Customer Reviews


13 Reviews
5 star:
 (13)
4 star:    (0)
3 star:    (0)
2 star:    (0)
1 star:    (0)
 
 
 
 
 
Average Customer Review
Share your thoughts with other customers
Create your own review
 
 
‹ Previous | 1 2 | Next ›
Most Helpful First | Newest First

9 of 9 people found the following review helpful
5.0 out of 5 stars The best place to start., September 2, 2007
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
Quick disclaimer: I know both authors. That said, I still have no problem pimping this book as "THE BEST PLACE TO START if you want to learn how to use honeypots." Best. Bar none. Par excellence - pick your cliche.

The fact is that these guys have pulled together an immense amount of experience into a book that will have you running your own honeypot in short order, and that's no small task. Setting up a honeypot/honeynet properly is *not* trivial. Tools like honeywall and argos are not for the faint of heart. But with VH, you'll have what you need to get started and most likely succeed.

Beyond the practical (i.e. step-by-step instructions on how to get things working), there is also plenty of theoretical. There truly is something for everyone in this book. Loads of info on low-interaction vs. high-interaction honeypots, plus legal and ethical points to consider for the budding honeypotter.

The proof is in the pudding for me - I now use argos to capture vulnerabilities in the wild, as well as sebek/honeywall/vmware to research worm propagation. I probably would have gotten there without this book, but certainly not as fast. Kudos to the authors - great book guys.

~SfS
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


6 of 6 people found the following review helpful
5.0 out of 5 stars Honeypots made easy, November 10, 2007
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
Books that put institutional knowledge, or knowledge that people in the industry know but its not written down anywhere, are few and far between. This book succeeds in taking that institutional knowledge and putting it into a readable, functional, and well-organized format.

Before I get into the chapter play by play stuff, let me just say that Chapter 8, Client Honeypots, is worth the price of the book. Client-side attacks are were everything is moving to and the days of a remote OS 0day or quickly fading away. One of the hardest things to automate and teach is client-side attacks because it used to involve user interaction (someone actually clicking on the email, link, .exe), but with the client honeypots they discuss in the book you can automate clicking on emails, clicking on links, spidering websites, and running the executables you download from the sites. You can also monitor your honeypot for changes after running the executable, good stuff!

Most of the other reviewers said you can skip the introductory material, and you could, but its better than the usual "beginning of the book/background" material. The book starts with honeypot/honeynet introduction. Chapter 2 covers high interaction honeypots to include a good chunk of information on VMware and your other "virtual" options including User Mode Linux and Argos. Chapter 3 covers Low interaction honeypots like LaBrea, GHH, and PHP.HoP for your web based low interaction honeypots. Chapters 4 & 5 are a healthy dose of honeyd. Chapter 6 is collecting malware with Nepenthes and Honeytrap. Chapter 7 covers Hybrid systems. Chapter 8 is, as discussed, Client Honeypots. Chapter 9 is on detecting low and high interaction honeypots. Chapter 10 contains Case Studies, Chapter 11 is Tracking Botnets, and Chapter 12 closes out the book with analyzing malware with CWSandbox.

My only gripes about the book were that they failed to talk about persistent versus non-persistent modes in VMware and there as no discussion of identifying VMware and Sebek in Windows. Configuring your virtual machine how you like it, then setting it to non-persistent is a great way to let users or attackers do whatever they want to the OS. The changes survive an OS reboot but if you reboot the virtual machine it goes back to the original state, very handy. The other gripe was a shortage of material on detection of Sebek on Windows hosts, its covered in-depth for Linux though. Detecting VMware and some other honeypot type tools like Sebek in Windows is fairly easy. Simply querying for their respective registry keys usually does the job :-)

Overall, a good book. Its useful, up-to-date, and relevant to security today.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


