Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Books Media Book Reviews Technology

Stealing the Network 141

Posted by timothy from the next-week-shoplifting dept.
Blaine Hilton writes "Stealing the Network is a refreshing change from more traditional computer books. The authors have created fictional stories based on non-fictional concepts that could really happen to our computer systems today. The realistic fiction approach makes the book much lighter to read and actually entertaining. I also believe this approach makes the true methods behind the fictional stores much more memorable then memorizing thousand page textbooks." Read on for his overview of the book.
Stealing the Network: How to Own the Box
author Ryan Russell, Tim Mullen (Thor), FX, Dan Kaminsky, Joe Grand, Ken Pfeil, Ido Dubrawsky, Mark Burnett, and Paul Craig
pages 328
publisher Syngress
rating 8
reviewer Blaine Hilton
ISBN 1931836876
summary An interesting fictionalized approach to hacking and other aspects of information security.

I'm leery of books that are written by multiple authors because the writing style always seems to keep me off beat from jumping around, however in this book it works out well since the book is organized as a series of short stories. Each story describes somebody involved in information security -- either somebody trying to access a system, or a person trying to keep the bad guys out.

If you are looking for a step-by-step guide to locking down your computer and network, this is not the book for you. Instead, this book is more to help people who already have at least a basic understanding of information security to see from another perspective. Stealing the Network looks at other reasons why people can break in: everything from being told to go to industry conferences to not collecting access cards when an employee leaves the company. What this book left deepest in my mind is to trust nothing, and assume even less.

After the ten short stories of how hacking is really done, there is a nicely done appendix along with Ryan Russel's "Laws of Security," which finishes this fictionalized book in a very non-fictional way. The laws cover most of the problems with current IT infrastructure, but do not go in-depth with what I believe is the biggest security hole, the user. Many of the stories touch on this fact but that's about the extent of it. I believe this may be because there are not any easy solutions to human behavior. This book says it best with "people are lazy."

At 328 pages (in pretty large text), this is a great easy read, though the book would be better with a lower price tag. However if you work with or around computers and the Internet, this book is very enlightening, if not completely informative.

Table of Contents

  • Acknowledgements
  • Contributors
  • Forward
  • Chapters:
    1. Hide and Sneak
    2. The Worm Turns
    3. Just Another Day at the Office
    4. h3X's Adventures in Networkland
    5. The Thief No One Saw
    6. Flying the Friendly Skies
    7. dis-card
    8. Social (In)Security
    9. BabelNet
    10. The Art of Tracking
  • Appendix - The Laws of Security

Most of the book's authors have websites you can hit for more information; follow these links to find more from Ryan Russell, Tim Mullen (Thor), FX, Dan Kaminsky, Joe Grand, Ken Pfeil, Ido Dubrawsky and Mark Burnett, as well as Jeff Moss (who wrote the forward).

You can purchase Stealing the Network from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Stealing the Network More

Stealing the Network

Comments Filter:

  • Woo Hoo! (Score:5, Informative)

    by ryanr ( 30917 ) * <ryan@thievco.com> on Wednesday June 04, 2003 @12:01PM (#6115702) Homepage Journal
    One of my books finally made it onto Slashdot. I wrote the "Worm Turns" chapter with Tim Mullen, acted as tech editor for the book, and wrote the overall outline. Pretty easy book to be a tech editor on. I'll be watching this thread if there are any questions I can answer.

    • Re:Woo Hoo! (Score:4, Interesting)

      by Chris_Stankowitz ( 612232 ) on Wednesday June 04, 2003 @12:05PM (#6115754)
      I do have a question. Does Syngres still offer their books in a downlodable text? I try to find this feature in most of my tech books and unfortunatley not many companies publish them this way.

      • Re:Woo Hoo! (Score:5, Informative)

        by ryanr ( 30917 ) * <ryan@thievco.com> on Wednesday June 04, 2003 @12:08PM (#6115795) Homepage Journal
        On some books, they do. When I "registered" my copy of this book, I was given a link to download a .PDF of it. Be aware that on some books (mostly older ones) the .pdf file(s) were contained in a Windows .exe.

