The Beyond the Manual series addresses the needs of very experienced readers. Although it is not assumed that they are familiar with the book’s topic, it is assumed that they are very familiar with similar technologies. The presentation of information is extremely dense and avoids introductory or basic text. The series delivers as much information in as little space as possible.
Hardening Windows, Second Edition is the definitive "counterintelligence" guide to performing preventative security measures for the Windows operating system. This second edition covers the release of Windows XP Service Pack 2 and its new security features, including the Windows Firewall and the Security Center. It also covers Windows Server 2003 Service Pack 1, Windows Server R2's new Security Configuration Wizard, Windows NT, Windows 2000, branch-office security features, and new setup options. A new chapter has been added on Windows Software Update Services. All chapters have been updated to reflect reader feedback from the first edition. Topics covered include system and group policies, Network Access Quarantine Control, auditing and event logs, IIS, and Exchange.
Windows Server 2008: The Definitive Guide takes a refreshing approach. You won't find the history of Windows NT, or discussions on the way things used to work. Instead, you get only the information you need to use this server. If you're a beginning or intermediate system administrator, you learn how the system works, and how to administer machines running it. The expert administrators among you discover new concepts and components outside of your realm of expertise.
Simply put, this is the most thorough reference available for Windows Server 2008, with complete guides to:Installing the server in a variety of different environmentsFile services and the Windows permission structureHow the domain name system (DNS) worksActive Directory, including its logical and physical structure, hierarchical components, scalability, and replicationGroup Policy's structure and operationManaging security policy with predefined templates and customized policy plansArchitectural improvements, new features, and daily administration of IIS 7Terminal Services from both the administrator's user's point of viewNetworking architecture including DNS, DHCP, VPN, RADIUS server, IAS, and IPSecWindows clustering services --- applications, grouping machines, capacity and network planning, user account managementWindows PowerShell scripting and command-line technologyWith Windows Server 2008: The Definitive Guide, you to come away with a firm understanding of what's happening under the hood, but without the sense that you're taking a graduate course in OS theory. If you intend to work with this server, this is the only book you need.
Hardening Windows is an intermediate-to-advanced guide to implementing preventative security measures for the Windows operating system, and it's the only book that covers NT, 2000, XP, and 2003. This book is designed to provide a quick and easy checklist-style reference to the steps system administrators need to take to anticipate attacks and compromises, and to harden Windows NT, 2000, XP, and Server 2003 against them.
Outlook 2007: Beyond the Manual takes you to the next level, showing you how to better manage your time, tasks, mail, and activities using Outlooks sometimes hidden and sometimes undiscovered features. Freshly written for and based on Outlook 2007, this book doesnt waste your time showing you how to send an e-mail, but tells you how to make yourself more efficient, less cluttered, and more clear about whats happening in your life.
This book goes farther faster into Outlooks advanced capabilities than other books. It shows you how to take control of the flow of information and time in your life and use Outlook to keep better tabs on it. It helps you take the thinking out of e-mail management, the tedium out of appointments and meeting scheduling, and the "rottenness" out of manual tasks.Doesn't waste time with introductory features Highlights new Outlook 2007 capabilities and improvements Discusses quick troubleshooting options so you don't wait on hold with your tech support group Shows integration with other Office products (SharePoint, Word, etc.) Includes a treatment of popular Outlook add-ins and add-ons Shows programmatic/development capabilities of Outlook
Now for the first time, Greenwald fits all the pieces together, recounting his high-intensity ten-day trip to Hong Kong, examining the broader implications of the surveillance detailed in his reporting for The Guardian, and revealing fresh information on the NSA's unprecedented abuse of power with never-before-seen documents entrusted to him by Snowden himself.
Going beyond NSA specifics, Greenwald also takes on the establishment media, excoriating their habitual avoidance of adversarial reporting on the government and their failure to serve the interests of the people. Finally, he asks what it means both for individuals and for a nation's political health when a government pries so invasively into the private lives of its citizens—and considers what safeguards and forms of oversight are necessary to protect democracy in the digital age. Coming at a landmark moment in American history, No Place to Hide is a fearless, incisive, and essential contribution to our understanding of the U.S. surveillance state.
After reading this book, you should be able to use these tools to do some testing and even working on penetration projects. You just need to remember not to use these techniques in a production environment without having a formal approval.
As the Android operating system continues to increase its share of the smartphone market, smartphone hacking remains a growing threat. Written by experts who rank among the world's foremost Android security researchers, this book presents vulnerability discovery, analysis, and exploitation tools for the good guys. Following a detailed explanation of how the Android OS works and its overall security architecture, the authors examine how vulnerabilities can be discovered and exploits developed for various system components, preparing you to defend against them.
If you are a mobile device administrator, security researcher, Android app developer, or consultant responsible for evaluating Android security, you will find this guide is essential to your toolbox.A crack team of leading Android security researchers explain Android security risks, security design and architecture, rooting, fuzz testing, and vulnerability analysis Covers Android application building blocks and security as well as debugging and auditing Android apps Prepares mobile device administrators, security researchers, Android app developers, and security consultants to defend Android systems against attack Android Hacker's Handbook is the first comprehensive resource for IT professionals charged with smartphone security.
