Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Books Media The Internet Book Reviews

Network Security Hacks 107

Posted by timothy from the tongue-accidentally-in-cheek dept.
Anton Chuvakin writes "When I first got this little book called Network Security Hacks, I was unimpressed by its idea: a seemingly random collection of network security tips combined under the same cover. However, when I started reading, more and more often I exclaimed "Ah, that's how it is done!" as well as found better ways of doing what I was doing." Read on for the rest of Chuvakin's review.
Network Security Hacks
author Andrew Lockhart
pages 312
publisher O'Reilly
rating 8
reviewer Anton Chuvakin
ISBN 0596006438
summary Surprisingly good; packs a lot of network security knowledge into a small book.

The book is structured around many security subjects. These are: UNIX, Windows, Network Security, Logging (covering collecting, summarizing and analyzing log files), Monitoring, (covering system and network monitoring and collecting various statistics), Tunnels (covering various kind of VPNs and encrypted communication), Intrusion Detection, and Recovery and Response (short section covering very basic forensics).

Each section has a dozen or more tips, each taking from a page to several pages. For example, looking for SUID and SGID files takes just half a page, while installing and configuring Snort NIDS takes several pages. As a result, the style is understandably terse and to-the point.

The book ended up being one cool collection of tips, ranging from mundane ('how to configure iptables on Linux') to fairly esoteric ('how to use MySQL as an authenticating backend for an FTP server'). If you've always wanted to use 'grsecurity' or 'systrace,' but thought they were too complicated - grab the book and give it a shot. If you want to set up a fancy encrypted tunnel between two networks, it covers that too. Admittedly, a lot of advice given in the book can be found on Google, but it is nice to find it in one place. Network Security Hacks covers selected topics in host security, SSH and VPNs, IDS, monitoring and even touches upon forensics. I also liked its multi-platform coverage, with a slight but unmistakable UNIX/Linux bias.

Overall, Network Security Hacks is a great book, provided you don't try to find in it something it isn't; it is a neat collection of simple network security tips. I somewhat disliked that many tips don't go beyond 'how to install a tool' and so stop short of discussing how to use it best. Another gripe: I'd rather some of the tips skipped the obvious (such as "./configure; make; make install") and focused on little known and cool ways to use technology for security. Network Security Hacks will be useful for people involved with system and network management, those starting up in the security field, as well as for more advanced professionals (as a way to check their knowledge and skills). Also, it helps folks to jump straight to effective ways of doing things in the areas where their skills are less developed.

For example, I knew it was possible to use SSH to create a makeshift VPN, but this books is the first I've seen with a really good description of doing so. Similarly, I found some neat MySQL hardening tips in the book. Overall, there is a lot in the book for most people who are somehow involved in computer security, particularly if they're also running UNIX or Linux.

Anton Chuvakin, Ph.D., GCIA, GCIH is a Senior Security Analyst with a major security information management company, author of Security Warrior (and contributor to Know Your Enemy II), and maintainer of security portal info-secure.org You can purchase Network Security Hacks from bn.com. Slashdot welcomes readers' book reviews. To see your own review here, carefully read the book review guidelines, then visit the submission page.
This discussion has been archived. No new comments can be posted.

Network Security Hacks More

Network Security Hacks

Comments Filter:

  • Happy Day! (Score:5, Funny)

    by Anonymous Coward on Thursday July 08, 2004 @06:12PM (#9648087)
    I've been beating myself over the head trying to find a gift for my Script Kiddie nephew! Thank you Andrew Lockhart!

  • Hmmm (Score:5, Funny)

    by Neil Blender ( 555885 ) <neilblender@gmail.com> on Thursday July 08, 2004 @06:12PM (#9648088)
    "Network security hacks" - sounds like some setups I know of.

  • Good book (Score:5, Interesting)

    by xOleanderx ( 794187 ) on Thursday July 08, 2004 @06:13PM (#9648097)
    Its a very good reference book. If anyones looking for a good beginners book thats similar tho this one then check out Steal This Computer Book 3: What They Won't Tell You About the Internet [amazon.com]

  • Beginner's book (Score:4, Interesting)

    by Zorilla ( 791636 ) on Thursday July 08, 2004 @06:15PM (#9648107)
    From what I read in the review, it looks more like a beginner's guide to network security. It could prove to be quite useful for someone fairly new to it. In the Air Force, quite a few people who deal with IT are pretty new to this stuff (a lot of people are straight out of high school), and even though most stuff we deal with is Windows-centric, we still need to know Unix for things such as firewalls. Looks like the book could be handy for both.