        If enough people care, I'll make them produce a HTML file or something.
        • yo yo i want it in html and i didnt see the link to get it in PDF form when i registered my copy... ill tell you what though dude... good job... i plan on purchasing all of your other books because of this one!!! i would like a list

    • Question: (Score:5, Funny)

      by mao che minh ( 611166 ) * on Wednesday June 04, 2003 @12:07PM (#6115782) Journal
      Yes mister Ryanr, I have a question that demands your expertise. How do I perform what is commonly refferred to as "teh haxX0r" on the internet? And is the art of "haxX0ring" related to "hacking" in any way? I am routinely laughed out of IRC chat rooms because I am not "l33t", as they put it.

      Thank you.

      • Re:Question: (Score:5, Funny)

        by ryanr ( 30917 ) * <ryan@thievco.com> on Wednesday June 04, 2003 @12:20PM (#6115910) Homepage Journal
        They're similar, but with hax0ring, you yell "3y3 0wn j00!!!!11!!!1!" a lot, and the actual hacking part looks a lot like flying through a wireframe cityscape.

        • Re:Question: (Score:3, Funny)

          by Surak ( 18578 ) *
          They're similar, but with hax0ring, you yell "3y3 0wn j00!!!!11!!!1!" a lot, and the actual hacking part looks a lot like flying through a wireframe cityscape.

          Phew. And here I was starting to think that the movie "Hackers" lacked actual basis in reality. At least they got *that* part right. ;)

          So, exactly where is your gibson, and how do I get to h4x0ring it?

    • This is a clasic that shouldn't be forgotten. "The Cuckoo's Egg", by Clifford Stoll [amazon.com]

    • Re:Woo Hoo! (Score:3, Interesting)

      by Mooncaller ( 669824 )
      How would you feel about submiting to a /. interview. Tech writting is an important part of any tech carrer. I have done quite a bit of it myself, including a 200+ page process procedure. I like to write SF short stories. When ever I do tech writing I pay as much attention to sentence structure and flow as when I write a story. The result is "wawawawawa". Nothing sticks. The prose is too smooth. That makes for a lousy procedure. The problem is that the procedure lacks a good plot.

      I'm interested in tech wr

      • Re:Woo Hoo! (Score:3, Interesting)

        by ryanr ( 30917 ) *
        Clearly, from the amount of whoring I've already done in this thread which is only tangentially about me, I'd love to do an interview.

        There are any number of details about how I perceive writing, what it's like to work with Syngress, etc... that I'd love to talk about.

        I can see where writing procedures, where there is little or no opportunity to include any personality, would drive one insane. I have no formal training on writing, other than the classes they have you take in college. And I read a lot.
        • have no formal training on writing, other than the classes they have you take in college.

          Even better. I'm sure most /.ers, who would be interested, have no formal training in writing either.

    • Looks like Mr. Russell has been hacked himself (Score:1, Interesting)

      by Anonymous Coward
      Hey, looks like this guy has been hacked quite a bit himself:

      Wired Article [wired.com]

      You can also see the contents of his home dir and some of the "sites" he likes to visit:

      Ryan Russell's home dir [efnet.ru]

      Not quite a security expert, I would say....
      • Hmm... phrack.ru has been down for some time, but you've got the link to my home dir contents handy. Who might Mr. AC be?

        Yep, the company that hosts the website that hasn't been updated in 3 years for $20/month was compromised. Is that supposed to reflect on me in some way?

        In a way, the attention is flattering.

        • Re:Looks like Mr. Russell has been hacked himself (Score:1, Insightful)

          by Anonymous Coward
          Is that supposed to reflect on me in some way?

          Yes, in fact, it does. This is something that has obviously eluded you. You claim to be a security "expert", but you can't even keep hackers out of your own box. Very simple, you claim to be something that you are not.

          And, gee, don't you send all your emails from @thievco.com? Isn't your own email worth protecting? Hardly some "crap" stored on some canadian ISP. Wouldn't mr. security expert take care to secure his own private emails?

          Also, why do you write th
          • Yes, in fact, it does. This is something that has obviously eluded you. You claim to be a security "expert", but you can't even keep hackers out of your own box. Very simple, you claim to be something that you are not.

