Review of Black Hat Python by Justin Seitz

This time, up for review is Black Hat Python by Justin Seitz by Justin Seitz (who also wrote Grey Hat Python.)

TL;DR: » 4 out of 5 stars.

Audience

This is not a beginner book. It assumes a lot of basic knowledge about security, networking, and Python. It’s also not an expert’s book as most of the stuff you can find online (if you know where to look). I’d put this book at somewhere inbetween intermediate and advanced. If you have a general idea of computer security, hacking, pen testing, etc and a little knowledge (but aren’t an expert) in Python, you’ll enjoy this book.

The 4 of the 5 stars

It just so happens that I fit the audience for this book pretty well. I’m by no means a security expert, nor do I work in the field (I wish), but I feel like I have a good handle on it. Likewise, although I know Python and could probably ‘get-by’ programming something in it, I don’t use it often enough to feel super comfortable using it.

The book is kind of a large collection of example scripts that you might use while hacking or pen testing. The Python code is at an intermediate level/advanced level and as I mentioned not being very good at Python, I had to look up several references. (Side Note: there are a few syntax typos in the book but nothing that shouldn’t be easy to fix.)

You might think that a book with a bunch of example code is kind of lame because you can just look it up online, but it turns out to be pretty useful. I think one of the hardest parts of programming is figuring out where to start. With these examples, you can copy the code and build on it from there. For example, I’ve actually always wanted to write a sniffer just to see how they work. The book takes you through writing a very simple sniffer that you could easily build on.

Perhaps what I enjoyed most about the book was that it got me excited about writing my own Python code for security tools. I guess you could say that it sort of motivated me or put me in the mindset to want to try doing it on my own instead of using everyone else’s tools!

The missing star

I didn’t think I’d ever say this about a book but I think my overall complaint is the length. It’s too short and there are several areas where the author could have expanded/explained things. For instance, with the Scapy library that it teaches you how to use, I was confused with how the ARP poisoning worked until I figured out that because the hardware src was not an argument to the ARP() class, it was set by default to the machine’s mac address (key to the arp poisoning). I was also confused with the / notation for composing packets until I read the Scapy docs

It’s kind of funny, the book can be a bit bipolar at times. One chapter you’re reading it thinking that this type of knowledge would be good for pen testing. The next chapter, you’re thinking, wow, this is real “bad guy” (Black Hat) stuff that I could rarely see a use for other than devious purposes. I’m glad to see these chapters because near the first of the book I was thinking to myself, is the ‘Black Hat’ title just a ruse to get you interested in the book, or are we actually going to learn real hacking stuff. I would have been happier if the whole book was this way but who knows, maybe the author and/or publishing company would get sued :-p

Thanks to my favorite publishing company in the world (No Starch Press) for providing the book for review!

A new, old book review: Ruby Under a Microscope

I’m porting over my review of Ruby Under a Microscope from Amazon.com (link to the review) because I was in the process of migrating my content from my old blog to this blog and did not have a platform where I could post reviews. Enjoy!

The Review

TL;DR: » This book does an excellent job of explaining the C implementation of Ruby. It’s very well organized and takes you on a step by step journey through Ruby. It’s mainly focused on the C implementation but it does describe other implementations, albeit with not as much detail as I would have liked.

If you’re curious for how things work (like me), you’ll really enjoy this book. The seemingly “magic” things that Ruby does all have a clear and straightforward, step-by-step, explanation.

What I liked:

  • The book is well organized and explains some very complicated topics in a very understandable way.
  • Figures are repeated so you don’t have to flip back and forth (a little thing but very helpful)
  • Has a very computer-science-like feel to it. It’s a fun read if you’re a computer science geek like me.

What I didn’t like:

  • The chapter on JRuby is severely lacking in my opinion. Given that the other chapters did a nice deep dive on the given topic, I felt a little bit cheated on the JRuby chapter. This was more of a really broad overview of JRuby with one or two examples.
  • The book explains a complicated topic in several chapters but you’re left to put everything together on your own. I would have liked to have seen one additional chapter that took a sufficient Ruby program and did a full walk through of all the concepts you’d learned in the previous chapters; basically, a top to bottom overview chapter.

