Customer Reviews

Botnets: The Killer Web App

5 star:		(0)
4 star:		(1)
3 star:		(0)
2 star:		(3)
1 star:		(0)

 

 

To put it bluntly: this book looks like it was written by a high-schooler. The English is simply atrocious, with bad sentence structure, inconsistent use of the past tense, unreferenced demarcation of time... it's just plain poor. Take this sample paragraph:

***START QUOTE***
Early in 2002, SDBot appeared. It was written by a Russian programmer
known as sd. SDBot is a major step up the evolutionary chain for bots. It was
written in C++. More important to the evolution of botnet technology, the
author released the source code, published a Web page, and provided e-mail
and ICQ contact information.This made it accessible to many hackers. It was
also easy to modify and maintain. As a result, many subsequent bot clients
include code or concepts from SDBot.
***END QUOTE***

Then there are the pages of useless information. By useless, I mean quoting pages worth of collection files used by Cain. Or pages worth of court documents on a botnet-related settlement. No highlighting of the most relevant bits, or explanations as to how it pertains to the situation.

Oh, and the book also overtly references Wikipedia as it's prime resource of information for a section on botnet history. Not what Wikipedia may cite - but Wikipedia itself. This is not prime textbook material.

This would of course all be forgivable if the book had some good technical information. But it doesn't. Honestly folks, I thought I didn't know that much about botnets. But everything that's in this book, I already knew - with the exception of how to use Ourmon. This book feels more like a rehash of Symantec's information on popular botnet programs than it does a proper technical text.

The book also references papers that were published in January...2007. Given that the book is on the shelf already (barely a month later), one really has to wonder how much quality control Syngress Publishing puts into it's products. Yeesh.

I am wary of Syngress books that consist of a collection of contributions. The quality of the books usually decreases as the number of authors increases. Botnets is no exception, unfortunately. You will probably enjoy chapters by Gadi Evron (Ch 3, Alternative Botnet C&Cs) and Carsten Willems (Ch 10, Using Sandbox Tools for Botnets). I was initially interested in the book because of chapters on Ourmon (Chs 6-9, by Jim Binkley, tool developer). That leaves half the book not worth reading.

Botnets suffers extensively from nonexistent editing. It's clear the authors wrote the text and figures, submitted them to Syngress, and finished their involvement in production. There was clearly no copy or proof editing in this process. Right from the start, Fig 1.1 on p 6 demonstrates the sort of presentation I would expect of a 6th grader. I thought Fig 1.2 on p 18 was an even bigger joke until I read "New Bot Rallys [sic] to let Botherder Know It's [sic] Joined The Team" in Fig 2.1 on p 36. The main text is often as lame as these diagrams, with questions like "How much is the Microsoft bounty for virus authors and how do I get me some?" When the book isn't frustrating readers with poor English, it's repeating sections like the Ancheta and Maxwell cases from Ch 1 reappearing in Ch 2, or yet another "bot overview" in Ch 4 repeating ideas from Ch 1. Are readers expected to pay for this sort of shoddy, unprofessional material?

On the positive side, I thought the chapters on Ourmon were decent. Since Botnets is the only book to cover this useful application, you might want to check them out. I thought Gadi Evron's section, probably written in late 2006 or early 2007, did a good job predicting what actually happened in botnet command and control (specifically with respect to FTP). The CWSandbox chapter was a real surprise, and I think it's the best part of the book. A different publisher might consider given Carsten Willems his own book deal.

Finally, no author should ever post a five star review of his own book on this Web site. I subtracted one star from this review after seeing the lead author give his own book a first review of five stars. That is really disappointing and completely unnecessary.

Although containing some valuable nuggets on Botnets and providing a general overview of the threat, the book left me wanting more. The organization of some topics and the treatment of others felt disorganized and lacking the robustness I was looking for. Although interesting, filling up 3 ½ chapters of a 12 chapter book on Ourmon was a bit much as well. Things could have been condensed and edited better which I think would have brought forth the authors intentions more clearly.

Working in the security arena for sometime, this is a must for those of us that wants to understand the underground aspects of BotNet. Good reference for your security library.ed