            AFAIK, there have never been hackers in my own boxes, just those belonging to other people, like the hosting box in question. There is a reason that nothing important was on that box when it was compromised. Frankly, I expected it to be compromised long before. It wasn't even defaced, I w

            • Re:Looks like Mr. Russell has been hacked himself (Score:1, Insightful)

              by Anonymous Coward
              First of all, Mr. Russell, I did not hack your box. I don't even know or care who did, but I do empathize with the person(s) that taught you a lesson.

              If having a box compromised means that person isn't an expert, then there are no experts.

              Its not just that. You don't know anything. Look in your own damn Slashdot journal [slashdot.org]. You don't even know how to code in C!!!!! Maybe you should start with html, then graduate to something more on your skill level.

              that nothing important was on that box when it was com

    • Phaeton Sez (Score:1)

      by Anonymous Coward
      Interestingly, it is books like this that taught me most of my preliminary UNIX knowledge, even before i owned a computer.

      There was a time where i (on a friend's 486) used to enjoy some $KrYp+ KiDDI3 Mischief at Hotelchat.com.

      I wanted more.

      So i started reading books about hax0rz. I read:

      John Markoff's "Cyberpunk" (talks about the Morris Worm, Mitnick and one other less known)

      Clifford Stoll's "The Cuckoo's Egg" (Ironically, i just recommended this to someone last night!)

      Tsusomi Shimomira's(sp?) "Taked

    • Sample Chapter (Score:3, Informative)

      by ryanr ( 30917 ) *
      BTW, sample chapter [syngress.com] if anyone wants to see.

  • Stealing the network (Score:4, Funny)

    by Anonymous Coward on Wednesday June 04, 2003 @12:02PM (#6115725)
    5 finger discounts at CompUSA!

  • Short Review? (Score:1, Insightful)

    by Anonymous Coward
    Why cant I just Amazon for review like this?

    • Re:Short Review? (Score:1, Insightful)

      by Anonymous Coward
      I didn't know this book existed.

      Now I do, and I'm better off for it.

      I don't go browsing through Amazon looking for reviews to read.

  • Learning through fiction (Score:5, Interesting)

    by nacturation ( 646836 ) <nacturation AT gmail DOT com> on Wednesday June 04, 2003 @12:05PM (#6115763) Journal
    This is a very valuable technique. After reading the Clavell novels (primarily Shogun) I was able to pick up and understand a small vocabulary of Japanese as it wasn't "dry" information. Hopefully this will be a great way to get management to clue in a little better to security without PHBs realizing that they're learning valable material.
    • Too true, it was zammechat how much dobby Nadsat [earthlink.net] was learned while reading "A Clockwork Orange". I once saw some real foreign language books start in English and gradually incorporate another language, wish I could get hold of something like that now.

      Another novel about software engineering is The Deadline: A Novel About Project Management [amazon.com] by Tom De Marco, author of the classic text, Peopleware. As the title indicates, it's a novel that not-so-subtly illustrates certain points about project management. I
    • Syngress specifically wanted to try teaching through fiction. (If you haven't heard of them before, the vast majority of their books are intended to teach IT techniques.) I personally was just interested in trying to write some fiction. I've written parts of a number of other books for them, but those are all closer to textbooks.

      The obvious setting for my first fiction attempt is the information security field that I'm involved in. Well, that and hacker stuff is probably one of the few things you could
      • Humor and negative example are pretty commonm.

        This is why I reccomend the BOFH series to new system administrators. You can just laugh, or you can think about privacy violations, user abuse etcetera. Like Dilbert for the corporate world, but less whiny.

        I like the idea of using fiction to teach, but so often it just ends up being smarmy. I'd like to try it myself, but balancing an agenda with the demands of a good story is hard. Just ask Goofus & Gallant.

        I'll look for the book, and the publisher Syngr
    • I agree completely. If someone can write an engaging fiction about adventures with AIX, I'll happily read it. In fact, I will personally give the author six months of my salary. Anyone who can write engaging fiction about AIX deserves it.

      But honestly, I recently read Kim Stanley Robinsons' Mars Trilogy (Red Mars, Blue Mars, Green Mars). As a result, I feel like I know a fairly good chunk about current martian geography, theories on various teraforming techniques, and about as much on the most likely ca
    • Yes, you can be a big hit with Japanese co-workers by bellowing "kinjiru" at random moments.

