I’ve put off doing this review for too long.  I was sent this book close to its release date, and made quick work of reading through it and making notes for the review. As you’ll see in this post, I don’t think much of it, and I wasn’t looking forward to making such a negative post about it. I would just let it slide, as I prefer to post reviews of books that I like and recommend at least to some extent, but Packt Publishing are heavily promoting this book and I’ve seen several people I know purchase or consider purchasing it. For that reason, I feel like it’s a good idea to warn the target audience of this blog away from it.

At a first glance, it’s easy to be skeptical of this book due to the fact that it had the misfortune of being a Backtrack 4 book published at almost the exact time Backtrack 5 came out. This doesn’t bother me so much. If it were written well, it could easily make up for any differences in the details between versions. Unfortunately, being dated is the least of this book’s problems.

The vast majority of the book is padded with a grocery list of what appears to be each and every tool in the Backtrack distribution. Comprehensive coverage is fine, though each tool is only given the very briefest of coverage, with almost no coverage or consideration to educating the reader on how the tools work or the background needed to effectively use them. New terms and concepts are thrown at the user relentlessly without introduction or explanation. This book falls into a useless “middle” state where a beginning user would be better served by a book that gives more depth of coverage for a handful of tools (see Web Application Hacker’s Handbook), while still failing to serve an advanced user that could find the same information quickly in a man page. The book falls well short of its goal of serving as a “single professional, practical, and expert guide to develop hardcore penetration testing skills from scratch”.

There are many instances of wasted space in the book as well. A straight copy-paste of /etc/services is the worst offender. The text doesn’t exactly live up to the promises of its table of contents either. A segment on “Writing exploit modules” simply takes the reader through the source code of an existing metasploit module, with only the barest of commentary that makes one wonder if the authors understand how it works, much less whether or not the reader will be able to write one (or even read one) in practice.

Aside from the “list of things” approach that takes up the majority of the book, there is a fair amount of text about the penetration testing process that, if executed properly, would make an excellent introduction to newcomers. Unfortunately, it’s written as though the authors intentionally wanted it to be impenetrable and difficult to understand. The following sentence is a representative example:

Since the exponential growth of an IT security industry, there are always an intensive number of diversities found in understanding and practicing the correct terminology for security assessment.

Some of it’s just plain wrong. A set of paragraphs equate “black hat” hacking with “black box” testing, and goes on the state the same about “white” and “grey”. It’s difficult to imagine that anyone in penetration testing believes that. The authors take the reader through overwrought descriptions of various testing “methodologies” (the OWASP top ten is not a methodology), and then throw them out in favor of an over-simplified “Backtrack Testing Methodology” that appears to be a simple depth-first traversal of the BT4 menu options.

While it may be tempting to buy this book as a quick reference or summary of all of the tools, I would not encourage it. I would strongly discourage anyone thinking to start out, or get up to speed in penetration testing from buying this book. It’ll just frustrate you. For more experienced readers, there are books that are far more worthy of your time and money.

• http://www.packtpub.com/backtrack-4-assuring-security-penetration-testing/book

Last year, I reviewed Jayson Street’s Dissecting The Hack: The F0rb1dd3n Network, uncovering a massive amount of plagiarism that resulted in the book getting pulled, pending a revision.  Here are the posts that chronicle those events:

• The original review – …before I realized the extent of the plagiarism.  To summarize: I enjoyed the book’s fictional section, despite some flaws.  I had far more complaints with the “Security Threats Are Real” (STAR) section, which seemed very disjointed and unfocused.
• Amending My F0rb1dd3n Network Review – …upon a closer look, it became apparent that readers (and reviewers) were misled.  The vast majority of the STAR section (comprising of all but 120 pages of the book’s total of 400) turned out to be plagiarized from various sources (primarily Wikipedia).  I documented it and made this post to warn potential readers.  The authors responded, pointing to the technical editor as the cause.
• Syngress Response to Plagiarism in Dissecting the Hack: The F0rb1dd3n Network – Syngress released a statement confirming the authors’ take on what happened, and announced that there would be a revised release of the book.

On July 15th, a revised edition was released, and I requested a review copy so that I could see what had changed, and provide this new review.

What do you get?

