Stealing the Network: How to Own an Identity 99
Scott Pinzon writes "Writing sonnets, screenplays, or an epic poem in your third language is a breeze compared to the toughest of art forms, didactic fiction. That might explain why the various chapters of Stealing the Network: How to Own an Identity range from appalling to exciting. Whether you see the glass of STN: Identity as half empty or half full depends on whether this is your cup of poison -- but on a technical level, it rocks." Read on for the rest of Pinzon's review.
Stealing the Network: How to Own an Identity | |
author | Raven Alder, Jay Beale, Riley "Caezar" Eller, Brian Hatch, Chris Hurley (Roamer), Jeff Moss, Ryan Russell, Tom Parker, Timothy Mullen, Johnny Long |
pages | 336 |
publisher | Syngress |
rating | 6 |
reviewer | Scott Pinzon |
ISBN | 1597490067 |
summary | Fiction that teaches about network security |
Slashdotters have a distinguished history of calling b.s. on fiction authors who get technical details wrong. (My recent favorite is Jeffrey Deaver's jargon-in-a-blender paragraphs in The Blue Nowhere, where a computer expert can't break a hacker's defenses because "I can't decrypt his firewall!") But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
And these authors do have impeccable Internet security cred. Many of them are stars circling the firmament of Black Hat and Defcon; senior penetration testers; former consultants to No Such Agency; authors of popular books on security; and so on.
Thus, STN: Identity describes attacks with accuracy and depth. The light veneer of fiction gives the networking tips real-world context. (On this point, I agree with Blain Hilton, who reviewed the first STN volume for Slashdot.) Sure, you've heard of all kinds of hacker tools, but do you know exactly when an attacker would use, say, Metasploit Framework, and not Knoppix? Chris Hurley's chapter, "Saul on the Run," stands out in this regard, showing how a black hatter uses social engineering and numerous tools to get a valid birth certificate for someone else, and exactly how an attacker can intrude on a secured wireless residential network to explore private information.
Another stand-out chapter is Johnny "Google Hacker" Long's "Death by a Thousand Cuts." This rambling episode follows, in part, a forensic cop's efforts to make a disc image of an iPod found at a crime scene. The trouble is, Apple's drivers spring into action whenever the iPod senses it has connected to a computer. If the driver activity changes anything in the iPod, all evidence on it will be inadmissible in court. In unraveling this challenge, STN became so fascinating, I couldn't put it down. Which made showering awkward.
Brian Hatch's chapter, "Bl@ckTo\/\/3r," stood out to me, also, but for the opposite reason: almost all of it went over my head. I thought I had accepted Unix into my heart, but I'm not disciple enough to keep up with Hatch's treatise on X11. Where I thought Hatch was talking only to himself, I had a more senior network security expert read the chapter, and he considered it well written. YMMV.
Other chapters cover basic crypto and code-breaking; how to forge cards that will fool magnetic stripe readers; the dark side of biometric authentication; uses of a Faraday cage; making a QWERTY keyboard type Dvorak letters, and just lots and lots of good undergroundy badness. The technical lessons hold tightly to the stated theme of identity theft. Any network administrator could learn a lot about the enemy's techniques from this volume; and, because of the story-driven format, probably even remember them.
But I've been dodging my opening question: does the fiction part work? Before I answer, I should mention that I've written a lot of fiction. I've had four books of fiction and 60 short stories published, and studied under the editor who removed 500 pages from Stephen King's The Stand. I'm not saying I'm good at writing fiction; I'm just saying I respect the craft. So, can STNs authors write fiction? No. No, they cannot.
STN: Identity reads like a catalog of beginning-fiction-writer mistakes, from misspellings and homophones (from Chapter 5: "He called me a Windows administrator, and it wasn't a complement") to characters with no feelings or personality. In Chapter 8, where college students decide to 0wn Hushmail's DNS servers for a man-in-the-middle attack, they work 36 hours straight without a smart remark, a crabby comeback, or, really, any dialog except ad hoc lectures on network architecture. Fiction-wise, it's as if Nancy Drew or the Hardy Boys tried hacking. And a couple of the chapters go so far past "wordy" that they're almost the verbal equivalent of running in place. If you're in a hurry to get to the technical meat [Jedi hand wave], these are not the authors you want. With that said, I admit that some of the chapters clamber all the way up to "adequate." But remember, fiction that teaches is hard for anyone to pull off.