  • Great, thanks! (Score:5, Informative)

    by Anonymous Coward on Wednesday June 04, 2003 @12:05PM (#6115764)
    A whole book review that consists of the Contents listing, and a whole paragraph that says "I liked the writing style, even though it was written by more than one person." Gee thanks. Next time save your time and just give us a link direct to the Amazon listing why not?

    • Re:Great, thanks! (Score:1)

      by Anonymous Coward
      No kidding. Maybe there needs to be a "book summary" icon for those "reviews" that really aren't.

      For the folks writing these "summaries" and calling them "reviews": how about at least superficially delving into criticism/praise for the book? I'm not asking for in-depth information, but at least a little more than this offers.

  • There was this guy.. (Score:4, Funny)

    by bigattichouse ( 527527 ) on Wednesday June 04, 2003 @12:07PM (#6115780) Homepage
    There was this guy.. and he liked to tell stories that had meaning, because it was easy to remember the story, and the associated meaning... man, what was his name... (Insert favorite diety/boddhi here)

    People inherently remember stories and songs much better than bare facts.

    • Good Point. The only thing I remembered from reading Hacking Linux: Exposed was a story on how a kid (roughly 19 if I remember correctly) comprimised an ISP. I certainly would remember all of the facts it they weren't in story form.
    • man, what was his name...

      Marge, you remember, he drove that blue car?!?!

  • Amazon (Score:5, Informative)

    by Meeble ( 633260 ) on Wednesday June 04, 2003 @12:10PM (#6115818) Journal
    here is the Amazon Link [amazon.com].

    I'm always wary of amazon reviews anyhow though, half the time their anonymous and most likely the publishers, authors, and editors. With my lack of trust does that mean I'm as knowledgeable as I would be from reading the book ? ;)

  • Parody time. (Score:3, Funny)

    by cyt0plas ( 629631 ) on Wednesday June 04, 2003 @12:11PM (#6115825) Journal
    I guess it's time for someone to write "Steal this Network" - a howto guide.

  • Where to buy (Score:2, Informative)

    by bogie ( 31020 )
    "You can purchase Stealing the Network from bn.com"

    Or from Amazon
    Insert secret Slash affilate number here [amazon.com]

  • very good (Score:5, Informative)

    by towaz ( 445789 ) * on Wednesday June 04, 2003 @12:13PM (#6115840)
    I downloaded this as an ebook from syngress its cheaper :)

    The stories were all well written, covered a varied amount of subjects and were not heavily technical.

    Hope to see more books take this different angle, the only one that seemed to be written the same style recently was Art of deception.
  • ...while I was waiting to see TM:R. I started reading it, and in half an hour was through fifty pages already. It was compelling, to say the least.

    The reviewer is quite correct - this book is different from most normal security books. Instead of "here's the attack, here's how to defend", it is a collection of fictional stories. Since I only read the first one, I can't comment on the rest of them, but the first was enough to make me want to read the rest.

    Needless to say, when I got home that night, I ordered it. Since then, I've been like Calvin waiting for his red beanie - every evening I come home and it's not there... but the next day I am psyched that it will be! (It should be arriving today! I am quite anxious to read the rest.)

    My recommendation is that you check it out if you get a chance. :)
    • Given the writing style, perhaps this would be something to recommend to PHB's, to put security issues into an understandable framework?
  • The talking socks network security book is expected any time now.

  • Computer Security Quote (Score:3, Funny)

    by bpfinn ( 557273 ) on Wednesday June 04, 2003 @12:16PM (#6115873)
    Could someone remind me who stated the two laws of computer security:
    1. Don't buy a computer.
    2. If you do buy a computer, don't turn it on.
    Thanks.

  • The laws of security: (Score:5, Funny)

    by cyt0plas ( 629631 ) on Wednesday June 04, 2003 @12:19PM (#6115895) Journal
    1) By the time you finish reading these laws, they will be hopelessly out of date

    2) Don't use anything that Microsoft got near, even if the interaction was nothing more than an underling squinting at it over his morning coffee - It might be tainted, don't risk it.

    3) The nice thing about being a security consultant is that if the customers knew enough to judge your work, they wouldn't need you in the first place.

    4) "Security Consultant" is a important-sounding title that carries very little real responsibility.

