Exploiting Software: How to Break Code

Anyone who's been in network security long enough will tell you that the current state of products and `solutions' to security problems are woefully inadequate. Firewalls, intrusion detection systems, content filters and anti-virus solutions are all reactive technologies, and as a result, they fail to address the primary cause of security vulnerabilities. This root cause is bad software. Viruses, worms and hackers exploit vulnerabilities in the design and logic of software applications to compromise, destroy and otherwise take control of important information. Once you accept this fact, you'll realize that the only path to good security is to write better code. `Exploiting Software - How to Break Code' is a book that fires up the hacker in me. It does not aim to teach you about the latest scanning tool, instead, it teaches you how to find and exploit vulnerabilities in systems. While many of the ideas in the book (such as the omnipresent buffer overflow) are not new, there is simply no literary comparison to the treatment given to them in this book. Application security is one of the highest regarded and specialized technical services in the security industry, and thus, finding people (let alone books) that delve in-depth into the topic is rare and refreshing. The first day I used this book, I was on an application security project. The target application was a distributed database application running on SQL server with a web front-end. I happened to have this book along with me, and while reading through it, the section on equivalent requests was something I hadn't tried - sure enough, 20 minutes later I had full control of the application and a very good impression of this book. I particularly like the conceptual sections of this book, especially their idea of `attack patterns' - generic scenarios that often lead to compromise in systems. A thorough study of all these attack patterns will leave you a much better analyst than when you started out, and it definitely pays off when it comes to testing. The book is also chock-a-block full of code, something that other books don't have the guts to do. Better yet, we're not talking about `hello world' stuff here, while reading the excellent chapter on root kits I finally realized that the device driver code I was trying out was way over my head. That's something you like to find, because it gives you something to learn. The art of reverse engineering, disassembly, writing IDA-Pro plugins, black / white and grey-box techniques, advanced payload creation on multiple architectures - this book has it all. The only thing I can possibly say against it is that this it caters to a niche audience. If you're not a coder or seriously into security however, large parts of the book may be inaccessible to you. However if you're a hacker, security tester or application developer and you don't own a copy of this book, you're not reaching your full potential.

A disturbing, subversive book. And I mean this in a positive sense. Hogland and McGraw explain the major ways in which software can be attacked. They describe how reverse engineering can be done, even if all you have is binary code to work on. Given a disassembler and a decompiler, and these exist for all the major platforms, you can systematically apply white box, black box and grey box analysis to deconstruct a program.They show how attacks can be done against servers, because nowadays on the net, servers are often tempting, fat targets. But from your standpoint, if you wish to defend against these attacks, you really need to be aware of the issues they raises. "Know the enemy". Plus, they also show how a server could attack, or be used to attack, unsuspecting clients that connect to it.Of course, buffer overflows are the most commonly known source of attacks. Thus an entire chapter is devoted to this.PHP users may not be thrilled to hear that it is fundamentally insecure. Its ease of learning and coding comes with this heavy price. Still, it is all the more reason that PHP users and sysadmins running web servers that use PHP, should be aware of the dangers in it.The book is not a trivial read. The authors give detailed examples at the level of the x86 assembler. A strong background in this and in C/C++ will give you the greatest benefit when studying the book.

Target AudienceSoftware developers and network administrators who are responsible for or concerned with the security of the code they write or run.ContentsThis book covers software exploits and how they work. The book is divided into the following chapters:Software - The Root Of The Problem; Attack Patterns; Reverse Engineering And Program Understanding; Exploiting Server Software; Exploiting Client Software; Crafting (Malicious) Input; Buffer Overflow; Rootkits; References; IndexReviewSoftware security is foremost in the news today. You can't go a day without news on how another group has found and exploited some software flaw to create havoc on the internet. It seems that the software bugs are found faster than the developers can patch them. How can a software developer get ahead of the curve and write software that is more secure from the start? Get this book.The authors start out with an overview of software and how code is open to bugs and exploits. By understanding the concepts of complexity, extensibility, and connectivity, you'll start to understand how easy it is for software to be "broke" by others to gain some sort of advantage or control over it. The rest of the book then goes into specific areas of attack and how they occur. There is an abundance of "attack patterns" that are highlighted throughout the chapters. These short sidebars will help you understand all the types of attacks that can (and will be) used against your systems. After you read and digest this information, you will be much better prepared to write code that is designed to be more secure from the initial design through implementation.A question comes to mind quickly when reading the book... Isn't it dangerous to put all this hacking information in one place where anyone can access it? In my opinion, it's more dangerous to not have this data available. If a person wants to break your software or systems, they already know this stuff. In the case of software security, it's often the corporate developer who is at a distinct disadvantage as they are more concerned with getting their software to work in the first place. By having a single volume that explains the concepts of software exploitation in detail, we can all start to write secure software instead of writing patches to fix flawed code. ConclusionThis book should be on the shelf of all software developers and administrators who are concerned about writing and administering secure software. And that should be all software developers and administrators! The information may be disturbing, but you need to understand it before others use the information against you.

Hoglund and McGraw is an amazing book. It's well written, comprehensive and full of detailed, up-to-date methodologies for messing with all kinds of code. It's a shame the black hats can buy this book. However, since they can, every white hat should make a point of reading it to understand how subtle attacks can be and what kinds of tools are out there to help develop exploits.Reading it will make you weep about the current state of operational code vulnerability!!!

For many years the "white hats" (good guys) have tried to guess how the black hats think, and how they find problems with software. That's as true with software as it is with other disciplines, where police study criminals, and military strategists learn about their enemy's tactics. Those of us in the information security field need to study our criminals and enemies, so we can tell the difference between pop guns and weapons of mass destruction.I enjoyed this book because it helped me understand how the bad guys think, and how they find the flaws that we constantly read about (and suffer from).The authors explain not only how hackers attack servers, but also how malicious server operators can attack clients (and how each can protect themselves from the other). I'd highly recommend it as a companion to Ross Anderson's "Security Engineering": Anderson's book provides the broad view of security, and this book provides the deep analysis of software security.An excellent book for practicing security engineers, and an ideal textbook for an undergraduate class in software security.