How to Break Software Security [Paperback]

James A. Whittaker (Author), Herbert H. Thompson (Author)

Book Description

ISBN-10: 0321194330 | ISBN-13: 978-0321194336 | Publication Date: May 19, 2003

How to Break Software Security describes the general problem of software security in a practical perspective from a software tester's point of view. It defines prescriptive techniques (attacks that testers can use on their own software) that are designed to ferret out security vulnerabilities in software applications. The book's style is easy to read and provides readers with the techniques and advice to hunt down security bugs and see that they're destroyed before the software is released. Accompanying the book is a CD-ROM containing Holodeck, which tests for security vulnerabilities. There are also a number of bug-finding tools, freeware, and an easy-to-use port scanner included on the CD-ROM.

Product Details

• Paperback: 208 pages
• Publisher: Addison Wesley (May 19, 2003)
• Language: English
• ISBN-10: 0321194330
• ISBN-13: 978-0321194336
• Product Dimensions: 9.2 x 7.1 x 0.4 inches
• Shipping Weight: 10.4 ounces (View shipping rates and policies)
• Average Customer Review: 4.0 out of 5 stars  See all reviews (7 customer reviews)
• Amazon Best Sellers Rank: #618,928 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews

16 of 17 people found the following review helpful:

2.0 out of 5 stars Good ideas, but fails to follow through, March 6, 2006

By 

Darius Wiles (San Francisco, CA USA) - See all my reviews
(REAL NAME)   

This review is from: How to Break Software Security (Paperback)

The book categorizes software testing for security defects into attacks on software dependencies, user interfaces, design and implementation. The book focuses on 19 attacks (one being "overflow input buffers"), which form the core of the book. Parts 2 and 3 of the book explain when and how to apply each attack and what faults they find. Part 4 takes a more hands-on look at how to perform the testing.

In my opinion, the book is too dependent on the Holodeck 1.3 program provided on the CD. Rather than explaining security testing in a tool agnostic way, the book often simply explains how to use Holodeck to perform an attack. I use Linux and Holodeck is Windows only, so it was useless to me. Reviewer Yvonne Eu said the tool did not work in her test environment. Holodeck is currently maintained by Security Innovation who charge $1495 for a single user license, but they also offer a 30 day evaluation license. If the version on the CD does not work for you, these are your two options. The book is a lot less useful if Holodeck does not work for you, so bear this in mind.

The focus on Holodeck also limits the scope of the book. The use of other types of tools such as web proxies, port scanners and tools to exercise user interfaces is not adequately covered.

Finally, I was disappointed by chapter 6, which looks at security testing three applications: Windows Media Player 9.0, Mozilla 1.2.1 (for Windows), and OpenOffice 1.0.2 (for Linux). This is an ideal opportunity to dive down and show how security testing tools should be applied, common pitfalls, and hands-on techniques for finding security issues. Instead, the chapter only explains how attacks should be planned and goes no deeper.

If you are new to security testing and want an overview of some common types of tests that should be run, this book will be useful. If you are interested in using Holodeck for your testing, this book will also be useful. If you do not fall into these categories, there are other books which are a better fit. If you want more detail, I recommend trying one of the Hacking Exposed series.

13 of 14 people found the following review helpful:

5.0 out of 5 stars Security testing for QA folks, also good for infosec folks, September 22, 2004

By 

The Grumpy Hacker (Milwaukee - Top 5000 Reviewer!) - See all my reviews

This review is from: How to Break Software Security (Paperback)

I'm the type of person who won't buy a tech book unless it's worth reading and referring to, and it didn't take much skimming to realize this was going to be worth it. My opinion hasn't changed since finishing it. I had a specific need for information on non-web application penetration (security) testing and I was surprised to find exactly what I needed in this book, and in a short, easy-to-read package including a CD with two unique tools to help apply what it teaches.

If you're a software tester or in the software quality assurance field, especially if you're interested in security, you need to read this book as it will likely be an eye-opener. It's not full of shocking anecdotes to scare developers into writing better software, it's a handbook of what to look for when testing software after you think you've done all your testing, and at the same time gives developers and project managers good information on how to design, code, and state requirements better.

If you're a security person, especially the burgeoning field of application security, you might also find this book pretty enlightining. Everyone's heard of penetration testing and vulnerability assessment, but typically only in the context of attacking remotely over a network. This book shows you how to attack the (more traditional?) software on your local machine, but not to the level of detail or geekiness of "shellcoding."

While I feel the cover price is a bit steep for such a thin book, especially given the amount of "filler" like illustrations, blank pages, figures, etc., the content is superb and the writing style makes it easy to read. I also appreciate that the points made and examples used tend to get me thinking and I'm able to apply the concepts right away--maybe it's just my "tinkerer" mindset but this book seems to encourage the reader to think outside the box and experiment, which I like. I don't give many 5-star ratings but I think this book deserves it.

11 of 12 people found the following review helpful:

2.0 out of 5 stars Holodeck rules! - Does it?, October 27, 2005

By 

Yvonne Eu (Seattle) - See all my reviews

This review is from: How to Break Software Security (Paperback)

The whole book feels like a promotion for Holodeck tool. Some of the chapters are very straightforward: boot your AUT (Application Under Test) from Holodeck and see what happens. However, the version of the tool supplied with the book isn't supported by anybody and, sure enough, it doesn't work with my AUT. The supported one is above $1K for single user licence...
Though as much as I appreciate the general ideas about blackbox security testing Whittaker is voicing in this book, I feel it's just not enough there for its price. :(