Kevin Mitnick, the world's most celebrated hacker, now devotes his life to helping businesses and governments combat data thieves, cybervandals, and other malicious computer intruders. In his bestselling The Art of Deception, Mitnick presented fictionalized case studies that illustrated how savvy computer crackers use "social engineering" to compromise even the most technically secure computer systems. Now, in his new book, Mitnick goes one step further, offering hair-raising stories of real-life computer break-ins-and showing how the victims could have prevented them. Mitnick's reputation within the hacker community gave him unique credibility with the perpetrators of these crimes, who freely shared their stories with him-and whose exploits Mitnick now reveals in detail for the first time, including: A group of friends who won nearly a million dollars in Las Vegas by reverse-engineering slot machines Two teenagers who were persuaded by terrorists to hack into the Lockheed Martin computer systems Two convicts who joined forces to become hackers inside a Texas prison A "Robin Hood" hacker who penetrated the computer systems of many prominent companies-andthen told them how he gained access With riveting "you are there" descriptions of real computer break-ins, indispensable tips on countermeasures security professionals need to implement now, and Mitnick's own acerbic commentary on the crimes he describes, this book is sure to reach a wide audience-and attract the attention of both law enforcement agencies and the media.
WE ARE ANONYMOUS is the first full account of how a loosely assembled group of hackers scattered across the globe formed a new kind of insurgency, seized headlines, and tortured the feds-and the ultimate betrayal that would eventually bring them down. Parmy Olson goes behind the headlines and into the world of Anonymous and LulzSec with unprecedented access, drawing upon hundreds of conversations with the hackers themselves, including exclusive interviews with all six core members of LulzSec.
In late 2010, thousands of hacktivists joined a mass digital assault on the websites of VISA, MasterCard, and PayPal to protest their treatment of WikiLeaks. Other targets were wide ranging-the websites of corporations from Sony Entertainment and Fox to the Vatican and the Church of Scientology were hacked, defaced, and embarrassed-and the message was that no one was safe. Thousands of user accounts from pornography websites were released, exposing government employees and military personnel.
Although some attacks were perpetrated by masses of users who were rallied on the message boards of 4Chan, many others were masterminded by a small, tight-knit group of hackers who formed a splinter group of Anonymous called LulzSec. The legend of Anonymous and LulzSec grew in the wake of each ambitious hack. But how were they penetrating intricate corporate security systems? Were they anarchists or activists? Teams or lone wolves? A cabal of skilled hackers or a disorganized bunch of kids?
WE ARE ANONYMOUS delves deep into the internet's underbelly to tell the incredible full story of the global cyber insurgency movement, and its implications for the future of computer security.
Kevin Mitnick's exploits as a cyber-desperado and fugitive form one of the most exhaustive FBI manhunts in history and have spawned dozens of articles, books, films, and documentaries. Since his release from federal prison, in 1998, Mitnick has turned his life around and established himself as one of the most sought-after computer security experts worldwide. Now, in The Art of Deception, the world's most notorious hacker gives new meaning to the old adage, "It takes a thief to catch a thief."
Focusing on the human factors involved with information security, Mitnick explains why all the firewalls and encryption protocols in the world will never be enough to stop a savvy grifter intent on rifling a corporate database or an irate employee determined to crash a system. With the help of many fascinating true stories of successful attacks on business and government, he illustrates just how susceptible even the most locked-down information systems are to a slick con artist impersonating an IRS agent. Narrating from the points of view of both the attacker and the victims, he explains why each attack was so successful and how it could have been prevented in an engaging and highly readable style reminiscent of a true-crime novel. And, perhaps most importantly, Mitnick offers advice for preventing these types of social engineering hacks through security protocols, training programs, and manuals that address the human element of security.
In Penetration Testing, security expert, researcher, and trainer Georgia Weidman introduces you to the core skills and techniques that every pentester needs. Using a virtual machine–based lab that includes Kali Linux and vulnerable operating systems, you’ll run through a series of practical lessons with tools like Wireshark, Nmap, and Burp Suite. As you follow along with the labs and launch attacks, you’ll experience the key stages of an actual assessment—including information gathering, finding exploitable vulnerabilities, gaining access to systems, post exploitation, and more.
Learn how to:
* Crack passwords and wireless network keys with brute-forcing and wordlists
* Test web applications for vulnerabilities
* Use the Metasploit Framework to launch exploits and write your own Metasploit modules
* Automate social-engineering attacks
* Bypass antivirus software
* Turn access to one machine into total control of the enterprise in the post exploitation phase
You’ll even explore writing your own exploits. Then it’s on to mobile hacking—Weidman’s particular area of research—with her tool, the Smartphone Pentest Framework.
With its collection of hands-on lessons that cover key tools and strategies, Penetration Testing is the introduction that every aspiring hacker needs.
A thoroughly revised and updated edition of the essential guide to preserving your personal security
From cyberspace to crawl spaces, new innovations in information gathering have left the private life of the average person open to scrutiny, and worse, exploitation. In this thoroughly updated third edition of his immensely popular guide How to Be Invisible, J.J. Luna shows you how to protect your home address, hide your ownership of vehicles and real estate, use pagers with dumbphones, switch to low-profile banking and invisible money transfers, use alternate signatures, and how to secretly run a home-based business.
J.J. Luna is an expert and highly trained security consultant with years of experience protecting himself, his family, and his clients. Using real life stories and his own consulting experience, J.J. Luna divulges legal methods to attain the privacy you crave and deserve, whether you want to shield yourself from casual scrutiny or take your life savings with you and disappear without a trace. Whatever your needs, Luna reveals the shocking secrets that private detectives and other seekers of personal information use to uncover information and then shows how to make a serious commitment to safeguarding yourself.
There is a prevailing sense in our society that true privacy is a thing of the past. In a world where privacy concerns that only continue to grow in magnitude, How to Be Invisible, Third Edition is a critical antidote to the spread of new and more efficient ways of undermining our personal security.
