Security Warrior

Today's computer systems and networks are constantly under siege by viruses, worms, denials of service, password sniffers and the like. To repel these attacks, computer security professionals must adopt a warrior-like attitude. Security Warrior is equipped to be the number one network security book in the world, written for the advanced infosec practitioners interested in taking their skillset to the highest level. The book provides the first complete coverage of software reverse engineering; advanced Bayesian analysis; how to detect wireless 802.11 rogue access points; building honeynets, and more. Security Warrior also covers security aspects of new operating systems, including Windows 2003 Server and Windows CE .NET.

Dr. Cyrus Peikari is currently the Chief Technical Officer of Airscanner Corporation, a leading mobile security software company. He personally holds several patents in the anti-virus and infosec fields. In addition to numerous radio and television appearances, he is a popular speaker at technology and network security conferences. He has co-authored four bestselling security books, two of them as lead author, including Maximum Wireless Security, Windows .Net Server Security Handbook, and Windows Internet Security.

Preface

xiii

Part 1. Software Cracking

1. Assembly Language

3

(6)

Registers

4

(3)

ASM Opcodes

7

(1)

References

8

(1)

2. Windows Reverse Engineering

9

(24)

History of RCE

10

(1)

Reversing Tools

11

(12)

Reverse Engineering Examples

23

(9)

References

32

(1)

3. Linux Reverse Engineering

33

(85)

Basic Tools and Techniques

34

(20)

A Good Disassembly

54

(15)

Problem Areas

69

(5)

Writing New Tools

74

(42)

References

116

(2)

4. Windows CE Reverse Engineering

118

(43)

Windows CE Architecture

119

(4)

CE Reverse Engineering Fundamentals

123

(8)

Practical CE Reverse Engineering

131

(16)

Reverse Engineering serial.exe

147

(13)

References

160

(1)

5. Overflow Attacks

161

(18)

Buffer Overflows

161

(1)

Understanding Buffers

162

(3)

Smashing the Stack

165

(1)

Heap Overflows

166

(1)

Preventing Buffer Overflows

167

(1)

A Live Challenge

168

(7)

References

175

(4)

Part II. Network Stalking

6. TCP/IP Analysis

179

(20)

A Brief History of TCP/IP

179

(1)

Encapsulation

179

(1)

TCP

180

(2)

IP

182

(2)

UDP

184

(1)

ICMP

185

(1)

ARP

185

(1)

RARP

186

(1)

BOOTP

186

(1)

DHCP

186

(1)

TCP/IP Handshaking

186

(2)

Covert Channels

188

(1)

IPv6

188

(2)

Ethereal

190

(1)

Packet Analysis

191

(1)

Fragmentation

192

(6)

References

198

(1)

7. Social Engineering

199

(13)

Background

200

(2)

Performing the Attacks

202

(7)

Advanced Social Engineering

209

(2)

References

211

(1)

8. Reconnaissance

212

(13)

Online Reconnaissance

212

(12)

Conclusion

224

(1)

References

224

(1)

9. OS Fingerprinting

225

(11)

Telnet Session Negotiation

225

(1)

TCP Stack Fingerprinting

226

(3)

Special-Purpose Tools

229

(1)

Passive Fingerprinting

229

(3)

Fuzzy Operating System Fingerprinting

232

(2)

TCP/IP Timeout Detection

234

(1)

References

235

(1)

10. Hiding the Tracks

236

(21)

From Whom Are You Hiding?

236

(1)

Postattack Cleanup

237

(6)

Forensic Tracks

243

(5)

Maintaining Covert Access

248

(6)

References

254

(3)

Part III. Platform Attacks

11. Unix Defense

257

(42)

Unix Passwords

257

(4)

File Permissions

261

(3)

System Logging

264

(3)

Network Access in Unix

267

(3)

Unix Hardening

270

(15)

Unix Network Defense

285

(13)

References

298

(1)

12. Unix Attacks

299

(30)

Local Attacks

299

(8)

Remote Attacks

307

(14)

Unix Denial-of-Service Attacks

321

(7)

References

328

(1)

13. Windows Client Attacks

329

(21)

Deniahof-Service Attacks

329

(10)

Remote Attacks

339

(4)

Remote Desktop/Remote Assistance

343

(6)

References

349

(1)

14. Windows Server Attacks

350

(19)

Release History

350

(1)

Kerberos Authentication Attacks

351

(1)

Kerberos Authentication Review

351

(5)

Defeating Buffer Overflow Prevention

356

(1)

Active Directory Weaknesses

357

(2)

Hacking PKT

359

(1)

Smart Card Hacking

360

(3)

Encrypting File System Changes

363

(2)

Third-Party Encryption

365

(2)

References

367

(2)

15. SOAP XML Web Services Security

369

(5)

XML Encryption

369

(3)

XML Signatures

372

(1)

Reference

373

(1)

16. SQL Injection

374

(17)

Introduction to SQL

374

(3)

SQL Injection Attacks

377

(6)

SQL Injection Defenses

383

(4)

PHP-Nuke Examples

387

(3)

References

390

(1)

17. Wireless Security

391

(18)

Reducing Signal Drift

391

(2)

Problems with WEP

393

(1)

Cracking WEP

393

(6)

Practical WEP Cracking

399

(1)

VPNs

399

(1)

TKIP

400

(1)

SSL

401

(1)

Airborne Viruses

401

(5)

References

406

(3)

Part IV. Advanced Defense

18. Audit Trail Analysis

409

(15)

Log Analysis Basics

409

(1)

Log Examples

410

(8)

Logging States

418

(1)

When to Look at the Logs

419

(1)

Log Overflow and Aggregation

420

(1)

Challenge of Log Analysis

421

(1)

Security Information Management

421

(1)

Global Log Aggregation

422

(1)

References

423

(1)

19. Intrusion Detection Systems

424

(22)

IDS Examples

425

(5)

Bayesian Analysis

430

(5)

Hacking Through IDSs

435

(2)

The Future of IDSs

437

(2)

Snort IDS Case Study

439

(4)

IDS Deployment Issues

443

(2)

References

445

(1)

20. Honeypots

446

(13)

Motivation

447

(1)

Building the Infrastructure

448

(9)

Capturing Attacks

457

(1)

References

458

(1)

21. Incident Response

459

(19)

Case Study: Worm Mayhem

459

(1)

Definitions

460

(2)

Incident Response Framework

462

(4)

Small Networks

466

(5)

Medium-Sized Networks

471

(2)

Large Networks

473

(4)

References

477

(1)

22. Forensics and Antiforensics

478

(31)

Hardware Review

478

(2)

Information Detritus

480

(1)

Forensics Tools

481

(5)

Bootable Forensics CD-ROMs

486

(4)

Evidence Eliminator

490

(7)

Forensics Case Study: FTP Attack

497

(9)

References

506

Part V. Appendix

Appendix: Useful SoftICE Commands and Breakpoints

509

(8)

Index

517

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Rent More, Save More! Use code: BBRENTAL

5% off 1 book, 7% off 2 books, 10% off 3+ books

Summary

Author Biography

Table of Contents

Supplemental Materials

FREE SHIPPING

Rent More, Save More! Use code: BBRENTAL

5% off 1 book, 7% off 2 books, 10% off 3+ books

Security Warrior

Summary

Author Biography

Table of Contents

Supplemental Materials

Digital License