Hunting Security Bugs (Paperback)

by Tom Gallagher (Author), Lawrence Landauer (Author), Bryan Jeffries (Author)
Key Phrases: canonicalization issues, other stack variables, injection bug, Internet Explorer, Microsoft Windows, Web Proxy Editor (more...)

Editorial Reviews

Product Description
Finding security flaws is now a fundamental development task, yet there has not been adequate documentation of the process used to find security bugs—until now. Before the Internet, computers were deployed in trusted environments and software development and testing practices emphasized functionality over security. As networking technologies emerged, though, times changed and people began to connect their computers together, instead of deploying in silos. However, development and testing practices did not account for attacks that could be mounted over networks.

The material currently available does not provide much practical guidance and the instructions given often fail to cultivate the right mindset and approach to enable people to successfully identify security issues before the software is published. This in-depth, technical reference highlights up-to-date tools, technologies, and techniques for helping find and eliminate vulnerabilities in software. Written for testers by testers, it delivers practical, hands-on guidance on how to find, classify, and assess bugs. In addition, this book covers the thought process behind security testing, use of source code to help in testing, and ways to spot security design flaws.

From the Publisher
Key Book Benefits: - Delivers practical, hands-oguidance on security bugs, how to find them, and how to help prevent them Provides specific, actionable technical details about security testing - Covers these subjects, among others: - The thought process behind security testing - Research and experience on how to find security bugs - How to classify the bugs you’ve found - What to do when you’ve found a bug - How to tell if a bug is serious and whether it is a security bug - Use of source code to help in security testing - Ways to spot security design flaws

See all Editorial Reviews

Product Details

• Paperback: 592 pages
• Publisher: Microsoft Press (June 9, 2006)
• Language: English
• ISBN-10: 073562187X
• ISBN-13: 978-0735621879
• Product Dimensions: 8.8 x 7.3 x 1.5 inches
• Shipping Weight: 2.3 pounds (View shipping rates and policies)
• Average Customer Review: 4.6 out of 5 stars See all reviews (5 customer reviews)
• Amazon.com Sales Rank: #452,045 in Books (See Bestsellers in Books)

  Popular in this category: (What's this?)

  #23 in

  Books > Computers & Internet > Programming > Languages & Tools > Debugging

Customer Reviews

Most Helpful Customer Reviews

5 of 5 people found the following review helpful:

4.0 out of 5 stars Finally something more than a checklist, February 5, 2007

By	John Jansen (Seattle, WA United States) - See all my reviews (REAL NAME)

As with other reviewers of the book: in an attempt at full disclosure, I also work at Microsoft. I am a Test Lead in the Office organization.

One of the challenges that faces any quality assurance engineer or Test engineer, or whatever our industry has chosen to call us this year is that we are constantly tasked with trying to "test in security" or "find the flaws in the product" after it has already been coded. While this is clearly a PART of our jobs, it is by no means the most important part. This book addresses what I consider to be a much higher priority for the Test Org generally, and Test Engineers specifically: helping reduce security vulnerabilities before they are coded into the product to begin with: as features are being spec'd and as code is being designed.
This book is not a simple check-list testers can use to say "Yes, my feature is secure, Ship It". Rather, it helps place Test into the frame of mind of a hacker, it gives test a set of tools to help find security issues, it outlines an approach to software Test that will cause fewer security issues to be coded at all, let alone have to be fixed post code-complete (or in a Service Pack). Used in conjunction with other test books like _How to Break Software Security_ by James A. Whittaker, this book will help ship more secure products.
Incidentally, I expect hackers will be reading this book in an effort to better understand the science of hunting security bugs, as well as the tools we use to do so - so if you're not using it, I'd expect your attackers will be thankful...

2 of 2 people found the following review helpful:

4.0 out of 5 stars A very practical book that will probably make you change the way you to you program, May 7, 2007

By	Olivier Langlois "www.OlivierLanglois.net" (Montreal, Quebec Canada) - See all my reviews (REAL NAME)

Beside Bruce Schneier books, this is the second software security book that I am reading. The first being Building Secure Software: How to Avoid Security Problems the Right Way and I have prefered this one because it provides more concrete examples. The book consists of over 20 chapters covering different security areas. As a software developer, some chapters appeared less relevent and less interesting to me and I guess that it is because these chapters are geared principally toward testers. However, at least 2 chapters should be extremely interesting and valuable to developers like myself. It is the chapters that demonstrate with step by step tutorials how a hacker would do to exploit buffer overflow and format string problems. I was already familiar with buffer overflows and I had read a similar chapter about them in Building Secure Software: How to Avoid Security Problems the Right Way but the format string exploits were new to me. As expected since the book is published by Microsoft Press, the book has a strong bias torward Microsoft products (ie.: .NET and ActiveX controls security) but the presented topics are general enough to make this book very valuable even for users of other OSes and/or development tools.

5.0 out of 5 stars Excellent, whether you skim or dive into it., September 28, 2008

By	pg94au "pg94au" (Canada) - See all my reviews

This is a very impressive book on finding security issues in software, especially because it really can serve as a book for almost all audiences. If you are not an expert, you can still gain a good understanding of what sorts of issues you need to be considering when writing secure software. At this level, it is valuable to know what a buffer overflow, format string attack or SQL injection are, for example, and how to prevent them. If you are interested in diving further into the details, this book will take you as far down as you are prepared for, including an exploration of buffer overflows at the machine register level. This is a great book to read through once, and then keep as a reference for when you need to review something you've covered, in greater detail.