Best computer hacking books according to redditors
We found 171 Reddit comments discussing the best computer hacking books. We ranked the 40 resulting products by number of redditors who mentioned them. Here are the top 20.
We found 171 Reddit comments discussing the best computer hacking books. We ranked the 40 resulting products by number of redditors who mentioned them. Here are the top 20.
Everyone asking what book it is, I googled a line from it and got:
Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous
Amazon link
Well, it mostly depends on what you’re trying to achieve. You definitely do not want to drop tools on the disk of the compromised machine if stealth is the main goal. You would load stuff into memory instead (reflective PE injection, reflective DLL injection (Powersploit toolkit) in case of Windows, /dev/shm in case of linux) and that way leave a minimal footprint for the blue team.
As to what would get picked up, that depends on the configurations. Process injection, process hollowing, outgoing connections, etc. can all be detected with the right (YARA) rules. Your best bet would be to use non-standard protocols such as DNS (look up dnscat2), ICMP and use the compromised host as sort of a pivot. Sending tool traffic through it instead of installing the needed tools on it.
Here are two writeups from the real world:
https://www.exploit-db.com/papers/41915
https://packetstormsecurity.com/files/155392/HackBack-A-DIY-Guide-To-Rob-Banks.html
Here are some other resources you may like (including DA compromise):
https://medium.com/@adam.toscher/top-five-ways-i-got-domain-admin-on-your-internal-network-before-lunch-2018-edition-82259ab73aaa
https://youtu.be/dKUS26BlKlc
https://youtu.be/q7DfaaUHXYE
https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2
PS: I do not condone malpractice. Provided links are purely educational... Also sorry for the formatting, on mobile. Feel free to DM with more questions, this is a wide topic.
Wow, 24 hours and no replies?!
Fine, you know what? FUCK IT!
Alright, first off - While you can concentrate on physical, understanding the basics of the digital side of things will make you more valuable, and arguably more effective. I'll take this opportunity to point you at Metasploit and tell you to atleast spend an hour or so each week working to understand it. I'm not saying you have to know it backwards or inside-out, just get a basic understanding.
But you said you want to go down the physical path, so fuck all that bullshit I said before, ignore it if you want, I don't care. It's just a suggestion.
Do you pick locks? Why not? Come on over to /r/Lockpicking and read the stickied post at the top. Buy a lockpick set. You're just starting so you can go a little crazy, or be conservative. Get some locks (Don't pick locks you rely on!) at a store, and learn the basics of how to pick.
Your fingers will get sore. Time to put down the picks and start reading:
That reading list right there gives you over 2000 pages to read. Read. Read More.
Tired of Reading? Have you been listening to the Social-Engineer.org Podcasts? 53 quality podcasts right there. Time to catch up!
Tired of listening? Take a break! And by "Take a break" I mean grab your lockpicks, a lock, and start picking while you relax with a Jayson Street video. He's fun to watch, and will hopefully distract you while you try picking a lock. Also, he highlights how you don't have to be a computer-genius to be good at PenTesting. Go watch more of his videos while you pick locks - It's entertaining at least, and informative/educational at best. Now go watch Deviant Ollam's videos if you're done with Jayson Street.
Sounds like a lot? It's not. You'll spend a bit of money getting started with picks, locks, and books. It's the nature of the game, no good way around it. It's time-consuming. You may have to give up playing your favourite games for a while. But the things you learn and skills you develop will pay more than that game did. By the time you're halfway through any one of those books you'll have a much better idea of what questions you want or need to ask in order to progress further and faster every day.
Go to Security Cons. DerbyCon is awesome, and happens in late September, plenty of time to start saving money and making reservations. Talk to people, ask questions, and make connections. You will learn more in those 4 days than some people learn in months or years and you'll have tons of fun.
If you can swing it, attend Deviant Ollam's "Physical Security Skills for Penetration Testers" class. The things you will learn in that class will make it worth every damned penny, and you'll feel like a bad-ass at the end of it.
Is this what you wanted?
The book "LikeWar: The Weaponization of Social Media" goes DEEP into this subject and came out last October. It's written extremely well and I would highly recommend it if you're looking to learn more about this.
The long and short is 'Memetic Warfare' is EXTREMELY important these days and has changed war as we know it.
Thank you all for your responses! I have compiled a list of books mentioned by at least three different people below. Since some books have abbreviations (SICP) or colloquial names (Dragon Book), not to mention the occasional omission of a starting "a" or "the" this was done by hand and as a result it may contain errors.
edit: This list is now books mentioned by at least three people (was two) and contains posts up to icepack's.
edit: Updated with links to Amazon.com. These are not affiliate - Amazon was picked because they provide the most uniform way to compare books.
edit: Updated up to redline6561
Here is a "curriculum" of sorts I would suggest, as it's fairly close to how I learned:
Generally you'll probably want to look into IA-32 and the best starting point is the Intel Architecture manual itself, the .pdf can be found here (pdf link).
Because of the depth of that .pdf I would suggest using it mainly as a reference guide while studying "Computer Systems: A Programmers Perspective" and "Secrets of Reverse Engineering".
Of course if you just want to do "pentesting/vuln assessment" in which you rely more on toolsets (for example, Nmap>Nessus>Metasploit) structured around a methodology/framework than you may want to look into one of the PACKT books on Kali or backtrack, get familiar with the tools you will use such as Nmap and Wireshark, and learn basic Networking (a simple CompTIA Networking+ book will be a good enough start). I personally did not go this route nor would I recommend it as it generally shys away from the foundations and seems to me to be settling for becoming comfortable with tools that abstract you from the real "meat" of exploitation and all the things that make NetSec great, fun and challenging in the first place. But everyone is different and it's really more of a personal choice. (By the way, I'm not suggesting this is "lame" or anything, it was just not for me.)
*edited a name out
Social Engineering: The Art of Human Hacking
All of your security infrastructure is meaningless if I can call Suzy in Accounting and ask her for her password.
TCP/IP Illustrated, Vol. 1: The Protocols
Yes, I know this book is old. This book is the Mutha-Fecking 1969 Camaro 454SS of networking books.
It simply NEVER goes out of style.
Wireshark for Security Professionals: Using Wireshark and the Metasploit Framework
If you don't have a basic understanding of Wireshark and Packet Analysis, you're useless to me.
You don't have to be a wizard. You don't have to look at the Matrix and see Blondes or Red Heads. But you MUST possess a clue.
I have no specific love for this book. Just pick any good looking Wireshark book writen for an InfoSec audience.
DNS and BIND (5th Edition)
The author "Cricket Liu" is THE DNS guy. He literally wrote the book on DNS.
Designing for Cisco Internetwork Solutions Foundation Learning Guide: (3rd Edition)
The Cisco CCDA track will teach you focus on technical requirements, and aligning network functionality to match those requirements. Data Networking is CRITICAL knowledge to InfoSec professionals. But you might find this an easier starting point than CCNA.
Social Engineering: The Art of Human Hacking
I liked Applied Cryptography by Bruce Schneier. Easy read.
Link
Shit yea. Peep The Art Of Human Hacking by Hadnagy - it's incredible. Goes into the science behind human interaction.
Now, keep in mind that I'm not suggesting you manipulate people to do your bidding, although that can be done using these same techniques. With great power comes great responsibility!
Interesting analysis. I have been thinking the same lately, while reading Biella Coleman's recent book on Anonymous. She is quite sympathetic to anon culture, as am I, despite its toxic elements. The interesting question is how the consensus seemed to drift in a weird, conservative way around GG, when in the past it supported more progressive causes (Steubenville, etc.). Are these just different subgroups within anon, have people drifted (eg. weev revealing himself to be a plain old unironic racist), have some boards always been this fucked, what's the story?
