Malware: Fighting Malicious Code

by Ed Skoudis and Lenny Zeltser

Prentice Hall PTR, 2003

ISBN: 0131014056

$44.99 US

Malware: Fighting Malicious Code is the most comprehensive book to date on the subject. The book devotes a full chapter to each type of malware, including viruses, worms, malicious mobile code, backdoors, Trojan horses, user-mode rootkits and kernel rootkits. Each chapter presents the characteristics and methods of attack, evolutionary trends and advice for how to defend against each. In addition, scenarios are presented in which malicious code has been planted in systems and directions are given for how to analyze potential and real malware safely and effectively.

The book focuses both on attacks and defenses. It reveals how attackers install malicious code and evade detection and then explains how to defeat their schemes, secure systems and protect networks from being affected by malware. The book discusses attacks in both Microsoft Windows and UNIX and Linux systems by using examples of recent kernel rootkits.

The book also introduces new ideas and theories, such as the discussions on new attacks to BIOS and Microcode. Here, the authors explain how these attacks are conducted, the results the attackers might be hoping for and how to protect from it. In Chapter 11 for instance, the authors cover reverse engineering. They use a lab setup to dissect malware and discuss some common tools and approaches, then provide a checklist for your own lab. I thought this was a nice feature, especially for people who would like to know more on this subject but are not security experts. This chapter allows them to get some hands-on experience safely in the comfort of their own labs.

The book provides great information for beginners to gain a better understanding but also provides in-depth information for more advanced users. It is well-written and fun to read. The writing style is simple but elegant, allowing readers from different backgrounds to follow the explanations and discussion. The authors have put a lot of effort into making complex topics and concepts understandable, especially with the use of analogies to help explain the difficult sections and scenarios. Malware: Fighting Malicious Code is a must read and an excellent resource.