Botnets: The Killer Web App [Illustrated] [Paperback]

Craig Schiller (Author), Jim Binkley (Author), Gadi Evron (Collaborator), Carsten Willems (Collaborator), Tony Bradley (Collaborator), David Harley (Collaborator), Michael Cross (Collaborator)

Book Description

ISBN-10: 1597491357 | ISBN-13: 978-1597491358 | Publication Date: February 15, 2007 | Edition: 1

The book begins with real world cases of botnet attacks to underscore the need for action. Next the book will explain botnet fundamentals using real world examples. These chapters will cover what they are, how they operate, and the environment and technology that makes them possible. The following chapters will analyze botnets for opportunities to detect, track, and remove them. Then the book will describe intelligence gathering efforts and results obtained to date. Public domain tools like OurMon, developed by Jim Binkley of Portland State University, will be described in detail along with discussions of other tools and resources that are useful in the fight against Botnets.

* This is the first book to explain the newest internet threat - Botnets, zombie armies, bot herders, what is being done, and what you can do to protect your enterprise
* Botnets are the most complicated and difficult threat the hacker world has unleashed - read how to protect yourself

Editorial Reviews

About the Author

Craig A Schiller (CISSP-ISSMP, ISSAP) is the CISO for Portland State University and President of Hawkeye Security Training, LLC. He is the primary author of the first Generally Accepted System Security Principles. He is a co-author of "Combating Spyware in the Enterprise" and "Winternals" from Syngress, several editions of the Handbook of Information Security Management, and a contributing author to Data Security Management. Mr. Schiller has co-founded two ISSA chapters, the Central Plains chapter and the Texas Gulf Coast Chapter.

Jim Binkley is a teacher, network engineer, and researcher in the Computer Science Department at Portland State University. Jim has twenty five years of experience with UNIX operating system internals and twenty years of experience with TCP/IP networking. Jim teaches a graduate sequence of networking classes including TCP/IP, routing, and network security, and also teaches operating system classes including Linux O.S. internals, Linux Device Drivers, and BSD TCP/IP stack internals.

Product Details

• Paperback: 480 pages
• Publisher: Syngress; 1 edition (February 15, 2007)
• Language: English
• ISBN-10: 1597491357
• ISBN-13: 978-1597491358
• Product Dimensions: 8.8 x 7 x 1.4 inches
• Shipping Weight: 1.3 pounds (View shipping rates and policies)
• Average Customer Review: 2.5 out of 5 stars  See all reviews (4 customer reviews)
• Amazon Best Sellers Rank: #1,284,751 in Books (See Top 100 in Books)

Customer Reviews

Most Helpful Customer Reviews

29 of 33 people found the following review helpful:

2.0 out of 5 stars A dissapointment., February 15, 2007

By 

Seal (Ontario, Canada) - See all my reviews

This review is from: Botnets: The Killer Web App (Paperback)

To put it bluntly: this book looks like it was written by a high-schooler. The English is simply atrocious, with bad sentence structure, inconsistent use of the past tense, unreferenced demarcation of time... it's just plain poor. Take this sample paragraph:

***START QUOTE***
Early in 2002, SDBot appeared. It was written by a Russian programmer
known as sd. SDBot is a major step up the evolutionary chain for bots. It was
written in C++. More important to the evolution of botnet technology, the
author released the source code, published a Web page, and provided e-mail
and ICQ contact information.This made it accessible to many hackers. It was
also easy to modify and maintain. As a result, many subsequent bot clients
include code or concepts from SDBot.
***END QUOTE***

Then there are the pages of useless information. By useless, I mean quoting pages worth of collection files used by Cain. Or pages worth of court documents on a botnet-related settlement. No highlighting of the most relevant bits, or explanations as to how it pertains to the situation.

Oh, and the book also overtly references Wikipedia as it's prime resource of information for a section on botnet history. Not what Wikipedia may cite - but Wikipedia itself. This is not prime textbook material.

This would of course all be forgivable if the book had some good technical information. But it doesn't. Honestly folks, I thought I didn't know that much about botnets. But everything that's in this book, I already knew - with the exception of how to use Ourmon. This book feels more like a rehash of Symantec's information on popular botnet programs than it does a proper technical text.

The book also references papers that were published in January...2007. Given that the book is on the shelf already (barely a month later), one really has to wonder how much quality control Syngress Publishing puts into it's products. Yeesh.

8 of 8 people found the following review helpful:

2.0 out of 5 stars A few good chapters surrounded by weak material, June 7, 2008

By 

Richard Bejtlich "TaoSecurity" (Metro Washington, DC) - See all my reviews
(REAL NAME)   

This review is from: Botnets: The Killer Web App (Paperback)

I am wary of Syngress books that consist of a collection of contributions. The quality of the books usually decreases as the number of authors increases. Botnets is no exception, unfortunately. You will probably enjoy chapters by Gadi Evron (Ch 3, Alternative Botnet C&Cs) and Carsten Willems (Ch 10, Using Sandbox Tools for Botnets). I was initially interested in the book because of chapters on Ourmon (Chs 6-9, by Jim Binkley, tool developer). That leaves half the book not worth reading.

Botnets suffers extensively from nonexistent editing. It's clear the authors wrote the text and figures, submitted them to Syngress, and finished their involvement in production. There was clearly no copy or proof editing in this process. Right from the start, Fig 1.1 on p 6 demonstrates the sort of presentation I would expect of a 6th grader. I thought Fig 1.2 on p 18 was an even bigger joke until I read "New Bot Rallys [sic] to let Botherder Know It's [sic] Joined The Team" in Fig 2.1 on p 36. The main text is often as lame as these diagrams, with questions like "How much is the Microsoft bounty for virus authors and how do I get me some?" When the book isn't frustrating readers with poor English, it's repeating sections like the Ancheta and Maxwell cases from Ch 1 reappearing in Ch 2, or yet another "bot overview" in Ch 4 repeating ideas from Ch 1. Are readers expected to pay for this sort of shoddy, unprofessional material?

On the positive side, I thought the chapters on Ourmon were decent. Since Botnets is the only book to cover this useful application, you might want to check them out. I thought Gadi Evron's section, probably written in late 2006 or early 2007, did a good job predicting what actually happened in botnet command and control (specifically with respect to FTP). The CWSandbox chapter was a real surprise, and I think it's the best part of the book. A different publisher might consider given Carsten Willems his own book deal.

Finally, no author should ever post a five star review of his own book on this Web site. I subtracted one star from this review after seeing the lead author give his own book a first review of five stars. That is really disappointing and completely unnecessary.

2.0 out of 5 stars Needs something more, February 25, 2009

By 

Nikk Gilbert (Japan) - See all my reviews

This review is from: Botnets: The Killer Web App (Paperback)

Although containing some valuable nuggets on Botnets and providing a general overview of the threat, the book left me wanting more. The organization of some topics and the treatment of others felt disorganized and lacking the robustness I was looking for. Although interesting, filling up 3 ½ chapters of a 12 chapter book on Ourmon was a bit much as well. Things could have been condensed and edited better which I think would have brought forth the authors intentions more clearly.