Reviewed by:  Robert Bruen   October 12, 2000

This is a book that I can recommend for its technical content, the topics covered and the contributors, but the quality is almost overshadowed by the hype associated with it.  The contributors are well known to Bugtraq readers and some even by the those that read the general press.  As an example of the hype problem, the well known Mudge, of L0pht fame, is mentioned on the cover with equal billing to the two editors and his bio gets the most ink of any contributor's bio, equaled only by Cunningham who is the technical editor of the book, just for writing the two page forward.  There are other examples, but there is no need to dwell on them, the book is more interesting.

The book is organized into four main sections, Theory and Ideals, Theory and Ideals (yes, section 1 an 2 have the same name), Remote Attacks and Reporting.  It would have been better to simply not have any section headings.  The chapters on the other hand are worth reading after wading through the top level stuff.  There are the expected chapters on Hacker definitions, laws and reporting, but in addition there are really good chapters on Unexpected Input, one of the better explanations of Buffer Overflows and one called Diffing that shows how one uses differences in files to locate (and modify) important data, for the more technical among us.

The range of topics is from high level politics to low level hex editing, which makes the book more a reference book that one that you read through start to finish.  This is not intended as a criticism, but just an observation that comes from having a dozen or so contributors for as many topics.  Hacking/cracking has gone from a few guys looking for a few holes to a world wide sport with sophisticated players and script kiddies looking for a joy ride.  This book reflects the growth in the "industry" of hacking which now includes many people attacking, defending, commenting and fans watching the battle.

Because of the large number of users affected by security concerns, the average level of knowledge is quite low elevating the myths of hackers and defenders to even greater heights.  Many books are geared to the new systems and networks administrators to help shore up their defenses, but not that many explain in detail just what the hackers are doing.  This one has some the more important techniques clearly laid out.

This is a recommended book for the content, some of which is not available in book form and for the quality of the explanations.  It would be helpful to a few more books like this one that explain techniques in a technical manner and not just with scare tactics.  The struggle over the years between computer code writers and computer code breakers is an just an extension of the millennia old struggle between code writers and code breakers of all kinds.  More analysis is need to strengthen our knowledge for producing strong, secure operating systems and application software. Hack Proofing is a good contribution to this end.