New, worthwhile book on hacking problems

I just got a copy of Hacking Exposed, by Stuart McClure, Joel Scambray and George Kurtz. This is a strange one. What the authors have done is compile hundreds of security hacks into one volume. The hacks and attacks range all around, from WWW server vulnerabilities to SNMP bugs in network gear to Windows NT-based password decoders and network denial of service attacks.

In a sense, this is a history of attacks against operating systems, ranging over the past three or four years, for every major hack. If you're a "script kiddie," this book would be your bible - it lists all of the known problems with every major operating system, and how to exploit them.

If you're new to the security business, this is an excellent place to start; it will help you get caught up to everything that's been happening in the cracker tool kit. This is also the kind of book I'd send to clients who are suddenly starting to think about network security.

However, Hacking Exposed has its faults. The authors are fantastic at collecting exploits and describing what's going on, but their prescriptive discussions are immature and incomplete. In that sense, Hacking Exposed can't stand on its own, since it tells you more of how people will try to break in and too little of the general principles behind securing your systems. But that's OK - no other book fills this niche, and while there are Web sites dedicated to listing exploits, none of them take the time to analyze the problems in the way that McClure, Scambray and Kurtz have.

Hacking Exposed, however, has a much bigger problem - it's in print. By definition, all of the information in this book is old news, history really. For that reason, I'd be cautious about giving this to a naïve network administrator who might think that by filling the holes listed in the book they're suddenly safe. This isn't something the authors could have done anything about; after all, we're lucky to have had them take the time to build such a comprehensive compilation of otherwise openly available information.

I'd say buy it. Everyone has something to learn from Hacking Exposed.

Due to the holidays, there will be only one Messaging newsletter this week.

RELATED LINKS

RELATED LINKS