    • Re:Beginner's book (Score:5, Interesting)

      by 0racle ( 667029 ) on Thursday July 08, 2004 @06:50PM (#9648354)
      In the Air Force, quite a few people who deal with IT are pretty new to this stuff.
      Anyone else more then a little bothered by this statement?
      • In the Air Force, quite a few people who deal with IT are pretty new to this stuff.

        Anyone else more then a little bothered by this statement?

        Bothered/insulted or bothered/worried?
        • Well Military sites have got to be high on the list of sites for random break in attempts, and while I would hope sensitive materials would be under very good lock and key, sometimes they make you wonder. Personally, I would have thought that the people covering their security would be more then a little familiar with what they were doing.

          Though it a nice little insult to everyone trying, they don't care so much that someone who has never done security before can handle all those pansy ass hackers.

          • Why is military IT not as good as it could be? (Score:5, Insightful)

            by attemptedgoalie ( 634133 ) on Thursday July 08, 2004 @09:26PM (#9649129)
            Wonder why the Air Force and other military branches don't have superior IT staff?

            When their time to re-enlist comes up, they can take that knowledge (and security clearance) and go get paid 5-10 times what the service pays them to work for a contactor to the NSA, FBI, CIA, or the big defense contractors.

            Why would you stay?

            Wonder why there are so many guys not re-enlisting? Is it that they don't want to serve or go back to Iraq? Nope. They see the private security guys there making 10-20 times what they make for the same job...

            I see a trend here.
            • Good point. I got out early, (intentionally RIF'd smartass :), and even without the security bit just some basic networking knowledge got me twice the pay immediately.

            • The financial incentive was there before 9/11. Several years ago, a college friend who has a B.S. in mechanical engineering let slip the amount of her naval officer's pay. It was about 2/3 what I was getting in private industry with a liberal arts degree. Knowing her personality, she wasn't in it for the money, but out of dedication to the U.S.

              It really bugs me that our military personnel get the short end of the stick, financially, when they face risks most of us do not. (After all, did YOUR boss deci

            • True, the military pay is lower in absolute terms (especially early on), but consider the following scenarios:

              Geek 1:
              1. Go to college for CS for 4 years
              2. Graduate with 30K student loan debt
              3. Spend months looking for job
              4. Working at Walmart at 62 to work off the effects of said student loans, several medical bills incurred during breaks between jobs with no health insurance, and no retirement savings
              5. ???
              6. Profit

              Geek 2:
              1. Enlist at 17 (or commission after college at 21-22)
              2. Military medical care for

    • Re:Beginner's book (Score:5, Interesting)

      by lylonius ( 20917 ) on Thursday July 08, 2004 @10:28PM (#9649432)
      I have an O'Reilly Safari account and checked out several recent "security" titles:
      - Network Security Hacks [amazon.com]
      - Network Security Assessment [amazon.com]
      - Security Warrior [amazon.com]

      and I have to say that all of them have weak content.

      I don't proclaim to be an expert by any means, but security cannot be administered in such small nuggets of mostly outdated tricks/hacks.

      Example: Hack 40: Block OS Fingerprinting. It briefly mentions nmap's -O option and then immediately demonstrates a fairly complex pf filter on OpenBSD. Does the author explain _any_ of the valid and invalid TCP flags that nmap uses? no. Does the author explain any adverse affects of silently dropping _all_ traffic that is satisfied by this complex ruleset? no. Does the author ever mention passive OS fingerprinting? Does it even mention the simplest/non-intrusive methods used to fool active OS fingerprinters like changing the IP default TTL or manipulating the TCP initial sequence number generation parameters? How do we port these rulesets to ipfw? netfilter? PIX conduits? In short, for this rule to be the slightest bit useful, we must assume that it works perfectly (does not drop a single legitimate frame/packet/segment) and simply cut-and-paste this solution in to our bastion host and hope it works.

      In that sense, you might as well be dealing with the Windows-centric mindset of cut-and-paste and hope it works.

      • I am a security professional and also have an O'Reilly Safari account. I agree completely with you, lylonius. O'Reilly has few good security titles at all. The SSH, OpenSSL, and Kerberos books are the only ones I have kept on my Safari bookshelf for long.

        Looking at my bookshelf in the office, the publishers of security titles I actually purchase from so as to have the hardcopy available for reading/reference/travel are New Riders, Syngress, and Auerbach. O'Reilly isn't represented.

        = jombee
        • There was a thread (RE: TCP/IP skills) today on the security-focus pen-test mailing lists discussing something similar and I think the book Network Security Hacks [amazon.com] is a perfect example. Each trick/hack demonstrates a high-level concept applicable to a single tool.

