Malware: Fighting Malicious Code

A comprehensive guide for defending against viruses, worms, rrotkits and more.

by Ed Skoudis and Lenny Zeltser

Prentice Hall PTR, 2003

ISBN: 0131014056

$44.99 US

Malware: Fighting Malicious Code is the most comprehensive book to date on the subject. The book devotes a full chapter to each type of malware, including viruses, worms, malicious mobile code, backdoors, Trojan horses, user-mode rootkits and kernel rootkits. Each chapter presents the characteristics and methods of attack, evolutionary trends and advice for how to defend against each. In addition, scenarios are presented in which malicious code has been planted in systems and directions are given for how to analyze potential and real malware safely and effectively.

The book focuses both on attacks and defenses. It reveals how attackers install malicious code and evade detection and then explains how to defeat their schemes, secure systems and protect networks from being affected by malware. The book discusses attacks in both Microsoft Windows and UNIX and Linux systems by using examples of recent kernel rootkits.

The book also introduces new ideas and theories, such as the discussions on new attacks to BIOS and Microcode. Here, the authors explain how these attacks are conducted, the results the attackers might be hoping for and how to protect from it. In Chapter 11 for instance, the authors cover reverse engineering. They use a lab setup to dissect malware and discuss some common tools and approaches, then provide a checklist for your own lab. I thought this was a nice feature, especially for people who would like to know more on this subject but are not security experts. This chapter allows them to get some hands-on experience safely in the comfort of their own labs.

The book provides great information for beginners to gain a better understanding but also provides in-depth information for more advanced users. It is well-written and fun to read. The writing style is simple but elegant, allowing readers from different backgrounds to follow the explanations and discussion. The authors have put a lot of effort into making complex topics and concepts understandable, especially with the use of analogies to help explain the difficult sections and scenarios. Malware: Fighting Malicious Code is a must read and an excellent resource.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Malware: Fighting Malicious Code

Anonymous's picture

I'm sure that if the author had written in his introduction : "stop using Windows", he would have had less than 50 pages left to deal with Unix or Linux related malware

Malware: Fighting Malicious Code

Anonymous's picture

Ohhh, very clever! Perhaps you could write a book?

Or, better yet, the introduction should say "Stop using Windows. But, also stop using Linux, Mac OS Classic and X. Use the Newton OS. An old version of Minix, perhaps! NeXTSTEP 3.3 seems pretty clean. That would stop pesky virus and spyware problems quick, and the solution would be a lot more comprehensive than switching to Linux, where by comparison, plenty of malware exists.

Malware: Fighting Malicious Code

ciptension's picture

Hi !
If you want to find out more about Linux Mail server Antiviruses, try www.benchmarks.dmz.ro
Enjoy,

Cipri

Malware: Fighting Malicious Code

Anonymous's picture

Windows and Linux, eh? How much Windows and how little Linux?

Malware: Fighting Malicious Code

Anonymous's picture

That's what I was thinking. I don't want to buy a book that goes on and on about windows, reverting back to Linux every chapter or so.

Webinar
One Click, Universal Protection: Implementing Centralized Security Policies on Linux Systems

As Linux continues to play an ever increasing role in corporate data centers and institutions, ensuring the integrity and protection of these systems must be a priority. With 60% of the world's websites and an increasing share of organization's mission-critical workloads running on Linux, failing to stop malware and other advanced threats on Linux can increasingly impact an organization's reputation and bottom line.

Learn More

Sponsored by Bit9

Webinar
Linux Backup and Recovery Webinar

Most companies incorporate backup procedures for critical data, which can be restored quickly if a loss occurs. However, fewer companies are prepared for catastrophic system failures, in which they lose all data, the entire operating system, applications, settings, patches and more, reducing their system(s) to “bare metal.” After all, before data can be restored to a system, there must be a system to restore it to.

In this one hour webinar, learn how to enhance your existing backup strategies for better disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible bare-metal recovery solution for UNIX and Linux systems.

Learn More

Sponsored by Storix