The book has the same basic appearance as the previous version, with the addition of a third author, Brian Baskin, on the cover.  On the title page, Marcus Carey is added (in a smaller font) as an author, and Dustin D. Trammell is listed as the new technical editor.  Apart from “Revised Edition”, there is no discussion or acknowledgment of the book’s past.

The book has gone on a bit of a diet, roughly 70 pages.  This is a good thing, however, as the old STAR section was mostly irrelevant filler.  The fiction remains, virtually untouched from the previous version, at about 120 pages of the book’s 330 page.  The new STAR section is original content now, which is, of course, a dramatic improvement.

The Fiction

My comments from my first review mostly stand here.  The fictional F0rb1dd3n Network story was always an original creation of Jayson and Kent’s.  I am a big fan of the concept of “hacker fiction”, the likes of which you’ll find in another Syngress series, Stealing the Network.  I am definitely supportive of any attempts at writing new material in this genre.

As a story, I enjoyed this section of the book, but found it to be very short.  The plot is very much what one would expect out of a techno-thriller TV show (perhaps an episode of Leverage) and you get about the same degree of character development.  Unlike the Stealing The Network series, explanations of the attacks are saved for the STAR section, rather than given in-character in the story.  While I can see that this helps moves the story along, I think it makes the fiction seem quite short.  When it ends, you’re left wondering about some things that probably could have been wrapped up within this story, particularly an incident of “dark-grey-hat” hacking the protagonists vow to atone for, but that is never revisited.  It may be something that’s saved for a sequel, but it reads like the authors simply forgot about it by the end of the story.

I’m being critical here, but I really did like the story, as a whole, and I hope that there is an opportunity for the authors to continue it.  If you liked Stealing the Network, you’ll definitely enjoy it.  It ranks right up there with the best writing in that series.

(As an aside, if you want some awesome hacker fiction, check out Daniel Suarez’ Daemon and its sequel Freedom(TM))

While one of the selling points of the book is that all of the attacks discussed in the fiction are real and documented in greater detail in STAR, there are some minor quibbles with that.  There are times in the story where it seems as though the authors have hit the limits of their own experience with attacks, on more difficult topics like reverse engineering and exploit development.  In the handful of times this comes up, artistic license is taken, hands are waved, meaningless phrases are thrown around (“pop the sled on that buffer”) and the story moves on without one of those STAR references.  Only once does a technical error directly impact the story, and honestly it’s not something even most security professionals would have caught.  These are small issues, though I would have liked it if some outside help would have been brought in to lend some authenticity to those points and document them in STAR.

The “Security Threats Are Real” (STAR) section

The STAR section is greatly improved.  Gone are the page-chewing screenshots of blogs and descriptions of unrelated tools.  There is a greater focus on describing the attacks that are in the story than in the previous edition.  Overall, it reads as being much more professional.

It’s a good first-read for people interested in computer security.  There are some technical issues and organizational issues (some topics don’t really fit with the phase of attack they’re classified in), but it’s good for someone who’s gauging their potential interest in security.  Experienced readers might be slightly disappointed.  There is a lot of material on hacker culture that is heavily skewed to the authors’ experiences with various events, people, and conferences, which the uninitiated might take as gospel for the entire scene.  I think that a lot of this could have been trimmed down (perhaps placed on the website) to give a more in-depth and complete coverage of the attacks in the fiction section.

Should you buy it?

I believe that most of the regular readers of this site are the more technical members of the security community: penetration testers, folk who do forensics and incident response.  Readers in these are similar areas that are already “in” security will get a fun read out of this book (and it’s worth it for that, especially if you’re pining for more Stealing the Network) but are not likely to pick up any new skills.

If you’re new to this stuff, or if you’re testing the waters to see if security even catches your interest in the first place, this book might be an entertaining way to learn some basic concepts.  You’ll pick up a few simple skills, and you’ll have some points at which you can start researching something that interests you.  While I don’t see this book as keeping the attention of non-technical people that wish to stay non-technical, if you’re a motivated learner, it’s a decent place to start.

Overall:  It’s a great book for the audience it should be marketed to.  Good work and congratulations to Jayson, Kent, Brian, Marcus, and Dustin Trammell for fixing up the book and seeing it through to the end.