Here what I've picked up
On War by Clausewitz
MCDP 1 Warfighting
FMFRP 12-18 Mao Tse-tung on Guerrilla Warfare
FMFRP 12-13 Maneuver in War
On Grand Strategy
The Art of War by Baron De Jomini
Just and Unjust Wars (apparently it's on the Commandant's reading list too)
Soviet Military Operational Art: In Pursuit of Deep Battle
Out of the Mountains: The Coming Age of the Urban Guerrilla
Seapower: A Guide for the Twenty-First Century
The Bear Went Over the Mountain: Soviet Combat Tactics in Afghanistan
Blitzkrieg to Desert Storm: The Evolution of Operational Warfare
Why Air Forces Fail: The Anatomy of Defeat
Deep Maneuver: Historical Case Studies of Maneuver in Large-Scale Combat Operations (Volume 5)
JP-1 Doctrine for the Armed Forces of the United States
DoD Law of War Manual
The Soviet Army: Operations and Tactics
Black Flags: The Rise of ISIS
Napoleonic Warfare: The Operational Art of the Great Campaigns
The Air Force Way of War: U.S. Tactics and Training after Vietnam
Strategy: A History
LikeWar: The Weaponization of Social Media
The Utility of Force: The Art of War in the Modern World
MCTP 3-01C Machine Guns and Machine Gun Gunnery
Man, the State, and War: A Theoretical Analysis
The U.S. Army in the Iraq War – Volume 1: Invasion – Insurgency – Civil War, 2003-2006
The U.S. Army in the Iraq War – Volume 2: Surge and Withdrawal, 2007-2011
Illusions of Victory: The Anbar Awakening and the Rise of the Islamic State
Concrete Hell: Urban Warfare From Stalingrad to Iraq
The American Way of War: A History of United States Military Strategy and Policy
Supreme Command: Soldiers, Statesmen, and Leadership in Wartime
This is all I can name off the top of my head right now
Here are some links for the product in the above comment for different countries:
Link: Social Engineering
This bot is currently in testing so let me know what you think by voting (or commenting).
I recommend reading (or listening to) Clint Watt's description of Edward Snowden in his book:
spoiler: Edward Snowden is not somebody to look up to.
He's now a divisive wedge to spark debate about privacy, information warfare and espionage. It's dangerous to romanticize him, and to forget his role in the Wikileaks/Russia disinformation pipeline.
He is currently in asylum in Moscow, Russia.
Similar killings happened in Iran when Stuxnet and its variants were wrecking the enrichment centrifuges.
Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon.by Kim Zetter is a great whodunnit exploring the failures of the centrifuges.
check out r/oscp Lots of blogs being posted over there almost on a weekly basis on what people did to get ready for the test and about the test.
> I have just set up simple virtual lab (Metaspolitable + Kali ) so where should I start ?! Is there any curriculum or learning path I need to follow to make my life easier ?!
What is your background when it comes to this stuff?
https://www.jpsecnetworks.com/week-1-oscp-preparation-lab-setup/
You need also learn about Windows exploitation
>Would you recommend specific course where you can get all what you need for OSCP in one place ?!
https://www.offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/
They already have a course to get you going. If you are totally new to this world, check out CEH, it will hold you hand and at least introduce you to the concepts of pentesting but the cert doesnt mean jack shit unless you are going for a 8750 requirement.
elearning has some basic pentesting courses to get you started and its a lot more hand holding that OSCPs material. However they seem to focus on relying on metasploit a lot more than you are allowed to use
https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2
Biella Coleman describes this in her book, so you might want to read that. The interesting thing is that for some operations, the targets, participants, and general public thought the firepower was from a huge number of people each using LOIC or whatever, but the most impact actually came from a small number of Anons using botnets. And the botnet guys were lying to all the other Anons and letting them think everyone was equal in it. So even if someone describes to you how it works, they don't necessarily know.
Also it's changed over time as Anonymous got larger and more diffuse. Originally people would gather in chat rooms and try to reach something of a consensus before acting, but later on, someone would get an idea and just go for it without running it past other people. Which is why those later ops tended to be less effective, because they had fewer people and more half-baked ideas.
Now it's mostly dead.
I enjoyed this: Social Engineering: The Art of Human Hacking.
Where Ghost in the Wires is more a story book filled with great tales of hacking and phreaking, Social Engineering: The Art of Human Hacking is more a HowTo book for SE.
Cough...
Actually, maybe that's why my relationships max out at two years.
I will use these two weapons.
This and this.
Just finished a book on stuxnet and I find it absolutely fascinating. Haven't watched the documentary yet, but if anyone is looking for more information, check out this book. It's written so anyone can understand it without any prior knowledge of computer viruses or nuclear power. I can't recommend it enough.
this should keep you busy for awhile.
chris hadnagy has a good book http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539/
kevin mitnick also has one "the art of deception"
hopefully my book will come out soon too :-)
Applied Cryptography might be useful to you.
A great video to start... and the relevant book.. This will serve as an excellent resource for now and future developers interfacing with vehicles.
Not a pdf but.... http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539
attacking infrastructure not connected to the internet is absolutely possible.
https://en.wikipedia.org/wiki/Stuxnet
if books are more your style:
https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196
That book is probably what you want. It looks like it focuses more on math and how it applies to cryptography rather than on crypto algorithms and how they work, pros/cons, etc. It was also used in this math class at Berkeley (lots of extra reading material on that page too).
Again, I think the book you found is what you want. But here are some other options if you want some:
Countdown to Zero Day by Kim Zetter is a good read (amazon)
A default assumption is that every team will contain a warrior so supreme that they got their name from the ability to defeat entire gangs, which usually have more firepower than the local police department, solo.
Runners go out of their way to make themselves as distinctive as possible and never bother to wear masks on runs because the idea of you getting hunted down in a sprawl is a laughable impossibility even if you make it easy on someone. We can't find people in modern cities using modern databases that are arguably set up better than SRs, forget about a sprawl with a population the size of all of California using 12 different databases in a setting where sifting through data is significantly harder than in real life.
My boss is ex-navy (and a shadowrun player, he enjoys riggers, the poor guy) who pointed out that Kane is the most realistic runner of the Jackpointers in that by going to the scale he goes to he can trivially snipe at anyone he wants to with no one ever having any ability to retaliate. Kane could go anywhere he wants to in the world, not just 'hellholes' because the scope of where he could be is impossible to search. You will not find Kane essentially ever. Like I will reiterate that Kane is his favorite because in his real world expert opinion "he is the most realistic" because if your a super criminal a good way to mask your presence is to force your opposition to search the entire god damn ocean for you.
Runners in setting are seen as supremely badass anti-heroes and counter cultural icons. While a given PC may not live up to this, the default assumption for SR was always that if you had talent and wanted to actually stick it to the man, the shadows were a great place to do that.
These are heavily established setting elements that are reiterated pretty constantly and they don't become less true because reality is unrealistic and it feels more real to do the less real thing and pretend that modern society is remotely secure.
A book I recommend to anyone who thinks Pink Mohawk is unrealistic and Black Trenchcoat is realistic is "The future of Violence" which, along with pretty much any experience in any security related field, should dispel that notion right quick. The short version is: as technology improves and cities become more dense and more interconnected, violence and extreme crimes become easier to commit with complete anonymity, not harder, because things like surveillance states don't actually scale well at all and the technology for defeating attacks pretty much always lags behind. SR actually was crazy ahead of the curve back in the day for accidently predicting this when it went out of its way to make "That guy with the rocket launcher shooting at cops" a viable PC pregen that was seen as so basic they made it twice for two different metatypes. If anything, its a wonder the game doesn't point out and run with the ramifications that smartgun platforms and common weapons that come from an entirely black market controlled supply chain completely trivialize anonymous high profile mass shootings and murder. Forget about assassination drones.
