[ISN] REVIEW: "Exploiting Software", Greg Hoglund/Gary McGraw

From: InfoSec News (isn@private)
Date: Tue Jun 29 2004 - 06:26:05 PDT

  • Next message: InfoSec News: "[ISN] Seven habits of highly secure companies"

    Forwarded from: "Rob, grandpa of Ryan, Trevor, Devon & Hannah" <rslade@private>
    BKEXPLSW.RVW   20040531
    "Exploiting Software", Greg Hoglund/Gary McGraw, 2004, 0-201-78695-8,
    %A   Greg Hoglund
    %A   Gary McGraw
    %C   P.O. Box 520, 26 Prince Andrew Place, Don Mills, Ontario  M3C 2T8
    %D   2004
    %G   0-201-78695-8
    %I   Addison-Wesley Publishing Co.
    %O   U$49.99/C$71.99 416-447-5101 fax: 416-443-0948
    %O  http://www.amazon.com/exec/obidos/ASIN/0201786958/robsladesinterne
    %O   http://www.amazon.ca/exec/obidos/ASIN/0201786958/robsladesin03-20
    %P   471 p.
    %T   "Exploiting Software: How to Break Code"
    I have learned to beware of books with titles like this, which
    generally indicate a hastily compiled set of old vulnerabilities,
    benefitting nobody save the author.  This work, however, turns out to
    have a lot of value for those interested in security of software.
    Although it does not deal with the factors inherent in software that
    almost ensure problems, chapter one outlines the fact of bugs in
    software, the relative rate and increasing prevalence, and future
    developments that may exacerbate the issue.  Chapter two provides
    taxonomies of general types of software problems (distinguishing, for
    example, between a bug and a flaw), patterns of attack activities
    (pointing out that most exploits are used in combination), and types
    of system scanning activities (used to determine specific attacks that
    might be effective).  This material is very useful in structuring the
    debate about software exploits and attacks in general, but,
    ironically, the chapter (and book) itself could benefit from better
    organization.  Reverse engineering, both via black box testing and
    through code analysis, is described in chapter three.  The discussion
    is general, and presents the different activities that can be
    undertaken, usually at a fairly abstract level.  (This is not true in
    all cases: there is a chunk of twelve pages of code for a plug-in
    module and eight pages of script for the IDA disassembler, which is of
    questionable utility, depending on the familiarity the reader may have
    with that particular program.)
    At this point in the book, the issue of the validity of the "learn to
    exploit in order to learn to protect" philosophy should be addressed. 
    In general, the "hack to protect" books do not provide much that is of
    value for the defenders.  That statement is not necessarily true of
    this work.  Since most of the presentation is at a conceptual level,
    it is the ideas, and not particular exploits, that are being reviewed. 
    The authors are explaining tools and techniques that, yes, can be used
    by attackers, but can equally be used by those who wish to probe a
    given system for weaknesses in order to determine vulnerabilities to
    be patched.  (There appears to be only one exception in chapter three:
    the authors note that vendor patches tend to act as a roadmap for
    vulnerabilities, and it is difficult to say how this technique is
    useful for defence, other than to note that the probability of an
    exploit increases after a patch has been issued.)
    Chapter four lists types of attacks on server software, while five
    looks at clients, primarily web browsers.  Indications pointing to
    patterns of malformed input that are likely to generate successful
    exploits are described in chapter six.  The classic and ubiquitous
    buffer overflow gets a detailed explanation (supported with a number
    of examples) in chapter seven, which has a strangely extensive section
    on RISC (Reduced Instruction Set Computer) architectures.  Chapter
    eight is rather disappointing in light of the tone of the rest of the
    book: it is primarily concerned with how to create and program
    rootkits, and the worth for defence is doubtful.
    While ultimately of greatest use to a rather select audience (those
    specifically concerned with finding and patching loopholes in
    software), this book does have a lot to say to most security
    professionals.  The security aspects of software development tend to
    be glossed over too quickly in most general works on security. 
    Specific examples of malformed input are used, in too many security
    texts, as evidence of the author's superior security erudition, rather
    than to explain the underlying concepts.  Hoglund and McGraw have
    prepared solid tutorials and definitions of these important ideas
    (although one could wish that they had prepared the arrangement of the
    book with the same degree of care).
    copyright Robert M. Slade, 2004   BKEXPLSW.RVW   20040531
    ======================  (quote inserted randomly by Pegasus Mailer)
    rslade@private      slade@private      rslade@private
    Vah! Denuone Latine loquebar? Me ineptum. Interdum modo elabitur.
    Oh! Was I speaking Latin again? Silly me. Sometimes it just sort
    of slips out.
    http://victoria.tc.ca/techrev    or    http://sun.soci.niu.edu/~rslade
    ISN mailing list
    Sponsored by: OSVDB.org - For 15 cents a day, you could help feed an InfoSec junkie!
    (Broke? Spend 15 minutes a day on the project!)

    This archive was generated by hypermail 2b30 : Tue Jun 29 2004 - 09:37:55 PDT