Privacy is a commonly-lamented casualty of the Information Age and of the world's changing climate--but that doesn't mean you have to stand for it. This new edition of J. J. Luna's classic manual contains step-by-step advice on building and maintaining your personal security, including brand new chapters on:
- The dangers from Facebook, smartphones, and facial recognition
- How to locate a nominee (or proxy) you can trust
- The art of pretexting, aka social engineering
- Moving to Baja California Sur; San Miguel de Allende, Guanajuato; Cuenca, Ecuador; or Spain's Canary Islands
- The secrets of international privacy, and much more!
Rather than merely showing how to run existing exploits, author Jon Erickson explains how arcane hacking techniques actually work. To share the art and science of hacking in a way that is accessible to everyone, Hacking: The Art of Exploitation, 2nd Edition introduces the fundamentals of C programming from a hacker's perspective.
The included LiveCD provides a complete Linux programming and debugging environment-all without modifying your current operating system. Use it to follow along with the book's examples as you fill gaps in your knowledge and explore hacking techniques on your own. Get your hands dirty debugging code, overflowing buffers, hijacking network communications, bypassing protections, exploiting cryptographic weaknesses, and perhaps even inventing new exploits. This book will teach you how to:
* Program computers using C, assembly language, and shell scripts
* Corrupt system memory to run arbitrary code using buffer overflows and format strings Inspect processor registers and system memory with a debugger to gain a real understanding of what is happening
* Outsmart common security measures like nonexecutable stacks and intrusion detection systems
* Gain access to a remote server using port-binding or connect-back shellcode, and alter a server's logging behavior to hide your presence
* Redirect network traffic, conceal open ports, and hijack TCP connections
* Crack encrypted wireless traffic using the FMS attack, and speed up brute-force attacks using a password probability matrix
Hackers are always pushing the boundaries, investigating the unknown, and evolving their art. Even if you don't already know how to program, Hacking: The Art of Exploitation, 2nd Edition will give you a complete picture of programming, machine architecture, network communications, and existing hacking techniques. Combine this knowledge with the included Linux environment, and all you need is your own creativity.
That's what this cookbook is for. Fortunately, most router configuration tasks can be broken down into several more or less independent steps: you configure an interface, you configure a routing protocol, you set up backup links, you implement packet filters and other access control mechanisms. What you really need is a set of recipes that show you how to perform the most common tasks, so you can quickly come up with a good configuration for your site. And you need to know that these solutions work: you don't want to find yourself implementing a backup link at 2 A.M. because your main link is down and the backup link you set up when you installed the router wasn't quite right.
Thoroughly revised and expanded, Cisco IOS Cookbook, 2nd Edition, adds sections on MPLS, Security, IPv6, and IP Mobility, and presents solutions to the most common configuration problems, including:Configuring interfaces of many types, from serial to ATM and Frame RelayConfiguring all of the common IP routing protocols (RIP, EIGRP, OSPF, and BGP)Configuring authenticationConfiguring other services, including DHCP and NTPSetting up backup links, and using HSRP to configure backup routersManaging the router, including SNMP and other solutionsUsing access lists to control the traffic through the router
If you work with Cisco routers, you need a book like this to help you solve problems quickly and effectively. Even if you're experienced, the solutions and extensive explanations will give you new ideas and insights into router configuration. And if you're not experienced--if you've just been given responsibility for managing a network with Cisco routers--this book could be a job-saver.
If you work with Cisco routers, it's likely that you deal with Cisco's IOS software--an extremely powerful and complex operating system, with an equally complex configuration language. With a cryptic command-line interface and thousands of commands--some of which mean different things in different situations--it doesn't have a reputation for being user-friendly.
Fortunately, there's help. This second edition of Cisco IOS in a Nutshell consolidates the most important commands and features of IOS into a single, well-organized volume that you'll find refreshingly user-friendly.
This handy, two-part reference covers IOS configuration for the TCP/IP protocol family. The first section includes chapters on the user interface, configuring lines and interfaces, access lists, routing protocols, and dial-on-demand routing and security. A brief, example-filled tutorial shows you how to accomplish common tasks.
The second part is a classic O'Reilly quick reference to all the commands for working with TCP/IP and the lower-level protocols on which it relies. Brief descriptions and lists of options help you zero in on the commands you for the task at hand. Updated to cover Cisco IOS Software Major Release 12.3, this second edition includes lots of examples of the most common configuration steps for the routers themselves. It's a timely guide that any network administrator will come to rely on.
TCP/IP is a hot topic, because it's the glue that holds the Internet and the Web together, and network administrators need to stay on top of the latest developments. TCP/IP For Dummies, 6th Edition, is both an introduction to the basics for beginners as well as the perfect go-to resource for TCP/IP veterans.
The book includes the latest on Web protocols and new hardware, plus very timely information on how TCP/IP secures connectivity for blogging, vlogging, photoblogging, and social networking. Step-by-step instructions show you how to install and set up TCP/IP on clients and servers; build security with encryption, authentication, digital certificates, and signatures; handle new voice and mobile technologies, and much more.Transmission Control Protocol / Internet Protocol (TCP/IP) is the de facto standard transmission medium worldwide for computer-to-computer communications; intranets, private internets, and the Internet are all built on TCP/IP The book shows you how to install and configure TCP/IP and its applications on clients and servers; explains intranets, extranets, and virtual private networks (VPNs); provides step-by-step information on building and enforcing security; and covers all the newest protocols You'll learn how to use encryption, authentication, digital certificates, and signatures to set up a secure Internet credit card transaction
Find practical security tips, a Quick Start Security Guide, and still more in this practical guide.
Hacking VoIP takes a dual approach to VoIP security, explaining its many security holes to hackers and administrators. If you're serious about security, and you either use or administer VoIP, you should know where VoIP's biggest weaknesses lie and how to shore up your security. And if your intellectual curiosity is leading you to explore the boundaries of VoIP, Hacking VoIP is your map and guidebook.