Though that of course doesn't service a fun game, which is ultimately the primary concern for any RPG setting, and its a bit bleak and too real to think about.
Furthermore if you don't want to play that way a really simple way to ensure that is to just ask that no one makes a street samurai, who strongly color how a team views violence. Without a samurai (or buff focused mage able to get crazy soaks) teams merely will be 'rather durable' rather than 'gods of war' and combat becomes slow enough its not generally a viable plan A. But, again, remember that one of the CRB story sections literally had plan A be "Drive up right next to the target and have the adept leap out of a car while half naked covered in lightning to punch a ton of spirits out on a crowded street" and this was presented as a fine plan. There are people in setting unarguably capable of pulling stuff that seems a bit much off.
You should read Dark Territory.
It goes both ways. Finding exploits means the NSA can use those exploits against foreign actors. Obviously, the existence of those exploits means, those same foreign actors can work against us.
It's a major debate in the intelligence community.
The one side is, pass along the exploits so, they get fixed... makes us safer. The other side is, keep quiet so we can use those exploits against the other side.
Me? I'm on the side of openness. But, I understand the counter argument.
Yes.
Hacking Exposed
Shellcoders Handbook
Reverse Engineering
Malware Analyst's Cookbook
Gray Hat Python
Gray Hat Hacking Second Edition
Writing Security Tools & Exploits
Sockets, Shellcode, Porting and Coding: Reverese Engineering Exploits and Tool Coding for Security Professionals
Professional Penetration Testing
These are definitely some books you could start with. Once you've gone through those, you'll know more then a lot of them out there :)
There's these reddit threads on r/netsec:
http://www.reddit.com/r/netsec/comments/d3hua/how_to_get_started_in_netsec/
http://www.reddit.com/r/netsec/comments/ekyjw/interested_in_learning_about_network_security/
http://www.reddit.com/r/netsec/comments/es4si/what_are_some_good_netsec_books_out_there/
http://www.reddit.com/r/netsec/comments/g6r71/getting_started_in_network_security_a_list_of/
There's also loads of blogs and websites around, if you go hunting or look at some of these netsec threads, you'll find loads more material.
Oh jeez.
I actually kinda want to revisit that DDoS episode for a couple reasons. Not to least, my friend Molly, who helped with that ep, just released her book on the subject which is AMAZING. If you're looking for some reading, highly recommended.
Pairs well with another colleague's book about Anonymous that just came out, if you need new reading times two.
"Hacker, Hoaxer, Whistleblower, Spy" sobre Anonymous. Estaba muy interesante por que, uno, describe lo que ha pasado los últimos 6 años en cuanto a seguridad en línea desde la perspectiva de Anonymous, y dos, por que me tocó vivir muchos de esos momentos en línea y en la vida real con lo de Cientología, Wikileaks, Occupy, etc. 10/10 recomendaría.
Antes de eso: "Social Physics". Dice que podemos usar "big data" para monitorear las interacciones de las personas para tomar mejores decisiones sobre como organizar nuestras empresas, organizaciones, y ciudades. Tipo chido, pero lo que argumenta sobre big data según yo puede exacerbar la desigualdad en poder que ya existe entre los "pudientes/1%/corporaciones" y el resto de la "gente común y corriente". También está el peligro de que los algoritmos que usamos para tomar decisiones no tomen en cuenta muchos factores importantes que igual pueden empeorar la disparidad económica y racial que ya existe. Pero tiene ideas muy interesantes. 8/10 léanlo si le entran a este tipo de cosas.
Siguiente: Capital in the Twenty-First Century. Trata sobre la desigualdad que existe y se ha creado con nuestro sistema económico actual. Viene muy recomendado.
Remember? How could I forget? My primary blue box was my amiga. For years. I think my program of choice might have been UADialer? Ultimate Access Dialer, I think? Some of these had weird keyboard combinations required to access them on startup.
https://www.amazon.com/Exploding-Phone-Phil-Lapsley/dp/0802122280/ref=sr_1_1?keywords=exploding+the+phone&qid=1556293395&s=gateway&sr=8-1
Pretty good book here. Get close enough to anything, though, and you'll find faults. I especially dislike the lack of coverage for 1980s and 1990s, for the US, where it was supposedly "no longer possible." I STARTED in the late 80s, and participated off and on until after 2000!
If you want to support the author, Amazon Link
The guy that wrote that blog post has a good book called Spam Nation that talks about his deep dive investigation into Russian cybercrime gangs. It's incredibly good, and he's one of the best reporters on the cyber underground.
I'd also look for the coverage of Stuxnet. There's a really good documentary about it called zer0days, and since you specifically asked about books you could do Countdown to Zero though I haven't read it so I don't know how good it is. If you haven't heard about Stuxnet it's a fascinating story about just how advanced US cyber warfare capability is.
> In what way is that a HACK on our election?
Social engineering is an accepted form of hacking. Proof
I'm not an expert here but I've picked up interest in the last 3 months and have been pouring through a lot of online resources related to Cryptography and coding. Here's some of what I've been working with:
Hacking Secret Cipher with Python: http://inventwithpython.com/hacking/
> Great hands on book teaching you about various types of ciphers, how they work, how to break them. If you don't know much coding, that's still okay for this book, you learn some of the Python basics.
Applied Cryptography
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099/ref=sr_1_1?s=books&ie=UTF8&qid=1394549623&sr=1-1&keywords=applied+cryptography
> Great book, essentially a cryptographers bible. I got the latest edition on Ebay for $20 total, nearly brand new, so it's cheaper than Amazon
Online course in Cryptography by Dan Boneh - standford
https://class.coursera.org/crypto-preview/lecture
> I'm halfway through this course and I'm loving it. I would be done by now but I've been busy the past couple of weeks.
That first resource is great and really easy to follow. It'll give a nice foundation for computer cryptography. I was able to get through it in a little over a week.
This does not make sense to me.
> The Public keys will be base 36 numbers ranging from 00000 (0) to ZZZZZ (60,466,176).
As nsa_at_home points out, the key representation normally has nothing to do with the actual key. Cryptographers will represent things in binary as a convenient standard; you'd say "I want a key with at least 23.5 bits of entropy", say. It's very, very easy to represent a key with N bits of entropy in any form you want, which sounds to be your goal; in this case, you'd take a number in base 2 and just convert it to a number in base 36.
For most purposes, your keyspace is not large enough. Say encryption has a cost of N. That means that brute-forcing your entire keyspace only costs about 60 million times that much. If you want a signing operation to be reasonable on a computer, you probably can't blow more than, oh, say, let's say a second on it for most applications that I can think of. If I'm willing to brute force for a day, I've already covered 1/700th of the keyspace. If I get 700 computers, I've broken your encryption.
Your key has ~25.8 bits of entropy. ln(36\^5)/ln(2). A typical RSA pubkey in practical use today might have a key length of 2048 bits, to give you an idea of what you might want to shoot for.
> The Private Keys need to be originally derived from the public keys mathematically (or Vice Versa)
This makes no sense. The point of public/private key encryption is that the person who has the public key cannot derive the private key; this property means that you can give out the public key without needing to worry about anyone using the public key being able to decode messages others have encoded and sent to use using the public key.
If you don't care about this property, you would be using symmetric encryption, not pub/privkey encryption.
> The Private Keys need to be completely different yet within the same number range (0 - 60466176) without being guessable (ex: very complicated and possibly irreversible).
Now I'm really lost. A key isn't "reversible"; a process is. You can't run a key backwards; it's just a number.
The only other pieces of information out there that it might be deducible from would be the pubkey (and you've already specified that you want the privkey to be derivable from the pubkey, which doesn't make sense either, so that's already reversible) and a known-plaintext attack on the ciphertext (and as I point out above, for most practical uses, your mandated key length is so short that it probably is derivable from the ciphertext for most practical applications).
