Slashdot Mirror
Stealing the Network: How to Own an Identity
Scott Pinzon writes "Writing sonnets, screenplays, or an epic poem in your third language is a breeze compared to the toughest of art forms, didactic fiction. That might explain why the various chapters of Stealing the Network: How to Own an Identity range from appalling to exciting. Whether you see the glass of STN: Identity as half empty or half full depends on whether this is your cup of poison -- but on a technical level, it rocks." Read on for the rest of Pinzon's review.
Stealing the Network: How to Own an Identity
author
Raven Alder, Jay Beale, Riley "Caezar" Eller, Brian Hatch, Chris Hurley (Roamer), Jeff Moss, Ryan Russell, Tom Parker, Timothy Mullen, Johnny Long
pages
336
publisher
Syngress
rating
6
reviewer
Scott Pinzon
ISBN
1597490067
summary
Fiction that teaches about network security
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong. (My recent favorite is Jeffrey Deaver's jargon-in-a-blender paragraphs in The Blue Nowhere, where a computer expert can't break a hacker's defenses because "I can't decrypt his firewall!") But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
And these authors do have impeccable Internet security cred. Many of them are stars circling the firmament of Black Hat and Defcon; senior penetration testers; former consultants to No Such Agency; authors of popular books on security; and so on.
Thus, STN: Identity describes attacks with accuracy and depth. The light veneer of fiction gives the networking tips real-world context. (On this point, I agree with Blain Hilton, who reviewed the first STN volume for Slashdot.) Sure, you've heard of all kinds of hacker tools, but do you know exactly when an attacker would use, say, Metasploit Framework, and not Knoppix? Chris Hurley's chapter, "Saul on the Run," stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information.
Another stand-out chapter is Johnny "Google Hacker" Long's "Death by a Thousand Cuts." This rambling episode follows, in part, a forensic cop's efforts to make a disc image of an iPod found at a crime scene. The trouble is, Apple's drivers spring into action whenever the iPod senses it has connected to a computer. If the driver activity changes anything in the iPod, all evidence on it will be inadmissible in court. In unraveling this challenge, STN became so fascinating, I couldn't put it down. Which made showering awkward.
Brian Hatch's chapter, "Bl@ckTo\/\/3r," stood out to me, also, but for the opposite reason: almost all of it went over my head. I thought I had accepted Unix into my heart, but I'm not disciple enough to keep up with Hatch's treatise on X11. Where I thought Hatch was talking only to himself, I had a more senior network security expert read the chapter, and he considered it well written. YMMV.
Other chapters cover basic crypto and code-breaking; how to forge cards that will fool magnetic stripe readers; the dark side of biometric authentication; uses of a Faraday cage; making a QWERTY keyboard type Dvorak letters, and just lots and lots of good undergroundy badness. The technical lessons hold tightly to the stated theme of identity theft. Any network administrator could learn a lot about the enemy's techniques from this volume; and, because of the story-driven format, probably even remember them.
But I've been dodging my opening question: does the fiction part work? Before I answer, I should mention that I've written a lot of fiction. I've had four books of fiction and 60 short stories published, and studied under the editor who removed 500 pages from Stephen King's The Stand. I'm not saying I'm good at writing fiction; I'm just saying I respect the craft. So, can STNs authors write fiction? No. No, they cannot.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement") to characters with no feelings or personality. In Chapter 8, where college students decide to 0wn Hushmail's DNS servers for a man-in-the-middle attack, they work 36 hours straight without a smart remark, a crabby comeback, or, really, any dialog except ad hoc lectures on network architecture. Fiction-wise, it's as if Nancy Drew or the Hardy Boys tried hacking. And a couple of the chapters go so far past "wordy" that they're almost the verbal equivalent of running in place. If you're in a hurry to get to the technical meat [Jedi hand wave], these are not the authors you want. With that said, I admit that some of the chapters clamber all the way up to "adequate." But remember, fiction that teaches is hard for anyone to pull off.
Maybe none of that matters. Is anyone looking for deathless prose when picking up a book subtitled "How to Own an Identity"? Nah. What matters is, the various authors lay down some seriously tricky attacks. If you are more geek than lit critic, the coolness factor is off the charts. If you like to spend your time reading and thinking about network security and hacking, this is for you. And if you still buy into the "romance" of hacker shenanigans, STN can be your little Defcon-away-from-Defcon.
So is this wildly uneven book worth the price? For fiction lovers, no. For white hat security aficionados, yes. For black hat security aficionados, buying it will be the last purchase you make on your own credit card -- so hell yes. #
Full disclosure: I am not personal friends with any of the authors, but I've interviewed a few of them, including the book's technical editor, Timothy Mullen, for my day job. I may also suffer from envy that my own attempts to fictionalize network security have been ignored by most of the world except German Tom's Hardware.
