Maximum Security ^{2nd Ed.}

Maximum Security: A Hacker's Guide to Protecting Your Internet Site and Network, Second Edition — the updated, expanded, and revised version of the #1 bestseller — is designed for system administrators and managers who need to find out how to protect their computers, networks, and Internet sites from these kinds of unauthorized intrusions. Written by an experienced hacker — someone who knows which systems are vulnerable and how crackers get into them — this unique guide to Internet and network security identifies the security holes and faults inherent in a wide variety of customer systems and networks, and then describes how to go about fixing them.

1. Setting the Stage
1. Why Did I write This Book?
• Our Need for Security: Real or Imagined?
  • Microsoft PPTP
• The Root of the Problem
• Misconfiguration of the Target Host
  • System Flaws or Deficiency of Vendor Response
  • Vendor Response
• Why Education in Security Is Important
  • The Corporate Sector
  • Government
• The Loneliness of the Long-Distance NetSurfer
• Summary
2. How to Use This Book
• How to Use This Book? Duh!
  • This Book's General Structure
• FTP Clients
• Programming Languages
• Methods of Using This Book
  • Learning the Basics of Internet Security
  • Using This Book to Secure a Network
  • Using This Book for Serious Security Research
• This Book's Limitations
  • Timeliness
  • Utility
• The Book's Parts
  • Part I: Setting the Stage
  • Part II: Understanding the Terrain
  • Part III: Tools
  • Part IV: Platforms and Security
  • Part V: Beginning at Ground Zero
  • Part VI: The Remote Attack'
• Odds and Ends to Know About Maximum Security
• Cool Stuff on the CD-ROM
• Summary
2. Understanding the Terrain
3. Birth of a Network: The Internet
• In the Beginning: 1962-1969
• UNIX Is Born: 1969-1973
• About C
  • The Internet's Formative Years: 1972-1975
  • UNIX Comes of Age
  • UNIX and the Internet Evolve Together
  • The Basic Characteristics of UNIX
  • The X Window System
  • What Kind of Applications Run on UNIX?
  • UNIX in Relation to Internet Security
• Moving On: The Modern Intgernet
  • Internet Service Providers
  • The Future
• Summary
4. A Brief Primer on TCP/IP
• What Is TCP/IP?
  • Types of Protocols in the TCP/IP Suite
  • The History of TCP/IP
  • What Platforms Support TCP/IP?
• How Does TCP/IP Work?
• The Individual Protocols
  • Network-Level Protocols
  • The Internet Control Message Protocol
  • The Internet Protocol (IP)
  • The Transmission Control Protocol
  • inetd: Managing Connection Requests
  • The Ports
  • Telnet
  • File Transfer Protocol (FTP)
• TCP/IP Is the Internet
• Summary
5. Hackers and Crackers
• What Is the Difference Between a Hacker and a Cracker?
  • Mens Rea
• Where Did This Start?
• The Situation Today: A Network at War
• Summary
6. Just Who Can Be Hacked, Anyway?
• What Is Meant by the Term Cracked?
• Government
  • Defense Information Systems Network
  • The United States Navy and NASA
  • The Pentagon Attacks
  • Government Security
  • The President's Commission on Critical Infrastructure Protection
  • The National Infrastructure Protection Center (NIPC)
  • Summary on Government Vulnerabilities
• The Public Sector
  • The StarWave Incident
  • Other Credit Card Data Cases
  • The Trends
  • The Farmer Survey: Dusting Moscow
  • The Ernst & Young LLP/Information Week Information Security Survey
• A Warning
• Summary
7. Internet Warfare
• The Internet Can Change Your Life
• Can't We All Just Get Along?
• Friend or Foe?
• Can the Internet Be Used for Espionage?
• The Threat Gets More Personal
  • Who Holds the Cards?
  • Can the U.S. Protect the National Information Infrastructure?
• What Would an Information Attack Look Like?
• Y2K
• The Immediate Future
• Summary
• Resources on Information Warfare
  • Books on Information Warfare
• Resources on Y2K
  • Y2K Books
8. Security Concepts
• We need the Internet and We Need It Fast!