Applied Cryptography is considered one of the best introductions.
Social-Engineer.org and the book are good starting points.
Bruce Schneier is Chief Security Technology Officer of British Telecom, one of the world's leading security experts and a very vocal advocate of strong security practices that benefit common people. He's published his crypto-gram newsletter since 1998, which is translated into several different languages, and published several books on the topic, including Applied Cryptography. If anyone is qualified to give testimony to Congress on the subject of technical measures to ensure airport security, it's this man.
Applied Cryptography: Protocols, Algorithms, and Source Code in C by Bruce Schneier. Bruce Schneier is basically the Chuck Norris of Information Assurance. The book is old and many of the technical details about cryptography are out of date, but it's still probably the best introduction to the subject.
I assume they mean Hacker, Hoaxer, Whistleblower, Spy.
I don't think you will find a book on a global financial crisis as devastating as Mr.Robot from a hack, but you can find books such as "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon" that deal with real world scenarios that can turn cyber weapons into real world problems portrayed in Mr.Robot
https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196
Chris Hadnagy's Art of Hunam Hacking is a good read. Its on audible too.
Two great pieces on Operation Olympic Games AKA Stuxnet
Book: Countdown to Zero Day
Documentary: Zero Days
A guy I work with teaches ethical hacking courses, advises a college cybersecurity club, and maintains an ethical hacking lab. These are all things he's been getting into lately.
Lockpicking set
Or
The Car Hacker's Handbook
+
USB2CAN
+
DB9 to OBDII cable
Or
Tiny quadcopter (upgradeable, has a camera for use with monitors or video goggles to give you a first-person view, fantastic if you have a cat)
+
Transmitter
Last time an unprecedented worldwide hack occurred the person involved wrote a book about it. Verifiable conformation isn't much to ask for here, especially when America's made up stuff before.
Let me just say this: if you are wanting a community and spiritual feelings or feel goods are there other places that you could get those things? If you check out r/Frisson/ you might get some of those spiritual feelings without the need for a church. Or you can learn how to get strong spritual feelings anytime you like by just remembering a time when you felt that way and then focus on that feeling. Actors use this method to recall feelings during their plays, shows etc so they can make the scene believable. (usually done with anger sadness joy) As for a community wouldn't you rather just join a meetup that already has ideals that meet your own instead of having to do mental gymnastics to make your worldview work? Also be prepared as Mormons tend to be super friendly when they are trying to convert you but once you are converted they focus their efforts elsewhere. That isn't to say this will absolutely happen but it can just ask some of those that are ex-converts to the church on this subreddit you will see what I mean. I think you would be better off finding some real authentic people that think similarly to you and are able to think critically about everything in their lives instead of just anything that doesn't involve religion. Read www.cesletter.org before you join as well so you know some of the old fallacies and doctrines that are in the history of the church or in other words the un-whitewashed version of TSCC. Also consider do you really want to give your money to a group of con-artists that are working actively to get people to not think critically but instead want people to just have faith in them and their doctrine? If you do this you are perpetuating the problem, if you join, then those who aren't thinking critically of TSCC will just be even more enthralled because "hey look guys an atheist just joined see we have the truth!" Please recognize their niceness for what it is even though they even may genuinely believe they are being nice they are that way because they are told to be from TSCC toward converts not because they actually think they need to help a fellow human just for the sake of helping them, this is especially true if they are trying to pressure you to join. Just think will they still be just as friendly if I decide not to join? If the answer is no then it would seem to me that they are trying to get something out of such as a pat on a back from their bishop, or trying to get a promotion calling such as become a bishop. Think of them as salesmen they actually use many of the same tactics, which also happen to be similar to what social engineers use. Social engineer is just an elaborate name for a con-artist. See what I mean in this book [here.] (https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539) As for social conservative please elaborate do you dislike gays? if not they you will see this church does some real damage with that community with their policy that any gay families children can't be baptized till they are 18 and renounce their parents marriage. It's really outrageous. If you just want limited government then I share that sentiment I don't really love either party, as such you can find people that share your values and don't need to join a church to get spiritual fulfillment and social fulfillment.
I remember reading this one
I went to the NCSU stacks and grabbed an armful from the psychology section so my memory is fuzzy. The best one had a profile of two people's faces yelling at each other but I can't remember the title.
Other good reads that will roundabout teach the same mechanics:
A classic
A more fun read, but less relevant.
With more entrenched ideas like politics it may be useful to look into books on the mechanics of brainwashing. If you learn how to build a bomb, you learn a lot about diffusing them. You also may learn we're all mildly brainwashed in some innocuous way or another.
And if you're not much of a reader, Chris Voss puts most of these ideas pretty eloquently.
Edit: The ones that look more like textbooks than self help tend to be more useful with the exception of Dale Carnegie.
Schneier's Applied Cryptography can be difficult to get through, but it is a really good book to spot read / keep as a reference.
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099
I'd also start reading blogs to get into the security mindset. Schneier on Security, Krebs, the podcasts that have been mentioned by other posts. They often have really good archives, too.
Social Engineering: The Art of Human Hacking
Depending on exactly what part of the automotive computing field you want to get involved in you may be better off with Computer Science (machine vision, deep learning, etc), Computer Engineering (sensor design, bus interfaces, etc) or Electrical Engineering (analog design, signal integrity, etc). A great book to get started is The Car Hackers Handbook https://www.amazon.com/dp/1593277032/
You're correct. And they do a great podcast, as well as Chris' book: http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539
Why not Social Engineering by Chris Hadnagy? This book has a lot of really interesting and dangerous insights into manipulative psychological techniques.
Just read chapters on elicitation, pretexting, psychology and related stuff, side away technical information.
I am an avid "people watcher" and notice things other people don't. I often accidently memorize things I would never need to memorize.
(like the license plate from the car in front of mine while driving)
Advice (things I have noticed):
Watch things, see a bird? Watch it. See a group of people? Watch them. It helps to be in a higher place. Have you ever noticed people almost NEVER look up when in the mall? Stands at the edge and look down.
Always, always, always, look around. Never stop looking around. Learn to do it naturally and to pay attention to something or someone while still studying your surroundings.
If you feel wierd watching people, wear headphones or hold a phone. Sounds dumb, I know. But what I have found is if you are wearing noticable headphones or have a phone in your hand. People don't expect or think it's wierd that you are staring in random directions which include theirs. Act like you have a reason to be there.
Remember how tall you are, it can help you find the height of objects or people.
Remember, most of the things you learn in a day will vanish within 20 seconds because of your short term memory and the way your brain sorts what to keep and what not. But that's not the point right now. The more you watch and pay attention. The more you will retain.
Make it a game, it will eventually give you a feeling of having the upper hand on people.
EDIT: If you also want to learn about people, not just details then I suggest you read about Social engineering. One of my personal favorite books is http://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539/ref=sr_1_1?ie=UTF8&qid=1318521071&sr=8-1
Applied Cryptology is the text you want.
This is way more than you need but it is an interesting read (that you can skim by chapter if you want to). http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539
Audio info http://www.social-engineer.org/podcast/episode-020-rapid-rapport-for-social-engineers/
Infographic. http://www.socialengineeringblogs.com/category/rapport/
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099
You might like, Social Engineering: The Art of Human Hacking. Its actually happend and he uses a combination of computer and human hacking to achive his goals. Its not one long story but multible storys.
He has many more books on the subject.
http://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
Super helpful! Thanks for the response. Might be dumb but what does CEH stand for? I'll avoid it as it sounds like I should.
I bought this book and this book I'll do all the excercises in them.
What are the CTF's you mention?
Thanks again though, very helpful.
The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age
By David Sanger, national security correspondent and a senior writer for the New York Times.