Who can/should read this:

  • Anyone interested in programming languages or implementing your own programming language.
  • Those who want to become better Ruby developers.

Prereqs:

  • You’ll need to know a little bit of C to understand the standard Ruby implementation examples but other than that, there’s no prereqs. You don’t really even need to know Ruby that well ( I don’t ). If you don’t understand what the piece of Ruby code is doing, it’s easy to look up online to quickly figure out what it does.

Book Review: Java Coding Guidelines

I’m back with another book review. This time I’ll be reviewing Java Coding Guidelines by Fred Long, et al. This is sort of the 2nd edition of The CERT Oracle Secure Coding Standard for Java. I had previously done a review on the “1st edition” and was asked to follow up with a review on this latest edition. I must say, I enjoyed this version much more. It’s substantially shorter, better organized, and to the point.

TL;DR » Java has had a bad rap for security lately (particularly around it’s ancient Applet technology).

Read chapter 1 to learn how to become a more secure Java Developer. Read the remaining chapters to learn how to become a better Java developer overall.

About the Book: Audience, Skill Level, Prerequisites

The subtitle for this book is

"75 Recommendations for Reliable and Secure Program."

It’s an accurate description with one chapter on security and the remaining three chapters on reliability. This book is geared towards professional Java developers and goes through many of the idiosyncrasies of Java that you have to watch out for. Some of those idiosyncrasies can lead to catastrophic bugs and vulnerabilities, others may just lead to many hours of annoying-debugging-only-to-find-out-that-you’ve-done-something-really-really-stupid™ ;). I’d recommend that you’ve had experience programming Java for 1 to 2 years before you read this as anything before that and you might not fully grasp the importance of some of the recommendations.

Thoughts on the book

I think a better name for this book would have been, “How to be a Extremely Paranoid, Secure, and Awesome Java Developer.”

This book is all about dotting your i’s and crossing your t’s. Similar to how I mentioned that the previous edition was like Josh Bloch’s Effective Java, this book is all about teaching you how to a be a better Java developer and how to avoid mistakes that only a seasoned Java developer would know. Given that my day job is being a Software Engineer, programing in Java, I plan to hold on to this book at my desk for a couple of reasons. 1. Whenever I need to teach a junior developer about “a bad way of doing things,” I can pull out this book and refer them to an example, along with a compliant solution. 2. I can lend it to junior developers looking to improve and learn more.

Side note: Shout out to the Authors for using Utah (my home state) in their #8 recommendation: Prevent XPath Injection. Come visit and hit the slopes some time ;)

Applicability to Security

Given that the focus of this blog is on computer security, I’ll touch on the security points throughout the book.

Chapter 1 is all about security. Many of the recommendations are general security advice with an example of how they’d apply in Java. There are some interesting recommendations that are more Java specific though.

Recommendation #18: "Do not expose methods that use reduced-security checks to unstrusted code,"

is particularly interesting as this recommendation actually has real applicability. Failure to follow this recommendation resulted in a couple of CVE’s (CVE-2012-4681, CVE-2013-0422).

Outside of the explicit chapter on security, you actually might be amazed at how a seemingly minor bug or action can result in a serious security vulnerability. There are a couple of examples worth mentioning.

Recommendation #46: "Do not serialize direct handles to system resources."

In retrospect, this one seems glaringly obvious, however, I had never given any thought to it. Essentially, if you serialize a Java object, that opens a file, to disk, you can edit the bytes representing the object to change what file is accessed when the file is deserialized. The first thing that comes to mind with this is Minecraft. It’d be interesting to see if anyone has ever leveraged this for exploitation.

The other interesting recommendation is

Recommendation #52: "Avoid in-band error indicators."

At first, this one doesn’t seem like it’s that big of a deal, however, it has resulted in many security vulnerabilities over the years. What it recommends, is to not return values that represent an error, and instead throw an Exception. The reason for this is that calling code often does not check for failing return values resulting in the succeeding code accessing a file or data that may be in an inconsistent state. This type of vulnerability is leftover from the earlier languages like ‘C’ which would return -1 or other negative values to indicate an error.

Conclusion

Overall, great book and easy book to read if you’re familiar with Java. Final rating, 4.5 out of 5. Dustin