Hacking VoIP will introduce you to every aspect of VoIP security, both in home and enterprise implementations. You'll learn about popular security assessment tools, the inherent vulnerabilities of common hardware and software packages, and how to:
* Identify and defend against VoIP security attacks such as eavesdropping, audio injection, caller ID spoofing, and VoIP phishing
* Audit VoIP network security
* Assess the security of enterprise-level VoIP networks such as Cisco, Avaya, and Asterisk, and home VoIP solutions like Yahoo! and Vonage
* Use common VoIP protocols like H.323, SIP, and RTP as well as unique protocols like IAX
* Identify the many vulnerabilities in any VoIP network
Whether you're setting up and defending your VoIP network against attacks or just having sick fun testing the limits of VoIP networks, Hacking VoIP is your go-to source for every aspect of VoIP security and defense.
“Bruce Schneier’s amazing book is the best overview of privacy and security ever written.”—Clay Shirky
Your cell phone provider tracks your location and knows who’s with you. Your online and in-store purchasing patterns are recorded, and reveal if you're unemployed, sick, or pregnant. Your e-mails and texts expose your intimate and casual friends. Google knows what you’re thinking because it saves your private searches. Facebook can determine your sexual orientation without you ever mentioning it.
The powers that surveil us do more than simply store this information. Corporations use surveillance to manipulate not only the news articles and advertisements we each see, but also the prices we’re offered. Governments use surveillance to discriminate, censor, chill free speech, and put people in danger worldwide. And both sides share this information with each other or, even worse, lose it to cybercriminals in huge data breaches.
Much of this is voluntary: we cooperate with corporate surveillance because it promises us convenience, and we submit to government surveillance because it promises us protection. The result is a mass surveillance society of our own making. But have we given up more than we’ve gained? In Data and Goliath, security expert Bruce Schneier offers another path, one that values both security and privacy. He brings his bestseller up-to-date with a new preface covering the latest developments, and then shows us exactly what we can do to reform government surveillance programs, shake up surveillance-based business models, and protect our individual privacy. You'll never look at your phone, your computer, your credit cards, or even your car in the same way again.
WikiLeaks brought to light a new form of whistleblowing, using powerful cryptographic code to hide leakers’ identities while they spill the private data of government agencies and corporations. But that technology has been evolving for decades in the hands of hackers and radical activists, from the libertarian enclaves of Northern California to Berlin to the Balkans. And the secret-killing machine continues to evolve beyond WikiLeaks, as a movement of hacktivists aims to obliterate the world’s institutional secrecy.
This is the story of the code and the characters—idealists, anarchists, extremists—who are transforming the next generation’s notion of what activism can be.
With unrivaled access to such major players as Julian Assange, Daniel Domscheit-Berg, and WikiLeaks’ shadowy engineer known as the Architect, never before interviewed, reporter Andy Greenberg unveils the world of politically-motivated hackers—who they are and how they operate.
Yes, you can mine through the 5,000 pages of documentation or take a two-thousand-dollar training course, but JUNOS's interprocess sophistication can be baffling unless you know the shortcuts and tricks, as well as those rays of illuminating comprehension that can come only from those who live with it. JUNOS Cookbook is the first comprehensive book about JUNOS software and it provides over 200 time-saving step-by-step techniques including discussions about the processes and alternative ways to perform the same task. It's been tested and tech-reviewed by field engineers who know how to take JUNOS out for a spin and it's applicable to the entire line of M-, T-, and J-series routers. JUNOS Cookbook will not only pay for itself the first few times you use it, it will make your network easier to manage and update.
"Aviva Garrett has done a tremendous job of distilling the features of JUNOS software in a form that will be useful for a wide audience-students, field engineers, network architects, and other networking professionals alike will benefit from this book. For many people, this is the only book on JUNOS they will need."Pradeep Sindhu, CTO and Founder, Juniper Networks
"This cookbook is superb. Aviva Garrett has masterfully assembled a complete set of practical real-world examples with step-by-step instructions. Security, management, routing: it's all here!"Stephen Gill, Research Fellow, Team Cymru
"A technical time-saver for any NOC or SOC working with JUNOS. It's clear, concise, and informative recipes are are an invaluable resource. "Scott A. McIntyre, Security Officer, XS4ALL Internet B.V
The word spread through the hacking underground like some unstoppable new virus: Someone—some brilliant, audacious crook—had just staged a hostile takeover of an online criminal network that siphoned billions of dollars from the US economy.
The FBI rushed to launch an ambitious undercover operation aimed at tracking down this new kingpin; other agencies around the world deployed dozens of moles and double agents. Together, the cybercops lured numerous unsuspecting hackers into their clutches. . . . Yet at every turn, their main quarry displayed an uncanny ability to sniff out their snitches and see through their plots.
The culprit they sought was the most unlikely of criminals: a brilliant programmer with a hippie ethic and a supervillain’s double identity. As prominent “white-hat” hacker Max “Vision” Butler, he was a celebrity throughout the programming world, even serving as a consultant to the FBI. But as the black-hat “Iceman,” he found in the world of data theft an irresistible opportunity to test his outsized abilities. He infiltrated thousands of computers around the country, sucking down millions of credit card numbers at will. He effortlessly hacked his fellow hackers, stealing their ill-gotten gains from under their noses. Together with a smooth-talking con artist, he ran a massive real-world crime ring.
And for years, he did it all with seeming impunity, even as countless rivals ran afoul of police.
Yet as he watched the fraudsters around him squabble, their ranks riddled with infiltrators, their methods inefficient, he began to see in their dysfunction the ultimate challenge: He would stage his coup and fix what was broken, run things as they should be run—even if it meant painting a bull’s-eye on his forehead.