Scott Pinzon, CISSP, is Editor-in-Chief for WatchGuard's LiveSecurity Service, and writes about network security on the free RSS news feed WatchGuard Wire. You can purchase Stealing the Network: How to Own an Identity from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong. (My recent favorite is Jeffrey Deaver's jargon-in-a-blender paragraphs in The Blue Nowhere, where a computer expert can't break a hacker's defenses because "I can't decrypt his firewall!") But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
And these authors do have impeccable Internet security cred. Many of them are stars circling the firmament of Black Hat and Defcon; senior penetration testers; former consultants to No Such Agency; authors of popular books on security; and so on.
Thus, STN: Identity describes attacks with accuracy and depth. The light veneer of fiction gives the networking tips real-world context. (On this point, I agree with Blain Hilton, who reviewed the first STN volume for Slashdot.) Sure, you've heard of all kinds of hacker tools, but do you know exactly when an attacker would use, say, Metasploit Framework, and not Knoppix? Chris Hurley's chapter, "Saul on the Run," stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information.
Another stand-out chapter is Johnny "Google Hacker" Long's "Death by a Thousand Cuts." This rambling episode follows, in part, a forensic cop's efforts to make a disc image of an iPod found at a crime scene. The trouble is, Apple's drivers spring into action whenever the iPod senses it has connected to a computer. If the driver activity changes anything in the iPod, all evidence on it will be inadmissible in court. In unraveling this challenge, STN became so fascinating, I couldn't put it down. Which made showering awkward.
Brian Hatch's chapter, "Bl@ckTo\/\/3r," stood out to me, also, but for the opposite reason: almost all of it went over my head. I thought I had accepted Unix into my heart, but I'm not disciple enough to keep up with Hatch's treatise on X11. Where I thought Hatch was talking only to himself, I had a more senior network security expert read the chapter, and he considered it well written. YMMV.
Other chapters cover basic crypto and code-breaking; how to forge cards that will fool magnetic stripe readers; the dark side of biometric authentication; uses of a Faraday cage; making a QWERTY keyboard type Dvorak letters, and just lots and lots of good undergroundy badness. The technical lessons hold tightly to the stated theme of identity theft. Any network administrator could learn a lot about the enemy's techniques from this volume; and, because of the story-driven format, probably even remember them.
But I've been dodging my opening question: does the fiction part work? Before I answer, I should mention that I've written a lot of fiction. I've had four books of fiction and 60 short stories published, and studied under the editor who removed 500 pages from Stephen King's The Stand. I'm not saying I'm good at writing fiction; I'm just saying I respect the craft. So, can STNs authors write fiction? No. No, they cannot.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement") to characters with no feelings or personality. In Chapter 8, where college students decide to 0wn Hushmail's DNS servers for a man-in-the-middle attack, they work 36 hours straight without a smart remark, a crabby comeback, or, really, any dialog except ad hoc lectures on network architecture. Fiction-wise, it's as if Nancy Drew or the Hardy Boys tried hacking. And a couple of the chapters go so far past "wordy" that they're almost the verbal equivalent of running in place. If you're in a hurry to get to the technical meat [Jedi hand wave], these are not the authors you want. With that said, I admit that some of the chapters clamber all the way up to "adequate." But remember, fiction that teaches is hard for anyone to pull off.
Maybe none of that matters. Is anyone looking for deathless prose when picking up a book subtitled "How to Own an Identity"? Nah. What matters is, the various authors lay down some seriously tricky attacks. If you are more geek than lit critic, the coolness factor is off the charts. If you like to spend your time reading and thinking about network security and hacking, this is for you. And if you still buy into the "romance" of hacker shenanigans, STN can be your little Defcon-away-from-Defcon.
So is this wildly uneven book worth the price? For fiction lovers, no. For white hat security aficionados, yes. For black hat security aficionados, buying it will be the last purchase you make on your own credit card -- so hell yes. #
Full disclosure: I am not personal friends with any of the authors, but I've interviewed a few of them, including the book's technical editor, Timothy Mullen, for my day job. I may also suffer from envy that my own attempts to fictionalize network security have been ignored by most of the world except German Tom's Hardware.
Scott Pinzon, CISSP, is Editor-in-Chief for WatchGuard's LiveSecurity Service, and writes about network security on the free RSS news feed WatchGuard Wire. You can purchase Stealing the Network: How to Own an Identity from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
STN: Identity
Is that a new Star Trek movie I didn't know about?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
"'Saul on the Run,' stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information. "
I think comprimising someone's birth certificate, and thus all government issued documents is a bit more serious than cracking a home network.