• Assessing Your Particular Situation
  • The Information Gathering Process
• Certification and Assurance
  • Coopers & Lybrand L.L.P., Resource Protection Services (USA)
  • The American Institute of Certified Public Accountants (AICPA)
  • International Computer Security Association (Previously NCSA)
  • Troy Systems
  • Certification as a Guarantee Against Liability
• Where to Get Training
• General Training
  • Lucent Technologies, Inc.
  • Great Circle Associate, Inc.
  • Learning Tree International
  • NSC Systems Group, Inc.
  • Training On Video
• Advanced Training
  • Sytex, Inc.
• Go-Location as a Solution
• Hiring an Outside Security Consultant
  • Cost
  • The Bottom Line
  • About Your System Administrator
• Consultants and Other Solutions
3. Tools
9. Destructive Devices
• What Are Destructive Devices?
  • Destructive Devices as Security Risks
  • The Email Bomb
  • Email Bomb Packages
  • Dealing with Email Bombs
  • Email Bombs as Security Risks
  • List Linking
  • A Word About Mail Relay
  • Denial of Service Attacks
  • Denial-of-Service Attack Index
  • Well-Known DoS Attacks
  • Denial-of-Service Attacks on Hardware
  • Other Denial-of-Service Tools
  • Other DoS Resources
  • Viruses
  • What Is a Computer Virus?
  • Who Writes Viruses and Why?
  • How Are Viruses Created?
  • In What Languages Are Viruses Written?
  • How Do Viruses Work?
  • Master Boot Record Viruses
  • Virus Utilities
  • Publications and Sites
• Summary
10. Scanners
• How Do Scanners Work?
• On What Platforms Are Scanners Available?
• What System Requirements Are Necessary to Run a Scanner?
• Is It Difficult to Create a Scanner?
• Are Scanners Legal?
• Why Are Scanners Important to Internet Security?
• How Scanners Have Influenced the Security Community
• The Scanners
  • Nessus
  • NSS (Network Security Scanner)
  • Strobe
  • SATAN (Security Administrator's Tool for Analyzing Networks)
  • Ballista
  • Jakal
  • IdenTCPscan
  • Ogre
  • Web Trends Security Scanner (previously Asmodeus)
  • Internet Security Scanner and SAFESuite
  • The Other Side  of the Fence
  • CONNECT
  • FSPscan
  • XSCAN
• On Other Platforms
  • Network Toolbox
• Summary
11. Password Crackers
• What Is a Password Cracker?
  • How Do Password Crackers Work?
  • Cryptography
• The Value of Password Crackers
  • The Password-Cracking Process
• The Password Crackers
• Password Crackers for Windows NT
  • l0phtCrack 2.0
  • ScanNT by Midwestern Commerce, Inc.
  • NTCrack from SomarSoft
  • Password NT by Midwestern Commerce, Inc.
• Password Crackers for UNIX
  • Crack
  • CrackerJack by Jackal
  • PaceCrack95 (pacemkr@bluemoon.net)
  • Qcrack by the CryptKeeper
  • John the Ripper by Solar Designer
  • Hades by Remote and Zabkar
  • Star Cracker by the Sorcerer
  • Hellfire Cracker by the Racketeer and the Presence
  • XIT by Roche'Crypt
  • Claymore by the Grenadier
  • Guess by Christian Beaumont
  • Merlin by Computer Incident Advisory Capability (CIAC) DOE
• Other Types of Password Crackers
  • ZipCrack by Michael A. Quinlan
  • Fast Zip 2.0 (Author Unknown)
  • Decrypt by Gabriel Fineman
  • Glide (Author Unknown)
  • AMI Decode (Author Unknown)
  • NetCrack by James O'Kane
  • PGPCrack by Mark Miller
  • The ICS Toolkit by Richard Stallman
  • EXCrack by John E. Kuslich
  • CP.EXE by Lyal Collins
• Resources
  • About UNIX Password Security
  • Other Sources and Documents
• Summary
12. Trojans
• What Is a Trojan?
• Where Do Trojans Come From?
• Where Will I Find a Trojan?
• C'mon! How Often Are Trojans Really Discovered=
• What Level of Risk Do Trojans Represent?
