couple of whom may be looking at jail time for espionage.
Need to add George H.W. Bush, James Baker, their cronies at the Carlyle Group, and the Saudi royal family (including the bin Ladens), too.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
for his identity to be stolen?
So he sold it on eBay.
New procedure:
1) Get born.
2) Grow up.
3) Get official documents proving^H^H^H^H^H^H^Hallowing you to exist.
4) Sell existence on eBay.
5) PROFIT!!!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
the author of this and a few other books will be doing a book signing at defcon 13 in las vegas tomorrow, friday the 29th at 15:00 cya at the con....
feeling lonely? grab a balled up pillow for company
Well, almost fiction I suppose. A weekly read of mine is SecurityMonkey's stories, and I nearly pee myself waiting for the next installment.
Rumor: he apparently has a book deal in the works. I'm going to pre-order on Amazon!!!
The quick way to switch your actual keyboard is to use setxkbmap, or loadkeys, but if then you'd need to type in all the comments here to have them translate. This script would work as a filter, which is more convienient.
Also, if you want to switch back and forth, or are on an old system that doesn't have alternate keyboards available in X11, I use tod/toq, from the Tools section of Hacking Linux Exposed website.
If you're wondering why there aren't many posts by the other authors, that's because they're all in or recovering from Las Vegas....
I read the same book and he can't even manage to spell the word "Steganography". He spells it "StenaNography". Of course if you Google the latter you'll get hits, but that, as this guy will attest, is Deaver's fault...
Have your friend send $250 to:
Microsoft
C/O Genuine Advantage
1 Microsoft Way
Redmond, WA 98052-8300
They've been trying to let the world know that Linux isn't free for ages and they need your help!
if the book had been run past a competant editor. Just using a spelling checker and (maybe) a grammer checker isn't enough.
OMG thats the funniest thing i've read today beaubell but i've already used my mod points today. RGH
Is it just me, or should Slashdot only review books that are in print and available for purchase. The link to by it from Barnes and Noble says that the book isn't available yet. Amazon says it is available in August. Not a good way for Slashdot to make money off the purchase if you can't purchase it.