Hacking Exposed: Network Security Secrets & Solutions, Fourth Edition

Rating:
Summary: Time to reposition the "Hacking Exposed" series?
Review: I am a senior engineer for network security operations. I've read and reviewed every edition of the "Hacking Exposed" series since the 1999 original. "Hacking Exposed" is a winner; the authors' powerful example-driven style teaches the tools and tactics of vulnerability assessment and penetration testing. Nevertheless, I've compared this third edition to its "Hacking Linux" and "Hacking Windows 2000" cousins, and I believe the authors should rethink their goals for the "Hacking Exposed" series.

"Hacking Exposed, Third Edition" (HE:3E) describes techniques to attack and defend a wide variety of network assets: Microsoft products (9x, ME, NT, 2000, XP), UNIX variants, Novell's NOS, routers, PBXs, firewalls, and so on. Weaknesses in individual applications are explained, with attention given to remote control tools (VNC, Windows Terminal Server, PCAnywhere), Web technologies (IIS, ColdFusion, ActiveX, Java), and file sharing/chat systems (Napster, IRC). Readers are unlikely to find so many topics given fairly thorough coverage in a single volume.

Unfortunately, at 727 pages, HE:3E has gained too much weight. The 1999 first edition offered 484 pages, and the 2001 (yes, 2001) second edition gave 703 pages. While the authors should be credited for not simply copying and pasting material from their 2001 edition of "Hacking Exposed: Windows 2000," many of the same topics appear in both books. Furthermore, some subjects are redundantly described within HE:3E. For example, why rehash port redirection and rootkits in chapter 14 when they were adequately covered in earlier sections?

I strongly recommend the authors remove the UNIX- and Windows-specific material from a future fourth edition of "Hacking Exposed," directing readers to "Hacking Linux" and "Hacking Windows" when necessary. The authors should briefly describe general UNIX and Windows vulnerabilities in "HE:4E," and devote most of the book to their methodology and systems not covered in other books. This overhaul will give the authors a chance to remove some dated material from "Hacking Exposed," like a reference to ISS RealSecure v3.0 (6.0 is now in use).

I recommend readers who have not read previous "Hacking Exposed" titles buy this book. Despite my concerns, I still learned something new (wireless issues, format string vulnerabilities) and re-acquainted myself with material mentioned in earlier editions (RIP spoofing, enumeration techniques). If you've read "Hacking Exposed, Second Edition," wait for a revamped fourth edition.

(Disclaimer: I received a free review copy from the publisher.)

Rating:
Summary: THE Guide to Hacking Exploits and Defense
Review: George Kurtz, Stuart McClure and Joel Scambray have been a staple of my Information Security library since the first Hacking Exposed book.

Things change quickly in the security world and the authors of Hacking Exposed-4th Edition have done a tremendous job at taking a great thing and making it better by updating it with new attacks and countermeasures.

There are a handful of books that should be "must-reads" for anyone responsible for computer or network security and this is one of them.

Knowing the tools and techniques used to gather information on and infiltrate your network, accompanied by countermeasures that work to thwart those attacks is invaluable information in the fight to protect your network.

Buy this book.

Tony Bradley is a consultant and writer with a focus on network security, antivirus and incident response. He is the About.com Guide for Internet / Network Security (http://netsecurity.about.com), providing a broad range of information security tips, advice, reviews and information. Tony also contributes frequently to other industry publications. For a complete list of his freelance contributions you can visit Essential Computer Security (http://www.tonybradley.com).


Rating:
Summary: Not too shabby.
Review: The author does a really nice job talking about network hacks. He sounds like he still hacks into networks on the side since the book contains so much information. The book is not exhaustive (no book can be about this subject) but covers the most important topics about hacking and security. If you want a good introduction with _some_ depth to it this is the book. It's good book to start with if you haven't read anything else. It's a fun read with some good points. After this, you'll want to buy other security books that go into a specific area with a lot of depth to it. Maybe you could go into the specific Hacking Exposed books on Windows or Linux, etc. Definitely should be part of your library.

Rating:
Summary: Hack Attack Primer
Review: Not a hacking how to per se but more like a really good resource for securing your network. Some people object to titles like this one because they naively and mistakenly believe it helps the bad guys. But in reality, without knowing black hat techniques there is no possible way that you can secure your network. Period. The authors do an outstand job of walking the uninformed reader through the process of the hack from initial surveillance up to and including the attack. Highly recommend this book if you have even a slight interest in learning the how's of hacking.

Rating:
Summary: Depends on what you want
Review: This book covers a lot of ground. More than most books. But if you think you can learn to hack or do penetration testing with this book, forget it. I also don't like the fact that the book overlaps so much with the other book I have - Win2k hacking exposed. Many sections are verbatum lifted. I won't be buying the fifth edition but recommend it to newbies.

Rating:
Summary: RUBBISH
Review: I had so much fun hacking my own servers, and exploiting all the lesser known security flaws. I highly recommend this book even for the experienced administrator.

Rating:
Summary: what, are you kidding me?
Review: no, i didn't buy this crap, i got a free copy at the blackhat conference in vegas, and left it there in my hotel room. every book like this is a joke, the sad thing is the guys who write this crap are actually getting a lot of money writing. it's an old, tired, subject and the author has no clue, just tries to cram it with useless "hacking" info. my friend had the source code to one of his exploits published in one of these books, it was easy for them to do since they didn't have this real name.. but why do they include exploits in the actual book? they don't explain them, and they are just printed on the pages... anyone who would buy the dumb book sure isn't gonna be able to understand.. what are people supposed to do? type it up in ms word? if you're reading the reviews to this book for any purpose other than to laugh, i pity you.

Rating:
Summary: Lots of good, organized information
Review: There are a lot of `hacking' books out there, but none better than Hacking Exposed.

The information is organized and to the point.

Read this and you will be a better systems administrator for it.