          So, the argument is, is it sufficient to be well-versed in tools or is it more important to possess a strong understanding of the underlying protocols?

          Of course, we could take it to another level and ask why there are so many books that take a bo
          • ITs always more important to know the underlying principles than a tool. Tools change, principles don't. And principles will help when something not covered by the tools occurs.

            AS for why books don't act like that- two reasons. First, many people want the lowdown on the tools so they can put it on their resume. Second, its easier. A lot easier. A lot of people writing these books don't understand the concepts, and even fewer who do can explain them. Forget the old saw about those who can't teach- te

  • Google (Score:5, Insightful)

    by Roland Piquepaille ( 780675 ) on Thursday July 08, 2004 @06:18PM (#9648128)
    Admittedly, a lot of advice given in the book can be found on Google, but it is nice to find it in one place.

    Well duh...

    Google knows everything, therefore includes any book, just like sea water contains sugar (and almost any known chemical compound) but it's so diluted it would make a lousy sweetener. Therefore, books are good, whether or not Google contains the information in the book.

    • Re:Google (Score:2, Funny)

      by Anonymous Coward
      Google knows everything, therefore includes any book, just like sea water contains sugar (and almost any known chemical compound) but it's so diluted it would make a lousy sweetener. Therefore, books are good, whether or not Google contains the information in the book.

      Can you write this u into a "technology trends" article and submit it to slashdot?

    • Re:Google (Score:5, Funny)

      by BigDave81 ( 790327 ) on Thursday July 08, 2004 @07:00PM (#9648421)
      Yes, but does google know what i'm thinking right now??

    • Re:Google (Score:3, Insightful)

      by Ryosen ( 234440 )
      No doubt he put that comment there to head off the obvious, non-essential and (frankly) lame comments from others who post "big deal, I can find this info on google." Which is fine. But I can find it all in this $16 book much quicker...and it's indexed.
    • "Google knows everything, therefore includes any book, just like sea water contains sugar (and almost any known chemical compound) but it's so diluted it would make a lousy sweetener."

      Wow... this 'Goo-gel' sounds pretty interesting. if you ask me, these guys should make some sort of filtering software based on keywords found in all that 'diluted' seawater, so as to be able to retrieve only relavant information for a person... maybe if they used some web-based application, or interface.... but they would ha

    • Re:Google (Score:4, Insightful)

      by sapgau ( 413511 ) on Friday July 09, 2004 @12:50AM (#9649969) Journal
      Its a catch 22. Google knows everything as long as you ask with the right keywords (i.e jdbc, rmi, DCOM, etc.) If you have no idea what acronyms to include in your query then you are stuck. A good place to get a starting point on the acronyms is reading them from a book!!! :o)

      • Re:Google (Score:3, Insightful)

        by WuphonsReach ( 684551 )
        Its a catch 22. Google knows everything as long as you ask with the right keywords (i.e jdbc, rmi, DCOM, etc.) If you have no idea what acronyms to include in your query then you are stuck. A good place to get a starting point on the acronyms is reading them from a book!!!

        Or subscribe to a good technical rag, or skim the newsgroups or mail lists regularly.

        As they like to say, "Knowing is half the battle"... yeah, simply knowing that something exists and what it might be called. I may not know anything
      • What I usually do is a generic search (ie: network security phrases) to find the keywords to use on a proper search. Works great, even if it is a two step process.

        For instance, I heard about a liquid that will solidify in the presence of a magnetic field. I type "liquid solidify magnetic field" into google. Then, looking though the pages, I find the term "magnetorheological fluid", which makes a much more refined search.

  • "Ah, that's how it is done!" (Score:5, Funny)

    by blue_adept ( 40915 ) on Thursday July 08, 2004 @06:36PM (#9648254)
    why can't I shake the image of Wyle. E. Coyote reading his Acme book of Hacking just before trying something he's about to reget...
    • I can just see it:

      Wyle E, sitting in front of a computer trying to hack the nation's defense computers to use starwars satellites to send a deathray down to the road runner's location.

      Thought bubble appears showing the roadrunner turning into a cooked turkey.

      After a short time, the screen flashes red. Wyle E. starts wiping his HD and eating his printouts and disks.

      Just as he finishes, the FBI break in and arrest him. Next, we see them holding Wyle E. over a plastic bag, waiting for the evidence to dro
  • You could probably just look at the table of contents of this book and do a search on each section/topic. Actually I might try just that, might turn up some interesting stuff.