• How Do I Detect a Trojan+
  • MD5
  • Hobgoblin
  • On Other Platforms
• Resources
• Summary
13. Sniffers
• Sniffers as Security Risks
  • Local Area Networks and Data Traffic
  • Packet Transport and Delivery
• What Level of Risk Do Sniffers Represent?
• Has Anyone Actually Seen a Sniffer Attack?
• What Information Do Sniffers Capture?
• Where Is One Likely to Find a Sniffer?
• Where Can I Get a Sniffer?
  • Commercial Sniffers
  • NetAnt Protocol Analyzer
• Freely Available Sniffers
  • Esniff
  • Gobbler (Tirza van Rijn)
  • ETHLOAD (Vyncke, Blondiau, Ghys, Timmermans, Hotterbeex, Khronis, and Keunen)
  • Netman (Schulze, Benko, and Farrell)
  • LinSNiff
  • Sunsniff
  • linux_sniffer.c
• Defeating Sniffer Attacks
  • Detecting and Eliminating Sniffers
  • Safe Topology
  • Encrypted Sessions
• Summary
• Further Readings on Sniffers
14. Firewalls
• What Is a Firewall?
• Other Tasks Performed by Firewalls
• What Are the Components of a Firewall?
• Types of Firewalls
  • Network-Level Firewalls
  • Application-Proxy Firewalls (Application Gateways)
• Firewalls Generally
• Building a Firewall: The Important Steps
  • Identifying Topology, Application, and Protocol Needs
  • Analyzing Trust Relationships in Your Organization
  • Developing Policies and Getting the Right Firewall
  • Employing and Testing Your Firewall
  • Are Firewalls Foolproof?
  • Firewall-1 Reserved Words Vulnerability
• Commercial Firewalls
  • AltaVista Firewall
  • ANS InterLock
  • Avertis
  • BorderManager
  • Conclave
  • CSM Proxy/Enterprise Edition
  • CyberGuard Firewall
  • CyberShield
  • Elron Firewall/Secure
  • FireWallA 3.0
  • Gauntlet Internet Firewall
  • GNAT Box Firewall
  • Guardian
  • IBM eNetwork Firewall
  • Interceptor Firewall Appliance
  • NETBuilder
  • NetRoad TrafficWARE Firewall
  • NetScreenA0
  • PIX Firewall 4.1
  • Raptor Firewall
  • Secure Access
  • SecurIT Firewall
  • SunScreen
• Summary
  • Resources
15. Logging and Audit Tools
• Logging Tools
• Why Use More Logs?
• Network Monitoring and Data Collecxtion
  • SWATCH (The System Watcher)
  • Watcher
  • lsof (List Open Files)
  • WebSense
  • WebTrends for Firewalls and VPNs
  • Win-Log version 1
  • MLOG
  • PingLogger
• Tools for Analyzing Log Files
  • NestWatch
  • NetTracker
  • LogSurfer
  • VBStats
  • Analog
• Specialized Logging Utilities
  • Courtney
  • Gabriel
• Summary
4. Platforms and Security
16. The Hole
• The Concept of the Hole
• About Timeliness
• How a Hole Emerges
• Mining the Data Monster
• How Much Security Do You Need?
