Security - How Can you Learn Internet Self-Defense?

notacracker asks: "A friend and I are trying to learn about network security. I figure it would be more fun if we set up a two machine local area network, and practiced breaking in and detecting break-ins. But where to start ? It's easy enough to find a cookbook (eg O'Reilly) on security, but where is the equivalent to an O'Reilly book on cracking and actively defending a system? It sounds like someone has been toying with this idea over at ZDNet as well. You might want to check out their free-for-all hackfest on OpenHack.com (thanks to Tarsi for the link).

Network Intrusion Detection : An Analysis Handbook

[lw54]

I highly recommend Network Intrusion Detection : An Analysis Handbook. It has been reviewed on slashdot [slashdot.org] too. I have a lot of respect for Stephen Northcutt and his book is extrememly easy to read with lots of case studies.

I highly recommend this book. I enjoyed every minute of it and I feel that people can get a lot out of this book no matter what their security knowledge is.

Re:Network Intrusion Detection : An Analysis Handb

[lw54]

Here's the Amazon.com reviews [amazon.com] too. :-)

Run Portsentry too.

[Wakko Warner]

It'll detect any sort of IP scanning, and, if you're a real bastard, it'll run counter-attacks against the attackers/port scanners.

Build yourself up a large arsenal of "eleet script kiddie" programs (jolt, jolt2, teardrop, winnuke, all of the thousand or so Wu-Ftpd exploits) and play around with them, to see just how vulnerable your machines are.

Subscribe to Bugtraq and read it voraciously.

- A.P.
--

"One World, one Web, one Program" - Microsoft promotional ad

hacker pages.

[crovax]

L0pht Heavy Industries [lopht.com]
Cult of the dead cow [cultdeadcow.com]
Happyhacker.org [happyhacker.org]
Infiltration.org [infiltration.org]
hackers.com [hackers.com]
Hacker news [hackernews.com]
attrition.org [attrition.org]
AntiOnline [antionline.com]
AntiCode [anticode.com]
phrack [phrack.com]
2600 [2600.com]
Many of these pages contain arhives that have documents on cracking networks and such.
Vast documents on cracking NT servers.
A few of these are not really related but fun any how.
And the archives also contain many documents on system defence.
-----
If my facts are wrong then tell me. I don't mind.

Maximum Security (SAMS)

[barbaBob]

I've got 'Maximum Security : A hacker's guide to protecting your internet site and network' which is a pretty good book. Published by SAMS, and thicker than the NT Workstation Resource Kit ;)

Highly recommended; the 'Cracked!' series of features from rootprompt.org [rootpromt.org]. Look in the 'Features' sidebar.

bBob

--

Inoshiro at Kuro5hin

[Pseudonymus Bosch]

Inoshiro [kuro5hin.org] publishes a series on practical Linux security at Kuro5hin.
__

From one beginner to another...

[Udon Nomee]

I was fortunate enough to attend the "Hacking Exposed:Live!" [usenix.org] tutorial at Usenix2000 [usenix.org] in San Diego, Ca. 3 weeks ago and can recommend "Hacking Exposed:" [hackingexposed.com](McClure,Cambray & Kurtz,Osborne/Mcgraw-Hill, $39.99 ). My prior network security experience consisted of copying IPCHAINS scripts to rc.firewall, yet I had no problem understanding the material or applying the suggested counter measures. I have since purchased the book and found it even more informative and thorough.

You may also find SecurityFocus.com [securityfocus.com] useful.

Another Book

[Digital Mage]

Take a look at Hacking Exposed by Stuart McClure, Joel Scambray and George Kurtz. It is similar to the Maximum Security books but is a little more descriptive about how an attack takes place.

Read, read, read

[Miniluv]

This is a growing hobby of mine as well. I've found that the best way to learn is read...I read both sides of the fence with equal eagerness, because as people have said, most notably Mudge(l0pht), learning to attack is the key to learning to defend. When constructing defences you must think about who and what you're defending against, and get inside their head. I frequent Security Focus [securityfocus.com], White Hats [whitehats.com] which is home to arachNID and anything else I can find linked, etc. Tools like Nmap, Nessus, Snort, tripwire, and the assorted "3l337" toolkits are incredibly useful. O'Reilly's Building Internet Firewalls is a good reference for when you get into a production environment, but it's tough to implement with only a few computers.

Where I am

[matman]

Well, so far, I've read Northcut's "Network Intrusion Detection: An Analysts Handbook" and I found it good, but fairly focused on Intrusion Detection - hence the title.

I think that first its very important to have a good grasp of all network operations. This is for a number of reasons - basically, if you dont know what's normal, you dont know what's not. There are also a lot of vulnerabilities that arrise out of a combination of configurations, etc. These really require a good grip on the technologies to be able to forcast.

To be a really good security person requires a lot of experience as an administrator. To me, it's either management, or security after system administration.

insecure.org, Re:[Cr]acker pages

[TheMeister]

Fyodar's exploit world [insecure.org] has a good collection of scanners, articles, and known exploits (if that's what you want).

Word of advice though, don't ask about the back doors in the various Quakes (here [insecure.org] and here [insecure.org]) during interviews on /. unless you've got Karma to spare . . . ouch.

It's mostly a conglomerate of different sources, but a number of the articles are kinda interesting. Keeping up with CERT [cert.org] advisories would probably be better for self defense though (always good to know what they do though). The scanners are pretty good, especially if your, um, on the "testing" end and the the detection end . . .

Ummm...

[0verl0rd]

From what I have heard on #2600, "Hacking Exposed" sucked...

Re:Network Intrusion Detection : An Analysis Handb

[lw54]

Tier