Maybe none of that matters. Is anyone looking for deathless prose when picking up a book subtitled "How to Own an Identity"? Nah. What matters is, the various authors lay down some seriously tricky attacks. If you are more geek than lit critic, the coolness factor is off the charts. If you like to spend your time reading and thinking about network security and hacking, this is for you. And if you still buy into the "romance" of hacker shenanigans, STN can be your little Defcon-away-from-Defcon.
So is this wildly uneven book worth the price? For fiction lovers, no. For white hat security aficionados, yes. For black hat security aficionados, buying it will be the last purchase you make on your own credit card -- so hell yes. #
Full disclosure: I am not personal friends with any of the authors, but I've interviewed a few of them, including the book's technical editor, Timothy Mullen, for my day job. I may also suffer from envy that my own attempts to fictionalize network security have been ignored by most of the world except German Tom's Hardware.
Scott Pinzon, CISSP, is Editor-in-Chief for WatchGuard's LiveSecurity Service, and writes about network security on the free RSS news feed WatchGuard Wire. You can purchase Stealing the Network: How to Own an Identity from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Khaaaaan! (Score:4, Funny)
Is that a new Star Trek movie I didn't know about?
Re:Khaaaaan! (Score:1)
Really, I have no idea how they solve any crimes on those things. If they dropped their pen they wouldn't be able to find it in the murk that is the office lighting, never mind finding microscopic fibres or flecks of blood/paint.
Re:Khaaaaan! (Score:2)
As long as they can find their guns - and not drop them - they don't care.
Of course, they can't HIT anything with their guns, but that's another story.
Re:Khaaaaan! (Score:2)
Khaaan [khaaan.com]
Birth Certificate (Score:3, Interesting)
I think comprimising someone's birth certificate, and thus all government issued documents is a bit more serious than cracking a home network.
Re:Birth Certificate (Score:1)
Re:Birth Certificate (Score:1)
Re:Birth Certificate (Score:1)
Copyright (Score:3, Funny)
I gather the book was made by copy/pasting Slashdot posts then? Tssk tssk, plagiarism, not good that...
Stealing Linux (Score:3, Funny)
I'm writing to ask for your advice since you seem to know about stealing. I was recently at a friends house, and he showed me his new Linux. It had a lot of interesting "features" like windows and firefox and tcpip. He even showed me dirty pictures with it.
My friend told me that he downloaded his Linux for free! He even showed me the web site. I think it was linuxtorrent.com. I freaked out! He's stealing form Linux! He told me that it was OK and that Linux is free, but I didn't believe him.
What should I do? My friend is stealing from Linux. A lot of people worked very hard to make Linux, and he's taking it without even saying thanks. I want him to stop, but I don't want him to go to jail!
Solution (Score:1)
Microsoft
C/O Genuine Advantage
1 Microsoft Way
Redmond, WA 98052-8300
They've been trying to let the world know that Linux isn't free for ages and they need your help!
Re:Stealing Linux (Score:1)
Re:Stealing Linux (Score:3, Funny)
Re:Poster's synopsis should have read: (Score:1, Informative)
Duplicate the network! (Score:1)
Fiction==Lame | Non-fiction Better (+1, Seditious) (Score:1, Funny)
How To Steal AND Own A Country
by Cheney, R. B., Rove, K., Rumseld, D., and Rice, D. [whitehouse.org]
Regards,
K. Trout, CEO
Re:Fiction==Lame | Non-fiction Better (+1, Seditio (Score:2)
You forgot Ariel Sharon - and he doesn't even live in D.C. - and the guys at AIPAC, a couple of whom may be looking at jail time for espionage.
Need to add George H.W. Bush, James Baker, their cronies at the Carlyle Group, and the Saudi royal family (including the bin Ladens), too.
Re:Duplicate the network! (Score:2)
spoiler (Score:1)
Re:spoiler (Score:4, Funny)
I wrote it by myself? The publisher owes me some more roylaties, then.
How about... (Score:2, Interesting)
Offtopic.... buuuuut (Score:5, Funny)
Shashdotters call b.s. on anything because they like to do this! They are natural born devil's advocates and kill-joys who look for the flaws in things. And it makes them happy, if not on the outside then deep on the geeky inside.