• General Sources
  • The Computer Emergency Response Team (CERT)
  • The US Department of Energy Computer Incident Advisory Capability 
  • The National Institute of Standards and Technology Computer Security Resource Clearinghouse
  • The US Department of Defense (DoD) Network Information Center
• Mailing Lists
• Usenet Newsgroups
• Vendor Security Mailing Lists, Patch Depositories, and Resources
  • Silicon Graphics Security Headquarters
  • The SUn Security Bulletin Archive
• Summary
17. Microsoft
• DOS
• IBM Compatibles in General
• Key-Capture Utilities
• Access Control Software for DOS
• Sites that House DOS Security Tools
• Windows for Workgroups and Windows 95
• The Password List (PWL) Password Scheme
• Flushing the Password Out of Cached Memory
• Access Control Software for Windows 95
• Modern Vulnerabilities in Microsoft Applications
  • Microsoft Internet Explorer
  • Microsoft FrontPage
  • Microsoft Exchange
  • Standalone Applications and Add-Ons
  • Other Microsoft Applications
  • Microsoft Access
  • Still Other Applications
  • Summary on DOS, Windows, and Windows 95
  • Windows NT
  • IIS (Internet Information Server)
  • General Windows NT Security Vulnerabilities
  • Other Important Vulnerabilities of Lesser Significance
• Internal Windows NT Security
  • Internal Security in General
  • Achieving Good Internal Security
  • A Tip in Setting Up a Secure NT server from Scratch
  • Tools
  • Good Online Sources of Information
  • Books on Windows NT Security
• Summary
18. UNIX: The Big Kahuna
• Beginning at the Beginning
• Addressing Physical Security
• Console Security
  • Console Passwords
  • The Root Password
• Installation Media
• Default Configurations
• Password Security
  • Installing Password Shadowing
• Installing a Proactive Password-Checking Program
• Patches
• Particular Vulnerabilities
  • Critical Remote Vulnerabilities: AIX
  • Critical Remote Vulnerabilities: IRIX
  • Critical Remote Vulnerabilities: SunOS and Solaris
  • Critical Remote Vulnerabilities: Linux
• The Next Step: Examining Services
  • The r Services
  • The finger Service
  • Telnet
• FTP
• FTP in General
  • TFTPD
• Gopher
• Network File System
• HTTP
  • HTTP Security in General
  • The Secure Sockets Layer Protocol
• Preserving a Record of the File System
  • TripWire
• About X
• Checklists and Guides
• Selected Exploits for UNIX (General)
• Publications and Things
• Books
• Online Publications
• Summary
19. Novell
• Novell Internal Security
• Default Passwords
  • The FLAG Vulnerability
  • Login Script Vulnerability
• Sniffers and Novell
  • The PERL Hole
  • Login Protocol Attack
• Spoofing
• Denial of Service
  • TCP/IP Denial of Service on Novell NetWare 4.x
  • FTP Vulnerability to Denial-of-Service Attacks
  • Third-Party Problems
  • The Windows 95 Hole
  • The Windows NT Hole
• Utilities for Securing and Managing Novell Networks
  • AuditTrack
  • ProtectNet for Novell NetWare
  • LattisNet Network Management System
  • LT Auditor+ v6.0
  • Kane Security Analysts for Novell NetWare
  • Information Security Policies from Baseline Software, Inc.
  • MenuWorks
  • AuditWare for NDS
    WSetPass 1.55
  • WnSyscon 0.95
  • BindView EMS
  • SecureConsole
  • GETEQUIV.EXE
• Utilities for Cracking Novell Networks or Testing Their Security
• Getit
• Burglar
  • Spooflog
• Setpass
• NWPCRACK
• IPXCntrl
• Crack
• Snoop
• Novelbfh.exe
  • Other Novell Cracking Tools
• Resources
  • Miscellaneous Resources
  • Usenet Newsgroups
  • Books
20. VAX/VMS
• VMS
• Security in VMS
• Some Old Holes
  • The Mountd Hole
  • The Monitor Utility Hole
  • Historical Problems: The Wank Worm Incident
• Audits and Monitoring
  • watchdog.com
  • Stealth
  • GUESS_PASSWORD
  • WATCHER
  • Checkpass
  • Crypt
  • DIAL
  • CALLBACK.EXE
  • TCPFILTER (G. Gerard)
• Changing Times
• Summary
• Resources
21. Macintosh
• Establishing a Macintosh Web Server
• Lasso by Blue World
• Exploring Your Possibilities
• Vulnerabilities on the Macintosh Platform
  • FoolProof Vulnerability
  • Denial of Service by Port Overflow
  • MacDNS Bug
  • Sequence of Death and WebSTAR
  • DiskGuard Bug
  • Retrospect Vulnerability
  • At Ease Bug
  • Network Assistant
  • Password Security on MacOS 8.0 Upgrades
• About File Sharing and Security
  • Server Management and Security
  • NetLock by Interlink Computer Services
  • Internal Security
  • Super Save 2.02
  • BootLogger
  • DiskLocker
  • FileLock
  • Sesame
  • MacPassword
• Password Crackers and Related Utilities
  • PassFinder
  • FirstClass Thrash!