Through the story of this criminal’s remarkable rise, and of law enforcement’s quest to track him down, Kingpin lays bare the workings of a silent crime wave still affecting millions of Americans. In these pages, we are ushered into vast online-fraud supermarkets stocked with credit card numbers, counterfeit checks, hacked bank accounts, dead drops, and fake passports. We learn the workings of the numerous hacks—browser exploits, phishing attacks, Trojan horses, and much more—these fraudsters use to ply their trade, and trace the complex routes by which they turn stolen data into millions of dollars. And thanks to Poulsen’s remarkable access to both cops and criminals, we step inside the quiet, desperate arms race that law enforcement continues to fight with these scammers today.
Ultimately, Kingpin is a journey into an underworld of startling scope and power, one in which ordinary American teenagers work hand in hand with murderous Russian mobsters and where a simple Wi-Fi connection can unleash a torrent of gold worth millions.
From the Hardcover edition.
With this book, you'll learn skills through a variety of genuine scenarios, from fixing a malfunctioning office network to planning a network for a high-technology haunted house. You'll learn exactly what you need to know, rather than a laundry list of acronyms and diagrams. This book will help you:
Master the functionality, protocols, and packets that make up real-world networkingLearn networking concepts through examples in the fieldTackle tasks such as planning and diagramming networks, running cables, and configuring network devices such as routers and switchesMonitor networks for performance and problems, and learn troubleshooting techniquesPractice what you've learned with nearly one hundred exercises, questions, sample problems, and projects
Head First's popular format is proven to stimulate learning and retention by engaging you with images, puzzles, stories, and more. Whether you're a network professional with a CCNA/CCNP or a student taking your first college networking course, Head First Networking will help you become a network guru.
Insider techniques and creative challenges throughout show you how to extend the hacks and how to write your own exploits.
When it comes to offensive security, your ability to create powerful tools on the fly is indispensable. Learn how in Black Hat Python.
Topics include:An in-depth view of routers and routingSwitching, using Cisco Catalyst and Nexus switches as examplesSOHO VoIP and SOHO wireless access point design and configurationIntroduction to IPv6 with configuration examplesTelecom technologies in the data-networking world, including T1, DS3, frame relay, and MPLSSecurity, firewall theory, and configuration, as well as ACL and authenticationQuality of Service (QoS), with an emphasis on low-latency queuing (LLQ)IP address allocation, Network Time Protocol (NTP), and device failures
Shortly after 9/11, Joel Brenner entered the inner sanctum of American espionage, first as the inspector general of the National Security Agency, then as the head of counterintelligence for the director of National Intelligence. He saw at close range the battleground on which adversaries are attacking us: cyberspace.
Like the rest of us, governments and corporations inhabit “glass houses,” all but transparent to a new generation of spies who operate remotely from such places as China, the Middle East, Russia, and even France. In this urgent wake-up call, Brenner draws on his extraordinary background to show what we can—and cannot—do to prevent cyber spies and hackers from compromising our security and stealing our latest technology.
The Metasploit Framework makes discovering, exploiting, and sharing vulnerabilities quick and relatively painless. But while Metasploit is used by security professionals everywhere, the tool can be hard to grasp for first-time users. Metasploit: The Penetration Tester's Guide fills this gap by teaching you how to harness the Framework and interact with the vibrant community of Metasploit contributors.
Once you've built your foundation for penetration testing, you'll learn the Framework's conventions, interfaces, and module system as you launch simulated attacks. You'll move on to advanced penetration testing techniques, including network reconnaissance and enumeration, client-side attacks, wireless attacks, and targeted social-engineering attacks.
Learn how to:
* Find and exploit unmaintained, misconfigured, and unpatched systems
* Perform reconnaissance and find valuable information about your target
* Bypass anti-virus technologies and circumvent security controls
* Integrate Nmap, NeXpose, and Nessus with Metasploit to automate discovery
* Use the Meterpreter shell to launch further attacks from inside the network
* Harness standalone Metasploit utilities, third-party tools, and plug-ins
* Learn how to write your own Meterpreter post exploitation modules and scripts
You'll even touch on exploit discovery for zero-day research, write a fuzzer, port existing exploits into the Framework, and learn how to cover your tracks. Whether your goal is to secure your own networks or to put someone else's to the test, Metasploit: The Penetration Tester's Guide will take you there and beyond.
—Vint Cerf, Internet pioneer
TCP/IP Illustrated, Volume 1, Second Edition, is a detailed and visual guide to today’s TCP/IP protocol suite. Fully updated for the newest innovations, it demonstrates each protocol in action through realistic examples from modern Linux, Windows, and Mac OS environments. There’s no better way to discover why TCP/IP works as it does, how it reacts to common conditions, and how to apply it in your own applications and networks.
Building on the late W. Richard Stevens’ classic first edition, author Kevin R. Fall adds his cutting-edge experience as a leader in TCP/IP protocol research, updating the book to fully reflect the latest protocols and best practices. He first introduces TCP/IP’s core goals and architectural concepts, showing how they can robustly connect diverse networks and support multiple services running concurrently. Next, he carefully explains Internet addressing in both IPv4 and IPv6 networks. Then, he walks through TCP/IP’s structure and function from the bottom up: from link layer protocols–such as Ethernet and Wi-Fi–through network, transport, and application layers.
Fall thoroughly introduces ARP, DHCP, NAT, firewalls, ICMPv4/ICMPv6, broadcasting, multicasting, UDP, DNS, and much more. He offers extensive coverage of reliable transport and TCP, including connection management, timeout, retransmission, interactive data flow, and congestion control. Finally, he introduces the basics of security and cryptography, and illuminates the crucial modern protocols for protecting security and privacy, including EAP, IPsec, TLS, DNSSEC, and DKIM. Whatever your TCP/IP experience, this book will help you gain a deeper, more intuitive understanding of the entire protocol suite so you can build better applications and run more reliable, efficient networks.
