My new book Hacking: The Next Generation is now available in electronic format. The physical version should be available on Amazon and in book stores in the next few days.
I want to thank Mike Loukides of O'Reilly for accepting the proposal and working with me throughout the process.
I also want to thank co-authors Billy Rios and Brett Hardin for writing significant chapters of the book.
Description
With the advent of rich Internet applications, the explosion of social
media, and the increased use of powerful cloud computing
infrastructures, a new generation of attackers has added cunning new
techniques to its arsenal. For anyone involved in defending an
application or a network of systems, Hacking: The Next Generation is one of the few books to identify a variety of emerging attack vectors.
You'll not only find valuable information on new hacks that attempt to exploit technical flaws, you'll also learn how attackers take advantage of individuals via social networking sites, and abuse vulnerabilities in wireless technologies and cloud infrastructures. Written by seasoned Internet security professionals, this book helps you understand the motives and psychology of hackers behind these attacks, enabling you to better prepare and defend against them.
- Learn how "inside out" techniques can poke holes into protected networks
- Understand the new wave of "blended threats" that take advantage of multiple application vulnerabilities to steal corporate data
- Recognize weaknesses in today's powerful cloud infrastructures and how they can be exploited
- Prevent attacks against the mobile workforce and their devices containing valuable data
- Be aware of attacks via social networking sites to obtain confidential information from executives and their assistants
- Get case studies that show how several layers of vulnerabilities can be used to compromise multinational corporations.
[Chapter 1] Intelligence Gathering: Peering Through the Windows to Your Organization
To successfully execute an attack against any given
organization, the attacker must first perform reconnaissance to
gather as much intelligence about the organization as possible. In
this chapter, we look at traditional attack methods as well as how
the new generation of attackers is able to leverage new technologies
for information gathering.
[Chapter 2] Inside-Out Attacks: The Attacker Is the Insider
Not only does the popular perimeter-based approach to security
provide little risk reduction today, but it is in fact contributing
to an increased attack surface that criminals are using to launch
potentially devastating attacks. The impact of the attacks
illustrated in this chapter can be extremely devastating to
businesses that approach security with a perimeter mindset where the
insiders are generally trusted with information that is confidential
and critical to the organization.
[Chapter 3] The Way It Works: There Is No Patch
The protocols that support network communication, which are
relied upon for the Internet to work, were not specifically designed
with security in mind. In this chapter, we study why these protocols
are weak and how attackers have and will continue to exploit
them.
[Chapter 4] Blended Threats: When Applications Exploit Each Other
The amount of software installed on a modern computer system
is staggering. With so many different software packages on a single
machine, the complexity of managing the interactions between these
software packages becomes increasingly complex. Complexity is the
friend of the next-generation hacker. This chapter exposes the
techniques used to pit software against software. We present the
various blended threats and blended attacks so that you can gain
some insight as to how these attacks are executed and the thought
process behind blended exploitation.
[Chapter 5] Cloud Insecurity: Sharing the Cloud with Your Enemy
Cloud computing is seen as the next generation of computing.
The benefits, cost savings, and business justifications for moving
to a cloud-based environment are compelling. This chapter
illustrates how next-generation hackers are positioning themselves
to take advantage of and abuse cloud platforms, and includes
tangible examples of vulnerabilities we have discovered in today's
popular cloud platforms.
[Chapter 6] Abusing Mobile Devices: Targeting Your Mobile Workforce
Today's workforce is a mobile army, traveling to the customer
and making business happen. The explosion of laptops, wireless
networks, and powerful cell phones, coupled with the need to "get
things done," creates a perfect storm for the next-generation
attacker. This chapter walks through some scenarios showing how the
mobile workforce can be a prime target of attacks.
[Chapter 7] Infiltrating the Phishing Underground: Learning from Online Criminals?
Phishers are a unique bunch. They are a nuisance to businesses
and legal authorities and can cause a significant amount of damage
to a person's financial reputation. In this chapter, we infiltrate
and uncover this ecosystem so that we can shed some light on and
advance our quest toward understanding this popular subset of the
new generation of criminals.
[Chapter 8] Influencing Your Victims: Do What We Tell You, Please
The new generation of attackers doesn't want to target only
networks, operating systems, and applications. These attackers also
want to target the people who have access to the data they want to
get a hold of. It is sometimes easier for an attacker to get what
she wants by influencing and manipulating a human being than it is
to invest a lot of time finding and exploiting a technical
vulnerability. In this chapter, we look at the crafty techniques
attackers employ to discover information about people to influence
them.
[Chapter 9] Hacking Executives: Can Your CEO Spot a Targeted Attack?
When attackers begin to focus their attacks on specific
corporate individuals, executives often become the prime target.
These are the "C Team" members of the company—for instance, chief
executive officers, chief financial officers, and chief operating
officers. Not only are these executives in higher income brackets
than other potential targets, but also the value of the information
on their laptops can rival the value of information in the
corporation's databases. This chapter walks through scenarios an
attacker may use to target executives of large corporations.
[Chapter 10] Case Studies: Different Perspectives
This chapter presents two scenarios on how a determined hacker
can cross-pollinate
vulnerabilities from different processes, systems, and applications
to compromise businesses and steal confidential data.
