Customer Reviews

Zero-Day Exploit:: Countdown to Darkness (Cyber-Fiction)

5 star:		(4)
4 star:		(5)
3 star:		(0)
2 star:		(1)
1 star:		(2)

 

 

I'm seeing more security books come out in the style of cyber-novel. The latest one is called Zero-Day Exploit - Countdown To Darkness by Rob Shein. While not on par with Tom Clancy material, it does quite well and should appeal to the cyber-geek in all of us.

In the novel, two security programmers (both geeky but pretty normal) are hired to do a security audit on a new VPN product to be used by the Department of Justice. They quickly find two exploitable bugs (denial of service and buffer overflow) and report the situation. But as often happens in real-life, politics and CYA cause the findings to be minimized and the software is installed anyway with a promise to fix the software later. Of course, it doesn't get done. Meanwhile, Islamic idealists enlist the help of two hackers in the Phillipeans to scan networks looking for this VPN package as well as some industrial software so that a cyber-attack can be launched against the US. The original security audit team (this is years later) notices the increase in port scans for the VPN package and try to alert the DoJ. But until the attack actually occurs, no one will listen. Once all hell breaks loose, its them against the hackers.

This is more of a novel and less of a security primer than books like Steal The Box. The author does go into detail on the technology, but not to the point of putting pages and pages of screen prints in the book. It's all part of the story dialog and action. The second member of the team ("MadFast") starts just about each sentence with "Right on", so don't expect outstanding dialogue. But then again, this would be closer to reality if you were listening and watching real computer geeks/hackers. A reader experienced in security will be entertained (but won't learn much), but others less tied into computer security may have their eyes opened as to dangers that are very real.

While not perfect, I still liked it a lot. Definitely worth a read...

A polemical diatribe that simply tries too hard. Considered purely as a novel, possibly in the thriller genre, it is poorly done. The characterisation is pathetic. Just cardboard. The dialog is utterly repetitive. The two secondary heroes are just sounding boards to the main character. Sherlock Holmes' Watson was hollow, but still light years ahead of these secondary characters.

Then there is the plot itself. All too reminiscent of the Y2K scare. Remember that? Planes falling out of the sky. Pacemakers freezing up. Utility companies' generators stopping. Just like Ed Yourdon and others peddled Y2K in the late 90s, this book has the same feel. Hysteria combined with an opportunistic grab at the topical problem of terrorism.

Purely as a $8 paperback novel, it is lacking. But as a $35 book?? Strewth.

Defending against external Internet threats and attacks is a daunting task at best. When coupled with internal politics and Byzantine contracting rules, you may as well put a "kick me" sign on your back. Before the days we became dependent on computers and networking for everyday tasks, the risks were not as great. When terrorism is added to the formula, there has to be a recognition that the days of finger-pointing and excuses are no longer acceptable. In Zero-Day Exploit: Countdown to Darkness (339 Pages, Syngress Press, 2004, ISBN 1931836094), Rob Shein, David Litchfield, and Marcus Sachs present an account of one possible attack scenario.

Like most fiction, you will have to ask yourself if the scenario in the book is possible at all. But the answer you give yourself may not be adequate. After all, who else except for the Able Danger team thought 9/11 was a real possibility?

What makes this book different from others that I have read, the authors bring a real world perspective of Washington, DC politics and the challenges brought by the divide between employees and federal contractors, as well as what happens when people put their own career self-preservation above doing the right thing. Think this is not possible in today's environment? Think again. Having spent 12 years as a federal acquisition professional, I saw it every day, and I know what happens to people who buck the system.

The book does get bogged down early with its detailed narrative of a DefCon convention, and I am not sure that it adds much to the book. The authors do manage to put useful information within this section, but the overall section was so dry I almost closed the book a few times. But then it picked up steam and I could not put it down until I finished it. Given my background, it was very interesting to see what I had experienced first hand (and still do as an IT consultant and auditor), knowing full well the damage those interactions alone can cause.