7 of 8 people found the following review helpful
5.0 out of 5 stars A breakthough work, August 21, 2007
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
Simply put, this is the best security book I have read this year. A perfect blend of well researched information about honeypots as well as plenty of pragmatic how to do it. Well known respected authors that clearly know their stuff. A nice blend of network and system information to give the read the full picture. The reader will learn a lot of analysis and be exposed to a number of attack signatures. And the information is applicable. That was the huge eye opener for me! I thought honeypots were boutique at best, but the book shows clearly how to use them to augment your intrusion detection capability, to detect malware and to identify botnets. At the exact second the Storm botnet is raging, anti-malware products from Symantec, NAI, Trend Micro just are not getting the job done. A large organization with a low interaction honeypot like honeyd, collapsar or potemkin would be able to track what is happening in their network. In the same way, if you are running nepenthes or roleplayer you can identify (detect) the malware and understand how it is working.

Obviously the book cannot cover each tool in depth, Virtual Honeypots goes into detail for honeyd and nepenthes and serves as a manual to help you get started. This is thrilling reading to the very end, the final three chapters are case studies ( war stories ), tracking botnets and working with the CWSandbox. I absolutely recommend this book and expect that I will keep it near my workstation for the next few months. I read it the first time on airplanes, I live in Hawaii so each trip to the east coast is ten hours airplane time and it took about 20 hours for me to work through the book. I plan to read it at least one more time, but with a computer nearby to try to apply some of this. Hats off to the authors, Provos and Holz for sharing their knowledge with the community.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


4 of 4 people found the following review helpful
5.0 out of 5 stars Most comprehensive information about Honeypots., August 27, 2007
By 
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
This book provides the most complete overview of Honeypots. It includes very detailed instructions on how to set up and use tools, and gives many examples for analysis and deployments. I have personally heard about Honeypots a lot, but never set one up myself. This book provided an excellent tutorial to show me how to do it. For both experts and novices, this book is filled with useful information. A must-read for anyone interested in Honeypots & malware simulations in general.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


2 of 2 people found the following review helpful
5.0 out of 5 stars Excellent, modern book on digital defense, January 7, 2008
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
It's fairly difficult to find good books on digital defense. Breaking and entering seems to be more exciting than protecting victims. Thankfully, Niels Provos and Thorsten Holz show that defense can be interesting and innovative too. Their book Virtual Honeypots is your ticket for deploying defensive resources that will provide greater digital situational awareness.

A security technician with some degree of proficiency should be able to read Virtual Honeypots and then implement at least one of the solutions presented. This sounds like a fairly common event, but too often technical books do not provide the detail required to transform theory into practice. Virtual Honeypots offers installation and operational guidance for a variety of deception and analysis systems, primarily for server-oriented technologies. I especially gained a better understanding of Honeyd and Nepenthes, the two applications about which I cared the most.

While I liked the first 2/3 of the book, I have to say I really enjoyed the last four chapters. These covered Detecting Honeypots, Case Studies, Tracking Botnets, and Analyzing Malware with CWSandbox. Of these the final chapter was superb. Ch 12 has probably the clearest explanation of hooking I've read anywhere. I am not a rootkit writer or Windows kernel programmer, but the text was so well written I had zero problems following along.

I gave Virtual Honeypots five stars because it is so unique and well-written, but I do have a few minor issues to mention. First, I was somewhat disappointed by the honeyclients section (ch 8). I was not as confident that I could implement a honeyclient solution after reading the great material on server-oriented honeypots. Perhaps the second edition or a separate book will give greater attention to this area. Second, I found a few small technical items. On p 4, it isn't accurate to say "TCP...[gives] each packet a sequence number." Bytes of application data are numbered, not packets. On p 13 we are told to use a snaplen of 1500 bytes, but this will cut off the last 14 bytes of many Ethernet frames. Try it with ping -s 1472 while sniffing with Tcpdump. As you can see, these minor issues are easily fixed in a future printing and do not justify dropping a star.