  • sorry ...but im not impressed (Score:3, Insightful)

    by brunokummel ( 664267 ) on Thursday July 08, 2004 @07:00PM (#9648424) Journal
    with a title like Network Security Hacks I would expect much more than teaching me how to install a program on my computer or how to use SSH to tunnel a connection like the reviewer has said.
    Sorry if im being mean but you can learn just as much by reading the manpages or by using google after the how-tos.
    If you really want to learn something useful about networks I suggest the good old Richard Stevens [amazon.com]

  • O'Reilly discount (Score:5, Informative)

    by MrWa ( 144753 ) on Thursday July 08, 2004 @07:29PM (#9648606) Homepage
    There is currently a $20 mail in rebate for this book at Fry's (and elsewhere?). On the 4th, this book and "Windows XP Hacks" were reduced to $20, so you only had to pay sales tax.

    This deal ends today (7/8) so hurry out:
    Hackers and Painters
    Network Security Hacks
    Windows XP Hacks
    Hardware Hacking
    Ipod and Itunes: The missing manual
    Hardware Hacking projects for geeks
    Adobe photoshop CS one on one
    Mac OS X Panther: the missing manual

  • best, cheapest way to test network security (Score:5, Funny)

    by spacerodent ( 790183 ) on Thursday July 08, 2004 @07:47PM (#9648685)
    The fastest, best, AND cheapest way to test network security is to load up an irc client on it and go to a linux channel. Then simply talk about how your "windows" system is unhackble.

  • First tip: Secure mountpoints (Score:5, Informative)

    by mcgroarty ( 633843 ) <brian.mcgroarty@ ... om minus painter> on Thursday July 08, 2004 @08:12PM (#9648799) Homepage
    The first tip covered is securing mountpoints. Did you know you can mount some volums so that suid bits don't work on them, or so you can't even execute files on them?

    This is a biggie. You can prevent users from creating code in /home if you want, and you can keep runnable stuff out of /tmp or /var.

    Debian does a really great job of keeping those paths pure so that packages don't rely on them having runnable things. This means great strides in security if you mount with those options, save one terrible exception: dselect wants to run scripts in tmp :(

    • Re:First tip: Secure mountpoints (Score:3, Informative)

      by Anonymous Coward
      Yes, in fact openbsd mounts various partitions noexec, nosuid, etc by default.

    • Re:First tip: Secure mountpoints (Score:5, Informative)

      by PacoTaco ( 577292 ) on Thursday July 08, 2004 @09:40PM (#9649187)
      You can prevent users from creating code in /home if you want

      Not quite. You can still run stuff as an argument, like:

      perl /home/pacotaco/something.pl

      • Except:

        a) you aren't executing the script, you are executing perl

        b) it's aweful hard to exploit anything that way, where as if you place an executable called 'ls' in /tmp and someone has '.' in their path, and happens to be in /tmp, they will run your script without knowing it

      • Re:First tip: Secure mountpoints (Score:1, Informative)

        by Anonymous Coward

        The worst interpreter for this is in fact the userland ELF linker, ld.so. For example:

        # chmod -x /usr/bin/xmms
        # /usr/bin/xmms -v
        bash: /usr/bin/xmms: Permission denied
        # /lib/ld-linux.so.2 /usr/bin/xmms -v
        xmms 1.2.10

        • Re:First tip: Secure mountpoints (Score:1, Interesting)

          by Anonymous Coward
          Wow this I didnt know, I always thought this was the worsed:

          #!/usr/local/bin/tcc -run
          #include
          int main(int argc, char **argv)
          { /* place your C Code here */
          return EXIT_SUCCESS;
          }

          But the Tiny C Compiler arent in the default installs.. and this doesnt even come close to yours

  • Haven't finished it yet... (Score:5, Interesting)

    by atomic-penguin ( 100835 ) <wolfe21@nOSpAM.marshall.edu> on Thursday July 08, 2004 @09:41PM (#9649190) Homepage Journal
    I was lucky enough to get a review copy from O'reilly. One of the first things I tried was faking your OS signature for port scans. It was interesting to try it out, but I had to downgrade my Linux Kernel to 2.4.18 *gasp*. So after a recompile, and configuring iptables for IP Personalities, nmap detected "Sega DreamCast Console" on aforementioned machine. There are other signatures, I just wanted to try out the most amusing one. The problem is the patch is deprecated, buggy, not being developed, and the sparse documentation mentions it can make your TCP sequences less secure. Hey, it was amusing to try it, but too much hassle, and maybe it is not the most secure solution. Don't know what this one was doing in a security book, considering it could cause your system to be less secure. Nmap detects the faked signature about 90% of the time, depends on how the network is routed and such.