(Okay, at this point, I'm really just suggesting books on my to-read list, but I did hear the guy speak and he had some pretty good anecdotes.)
Would you call it... A friendly orange glow ?
Hacking: The art of exploitation
The Web Application Hackers Handbook
The Tangled Web: A Guide To Securing modern Web Applications
The Hacker Playbook 2
The Hacker playbook 3
Black Hat Python: Python Programming for Hackers and Pentesters
A lot depends on the school and the program- some are operations focused, others are management focused. What school are you going to? It sounds like you're pretty well ahead already, so I wouldn't worry too much, especially as you will be reading a lot for school, but if I had to give you one book, I'd go with the Hacker's Playbook https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2. Its a far better book that the for dummies series.
It's on amazon too. https://www.amazon.com/Messing-Enemy-Surviving-Terrorists-Russians/dp/0062795988 (note the wording in the link).
This one is free:
http://www.fak.dk/en/publications/Pages/publication.aspx?pageid=559
And
https://www.amazon.com/Hacking-Human-Ian-Mann/dp/0566087731
And this is probably one of the more well known ones:
https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
Also anything written by Kevin Mitnick
For what it's worth, cryptography is famously hard to get right and I would strongly recommend that you use existing crypto software if you are actually trying to secure your computer.
That said, if you're interested in coding and want to learn more about encryption just for fun, you should check out the Matasano Crypto Challenges. They teach you about the fundamentals of cryptography by having you build a bunch of ciphers and then break them.
If you're looking into doing this more professionally, I've been told that Cryptography Engineering and Applied Cryptography are some good resources, though I haven't read them myself.
I do agree they could and have tampered with shipping on things in the past (Countdown to Zero Day ); however, for the NSA (as an example) to target ordinary citizens seems a bit out of focus for what the NSA would want to use resources on. I'm not saying they would not (please excuse the double negative), it seems like a lot of effort for next to zero gain. They would want to target individuals of high interest for sure and have shown in the past to be very specific on how they target them. Again the above mentioned book details how specific the Stuxnet virus was to avoid it from activating on every logic controller or found. I feel the same would be true for certain agency's to target select individuals not an entire group.
Also, if this bothers you then how can you trust VPN encryption at this point? Who can say they have or have not broken that? How can you trust they haven't broken HTTPS encryption? We can "what if" this to death.
For myself, I'm really looking forward to this phone for the lack of a company tracking me. No more Google listening to everything I say within ear shot of my phone. No more Google tracking everywhere I've been all day Watch this.
The NSA cares about national security, you downloading that new album of MP3s with Bit torrent is a matter for other agencies. Why waste the resources?
Some dank af infosec books:
Malware Data Science: https://nostarch.com/malwaredatascience
Real World Bug Hunting: https://nostarch.com/bughunting
Penetration Testing: https://nostarch.com/pentesting
Black Hat Python: https://nostarch.com/blackhatpython
Social Engineering: The art of human hacking https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
Linux System Security: https://www.amazon.com/Linux-System-Security-Administrators-Source/dp/0130158070
Advanced Penetration Testing: https://www.amazon.com/Advanced-Penetration-Testing-Hacking-Networks/dp/1119367689
https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196
Read that book if you want a real life James Bond type story. It details the work done to bypass airgapped machines and sabotage uranium centrifuges. Seriously good book!
>*Learn social engineering, somehow.
http://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
It just came out couple days ago. Publisher's release date is today infact. For that reason I havent read it and cant say if it's good or not.
One of the "bibles":
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099/ref=sr_1_1?ie=UTF8&s=books&qid=1256702627&sr=1-1
I read a bit of it, some great insights.
All the credit goes to Applied Cryptography
I made a similar jump, IT to Security Analyst.
I spun up a home lab in vmware with Kali, metasploitable, splunk, pfsense and security onion (for snorby).
I read a couple books:
Network Intrusion Detection:
https://www.amazon.com/gp/aw/d/0735712654
Applied Cryptography:
https://www.amazon.com/gp/aw/d/0471117099
Between this and diving into security centered news sites I went from 0 to (what felt like 60) in about 3 months. I was picked up as a security analyst for a pretty solid tech company.
It's like on the cover of this book
http://amzn.com/0470639539
"The Art of Human Hacking" :
https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
Ok, it's good a question. I loved cryptography learned bitcoin. But i recommended this book!
And if you suck at math i recommended write a code with existing crypto-libs (on python,go,cpp etc....)
I just finished reading this book: Countdown to Zero Day
It covers what this movie goes into and a little bit more.
wow, you're killing yourself
https://www.rollingstone.com/politics/politics-features/trump-access-hollywood-tape-733037/
​
Two years have passed, and Trump is president because the events of October 7th, 2016 marked a revolution. This was the moment that the old gatekeepers were swept aside, their indignation and appeals to “decency” kicked to the curb with them. Instead, the 2016 election would be decided by competing viral events, what we call “LikeWars.” This was the moment that the Internet swallowed politics for good.
Beyond the Access Hollywood tape, two other events transpired online that day. The first was official acknowledgement by the U.S. intelligence community that Russia had targeted the 2016 election by hacking the emails of the Democratic National Committee and Clinton proxies — a story of momentous importance that would be immediately lost in the “locker room talk” news cycle. The second, coming just minutes after the Washington Post published its article with the Access Hollywood video embedded, was the fruits of the the aforementioned hack. This was the initial release of the “Podesta Emails,” laundered through the “transparency” organization Wikileaks. The document dump would be repeated dozens of times, amounting to more than 20,000 pages of stolen communications.
This was the ammunition that Trump depended on to mount his comeback.
​
edit - as it's now obvious you're posting in bad faith we'll focus on assange and then you can ask for me to explicitly address any or every other lie you have forwarded to try to distract from us doing that
http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539
This one is a good start.
I imagine that their warehouses will get some in up to two weeks before they ship. There are a few ways to score one early. My favorite method for getting early deliveries from Amazon requires you to spend a little bit more money. Add this, this, this and this to your cart and use your Amazon prime to get overnight shipping.
Now you've got a little reading to do (no big deal for us Kindle lovers though, right? LOL!) Give this a read. On your PC, I guess since you don't have a kindle right now :(. Maybe print it out.
You've still got a few weeks before they hit the warehouses. Give this page a once over. Which one of those is nearby you? Take a drive down to the airport and do a little Kindle-lover pilgrimage! Make some notes about what people are wearing. You'll want to get an outfit like that.
Go back a few more times at different times of day. Get a feel for the flow of the place.
Now we have some more reading to do! Pick up the Kindle edition of this and read it on your PC (you'll get to put it on your new Kindle soon!). (I <3 Calibre's reader for this sort of thing.)
Hold on, someone's at my door. Probably about that slick "free TV from Best Buy" deal I posted a while ago! BRB!
There is a book that just recently came out, titled Social Engineering that is very in depth. The author also has a website and podcast. I liked the book, and the pod casts are pretty neat. The only thing w/ the pod casts is that they are a little heavy on the chit-chat, a little light on the information.
Get a copy of Bruce Scheier's Applied Cryptography, there is plenty of stuff in there that's accessable even without a strict mathematical background. Most (if not all) of the algorithms in the book are explained with an example setup using Alice and Bob (and other characters) to explain the steps of the algorithms.
It also has extensive chapters on modern stream- og blockcifers, which may be somewhat harder to dig into as a novice.
Note that it does not comtain any material on the Advanced Encryption Standard (AES), since it was written before that was adopted.
It's totally a thing and it's one of my favorite parts of my job - but it can get really dark too when we do phishing/open source intelligence gathering :/
This is fascinating. If you're into this stuff I highly suggest reading/listeninng to Dark Territory: The Secret History of Cyber War by Fred Kaplan https://www.amazon.com/Dark-Territory-Secret-History-Cyber/dp/1476763259
Oh Bruce, how I love thee.
