Maximum Security. A Hacker's Guide to Protecting Your Internet Site
and Network by Anonymous. Indianapolis. Sams.net Publishing. 1997.
ISBN 1-57521-268-4. $49.99. 885 pages. CDROM included. Index. Appendices.
Seven major sections, 31 chapters. by BobBruen
The author of this book prefers to remain anonymous because, he says,
he was convicted in the late 1980s for financial crimes after developing a
method to circumvent automatic teller machines. He now works in the
security field specializes in breaking into systems and providing reports
to the owners. This sounds like a good background for such a book as this.
Since I have no way to verify if this true or just a good marketing
technique, I will take him at his word and concentrate on the book.
The book is long, but it is not unusual for security related books to
be this long. Moreover, the appendices and index are about 120 pages, the
first 160 pages are background for the true novice (hacker vs. cracker and
what is TCP/IP? topics), and there is a 25 page on the law at the end,
all of which puts the useful text at a readable level.
The remaining four sections are Tools, Platforms and Security, Beginning
at Ground Zero, and The Remote Attack. All are filled with good
straight-forward, explanations and pointers to code, papers and other
information. In fact, there is probably an average of a web site per page,
although I did not actually count them, but it represents a fair amount
research. I checked out several of the references including the C source
for a good sniffer program. If you are new systems administrator you may
find yourself a bit depressed by the overwhelming problems coupled with
freely available code to take advantage of these problems. At least the
book offers methods to cope with the problems.
The Tools section has six chapters: Scanners, Password Crackers, Trojans,
Sniffers, Techniques to Hide One's Identity and Destructive Devices.
There is almost 200 pages of hacker tool information - reason enough to
buy the book, unless you want to do the research yourself, and all but one
chapter has additional resources listed at the end.
The Platforms and Security section is more comprehensive than most
security books. The first chapter is all about holes, then a chapter
each on Microsoft, Unix, Novell, VAX/VMS, Macintosh and Plan 9. The VMS
chapter is a bit dated (the author explicitly states this), but it is good
history and most books ignore it completely to focus on Unix. NT is
brought up in the Microsoft section in anticipation of the expected
penetration into the desktop market. Macintosh was a bit of a surprise
to see, but some people still need to protect them from attack. Plan 9
from Bell Labs was unexpected for such a book since it is not all that
commonplace. The author makes a good case for including it. It has no
root that can be compromised. If you are interested in examining one
approach to stopping hackers & crackers then Plan 9 is worth looking
into, although since it is the property of AT&T is not free.
A short section is next discussing the importance of root, breaching
a server internally and a little about security consultants.
The last of the core sections discusses various aspects of the remote
attacks. The problem is spelled out with definitions which break out
the different levels that are possible. Other chapters cover firewalls,
spoofing, telnet-based attacks and a handy chapter on languages. This
last chapter brings to light the good and the bad about C, Perl, Java
and others, even ActiveX, in an even-handed manner although it is clear
where the author's biases are.
If you need to worry about securing your site (and who doesn't?), this
is a worthwhile purchase and a worthwhile read. If you are experienced
in security a certain amount may be redundant, but there are lots of
pointers that should provide something new. The CD has some useful stuff
on it as well to save you the trouble of tracking it all down. If you already
have a sniffer, you might want to compare several others that are
mentioned. If you have not given too much thought to just what is out there,
this book will fix that problem.