    Most of the Windows hacks are a matter of downloading 3rd party software, however there was one registry hack to turn off Default SMB shares (C$ and ADMIN$), this was the only Win Hack.

    I have enjoyed reading so far, and will get around to finishing it...eventually. Much like the other hack books there are hacks in here for beginners, intermediates, and wizards.
    • I got OS confusion to work with no kernel hacks - I have a windows (98) box as my gateway, with ports forwarded to all my linux (2.6) boxen behind it - the mix of windows replies and forwarded linux replies results thusly:

      Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2004-07-09 11:17 GMT
      Interesting ports on cafe (192.168.0.1):
      (The 1647 ports scanned but not shown below are in state: closed)
      PORT STATE SERVICE
      20/tcp open ftp-data
      21/tcp open ftp
      80/tcp open http
      113/tcp open auth
      240/tcp open unknown
      6

    • While its often funny as hell to set a server signature to something like "General Electric Toaster Oven, Microsoft Windows 3.11", I gotta wonder if doing this results in more malicious pokes at a system? Obviously a hardcore cracker is gonn know its bogus, and I'm willing to bet this only makes him/her more determined to correctly identify the target.

      Anybody have some stories/thoughts/example data?

  • BOFH hack -- restricted shell (Score:5, Interesting)

    by atomic-penguin ( 100835 ) <wolfe21@nOSpAM.marshall.edu> on Thursday July 08, 2004 @09:47PM (#9649214) Homepage Journal
    bash-2.05b$ bash -r

    bash: SHELL: readonly variable

    bash: PATH: readonly variable

    bash-2.05b$ ls

    bash: ls: No such file or directory

    bash-2.05b$

    Now users cannot run anything that is not symlinked to their home directory.

  • snort setup (Score:5, Interesting)

    by AmishSlayer ( 324267 ) on Thursday July 08, 2004 @11:01PM (#9649594) Homepage
    I've just finished a setup with snort, apf, logsurfer and a custom program to create a live repsone firewall.

    snort will detect the offensive network traffic and put it into the alert log file. Logsurfer will then trigger and email me with a notice, it will run a program I wrote to blacklist the attacking IP (my program checks to make sure the IP is not already banned and makes sure the IP is not my own so I do not get locked out). Finally, my program updates the firewall to block the bastard.

    The only hole I see in this setup is a DoS by attacking with different spoofed "from IPs" until the firewall rules are too big, or too many legit servers are banned.
    • Cool, do you have this blogged somewhere? I am interested in reading more if you have written anything on the setup.

      --gabe
    • Put in a timeout for your rules and you'll be safer as well in case of a DoS directed at your dynamic firewall. For example if you let every dynamic rule have a lifetime of 10 minutes before it gets deleted again it'll cut down on how many rules there are in your iptables setup, and limit the risk of being shut off from someone for a longer time-period.

    • Re:snort setup (Score:1, Informative)

      by Anonymous Coward
      This has been done to death when portsentry was released shortly followed by fuckportsentry.pl that could cripple any machine running it.

      The exploit uses the method you describe, spoofing the source addresses so you block a machine that you should actually trust.

      If you use snort then you've upped the stakes a bit in that the spoofed traffic is quite a lot harder to create but its not impossible. You only need to lose DNS access and the system will be knackered.

      It's a nice idea, pro-active IDS, but unfort
    • Are you familiar with snort2pf [gnu.org]?
      What do you think of it? How does it compare with what you've done?

      And how about the Snort DDOS rules? [snort.org]
    • If you use snort then you've upped the stakes a bit in that the spoofed traffic is quite a lot harder to create but its not impossible. You only need to lose DNS access and the system will be knackered.

      Fortunately, I have whitelisted important services like DNS. But I am still very cautious about this, because it is actually much easier than you might think to trigger a positive (or even a false positive) for snort. A false positive for example would be, IIRC, sending an email (accepted or not) that doe
  • Can someone point me to a download link for the scripts used in that book.
    Thanks in advance.
  • i'll check it out though, thanx :)
  • While a good book is always great, most of this stuff is already on SecurityFocus [securityfocus.com]. Not to mention is home of the bugtraq mailing list [securityfocus.com]. I find alot of the material is already covered in their infocus articles, plus some of the best hackers out there, both white hat and black hat, are on the list and give some of the best tips.

Slashdot Top Deals

We all agree on the necessity of compromise. We just can't agree on when it's necessary to compromise. -- Larry Wall

Close