    5) It doesn't matter how good your security is, some manager will give out his password to his wife/kids/secretary/dog, and data _will_ be lost. Don't wait for it to happen, back up the data _now_.

  • Fiction as technical (Score:3, Funny)

    by genkael ( 102983 ) on Wednesday June 04, 2003 @12:23PM (#6115936)
    And then Bob realized he could do an nslookup on his IP. Frustration rained. They he realized that inevitably he had forgotten to put in a reverse lookup into the nameserver.

    It just doesn't work for me.

  • reminds me of... (Score:4, Informative)

    by newsdee ( 629448 ) on Wednesday June 04, 2003 @12:24PM (#6115938) Homepage Journal
    ...a book I read long ago, that was supposedly a novelized true story about how a network administrator "catched" a hacker. Unfortunately I don't remember its title nor the author, but I expect somebody here will remember the scene where the guy melts his sneakers in the microwave, because he wanted to quick dry them... :-)

    Does it ring a bell?

  • Great Pedagogical Technique, this (Score:4, Insightful)

    by Phoenix666 ( 184391 ) on Wednesday June 04, 2003 @12:34PM (#6116018)
    I think this is an excellent direction to take education in. The difference between book learning and real world knowledge is always context. Book learning teaches you math out of context, teaches you grammar out of context, and what have you. It's the real world that teaches you the actual context for applying the book learning. Whereas a book like this, presenting the knowledge in the way it does, actually takes you back to the original purpose for stories: to teach.

    Remember Aesop's Fables? They weren't meant primarily to entertain, but to teach a moral lesson. The same with the little incidental stories we tell each other daily about, for example, how so-and-so got fired because he was surfing porn on the company network. The entertainment value is incidental.

    Given that bodies of knowledge, IT and otherwise, are multiplying so rapidly, it seems like the only way to get a reasonable handle on it as a society is to create these kinds of stories to put it in context.

    Great work, guys.

  • Personally, I like the idea... (Score:3, Insightful)

    by The Angry Mick ( 632931 ) on Wednesday June 04, 2003 @12:43PM (#6116085) Homepage

    ...of using a fictional approach to highlight security vulnerabilities. How many times have we sysadmins tried to point out the dangers of a particular practice (say, passwords pasted to monitors), only to be asked "what's the worst that could happen" and asked to prove the risk?

    Other than spending a large chunk of time Googling for news stories, there's not a lot of real and readily accessible information out there about the serious consequences of a lame security approach. Nor is there a pile of information that comes in an easy to understand form that upper management can grasp. Trying to explain the technical aspects will only make their eyes glaze over, and appealing to their sense of security is more often than not perceived as questioning the morality of staff.

    Anecdotal "tales" such as this, may actually help the technologically adverse see the nightmare scenarios that many of us admins lose significant sleep over, and can do so in a way that makes them understand that even the best intentions can go horribly awry.

  • Our Thoughts Writing STN (Score:5, Interesting)

    by Effugas ( 2378 ) on Wednesday June 04, 2003 @12:50PM (#6116146) Homepage
    Heh. STN made Slashdot. Scanrand [slashdot.org]on the shelves...cool :-)

    Stealing the Network is a relatively unique book. Remember Swordfish? Remember Antitrust? Wish there was a cheap procedure to repair that psychic damage? Because that's what got me involved. Syngress was as tired of the hype as we were. Spindly kids playing with 3D modelers to make worms was not reality. Syngress had a basic request: Show us what really happens. Make it interesting, tell a story, but at the end of the day, take the gloves off.

    Most of us had worked with Syngress before -- we'd done Hack Proofing Your Network [amazon.com] for them, which was actually pretty well received. It was a strange experience, travelling half-way round the world to Black Hat Asia and seeing my Defcon talk on sale in a Singaporean bookstore :-) So when Syngress said they wanted to do this -- we put this together.

    We've actually put together a surprisingly good package. Everything from dumpster diving to printer abuse to some of the first real documentation of my personal scanrand techniques shows up. If there's interest, I'll put together a summary of some of the cooler things in here. And of course, if there's any questions, bug me here or in email :-)

    Yours Truly,

    Dan Kaminsky

  • Brilliant (Score:5, Funny)

    by Mannerism ( 188292 ) <keith-slashdot AT spotsoftware DOT com> on Wednesday June 04, 2003 @01:11PM (#6116357)
    The authors have created fictional stories based on non-fictional concepts that could really happen to our computer systems today.