In The Tangled Web, Michal Zalewski, one of the world's top browser security experts, offers a compelling narrative that explains exactly how browsers work and why they're fundamentally insecure. Rather than dispense simplistic advice on vulnerabilities, Zalewski examines the entire browser security model, revealing weak points and providing crucial information for shoring up web application security. You'll learn how to:
* Perform common but surprisingly complex tasks such as URL parsing and HTML sanitization
* Use modern security features like Strict Transport Security, Content Security Policy, and Cross-Origin Resource Sharing
* Leverage many variants of the same-origin policy to safely compartmentalize complex web applications and protect user credentials in case of XSS bugs
* Build mashups and embed gadgets without getting stung by the tricky frame navigation policy
* Embed or host user-supplied content without running into the trap of content sniffing
For quick reference, "Security Engineering Cheat Sheets" at the end of each chapter offer ready solutions to problems you're most likely to encounter. With coverage extending as far as planned HTML5 features, The Tangled Web will help you create secure web applications that stand the test of time.
But 2012 marked a transformation in geopolitics and the tactics of both the established powers and smaller entities looking to challenge the international community. That year, the US government revealed its involvement in Operation “Olympic Games,” a mission aimed at disrupting the Iranian nuclear program through cyberattacks; Russia and China conducted massive cyber-espionage operations; and the world split over the governance of the Internet. Cyberspace became a battlefield.
Cyber conflict is hard to track, often delivered by proxies, and has outcomes that are hard to gauge. It demands that the rules of engagement be completely reworked and all the old niceties of diplomacy be recast. Many of the critical resources of statecraft are now in the hands of the private sector, giant technology companies in particular. In this new world order, cybersecurity expert Adam Segal reveals, power has been well and truly hacked.
The fifth edition covers BIND 9.3.2, the most recent release of the BIND 9 series, as well as BIND 8.4.7. BIND 9.3.2 contains further improvements in security and IPv6 support, and important new features such as internationalized domain names, ENUM (electronic numbering), and SPF (the Sender Policy Framework).
Whether you're an administrator involved with DNS on a daily basis or a user who wants to be more informed about the Internet and how it works, you'll find that this book is essential reading.
Topics include:What DNS does, how it works, and when you need to use itHow to find your own place in the Internet's namespaceSetting up name serversUsing MX records to route mailConfiguring hosts to use DNS name serversSubdividing domains (parenting)Securing your name server: restricting who can query your server, preventing unauthorized zone transfers, avoiding bogus servers, etc.The DNS Security Extensions (DNSSEC) and Transaction Signatures (TSIG)Mapping one name to several servers for load sharingDynamic updates, asynchronous notification of change to a zone, and incremental zone transfersTroubleshooting: using nslookup and dig, reading debugging output, common problemsDNS programming using the resolver library and Perl's Net::DNS module
Author Matthew Gast—an industry expert who led the development of 802.11-2012 and security task groups at the Wi-Fi Alliance—explains how 802.11ac will not only increase the speed of your network, but its capacity as well. Whether you need to serve more clients with your current level of throughput, or serve your existing client load with higher throughput, 802.11ac is the solution. This book gets you started.Understand how the 802.11ac protocol works to improve the speed and capacity of a wireless LANExplore how beamforming increases speed capacity by improving link margin, and lays the foundation for multi-user MIMOLearn how multi-user MIMO increases capacity by enabling an AP to send data to multiple clients simultaneouslyPlan when and how to upgrade your network to 802.11ac by evaluating client devices, applications, and network connections
—Jon “jcase” Sawyer, from the Foreword
There are more than one billion Android devices in use today, each one a potential target. Unfortunately, many fundamental Android security features have been little more than a black box to all but the most elite security professionals—until now.
In Android Security Internals, top Android security expert Nikolay Elenkov takes us under the hood of the Android security system. Elenkov describes Android security architecture from the bottom up, delving into the implementation of major security-related components and subsystems, like Binder IPC, permissions, cryptographic providers, and device administration.
* How Android permissions are declared, used, and enforced
* How Android manages application packages and employs code signing to verify their authenticity
* How Android implements the Java Cryptography Architecture (JCA) and Java Secure Socket Extension (JSSE) frameworks
* About Android’s credential storage system and APIs, which let applications store cryptographic keys securely
* About the online account management framework and how Google accounts integrate with Android
* About the implementation of verified boot, disk encryption, lockscreen, and other device security features
* How Android’s bootloader and recovery OS are used to perform full system updates, and how to obtain root access
With its unprecedented level of depth and detail, Android Security Internals is a must-have for any security-minded Android developer.
The flood of Internet-enabled devices has made migrating to IPv6 a paramount concern worldwide. In this updated edition, Hagen distills more than ten years of studying, working with, and consulting with enterprises on IPv6. It’s the only book of its kind.
IPv6 Essentials covers:Address architecture, header structure, and the ICMPv6 message formatIPv6 mechanisms such as Neighbor Discovery, Stateless Address autoconfiguration, and Duplicate Address detectionNetwork-related aspects and services: Layer 2 support, Upper Layer Protocols, and ChecksumsIPv6 security: general practices, IPSec basics, IPv6 security elements, and enterprise security modelsTransitioning to IPv6: dual-stack operation, tunneling, and translation techniquesMobile IPv6: technology for a new generation of mobile servicesPlanning options, integration scenarios, address plan, best practices, and dos and don’ts
Protect wireless networks against all real-world hacks by learning how hackers operate. Wireless Network Security: A Beginner's Guide discusses the many attack vectors that target wireless networks and clients--and explains how to identify and prevent them. Actual cases of attacks against WEP, WPA, and wireless clients and their defenses are included.