  • FMProPeeker 1.1
  • FMP Password Viewer Gold 2.0
  • MasterKeyII
  • Password Killer
  • Killer Crack
  • MacKrack
  • Remove Passwords
  • RemoveIt
• Tools Designed Specifically for America Online
• Summary
• Resources
  • Books and Reports
  • Sizes with Tools and Munitions
  • E-Zines and Electronic Online Magazine
5. Beginning at Ground Zero
22. Who's in Charge?
• The General Idea
• About Access Control
• About Gaining Root
  • Pros and Cons of the Permission System
  • Cracking Root
• Root May be a Thing of the Past
• Root on Other Operating Systems
• The Cracker Who Is Root
• Beware of Root
• Summary
23. Internal Security
• Internal Security
• Do I Really Need Internal Security?
• Why Are Internal Attacks So Prevalent?
• About Policies
• Hardware Considerations
  • Modems
• Drives, Directories, and Files
• General Internal Security Assessment 
  • SysCAT
  • SQLAuditor
  • System Security Scanner (S3)
  • RSCAN
• Controlling Employee Access to the Internet
  • N2H2 by Bees School and Business Filters
  • WebSENSE
  • X-STOP
  • Sequel Net Access Manager
  • SmartFilters
• Developing Best Practice Checklists
  • Security Checklists
• Summary
6. The Remote Attack
24. The Remote Attack
• What Is a Remote Attack?
• The First Steps
• Getting a Brief Look at the Network
  • WHOIS
  • finger and rusers
• The Operating System
• The Research Phase
  • Identifying Key Weaknesses in the System
  • Data Collection of System Weaknesses
  • Legitimate Security Sources
• Doing a Test Run
• Summary
25. Levels of Attacks
• When Can an Attack Occur?
• What Operating Systems Do Crackers Use?
  • Sun
  • UNIX
  • Microsoft
• Origins of Attack
• What Is the Typical Cracker Like?
• What Is the Typical Target Like?
• Why Do They Want to Attack?
• About Attacks
• The Sams Crack Level Index
  • Levels of Sensitivity
  • Response Levels
• Summary
• Resources
  • Intrusion Detection
26. Spoofing Attacks
• What Is Spoofing?
• Internet Security Fundamentals
  • Methods of Authentication
  • RHOSTS
• The Mechanics of a Spoofing Attack
• The Ingredients of a Successful Spoofing Attack
• Guessing the Sequence Number
  • Opening a More Suitable Hole
  • Who Can Be Spoofed?
  • How Common Are Spoofing Attacks?
• Documents Related Specifically to IP Spoofing
  • How Do I prevent IP Spoofing Attacks?
  • Other Strange and Offbeat Spoofing Attacks
• ARP Spoofing
• DNS Spoofing
• Summary
27. Telnet-Based Attacks
• Telnet
  • Virtual Terminal
  • Telnet Security History
  • Are These Attacks No Longer Effective?
  • Telnet as a Weapon
• Summary
  • Resources
28. Languages, Extensions, and Security
• The World Wide Web Grows Up
• CGI and Security
  • The Practical Extraction and Report Language (Perl)
  • Perl Security
  • About Running Scripts in Privileged
  • File Creation
  • Server-Side Includes
  • Java
• Active-X
  • What's the Problems with Active-X
• Scripting Languages
  • JavaScript
  • VBScript
  • Closing on Scripting Languages
• Summary
29. Hiding Your Identity
• Degree of Exposure
  • Human Intelligence
• Web Browsing and Invasion of Privacy
  • Internet Architecture and Privacy
  • How User Information Is Stored on Servers
  • Finger
  • MasterPlan
  • Beyond Finger
• Browser Security
  • IP Address and Cache Snooping
• Cookies 
  • Privacy Solutions from Lucent Technologies
  • Using Lucent's Personalized Web Assistant
  • Your Email Address and Usenet
  • DejaNews
  • The WHOIS Service
  • A Warning
7. Appendices
1. Security Bibliography — Further Reading
2. How to Get More Information
3. Security Consultants
4. Reference Documents Linked on the CD-ROM
5. Reality Bytes: Computer Security and the Law
6. What's on the CD-ROM
7. Security Glossary

This is one of those giant tombs, but interesting as it touches on a lot of platforms.