If you are at all interested in potentially deceiving intruders, buy and read Virtual Honeypots. You'll learn about more than VMware (QEMU, UML, etc.) as well as numerous open source tools you can download and try for free. I look forward to reading more from these authors -- perhaps a book of true case studies?
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


2 of 2 people found the following review helpful
5.0 out of 5 stars A must read, August 7, 2007
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
I got this book approximately 3 days ago and absolutely tore through it. This book was fantastic in every sense of the word.

Niels Provos (of honeyd fame) and Thorsten Holz (from the German honeynet project) teamed up to provide a true wealth of knowledge and information in Virtual Honeypots

As the title suggests, this book is all about creating and utilizing a virtualized environment to host honeypots. From the first chapter on, there is no mincing of words and the technical aspects are covered from set up to configuration to usage. Virtual Honeypots is a logical progression from the initial honeypots and KYE books and focuses more on the honeypot than the honeynet. There's such a wide variety of topics discussed that this book is probably best served as a reference after reading it once or twice. I was in awe when I read chapter 7 and specifically the section on the potemkin honeyfarm which apparently has been used to emulate over 64,000 honeypots!

This book presents itself really well and the authors did a fantastic job covering all of the critical and really interesting projects that are out there in the honey(net|pot) world. If you operate a honeynet or honeypots this book is not an option, it simply provides too much information to ignore. Even if you don't operate a honey(net|pot) this book is well worth the money and It's going right on the shelf next to other quick grab reference books.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


1 of 1 people found the following review helpful
5.0 out of 5 stars THE current reference about honeynet technologies and solutions, July 18, 2008
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
Honeynet solutions were seen just as a research technology a couple of years ago. It is not the case anymore. Due to the inherent constraints and limitations of the current and widely deployed intrusion detection solutions, like IDS/IPS and antivirus, it is time to extended our detection arsenal and capabilities with new tools: virtual honeypots.

Do not get confused about the book title, specially about the "virtual" term. The main reason to mention virtual honeypots, although the book covers all kind of honeynet/honeypot technologies, is because during the last few years virtualization has been a key element in the deployment of honeynets. It has offered us a significant cost reduction, more flexibility, reusability and multiple benefits. The main drawback of this solution is the detection of virtual environments by some malware specimens.

The detection of honeypots has always been one of the main concerns in the honeynet community, basically because if the attacker can identify them, they are useless. For this reason, one of the chapters is just focused on providing some light, tips, and tricks about what an adversary can really accomplish. In fact, we have not seen lots of real-world incidents where the attacker actively checks the existence of honeynet setups.

I have been working with honeynets during the last 5 years. We founded the Spanish Honeynet Project on 2004, and almost at the same time we became part of The Honeynet Project and released the Scan of the Month 32. The main honeynet/pot book reference till last year was the book published by the Honeynet Project. As this is a rapidly evolving field, definitely it has been replaced by this book, written by two project members.

The first chapter is a very brief introduction to honeynet technologies and basic tools. You can jump through it if you are not new to this field. Then, the book covers the main two honeypots types: high and low interaction. The high interaction section provides details about the tools to virtualize your honeypots: VMware, UML, or more specific solutions, such as Argos. The low interaction section provides details about some the most relevant honeypot types to cover lots of detection scenarios: worms, traditional server attacks, Google Hacking, Web-based attacks, etc. It is a wide overview that will give you lot of ideas for new deployments.

The whole book has been cooked with a how-to mentality , and it explains in detail how to install and configure the different tools and software elements covered. Additionally, it provides guidelines, best practices, and analysis recommendations for each tool based on the authors experience. However, for the how to portions take into account that most of the solutions are Linux-based, and the installation and setup process will vary based on the tool version and the Linux distribution you are using (library dependencies, etc). In any case, the step by step guides are very useful as a general setup reference.

From my perspective, the most valuable part of the book is chapters 4 to 6. The authors, Niels Provos and Throsten Holz, are the lead developer/architect for honeyd (chapter 4 and 5) and strongly related with nephentes (chapter 6), respectively. These two are the most famous and advanced low-interaction server-based honeypot and malware honeypot. They know what they are talking about :), and you cannot find a better reference out there for these two tools. The book is an excellent guide, covering from the design principles and innovative deployment ideas, to all kinds of configuration options and possibilities, including limitations on real-world scenarios. Chapter 6 is complemented with other less popular malware-based honeypots (except for Honeytrap).