Jayson called me regarding this post, and I promised to let him tell his side of the story, right here, at the top of the post, so here it is:

I am more stunned than anyone on finding this out. When Kent and I finally got the book deal from Syngress we were overjoyed and immediately felt the pressure of completing the book by our deadline. We had been so involved in getting the first part completed that we turned to Dustin L. Fritz to step in to write the 2nd part.

Dustin served as the Technical Editor and we were assured that he would be able to complete the 2nd part in time to meet the deadline. I trusted the material that Dustin delivered was either original or properly sourced. As people heard me say before this discovery, I gave proper credit to Dustin for the 2nd part.

I do feel betrayed that someone I trusted appears to have taken short cuts and not delivered original material. The Information Security community is about trust and I apologize to those who should feel betrayed. This is not trying to lay blame this is trying to get the full story out there. This book has my name on it so therefore the ultimate blame is with me.

I want to also apologize to Syngress, Rachel, and Angelina who were behind me 100% for this project. I will personally work to correct any plagiarism or copyright issues in this work.

Edit: Co-author Kent Nabors posted his response in the comments below (where the discussion is going very well), and I have made a couple of small edits to the post to more accurately reflect the fraction of the book made up by the STAR section (from all but 170, to all but 125).

Edit: Dustin L. Fritz (of The CND Group) has left the following comment regarding plagiarism in this book:

This was an honest mistake and I sincerely apologize for any miscommunication. I hope that the correct and proper citations can be added soon and that all questions regarding copyright and plagiarism issues can be resolved. I hope the book can still be enjoyed as a valuable contribution to the information security community and I hope it will go on to fulfill its objective in reaching anyone who desires to learn more about hacking and security. I want to specifically apologize to Jayson, Kent, Syngress, Rachel, Angelina, all the readers, reviewers, and others who have taken offense. I want to fix this and I sincerely appreciate everyone’s positive support!

I appreciate Dustin’s comment, however (as we discussed at length on the phone this morning) I disagree partially with it being an honest mistake.  When one has demonstrated in other parts of the same book, and at presentations at venues such as DojoSec, that he or she is capable of quoting and citing things properly, and knows that permission should be asked before reproducing material, it’s no accident when large sections of text are lifted from non-attributed sources and presented as the authors’ work.  The argument was made that the work was never put forth as the authors’ words, but the below information and anyone with a copy of the book can verify that this is not the case.

My original post continues from this point.

—

I am posting this as an amendment to my review of Jayson Street and Kent Nabor’s Dissecting the Hack: The F0rb1dd3n Network. It turns out that a large portion of the book being presented as the author’s original work (almost the entirety of the STAR section, which is all but 125 of the book’s 400) is actually plagiarized from various online sources (primarily Wikipedia).  Not much in information security angers me, but it does anger me when authors attempt to present others’ work as their own, misleading their readers and reviewers (many of which have given very positive reviews to this book).

While I was in the process of reading and reviewing Dissecting the Hack: The F0rb1dd3n Network, I promised Jayson that I would provide notes that I had taken in the process of reviewing the book.  A few days ago I posted that review, and today I reviewed my notes and edited them to be more readable than they were for his benefit.

In the process of editing those notes, I reviewed each of the problems they addressed, including where I had stated that many quoted materials were not attributed to any source.  I had also noticed normally formatted, apparently author-written text that was actually an excerpt from a Wikipedia article in one place.  At the time and in my notes, I figured that it was likely a typesetting error.

Unfortunately, this evening, I found out that this is not the case.

After reviewing my notes, I noticed other strange wording in the STAR section, which comprises all but 125 of the book’s 400 pages.  I chose some excerpts at random, and Google’d what should have been unique phrases from them.  In most cases I was given results on Wikipedia, where the text of the entry matched the text of the book exactly.  This worried me greatly.

For several hours this evening, I have gone through STAR, section by section, locating the sources of plagiarized material.  The majority of the text presented as the word of the authors’ (normal typesetting, not quoted or attributed) is directly ripped off from a number of online sources, primarily Wikipedia.  For the most part, only the sections that directly reference the characters in the story portion of the book can be trusted.

I kept notes this evening, and I have created the table below, which documents 55 instances in The F0rb1dd3n Network where the contents are directly taken from Wikipedia and other online sources.  Most of these are quite blatant, taking exact sentences and paragraphs from Wikipedia articles and using those to form the entirety of the book’s explanation of the topic.  In most cases, all that is added are references to screenshots, and small wording and paragraph break changes.