But what happens when the problem is reversed? Can authors with awesome technical credentials, but little literary background, teach by using story?
The same thing would happen. Slashdotters are nitpickers because they can be. Slashdotters, while a majority of them are tech heads, are not limited to tech heads. Nerd and geeks take many forms, including literary geeks. Enough of them exist in the slashdot base to properly rend a poorly written and poorly thought-out story to quivering shreds.
Re:On topic now (Score:2)
I call B.S. Let me be the devil's advocate and put to you that you're nitpicking on Slashdotters' habits.
Re:Offtopic.... buuuuut (Score:2)
And it should be "Nerds and geeks take many forms...". What a moron! I bet he uses suboptimal thermal paste!
Re:Offtopic.... buuuuut (Score:2)
Shashdotters call b.s. on anything because they like to do this! They are natural born devil's advocates and kill-joys who look for the flaws in things.
Facts:
These guys are so crazy and awesome that they flip out ALL the time. I heard that there was this Slashdotter who was eating at a diner. And when some dude dropped a spoon the Slashdotter kill-joyed the whole to
Hmm, not the guys I hang out with. (Score:1)
How to Own an Identity (Score:5, Funny)
2. Get issued a state sanctioned Identification Number.
3. Get a job
4. Profit.
Re:How to Own an Identity (Score:2)
4. Don't Profit
Re:How to Own an Identity (Score:1)
making a QWERTY keyboard type Dvorak letters (Score:3, Funny)
Cb Qw frg hgoy dak. yr mat. ogp. yday yd. _QtxNafrcgy_ rlycrb cb yd. t.fxrape o.jycrb co o.y yr _ekrpat_ cboy.ae ru _go_ rp ,day.k.pv
Ru jrgpo.w p.an daq0po ap. jrmmabe ncb. go.pow or frg ,aby yr go. _nraet.fo ekrpat_ cboy.aewv C dak. ydco cb mf i.byrr oyapygl ojpclyov
Yd. ucpoy ydcbi C gogannf er ,d.b C i.y a b., t.fxrape co yr lrl ruu ann yd. jalo abe p.appabi. yd.m cb Ekrpat nafrgyv Rbj. C dak. yd. t.fo o.y gl pcidyw C jab rbj. aiacb nrrt ay mf ucbi.po ,dcne C yfl.v d.d.v
Cy-o dape x.cbi or 1337v
Re:making a QWERTY keyboard type Dvorak letters (Score:1)
Re:making a QWERTY keyboard type Dvorak letters (Score:2, Interesting)
In X, you just have to make sure that the "XkbLayoiut" option in the keyoard section is set to "dvorak" instead,. I have this in my gentoo startup scripts.
The first thing I usually do when I get a new keyboard is to pop off all the caps and rearrange them in Dvorak layout. Once I have the keys set up right, I can once again look at my fingers whild I type. hehe.
It's hard being so 1337."
Daymn, you're so 13373 you don't even need to use
Re:making a QWERTY keyboard type Dvorak letters (Score:1)
P.S. You seem to be missing a chunk after "instead". jpn has a complete translation lower down.
Re:making a QWERTY keyboard type Dvorak letters (Score:2, Informative)
Re:making a QWERTY keyboard type Dvorak letters (Score:1)
Re:making a QWERTY keyboard type Dvorak letters (Score:1)
Re:making a QWERTY keyboard type Dvorak letters (Score:1)
I keep it straight in my head just by remembering what I have said.
The script in question... (Score:2)
The quick way to switch your actual keyboard is to use setxkbmap, or loadkeys, but if then you'd need to type in all the comments here to have them translate. This script would work as a filter, which is more convienient.
Also, if you want to switch back and forth, or are on an old system that doesn't have alternate keyboar
and he wrote the Xian Encyclopedia Brown too... (Score:2, Informative)
Re:and he wrote the Xian Encyclopedia Brown too... (Score:1)
Re:and he wrote the Xian Encyclopedia Brown too... (Score:1)
Re:and he wrote the Xian Encyclopedia Brown too... (Score:1)
Every Story has a Moral (Score:5, Insightful)
What is the moral being propagated in this work? None? Is it just a wapper for tech knowledge? Then why read it? Most geeks just want the facts. As the reviewer points out /. ers do well at calling bs. Why read poorly crafted fiction when the tech details are readily at hand?