The book includes some extra material, covering academic and research hybrid solution, still on their early stages, but that can give you and idea of where these technologies are evolving to and the major challenges we are facing nowadays. This pretty much theoretical content is well balanced with the case studies chapter, where real incidents involving different honeypot types are presented. These are always a fun read and a way of getting experience and learn how to deal with intrusions.

Finally, one of the main expansion areas we are involved today is the creation of new client-based honeypot technologies. This book section (highly recommended) does a great job introducing multiple high and low interaction honeyclients currently available, their benefits and drawbacks (chapter 7). This information is perfectly complemented by the last two chapters, focused on tracking botnets and analyzing malware with sandbox environments. Once a client is compromised, it typically becomes a member of a botnet, and for easy and quick categorization, we start by performing a malware analysis of the specimens. I recommend you to add all this knowledge to your incident handling and response capabilities.

Something I would have liked to see in the book is a section about a fully virtualized honeynet environment, showing how using VMware, you can build up a virtual Honeywall (just slightly mentioned on chapter 2) and different honeypots, creating a complete, cheap, mobile and multi-purpose virtual honeynet infrastructure. Also, we receive multiple questions related to this kind of setup in the Honeynet Project mailing lists, because all the previous whitepapers are obsoleted now. I've been deploying these type of solutions for fun and professionally during the last few years and I strongly recommend you to start using them. You won't be disappointed about how much you can learn of what is going on in your networks and systems, and this book is the best starting point.

If you have any relationship with the intrusion detection, incident handling and forensics, threat analysis, or SOC and CERT security side of things, definitely this book is for you. Go through it and improve your capabilities with easy to deploy virtual honeypot solutions. You just need a (not so new) computer, virtualization software, and some time!
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


1 of 1 people found the following review helpful
5.0 out of 5 stars another great AW book, October 24, 2007
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
Provos and Holz have added yet another high-quality academic book on security to AW's list. Anybody with experience in studying malware can appreciate the great deal of experience behind this book. The quality of citations and research polish this book with an air of expertise and academia that is often lost in other books of this genre.

At first I imagined this book was simply a cookbook for setting up honeypots. These first few chapters are not essential, but give a good background for the type of environments (low, mid, or high-interaction honeypots) that are cited later in the book.

This book is the Stevens of honeypots.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


5.0 out of 5 stars Comprehensive and Easy to Use, January 16, 2012
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
From the first glance, I knew that this book would be more than helpful. As a student of Information Security, I'm always looking for new tools and methods for system hardening. When implemented properly, a virtual honeypot will allow you to maintain the integrity of your network, while auditing the methods used by would-be infiltrators.
From the detailed Contents to the comprehensive Index, anything you want to know can be easily found. In-depth references make cross-referencing a breeze; along with the step-by-step installation for tools in Linux and Windows, there is no doubt that this book will be used. It would definitely find a home on the shelf of anyone serious about Information Security.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


5.0 out of 5 stars Fantastic intro and depth, March 24, 2008
By 
Verified Purchase(What's this?)
This review is from: Virtual Honeypots: From Botnet Tracking to Intrusion Detection (Paperback)
The book is well written and I feel that I will be successful in setting up my first honey pot once I get my network segmented for security purposes.
Help other customers find the most helpful reviews 
Was this review helpful to you? Yes No


‹ Previous | 1 2 | Next ›
Most Helpful First | Newest First

Details

Virtual Honeypots: From Botnet Tracking to Intrusion Detection
Virtual Honeypots: From Botnet Tracking to Intrusion Detection by Niels Provos (Paperback - July 26, 2007)
$64.99 $43.34
In Stock
Add to cart Add to wishlist
Search these reviews only
Rate and Discover Movies
Send us feedback How can we make Amazon Customer Reviews better for you? Let us know here.