I don't have anything like that to recommend but if you are interested in more reading (especially non-fiction) take a look at the ones below.
Red Wheelbarrow Journal
I also really enjoyed the following:
The Innovators: How a Group of Hackers, Geniuses, and Geeks Created the Digital Revolution
We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous, and the Global Cyber Insurgency
Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous
Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground
&#x200B;
From there, I went on to various sysadmin books (non-fiction) and a few journal articles.
Let me preface this by saying I know nothing about netsec but can offer a general framework.
To make a career out of netsec you need to know the answers to three questions:
As a starting point you might like to check out
http://www.amazon.com/InfoSec-Career-Hacking-Sell-Skillz/dp/1597490113
That book covers nominally what you are after but it's a touch old (2005) so things might have changed since it was published. Apparently it discusses the various job types within the industry which should give you a sense of what is possible.
With this information you next want to find a list of employers you'd like to work for. Your goal is to try to build relationships with those companies: do they offer internships? What knowledge/experience are they looking for from new employees? Could you meet with someone to talk about the industry? Etc.
You might be able to do this by blindly emailing or phoning the companies. However, it will probably be more effective if you can meet someone face to face. The obvious way to do this is to go to university careers fairs, conferences, local clubs etc. If you're at university you might be able to ask your teachers if there is anyone they know of who they could introduce you to.
At the very start of this networking phase you could be quite broad in who you talk to. If you know 20 people and they each know 20 people then you have access to 400 friends-of-friends. Sometimes someone knows of someone who could be helpful for you. Once this lead generation has kicked into gear though you can focus down on the people most relevant to you.
At this stage you hopefully be able to answer the question 'What do I need to know?' with 'If I can do x,y,z then ABC Inc will give me work.'
You will now want to start learning those skills. Your contacts might be able to give you some suggested reference sources but you're probably best off learning by doing a series of small projects. The reason is that they will give you a sense of 'what it is really like' beyond the textbook theory, but also because they will prove that you can actually do something. It's one thing to say "I know some basic reverse engineering." and another to say "I know some basic reverse engineering, here is a 'Hello World!' program I wrote in C and here is a crack I wrote which makes it output 'Goodbye World!' instead."
If you're really pushing this you could start a blog detailing your projects. From your perspective it's a way to track your progress. From a more pragmatic perspective it is an advertisment for yourself and a way to keep bubbling at the back of your prospective employers mind as they can see what you are working on.
As you continue along this path eventually you'll get the necessary skill set to start applying for positions. When you do apply you'll hopefully have two aces up your sleeve: projects which prove you are capable of undertaking the required work, and ideally some sort of reference from an established figure within the industry (or even better, company.)
I am vaguely aware of a netsec one-person consultancy company vibe. I don't know how common that is or how you would set up as an independent contractor but that is another path to look into.
----
This approach is loosely based on this which might be interesting to you for a much more detailed application in an academic setting.
If you "didn't mean Reddit.com" you shouldn't have said "a site like Reddit".
Anyway, no, what we have isn't "secure," but it at least (most places) has a paper trail. Any sort of internet voting system, however, would be less - far less - secure and far more gameable. No system running over the internet can be secure - at least, none that you can then give access to, well, everybody.
See Bruce Schneier's website - the man who literally wrote the book on cryptography.
Aside: you might also find some of the equivalent books about the early tech movements interesting; I got into them when I had trouble finding good retro-gaming books several years. Two neat examples would be Exploding The Phone and The Soul Of A New Machine. I never would've guessed that early phreaking or the development of a mainframe could be fascinating, touching and suspenseful, but those books managed to make it seem that way.
> Suppose the voting machine stores...
No, this isn't how cryptography is used for voting (or can be used) as far as I recall. Recommended read: https://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099 :) I haven't taken much interest into secure voting apart from what I have read in this excellent book. I think it's a great starting point for any serious thinking about this topic.
I suck at explaining myself. For example, the second serial number I mentioned isn't for YOU and is not meant to prove anything but act as a "fake" (but verifiable) one you can present to blackmailer. I failed to explain even that properly.
As a side note, you make many assumptions about the voting process. For example, where I live you cannot get a duplicate voting card because this means messing with results easier so a photo would indeed be a proof etc. This is a detail though because I think you have much stricter expectations of a cryptographic system than you have of a physical one as if the latter couldn't be tampered with (they are!).
I think I'm not qualified for this discussion simply because cryptography isn't my specialization, esp. in this context. But thank you so much for sharing your thoughts.
https://arstechnica.com/tech-policy/2012/06/confirmed-us-israel-created-stuxnet-lost-control-of-it/
This book is an amazing read and gives a hugely comprehensive picture of everything: https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196
https://www.wired.com/2013/06/general-keith-alexander-cyberwar/
https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
Autogenerated.
I’ve written a book about how posting is warfare and memes are its weapons. There are terrorists, trolls, IDF officers, and Donald J. Trump, fighting for your attention one viral event at a time. AMA.
Hey Reddit! My name’s Emerson Brooking. I’m a Washington, DC-based defense analyst and coauthor of a new book, LikeWar: The Weaponization of Social Media, that traces how the modern internet has intersected with war—and birthed new kinds of conflict along the way.
The book chronicles the history of communication and creation of the internet, the development of open-source military intelligence (OSINT), the disinformation tactics of Egypt, Turkey, China, and (especially) Russia, human psychology and the attention economy, “military memetics” and associated information warfare theories, Silicon Valley’s growing political power (including Reddit’s!), and the advent of advanced neural networks that will govern the LikeWars of tomorrow.
Highlights include:
Got questions about this weird intersection of war, politics, and shitposting? Just ask!
Proof: https://twitter.com/etbrooking/status/1047941322034831360
-----------------------------------------------------------
IamAbot_v01. Alpha version. Under care of /u/oppon.
Comment 1 of 1
Updated at 2018-10-05 19:42:31.113887
Next update in approximately 20 mins at 2018-10-05 20:02:31.113925
The ever-excellent Khan Academy has produced a very nice and short series of videos explaining how cryptography works. Anyone who understands basic high school arithmetic can follow this. If you have ever been interested in the science of codes, ciphers, breaking them, etc. this is worth a look:
http://www.khanacademy.org/science/brit-cruise/cryptography
More in-depth treatments of cryptography can be found here:
https://www.coursera.org/course/crypto
and here:
http://www.youtube.com/playlist?list=PL71FE85723FD414D7&amp;feature=plcp
And for the truly hard-core some of best books on crypto are:
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Edition/dp/0471117099/ref=sr_1_1?s=books&amp;ie=UTF8&amp;qid=1340524661&amp;sr=1-1&amp;keywords=applied+cryptography
and
http://www.amazon.com/Practical-Cryptography-Niels-Ferguson/dp/0471223573/ref=sr_1_1?s=books&amp;ie=UTF8&amp;qid=1340524712&amp;sr=1-1&amp;keywords=practical+cryptography
and
http://www.amazon.com/Cryptography-Engineering-Principles-Practical-Applications/dp/0470474246/ref=sr_1_2?s=books&amp;ie=UTF8&amp;qid=1340524751&amp;sr=1-2&amp;keywords=practical+cryptography
Making up a persona and using articles to improve your search rank =/= social engineering, which has to do with hacking. They aren't even remotely similar. Again, you clearly have no idea what it means.
http://searchsecurity.techtarget.com/definition/social-engineering
http://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
I would recomend you to read Future Crimes by Marc Goodman https://www.amazon.co.uk/Future-Crimes-Digital-Underground-Connected/dp/0552170801?SubscriptionId=AKIAILSHYYTFIVPWUY6Q&amp;tag=duckduckgo-ffab-uk-21&amp;linkCode=xm2&amp;camp=2025&amp;creative=165953&amp;creativeASIN=0552170801 mostly deals with the non existence of electronic security though and how it is and can be exploited
Information and Corporate security is a very big subject, so it kind of depends where you intend to take your story. But you can start by reading the Wikipedia article about InfoSec https://en.wikipedia.org/wiki/Information_security and then see how each area fits into your story and work out from there.