The technical information presented is good, but not so deep that a nontechnical reader will get lost or bored (except perhaps for the DefCon section). As the story unfolds, the authors do a very good job showing how the emotion of a situation can lead to blaming the wrong person (in this case the programmer of the faulty software) instead of the circumstances that lead to the faults outside of his control (See my review of Secure Coding - Principles and Practices for more on this topic).

The book is not cheap and may be a bit pricey for the content, but that does not mean it is not worth reading.

Who Should Read This Book?

IT Audit professionals, bureaucrats, and programmers/developers will all gain benefit from reading this book. It is not really a good read for other people because they may take the wrong message from it.

Scorecard

Par on Long Par 4

The first problem I have with this book is the absolutely laughable price tag. Even at Amazon's discount, thirty-five bucks is still a joke for a novel!

The second problem I have with this novel is that it simply isn't very good. The author is second rate, at best. So, since it's a second rate work of fiction, shouldn't it be priced at about half the price of a popular novel, such as those by Stephen King, Tom Clancy, etc...?

Where does a nobody clown that no one ever heard of get off trying to gouge people for fifty bucks, and for a cheesy work of fiction to boot!?!?!?

The 2 guys who gave it 5 stars are paid reviewers, I'm not (and one of them even states that the book isn't very good). I just like to read, and I work for a living. Take my advice: Before you even think about tossing your money away on this book, go to a bookstore and read the first couple of pages. Once you've done that, I suspect you'll put your money to better use.

This book is a slog to get through. It's an exploration of the world of whitehat and blackhat hackers, the FBI, and well, I really couldn't get through it because the writing wasn't very good. The dialogue in particular was painful to get through. The characters weren't very well developed. I would like to have been able to recommend this book. I think there are some interesting ideas in there, but they are just too far past all of the tough dialogue.

This is a good book if you are involved in IT security. Although some of the plot is a bit too simplistic, overall it gives a good account of what could happen.

This is my 3rd hacker novel (Steal the Network: Box and Contintent) and I consider it better than both of them. The story is enjoyable and has several chapters of excitement that make you want to turn the page into the wee hours of the morning. The plot as a whole is more fluid, which is something that was lacking with the StN books, I found.

Having said that, there were no less than 4 glaring typos that took the professionalism down several notches. The appendix, in fact, ends midsentence in my copy of the book. At another point earlier it says "to find more information ." and omits the web address that was expected to accompany it. That, along with the somewhat lackluster dialogue were distractions to an otherwise enjoyable novel. The writing towards the end seemed overly rushed (telling the solution was found to a particular problem, rather than explaining /how/ for the sake of time was out of character for this style of book).

Overall, an enjoyable read if you like to get further insight into how the White Hats work, but this isn't a NYT Best Seller.

The Expert on Everything - a novel

Big Brother meets Big Business in Edward David Gil's novel, "The Expert on Everything." Orwell was on the right track of course, but Edward Gil takes it a step further and into the 21st century. This techno thriller touches on the real threat of privacy no longer existing. The plot is smooth and interesting, showing a great deal of the truth of business development. Gil's style is of a different flavor and sticks out just enough to be memorable. Let's hope the premise never comes to be, and if it already does, I just don't want to know. Review by Heather Froeschl.
[...]

Zero Day Exploit calls our attention to an all too often under reported reality: We live in a high risk society where our digital infrastructure is extremely vulnerable to certain kinds of attacks.

I want to thank the author, Rob Shein, for producing a work of fiction that helps focus our attention on these contemporary risks, without being too shrill about them. This book I would recommend to my friends and clients alike as a nice change of pace to their usual reading choices.

Paul McCubbin,
Senior Consultant
Forsythe Solutions Group

The back cover calls this book "a must read cyber thriller." It's right--the book features real places like the Defcon tradeshows in Vegas to Washington, D.C. hotspots and the slums of Manila where a group of terrorists sprouts, grows, and plans to take over US-based computers using a zero day bug. The story centers around a security expert named Reuben who tries to stop the bug from being exploited, trying to convince governments, colleagues, and a vendor who is loathe to believe they have a faulty product. Pretty cool stuff.