This practical resource reveals how intruders exploit vulnerabilities and gain access to wireless networks. You'll learn how to securely deploy WPA2 wireless networks, including WPA2-Enterprise using digital certificates for authentication. The book provides techniques for dealing with wireless guest access and rogue access points. Next-generation wireless networking technologies, such as lightweight access points and cloud-based wireless solutions, are also discussed. Templates, checklists, and examples give you the hands-on help you need to get started right away.
Wireless Network Security: A Beginner's Guide features:Lingo--Common security terms defined so that you’re in the know on the job IMHO--Frank and relevant opinions based on the author's years of industry experience In Actual Practice--Exceptions to the rules of security explained in real-world contexts Your Plan--Customizable checklists you can use on the job now Into Action--Tips on how, why, and when to apply new skills and techniques at work
This is an excellent introduction to wireless security and their security implications. The technologies and tools are clearly presented with copious illustrations and the level of presentation will accommodate the wireless security neophyte while not boring a mid-level expert to tears. If the reader invests the time and resources in building a lab to follow along with the text, s/he will develop a solid, basic understanding of what "wireless security" is and how it can be implemented in practice. This is definitely a recommended read for its intended audience. - Richard Austin, IEEE CIPHER, IEEE Computer Society's TC on Security and Privacy (E109, July 23, 2012)
Network Warrior takes you step by step through the world of hubs, switches, firewalls, and more, including ways to troubleshoot a congested network, and when to upgrade and why. Along the way, you 'll gain an historical perspective of various networking features, such as the way Ethernet evolved. Based on the author 's own experience as well as those he worked for and with, Network Warrior is a Cisco-centric book, focused primarily on the TCP/IP protocol and Ethernet networks -- the realm that Cisco Systems now dominates. The book covers:
The type of networks now in use, from LANs, WANs and MANs to CANs
The OSI Model and the layers involved in sending dataHubs, repeaters, switches, and trunks in practiceAuto negotiation and why it 's a common problem in network slowdownsRoute maps, routing protocols, and switching algorithms in Cisco routersThe resilient Ethernet -- how to make things truly redundantCisco 6500 multi-layer switches and the Catalyst 3750 switchTelecom nomenclature -- why it 's different from the data worldT1 and DS3Firewall theory, designing access lists, authentication in Cisco devicesServer load balancing technologyContent switch module in actionDesigning QOS and what QOS does not doIP design and subnetting made easy
The book also explains how to sell your ideas to management, how networks become a mess as a company grows, and why change control is your friend. Network Warrior will help network administrators and engineers win the complex battles they face every day.
The book's authors have taken great care to ensure all exam topics and fundamental networking areas are covered in full. The OSI Model, the Data Link, Network, Transport and Application Layers, Switching & Routing, F5 Solutions, Load Balancing, Security and Application Delivery Platforms are all covered in depth. No prior knowledge or experience is assumed.
There are 13 chapters, 90 diagrams and over 70 test questions to ensure you have everything necessary to prepare for and pass the exam with confidence.
Download of the PDF file has been disabled.
She writes, ÒContent platforms and social media networks do not have the power to restrain stalkers, end intimate partner violence, eliminate child abuse, or stop street harassment. But they can cultivate better interactions and better discourse, through thoughtful architecture, active moderation and community management.Ó
So how do we filter content from garbage? Read on.
Sarah Jeong writes about technology, policy and law with bylines at Forbes, The Verge, The Guardian, Slate and WIRED.
Author Elliotte Rusty Harold provides complete working programs to illustrate the methods and classes he describes. This thoroughly revised fourth edition covers REST, SPDY, asynchronous I/O, and many other recent technologies.Explore protocols that underlie the Internet, such as TCP/IP and UDP/IPLearn how Java’s core I/O API handles network input and outputDiscover how the InetAddress class helps Java programs interact with DNSLocate, identify, and download network resources with Java’s URI and URL classesDive deep into the HTTP protocol, including REST, HTTP headers, and cookiesWrite servers and network clients, using Java’s low-level socket classesManage many connections at the same time with the nonblocking I/O
Practical discussions provide an inside look at TCP/IP components and protocols.
Step-by-step instructions walk you through many common tasks.
Q&As at the end of each hour help you test your knowledge.
Notes and tips point out shortcuts and solutions and help you steer clear of potential problems.
If you’re looking for a smart, concise introduction to the protocols that power the Internet, start your clock and look inside. Sams Teach Yourself TCP/IP in 24 Hours is your guide to the secrets of TCP/IP.
Learn how to…
Understand what TCP/IP is, and how it works Discover how IPv6 differs from IPv4, and how to migrate or coexist with IPv6 Work with TCP/IP’s Network Access, Internet, Transport, and Application layers Implement flexible addressing with subnetting and CIDR Establish efficient and reliable routing Implement name resolution Secure TCP/IP networks—detect and prevent attacks Automatically configure TCP/IP clients and hosts Provide classic TCP/IP services and powerful new Web services Use TCP/IP in advanced cloud-based environments Support efficient media streaming and webcasting Capitalize on the benefits of the new HTML5 standard Run TCP/IP protocols over wireless networks Troubleshoot TCP/IP networks with ping, traceroute, and other tools Provide for monitoring and remote access Deploy efficient email systems with POP3, IMAP4, and SMTP Walk through all facets of implementing a TCP/IP network
Ideal for beginning network engineers, each chapter in this book includes a set of review questions, as well as practical, hands-on lab exercises.