Some realisim in how difficult it can be to track down a hacker, read The Cuckoo's Egg by Clifford Stoll
https://www.amazon.co.uk/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787/ref=sr_1_1?s=books&amp;ie=UTF8&amp;qid=1500888747&amp;sr=1-1&amp;keywords=clifford+stoll very different from what you see in the media
IMHO the most interesting area in Information security is Social Engineering, it requires cunning and skill, and sometimes you can't stop admiring the talents and genius of some of these people. Read Social Engineering: The Art of Human Hacking https://www.amazon.co.uk/Social-Engineering-Art-Human-Hacking/dp/0470639539/ref=sr_1_1?s=books&amp;ie=UTF8&amp;qid=1500889212&amp;sr=1-1&amp;keywords=social+engineering+the+art+of+human+hacking
Each year Verizon release their data breach report http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/ it is free to download (don't have to register, just click the download only button) I think that is possibly the best insight you can get into corporate security challenges in 2017
https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196 has been recommended to me by multiple people. I have yet to read it myself though
Recommended reading for follow-up on the Capt'n Crunch thread: https://www.amazon.com/dp/0802122280
In most public hacks the vector of attack was a human being tricked into clicking a phishing link (Podesta), or being manipulated into thinking they were a justice warrior (Snowden).
Which major hack was purely technical?
https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
http://www.amazon.com/Applied-Cryptography-Protocols-Algorithms-Source/dp/0471117099
You Need,
http://www.amazon.in/Social-Engineering-Art-Human-Hacking/dp/0470639539/
https://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital/dp/0770436196
I highly recommend this book, you guys will love this one!
Two books on social engineering I can recommend:
Social Engineering: The Art of Human Hacking
http://www.amazon.com/Social-Engineering-The-Human-Hacking/dp/0470639539/ref=sr_1_1?ie=UTF8&amp;qid=1333753273&amp;sr=8-1
No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing
http://www.amazon.com/No-Tech-Hacking-Engineering-Dumpster/dp/1597492159/ref=sr_1_4?ie=UTF8&amp;qid=1333753273&amp;sr=8-4
These should get you strated:
What Every BODY is Saying Amazon link.
The Definitive Book of Body Language Amazon link
Whit focus on social engineering:
Social Engineering: The Art of Human Hacking Amazon link
If money is an issue you can find all of these books on pirate bay.
These books are not read-once-and-become-expert, like with any skill it takes time and practice.
Just wait until people figure out what hackers can do with neuro-linguistic programing.
It is covered briefly in this book, but this is just the tip of the iceberg. https://www.amazon.com/Social-Engineering-Art-Human-Hacking/dp/0470639539
Always being keen in these areas, a book of social engineering.
http://www.amazon.com/dp/0470639539
Found it in a goodwill for a dollar.
Books that changed the way I look at things, and thus changed my life:
Light by M. John Harrison Helped me understand that my feelings of smallness and impotence were pointless. In the greater scheme of things there is always two things: Someone better-off than you, and Someone worse-off than you. Whining about it helps no one.
Crank by Ellen Hopkins Helped me understand my mother's drug abuse. Not condone it of course, but understand it. Within six months of me reading this book, my Mother actually started to get clean. Maybe she found it in my room or something.
House of Leaves by Mark Z. Danielewski Through this I learned the true power of fiction. This book makes movies look bad. It is the biggest must-read on my list.
Social Engineering: The Art of Human Hacking by CHristopher Hadnagy taught me how better to interpret my actions and the actions of others, and in general made me a more observant person. Barring the manipulative side of things, (which it helps you notice as other people do it or you do subconsciously) it helps you understand social interaction on a deeper level than just words.
A Child's First Book of Virtues by Emily Hunter
I'd have to say that this was one of the single most important books of my childhood. It taught me all the important bits. This book was gifted to me right after I learned to read, and I am quite frankly a better person because of it. It helped form the model by which I judged my own character.
And of course a set of the Encyclopedia Britannica and Compton's interactive encyclopedia.
Buh I like reading.
make sure this is legally waterproof. i've read in Social Engineering that there was prosecution of hired security experts that performed a certain penetration test on their clients servers, because it's still a criminal offence to do so.
Oi. Disclaimer: I haven't bought a book in the field in a while, so there might be some new greats that I'm not familiar with. Also, I'm old and have no memory, so I may very well have forgotten some greats. But here is what I can recommend.
I got my start with Koblitz's Course in Number Theory and Cryptography and Schneier's Applied Cryptography. Schneier's is a bit basic, outdated, and erroneous in spots, and the guy is annoying as fuck, but it's still a pretty darned good intro to the field.
If you're strong at math (and computation and complexity theory) then Oded Goldreich's Foundations of Cryptography Volume 1 and Volume 2 are outstanding. If you're not so strong in those areas, you may want to come up to speed with the help of Sipser and Moret first.
Also, if you need to shore up your number theory and algebra, Victor Shoup is the man.
At this point, you ought to have a pretty good base for building on by reading research papers.
One other note, two books that I've not looked at but are written by people I really respect Introduction to Modern Cryptography by Katz and Lindell and Computational Complexity: A Modern Approach by Arora and Barak.
Hope that helps.
buy this:
http://www.amazon.com/Professional-Penetration-Testing-Creating-Learning/dp/1597494259/ref=la_B002WK0OS4_1_5?s=books&amp;ie=UTF8&amp;qid=1420278723&amp;sr=1-5
Submission Statement: In this episode of the podcast, Sam Harris speaks with Benjamin Wittes about both volumes of the Mueller Report.
Benjamin Wittes is a legal journalist who focuses on issues of national security and law. He is a Senior Fellow in Governance Studies at the Brookings Institution, where he is the Research Director in Public Law. Benjamin is also the co-founder of Lawfare, a blog devoted to discussion of U.S. national security choices, and a cohost of the Rational Security podcast. His books include The Future of Violence: Robots and Germs, Hackers and Drones—Confronting A New Age of Threat (coauthored with Gabriella Blum), Detention and Denial: The Case for Candor after Guantánamo, and Law and the Long War: The Future of Justice in the Age of Terror.
&#009;
&#009;
&#009;
> # How does a big company full of smart people miss a revolution?
>
>
>
> The Friendly Orange Glow: The Untold Story of the PLATO System and the Dawn of Cyberculture (Brian Dear 2017; Pantheon) tells a story of business blindness.
>
> The programmers of the powerful CDC mainframe had all of the technical knowledge, and more, of the PC pioneers, but they didn’t want to drop everything and rush to the PC. The business folks behind the mainframe were similarly mentally locked into their well-trodden paths of sales and applications.
>
> The CDC/PLATO folks actually built a modern distributed system, with a microprocessor in every terminal (“desktop PC”) and communications lines back to a server.
>
> > Instead of orange pixels, they were grayish white. The new terminal, called the IST (short for Information Systems Terminal), looked more like an early personal computer. A big, wide, heavy base, with a black grille in front, to which a detached keyboard was connected via a thick cable. On top of the base was a monitor, a special elongated CRT with a square display featuring exactly 512 x 512 black-and-white pixels and, mounted directly over the surface of the CRT’s glass, a reflective, acrylic touch screen with barely visible gold wires crisscrossing across the display. During the nine months of development, the price of CMOS (complementary metal-oxide semiconductor) memory chips had plummeted even further than Hill had anticipated. “According to the really long-haired predictions,” says Hill, “it was going to come down, by six or eight to one, and it came down about ten to one, right when we were doing our development. The result was that we could produce a memory-mapped video terminal, which as far as I know had never been done before, because it was cost-prohibitive.