    Wow. This could spawn a whole genre of books. We could call it "Science Fiction".

  • Highlights from STN (Score:4, Informative)

    by Effugas ( 2378 ) on Wednesday June 04, 2003 @01:49PM (#6116683) Homepage
    All--

    Thought it'd be fun to talk about some of the more interesting material we put together throughout the book:

    --HTTP-only access to the outside world doesn't actually pose much of a barrier...httptunnel (the original web service) may not be as mindbending as IP-over-DNS or mailtunnel, but damned if it doesn't punch ssh sessions bidirectionally through web proxies ;-) This gets mentioned in Dubrawsky's attack tree analysis -- an extremely systematic breakdown of attack selection across pretty much every platform an attacker might find.

    --Worm analysis. Guys, Code Red and Nimda were astonishingly successful; there's not-so-idle speculation that Nimda was a test run from a foreign intelligence service. One of my good friends did almost nothing for a year but manage Nimda recovery. Just because it left the press doesn't mean it left the network. Reverse Engineering is never trivial (unless you're Halvar Flake and dream in x86); throw extreme time sensitivity, malicious design, and financial implications and you get an idea of the world virus fighters and worm smashers have to face. Kudos to Tim Mullen and Ryan Russell for their nuts-and-bolts breakdown of this process.

    --Joe Grand. Software-based RF Analyzer. Pre-GSM/GPRS Blackberry transmissions. Mobitex.exe. And if that wasn't enough, "Creating a fake gelatin finger to bypass a biometric fingerprint sensor.", complete with photographs.

    --Ah, FX. Leave the poor Cisco alone, man :-) And of course, it wouldn't be FX without seeing those HP Laserjets as covert outposts :-)

    --Security and Functionality tend to play in opposition...as Paul Craig points out, maybe those step-by-step guides to getting through the VPN shouldn't show up on Google :-)

    --WiFi. Dead horse. But it's nice to see it anyway.

    --Password cracking by calling up administrators and listening to them type in their password -- nice, Mark. I'd like to see some of the stats code to manage that. Also good to see Windows Proxy Autodetection getting some misexposure.

    --Auditors are given lots of leeway. No, let Ken Pfiel clarify...those who claim to be auditors are given lots of leeway.

    --OK, I'm a protocol geek. For a good time, switch to root and type:

    "tcpdump -w - -s65535 | strings --bytes-8"

    If it's ugly, it's SMB. If it's scary, you're probably at Network Interop, where there's 220 access points and you're sniffing across all of them.

    --Scanrand docs! Portscan detection on switched networks by watching the router spew an ARP storm! "If your SMTP server has teleported 15 hops closer than the rest of your host, perhaps it's being hijacked by your hotel." And more NAT games.

    --Collaborating on tracking down an attacker, while the attacker can read your email...fun.

    We've had some fun, to say the least. :-)

    Yours Truly,

    Dan Kaminsky

  • On amazon.com, it has a list price of $50, discounted to $35. Barnes & Noble has it for $40.

    It was tough for me to pay $7 for "Takedown" at the used book store (it's out of print now). $35 is out of my price.
    • A common (and probably fair) complaint. If you shop around a bit [bookpool.com] you may find it for slightly less.

      Syngress books tend to be priced a bit higher than some of the competition. They seem to be happy doing a little less volume at a little more margin. They're also a small publisher, so they don't neccessarily have the same economics of scale or influence that a big publisher does.

      The whole book industry is interesting, from what relatively little I know about it.
  • After reading about the book this morning on /., I went to B&N and actually caught sight of the book (inadvertently). I picked it up and it was such an interesting read, I didn't put it down until I had read it all. As mentioned, it's interesting in the fact that they're all 'make believe' stories carrying an underlying lesson in each chapter. A lot of different scenarios are covered and it would be a pretty good read for anyone even remotely connected to network security. Now, I am not saying that

Slashdot Top Deals

The rule on staying alive as a program manager is to give 'em a number or give 'em a date, but never give 'em both at once.

Close