Before I found so many examples, I thought that this might be a product of my own academic background holding this non-academic text to too high of a standard, but the massive scale of it constitutes plagiarism by any rational definition, and specifically violates Wikipedia’s copyright rules, among others’ rights.  It is an insult to those that have taken the time to review it, and to those who have paid for the book under the assumption that it is an original work.  I find it hard to believe that the authors did not feel that this was wrong, and can only assume that the editors were unaware.

The following table lists page numbers, the topic being discussed, a URL of the original material, and a “length” which roughly describes how much material is lifted.  In this field, “Entire description” indicates that the entirety of the discussion of the topic in the book is taken directly from the source URL.  Other descriptions attempt to explain how much material was “lifted”, though it’s inexact, as paragraph breaks are changed from the source to the book.  In some cases, I had to go back to previous revisions of Wikipedia articles to determine what was copied, and so the revision I list may or may not be the exact revision the author used.

If you have a copy of this book that you bought or received for review, I encourage you to take a look at these pages and source URLs to see what I’m talking about:

Bill Blunden’s book, The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System, is one of the hidden gems in computer security books, and I hope that I can convince you to give it a look.  This review has been too-long to arrive, as I haven’t had the time to read that I would like.  That said, I felt it was very important to finally get the review up, as this is a book that I’m sure my regular readers will enjoy.

I first spotted this book on a vendor table at Defcon, and it stood out among the rest mostly because *I hadn’t heard of it*.  I try to keep up with new book releases, especially on attack-oriented topics that would be of interest to the penetration testers and vulnerability analysts that read this blog.  It was surprising to me that one had flown under the radar.  I picked it up and flipped through the table of contents (which I encourage you to do as well), and was very impressed with the amount of material it covers.

I looked up the author, and was disappointed to realize that I had missed his talk at Blackhat earlier that week (looking forward to the video).  I contacted him, and he was kind enough to supply a review copy of the book.  It arrived very quickly, with a humorous personal note on the inside cover, and ever since, I have been learning a lot from it.

The author’s style is excellent.  The material is technical and has the potential to be very dry, but the text has a very conversational tone, as if it were being presented as a lecture for a (particularly good) class.  Each concept is tied back to the main topic: hiding operations and data from the user and operating system, and frustrating forensic analysis.  The book reads very well, presenting enough context that you can understand it if you’re reading away from a computer, and enough detail that you can follow along and experiment with it if you are at your desk.

I appreciate that this book does not attempt to hold the reader’s hand throughout with the ethics of developing rootkits.  The author takes a brief moment at the beginning of the book to explain the legitimate needs for security professionals to be familiar with rootkit techniques and development, and points out that the information can be found elsewhere.  After this point, the book assumes a level of maturity in its reader that is greatly appreciated.

The first part of the book, “Foundations”, has an excellent introduction to IA32 architecture and Windows internals that I have never seen so well-described for beginners.  Even if you aren’t interested in rootkits, this portion of the book is something I would recommend to anyone getting started in related fields, like reverse-engineering or exploit development.  Digging further into the text, the second section on “System Modification” makes up the “meat” of the book, delving into the details of subverting Windows internals in many different ways.  As technical and in-depth as the book gets, though, it never seems to leave the reader behind.  Each new concept is well-explained and builds upon the material the reader has already learned.  You may have to go through the text slower than you had anticipated, and go back to review previous material, but you’re never left feeling hopelessly lost.

The remainder of the book is a treat, as well.  I can’t recall another book that goes into any kind of detail on defeating forensic analysis of memory and file systems.  Anyone interested in developing forensic tools or curious about how analysis with tools like Encase and FTK might be subverted, should give it a read.  The author closes the text with some strategic guidelines for rootkit development, and his own thoughts on how evasion and deception can be used to similar ends on a larger scale than operating systems.

This is now one of my favorite computer security books, and I believe that if you review its contents, you’ll find that you’re getting a great value for your money.  If you are familiar with C and have a beginner’s knowledge of IA-32 assembly, you should have the prerequisites you need to follow along with this book.  I highly recommend it, and hope that it becomes less-hidden of a gem that it already is.

• The Rootkit Arsenal, at the author’s site, Below Gotham Labs