Saskboy's blog is good. 9 out of 10 dentists agree.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement"
I gather the book was made by copy/pasting Slashdot posts then? Tssk tssk, plagiarism, not good that...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Mr. Pinzon
I'm writing to ask for your advice since you seem to know about stealing. I was recently at a friends house, and he showed me his new Linux. It had a lot of interesting "features" like windows and firefox and tcpip. He even showed me dirty pictures with it.
My friend told me that he downloaded his Linux for free! He even showed me the web site. I think it was linuxtorrent.com. I freaked out! He's stealing form Linux! He told me that it was OK and that Linux is free, but I didn't believe him.
What should I do? My friend is stealing from Linux. A lot of people worked very hard to make Linux, and he's taking it without even saying thanks. I want him to stop, but I don't want him to go to jail!
if the glass was in the forest and no one was there to see it, would it be half anything?
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong.
Shashdotters call b.s. on anything because they like to do this! They are natural born devil's advocates and kill-joys who look for the flaws in things. And it makes them happy, if not on the outside then deep on the geeky inside.
But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
The same thing would happen. Slashdotters are nitpickers because they can be. Slashdotters, while a majority of them are tech heads, are not limited to tech heads. Nerd and geeks take many forms, including literary geeks. Enough of them exist in the slashdot base to properly rend a poorly written and poorly thought-out story to quivering shreds.
"All great wisdom is contained in .signature files"
1. Get born.
2. Get issued a state sanctioned Identification Number.
3. Get a job
4. Profit.
Cb Qw frg hgoy dak. yr mat. ogp. yday yd. _QtxNafrcgy_ rlycrb cb yd. t.fxrape o.jycrb co o.y yr _ekrpat_ cboy.ae ru _go_ rp ,day.k.pv
Ru jrgpo.w p.an daq0po ap. jrmmabe ncb. go.pow or frg ,aby yr go. _nraet.fo ekrpat_ cboy.aewv C dak. ydco cb mf i.byrr oyapygl ojpclyov
Yd. ucpoy ydcbi C gogannf er ,d.b C i.y a b., t.fxrape co yr lrl ruu ann yd. jalo abe p.appabi. yd.m cb Ekrpat nafrgyv Rbj. C dak. yd. t.fo o.y gl pcidyw C jab rbj. aiacb nrrt ay mf ucbi.po ,dcne C yfl.v d.d.v
Cy-o dape x.cbi or 1337v
A republic cannot succeed till it contains a certain body of men imbued with the principles of justice and honour.
No wonder this guy's so crafty, he used to get kids out of trouble with flash pots and prayer.
Terminate and stay resinous.
What is the moral being propagated in this work? None? Is it just a wapper for tech knowledge? Then why read it? Most geeks just want the facts. As the reviewer points out /. ers do well at calling bs. Why read poorly crafted fiction when the tech details are readily at hand?
"Academicians are more likely to share each other's toothbrush than each other's nomenclature."
Cohen
"Shashdotters call b.s. on anything because they like to do this! They are natural born devil's advocates and kill-joys who look for the flaws in things. And it makes them happy, if not on the outside then deep on the geeky inside."
I call B.S. Let me be the devil's advocate and put to you that you're nitpicking on Slashdotters' habits.
Saskboy's blog is good. 9 out of 10 dentists agree.
The STN series is unique in that it focuses on technical details. Some of the fiction itself might be lacking in form, but the reality is that this is not what the authors are really trying to do. They're trying to educate about various techniques in an entertaining way, and in that department I think they do a pretty good job.
One of the criticism about STN: How To Own A Continent that I had, though, was that there didn't seem to be enough technical details. I'd much rather read a book like this and have it go over my head than be able to understand everything without much thought. From this review, it looks like they might have addressed this in STN: How To Steal an Identity.
Most likely, I'll be ducking into a bookstore to buy this thing.
The beginning mistakes listed here, except for lack of characterization, could all have been fixed if the book had been run past a competant editor. Just using a spelling checker and (maybe) a grammer checker isn't enough. You need to make sure the words are the right words, and a computer just can't do that. Blame the publishers for that, not the authors.
Good, inexpensive web hosting
I don't think this will be worth picking up.
After all, how can the authors be truly 1337 if they can't even spell pwn?
for his identity to be stolen?
So he sold it on eBay.
New procedure:
1) Get born.
2) Grow up.
3) Get official documents proving^H^H^H^H^H^H^Hallowing you to exist.
4) Sell existence on eBay.
5) PROFIT!!!
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
the author of this and a few other books will be doing a book signing at defcon 13 in las vegas tomorrow, friday the 29th at 15:00 cya at the con....
feeling lonely? grab a balled up pillow for company
It's actually all written by one person, but you don't find that out til the last chapter.
:)
I wrote it by myself? The publisher owes me some more roylaties, then.
if the book had been run past a competant editor. Just using a spelling checker and (maybe) a grammer checker isn't enough.