> >
> > “We produced what in effect was a PC,” says Hill, “in 1975.” When one considers the year this machine was developed, and compare it to what else was available at that time, it is suddenly apparent that CDC had just leapfrogged over the entire microcomputer field. Here is Hill describing his machine: “[ It had an] 8080 microprocessor, it had plugin cards, it had a separate monitor, with a cable going to the main box, it had a separate keyboard, it had plugin modems, plugin memory, plugin communications, and we even had a plugin disk driver, that wasn’t part of the standard stuff, but we had it networked, so it was revolutionary. And our big problem was producing it at low cost. And we did that. That terminal came in with something like a $ 1,300 cost, in the first few terminals. And that was beyond everybody’s belief.” By the time the IST was ready to be sold to consumers, the marketing people had marked up the price to over $ 8,000, says Hill. It was the beginning of a long line of very bad decisions at CDC. Hill believed the terminal should have been sold for $ 100 above cost. “If we’d done that, we would have flooded the market because people knew they could use it for other things. It would take loadable programs— we could load programs down from the mainframe into that terminal.”
>
> Note the last sentence. The system had the same capability as a modern Web browser that may download a Java or JavaScript program from the server.
>
> The author says that CDC had roughly $1 billion in revenue in 1969 ($7 billion in today’s mini-dollars) so it was about one seventh the size of IBM. Management went all-in on computer-delivered education, which meant trying to sell to governments such as the Soviet Union, Iran, and Venezuela. The U.S. government delayed the Soviet sale due to security concerns and then killed it after the invasion of Afghanistan (imagine how many trillions of dollars we could have saved if we had let the Russians support the secular government in Afghanistan and not supported the Mujahideen!). The Iranian deal fell apart due to political instability:
>
> > CERL and CDC created Persian-language support in PLATO as part of the demos, and eventually the Shah’s government agreed to a deal. However, it required that the IST terminals had to be made in Iran (or at least have a decal with “Control Data of Iran” and Persian script on it affixed to the screen bezel). In the end, the Ayatollah Khomeni and the Iranian revolution ended CDC’s hopes in that country. Several of the government ministers, including Prime Minister Amir-Abbas Hoveyda, who had attended the demos back in 1975, were executed. CDC personnel had to evacuate the country, and the company lost a lot of money.
>
> The Venezuela dream didn’t pan out either…
>
> > “Venezuela was more corrupt than Iran, if that was possible…. In South America, the Venezuelans were known as the ‘Iranians of South America’ and not just for their oil reserves. You could get anything you wanted in Caracas— anything. Like many CDC international offices, CDCVEN [the acronym CDC used for its Venezuelan business] had its own guy specializing in local bribery and ours was good.” This was CDC’s fixer for Venezuela, “used for more local practical bribery associated with licenses, permits, getting employees and families out of scrapes, etc.” … “My short version,” Smith once explained in an email, “is the PLATO buy became entangled in Venezuelan politics and did not survive the massive political infighting and jockeying for a bite out of it for all concerned (including two or more of our own guys). I do not believe we lost it because we did not bribe. True there was a corporate public effort to clean up our act (I have seen CDC bribe all over the world— even in places like Germany, supposed to be un-bribable) but HQ never backed off of doing business along those lines (anyway it was very difficult to stop the local CDC folks from making deals HQ did not know about). In a lot of countries it was the only way to do business. When the U.S. government started with pressure on U.S. companies to not bribe they started our downfall in the business world….
>
> Are you a big believer in social impact investing? So was the imperial CEO of CDC:
>
> > Morris tried to explain to [William] Norris the benefits of pursuing business and education markets at the same time— charging more to business customers so they could charge less to education customers— but Norris did not see it this way. “Norris logically could see it that way,” said Morris. “But his concern was, ‘I’m doing this because I want to make a social impact on education. And if you guys go and turn your attention to selling in the business environment, you’re going to start forgetting about education, and start forgetting about our end goal. I want you to concentrate on education. Okay?’ And so based on that, we did concentrate on education, I still think today if we had sold into the business environment we would have been able to fund more of the stuff that was getting the price down and achieving the educational objectives that we were out to achieve.”
> >
> > “Addressing society’s major unmet needs” became Norris’s rallying cry, a remarkably progressive mantra for a tech company in the 1970s and 1980s, and one that the rest of the industry and financial world regarded with befuddlement or derision.
> >
> > In 1984, Randall Rothenberg wrote a profile of Bill Norris and Control Data for Esquire magazine. The article never ran. However, Rothenberg’s recollections of the article’s conclusions shed light on the predicament Norris and CDC were in, particularly with regard to PLATO. “Control Data,” he says, “was an example of what we’d later call industrial policy; its expertise was in seeking government funding for technology projects relating to supercomputing. When the government market for supercomputing for military and economic applications began to dry up (because of, e.g., the advance of minicomputing), CDC, instead of adapting its business model, began to seek new uses within a government welfare structure for its existing supercomputing technology. Using the technology for training, small business development, etc., was a logical extension of this. What CDC could not do was diverge from a model predicated on powerful central control. The whole notion of distributed systems— in computing, in social welfare, in anything else, it seems— was totally foreign to it. So the inapplicability of its technology to the social-welfare aims it was seeking to address was something the company could not work around. Put another way, it had come up with the perfect Great Society solution— twenty years late.”
>
> CDC and PLATO were successful in some markets:
>
> (continues in next comment)
If you found this interesting, check out the book The Perfect Weapon by David E. Sanger.
Stuxnet, Russia's Internet Research Agency, Chinese corporate espionage, ISIS social media campaigns... it's all there.. and it's VERY interesting.
I want to help, but because of lack of time, i will give you an incomplete answer
I have recently written an MSc thesis related to Social Engineering, where i had to review a number of books / papers / articles. One starting point for you would be to start by looking at the reference section of the thesis [here] (http://pure.ltu.se/portal/en/studentthesis/social-engineering-and-influence\(0d61b8aa-30ad-4cb0-9039-e04832f250a7\).html).
In general, anything from Kevin Mitnick is a good start, together with Chris Hadnagy's book
If you are to read only one book, start with Carnegie's book.
If you need more information information, let me know
Here is a great book that can answer a lot of your questions and give you some insight on what you can expect with various certification and paths.
http://www.amazon.com/gp/product/1597490113/ref=oh_details_o01_s00_i01?ie=UTF8&amp;psc=1
Yes and no. A minimal keyspace password is still a problem but I covered that in a previous post. It's up to the engineer and the user to expand on that, not the hash. Or you have to go with lunatic 1s hash stuff which just creates it's own problems as you've pointed out - I believe there's better novel approaches to making sure more entropy is captured from the user.
Quick mention about rainbow tables; The input keyspace of any password is relatively small, which is why rainbow tables on unsalted hashs are the cheapest attack, but once you salt the password, it's impossible to predict where in the expanded hash keyspace the collision will occur, thus the whole keyspace of the hash is relevant.
You'd have to have a rainbow table for every salt (presuming another 1KiB) and for the common keyspace for user passwords. Using xkcd's easy example of 28bits entropy, that's still 8000^28 entries, so (8000^28 )*(10[pw]+1000[key]+1000[salt])bytes aka 3.888 x 10 ^112 bytes - ie. not feasible.
Which brings us back to brute forcing taking longer than the universe is old.
So entropy is the key and bring us back to xkcd... again. Educate users to make better passwords or provide better ways of capturing entropy like patterns, colours, picture (key files) and puzzles.
If you're really into the subject, go read Applied Cryptography. It'll better explain the situation than I! :D
edit: for superscripts going crazy and refocus the point.