You’ll explore topics including:Basic network architecture: how protocols and functions fit togetherThe structure and operation of the Ethernet protocolTCP/IP protocol fields, operations, and addressing used for networksThe address resolution process in a typical IPv4 networkSwitches, access points, routers, and components that process packetsTCP details, including packet content and client-server packet flowHow the Internet Control Message Protocol provides error messages during network operationsHow network mask (subnetting) helps determine the networkThe operation, structure, and common uses of the user datagram protocol
This book will walk you through exploring and harnessing the vast potential of Wireshark, the world's foremost network protocol analyzer.
The book begins by introducing you to the foundations of Wireshark and showing you how to browse the numerous features it provides. You'll be walked through using these features to detect and analyze the different types of attacks that can occur on a network. As you progress through the chapters of this book, you'll learn to perform sniffing on a network, analyze clear-text traffic on the wire, recognize botnet threats, and analyze Layer 2 and Layer 3 attacks along with other common hacks.
By the end of this book, you will be able to fully utilize the features of Wireshark that will help you securely administer your network.
CASP: CompTIA Advanced Security Practitioner Study Guide: CAS-002 is the updated edition of the bestselling book covering the CASP certification exam. CompTIA approved, this guide covers all of the CASP exam objectives with clear, concise, thorough information on crucial security topics. With practical examples and insights drawn from real-world experience, the book is a comprehensive study resource with authoritative coverage of key concepts. Exam highlights, end-of-chapter reviews, and a searchable glossary help with information retention, and cutting-edge exam prep software offers electronic flashcards and hundreds of bonus practice questions. Additional hands-on lab exercises mimic the exam's focus on practical application, providing extra opportunities for readers to test their skills.
CASP is a DoD 8570.1-recognized security certification that validates the skillset of advanced-level IT security professionals. The exam measures the technical knowledge and skills required to conceptualize, design, and engineer secure solutions across complex enterprise environments, as well as the ability to think critically and apply good judgment across a broad spectrum of security disciplines. This study guide helps CASP candidates thoroughly prepare for the exam, providing the opportunity to:Master risk management and incident response Sharpen research and analysis skills Integrate computing with communications and business Review enterprise management and technical component integration
Experts predict a 45-fold increase in digital data by 2020, with one-third of all information passing through the cloud. Data has never been so vulnerable, and the demand for certified security professionals is increasing quickly. The CASP proves an IT professional's skills, but getting that certification requires thorough preparation. This CASP study guide provides the information and practice that eliminate surprises on exam day.
Also available as a set, Security Practitoner & Crypotography Set, 9781119071549 with Applied Cryptography: Protocols, Algorithms, and Source Code in C, 2nd Edition.
The Conficker worm infected its first computer in November 2008 and within a month had infiltrated 1.5 million computers in 195 countries. Banks, telecommunications companies, and critical government networks (including the British Parliament and the French and German military) were infected. No one had ever seen anything like it. By January 2009 the worm lay hidden in at least eight million computers and the botnet of linked computers that it had created was big enough that an attack might crash the world. This is the gripping tale of the group of hackers, researches, millionaire Internet entrepreneurs, and computer security experts who united to defend the Internet from the Conficker worm: the story of the first digital world war.
Leading networking instructor Rick Graziani explains all the basics simply and clearly, one step at a time, providing all the details you’ll need to succeed. Building on this introductory coverage, he then introduces more powerful techniques that involve multiple protocols and processes and provides hands-on resources you can rely on for years to come.
You’ll begin by learning why IPv6 is necessary, how it was created, and how it works. Next, Graziani thoroughly introduces IPv6 addressing, configuration options, and routing protocols, including RIPng, EIGRP for IPv6, and OSPFv3. You’ll learn how to integrate IPv6 with IPv4, enabling both protocols to coexist smoothly as you move towards full reliance on IPv6.
Throughout, Graziani presents all the IOS command syntax you’ll need, offering specific examples, diagrams, and Cisco-focused IPv6 configuration tips. You’ll also find links to Cisco white papers and official IPv6 RFCs that support an even deeper understanding.
Rick Graziani teaches computer science and computer networking courses at Cabrillo College. He has worked and taught in the computer networking and IT field for nearly 30 years, and currently consults for Cisco and other leading clients. Graziani’s recent Cisco Networking Academy Conference presentation on IPv6 Fundamentals and Routing drew a standing audience and the largest virtual audience for any session at the event. He previously worked for companies including Santa Cruz Operation, Tandem Computers, and Lockheed.
· Understand how IPv6 overcomes IPv4’s key limitations
· Compare IPv6 with IPv4 to see what has changed and what hasn’t
· Represent IPv6 addresses, including subnet addresses
· Enable IPv6 on router interfaces using static, dynamic, EUI-64, unnumbered, SLAAC, and DHCPv6 approaches
· Improve network operations with ICMPv6 and Neighbor Discovery Protocol
· Configure IPv6 addressing and Access Control Lists using a common topology
· Work with IPv6 routing tables and configure IPv6 static routes
· Compare, configure, and verify each IPv6 IGP routing protocol
· Implement stateful and stateless DHCPv6 services
· Integrate IPv6 with other upper-level protocols, including DNS, TCP, and UDP
· Use dual-stack techniques to run IPv4 and IPv6 on the same device
· Establish coexistence between IPv4 and IPv6 through manual, 6to4, or ISATAP tunneling
· Promote a smooth transition with NAT64 (Network Address Translation IPv6 to IPv4)
This book is part of the Cisco Press Fundamentals Series. Books in this series introduce networking professionals to new networking technologies, covering network topologies, sample deployment concepts, protocols, and management techniques.