Re:Every Story has a Moral (Score:1)
Re:Every Story has a Moral (Score:2)
not nearly as boring as bad fiction
Re:Every Story has a Moral (Score:3, Insightful)
Re:Every Story has a Moral (Score:2)
Re:Every Story has a Moral (Score:3, Insightful)
I don't want a military bomb expert who couldn't figure out how to build a bomb (albeit a lame one) with some nails, some glass bottles, Clorox, and a bottle of ammonia. Similarly, I feel a hell of a lot better as a network administrator (unpaid -- grumble) knowing how to compromise a system when it comes to securing the damned thing.
Re:Every Story has a Moral (Score:3, Funny)
(Note: I am in no way attempting to equate my fiction abilities with those of Stephen King.)
Re:Every Story has a Moral (Score:4, Interesting)
I haven't read this book and I likely won't; it sounds too much like a the computer-crime version of a Tom Clancy or Stephen King novel. There are probably several flaws in it, but the reasons you cite would rule out e.g. Thomas Pynchon's Entropy, one of the classics of modern American literature.
Re:Every Story has a Moral (Score:3, Interesting)
Admittedly, themes run through great works, and, you're quite right about Aesop's Fables and the passion plays. I would add that the works of the Troubadours and Trouvères also have much to do with the making of The Western Canon [amazon.com].
My point
Re:Every Story has a Moral (Score:1)
STN: How To Own A Continent (Score:3, Informative)
The STN series is unique in that it focuses on technical details. Some of the fiction itself might be lacking in form, but the reality is that this is not what the authors are really trying to do. They're trying to educate about various techniques in an entertaining way, and in that department I think they do a pretty good job.
One of the criticism about STN: How To Own A Continent that I had, though, was that there didn't seem to be enough technical details. I'd much rather read a book like this and have it go over my head than be able to understand everything without much thought. From this review, it looks like they might have addressed this in STN: How To Steal an Identity.
Most likely, I'll be ducking into a bookstore to buy this thing.
Re:STN: How To Own A Continent (Score:3, Interesting)
To give you fair warning, I don't think you'll find the tech level in this one any different from Continent. I think it's quite relative to the reader, and the reviewer's comments reflect his impression.
Having said that, I would of course love to have you thumb through it in a bookstore, and decide yourself. I expect you will be abe to find it on store shelves in a few weeks. The first printing just finished this week, and so far the only place you could have purchased it is a
Badly edited. (Score:5, Insightful)
The beginning mistakes listed here, except for lack of characterization, could all have been fixed if the book had been run past a competant editor. Just using a spelling checker and (maybe) a grammer checker isn't enough. You need to make sure the words are the right words, and a computer just can't do that. Blame the publishers for that, not the authors.
Re:Badly edited. (Score:2)
Re:Badly edited. (Score:2)
Re:Badly edited. (Score:1)
Re:Badly edited. (Score:2)
Practice what you preach... (Score:3, Interesting)
Title says it all (Score:4, Funny)
After all, how can the authors be truly 1337 if they can't even spell pwn?
Re:Title says it all (Score:2)
They AREN'T 1337 - they know what they're doing.
Everything I've read by the "1337" has usually been out-of-date by about ten years and lame when it wasn't.
Which is why the book is safe to publish because the 1337 will never understand it.
Re:Title says it all (Score:1)
It was a joke, son! Yer supposed to laugh.</leghorn>
Re:Title says it all (Score:2)
I know that, I was making a "pointed comment" in response.
Not against
What About The Guy Who Didn't Want To Wait (Score:3, Interesting)
So he sold it on eBay.
New procedure:
1) Get born.
2) Grow up.
3) Get official documents proving^H^H^H^H^H^H^Hallowing you to exist.
4) Sell existence on eBay.
5) PROFIT!!!
book signing at defcon 13 (Score:2, Informative)
Re:book signing at defcon 13 (Score:2)
Yes, techies can write fiction! (Score:1, Informative)
Rumor: he apparently has a book deal in the works. I'm going to pre-order on Amazon!!!
Never mind "I can't decrypt his firewall" (Score:1)
Re:Never mind "I can't decrypt his firewall" (Score:1)
Not in Print? (Score:1)