Hacking Exposed Windows: Microsoft Windows Security Secre... and over one million other books are available for Amazon Kindle. Learn more

Vous voulez voir cette page en français ? Cliquez ici.


or
Sign in to turn on 1-Click ordering.
or
Amazon Prime Free Trial required. Sign up when you check out. Learn More
More Buying Choices
Have one to sell? Sell yours here
Start reading Hacking Exposed Windows on your Kindle in under a minute.

Don't have a Kindle? Get your Kindle here, or download a FREE Kindle Reading App.

Hacking Exposed Windows: Microsoft Windows Security Secrets and Solutions, Third Edition [Paperback]

Joel Scambray

List Price: CDN$ 62.95
Price: CDN$ 39.66 & FREE Shipping. Details
You Save: CDN$ 23.29 (37%)
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o
Only 1 left in stock (more on the way).
Ships from and sold by Amazon.ca. Gift-wrap available.
Want it delivered Tuesday, September 23? Choose One-Day Shipping at checkout.

Formats

Amazon Price New from Used from
Kindle Edition CDN $33.60  
Paperback CDN $39.66  
Save Up to 90% on Textbooks
Hit the books in Amazon.ca's Textbook Store and save up to 90% on used textbooks and 35% on new textbooks. Learn more.
Join Amazon Student in Canada


Book Description

Dec 25 2007 007149426X 978-0071494267 3

The latest Windows security attack and defense strategies

"Securing Windows begins with reading this book." --James Costello (CISSP) IT Security Specialist, Honeywell

Meet the challenges of Windows security with the exclusive Hacking Exposed "attack-countermeasure" approach. Learn how real-world malicious hackers conduct reconnaissance of targets and then exploit common misconfigurations and software flaws on both clients and servers. See leading-edge exploitation techniques demonstrated, and learn how the latest countermeasures in Windows XP, Vista, and Server 2003/2008 can mitigate these attacks. Get practical advice based on the authors' and contributors' many years as security professionals hired to break into the world's largest IT infrastructures. Dramatically improve the security of Microsoft technology deployments of all sizes when you learn to:

  • Establish business relevance and context for security by highlighting real-world risks
  • Take a tour of the Windows security architecture from the hacker's perspective, exposing old and new vulnerabilities that can easily be avoided
  • Understand how hackers use reconnaissance techniques such as footprinting, scanning, banner grabbing, DNS queries, and Google searches to locate vulnerable Windows systems
  • Learn how information is extracted anonymously from Windows using simple NetBIOS, SMB, MSRPC, SNMP, and Active Directory enumeration techniques
  • Prevent the latest remote network exploits such as password grinding via WMI and Terminal Server, passive Kerberos logon sniffing, rogue server/man-in-the-middle attacks, and cracking vulnerable services
  • See up close how professional hackers reverse engineer and develop new Windows exploits
  • Identify and eliminate rootkits, malware, and stealth software
  • Fortify SQL Server against external and insider attacks
  • Harden your clients and users against the latest e-mail phishing, spyware, adware, and Internet Explorer threats
  • Deploy and configure the latest Windows security countermeasures, including BitLocker, Integrity Levels, User Account Control, the updated Windows Firewall, Group Policy, Vista Service Refactoring/Hardening, SafeSEH, GS, DEP, Patchguard, and Address Space Layout Randomization

Special Offers and Product Promotions

  • Join Amazon Student in Canada


Customers Who Bought This Item Also Bought


Product Details


Product Description

About the Author

Joel Scambray, CISSP, is Chief Strategy Officer at Leviathan Security Group (leviathansecurity.com). His nearly 15 years of information security experience encompasses roles as a corporate leader (senior management positions at Microsoft and Ernst & Young), entrepreneur (co-founder of Foundstone), successful technical consultant for Fortune 500 firms, and internationally recognized speaker and author of multiple security books, including all five editions of Hacking Exposed: Network Security Secrets & Solutions.

Stuart McClure, CISSP, an independent computer security consultant, is one of today's leading authorities on information security. He was SVP of Global Threats and Research for McAfee where he led an elite global security team fighting the most vicious cyber attacks ever seen. Stuart is the coauthor of multiple security books, including all five editions of Hacking Exposed: Network Security Secrets & Solutions.


Inside This Book (Learn More)
Browse Sample Pages
Front Cover | Copyright | Table of Contents | Excerpt | Index
Search inside this book:

Customer Reviews

There are no customer reviews yet on Amazon.ca
5 star
4 star
3 star
2 star
1 star
Most Helpful Customer Reviews on Amazon.com (beta)
Amazon.com: 3.8 out of 5 stars  8 reviews
12 of 12 people found the following review helpful
4.0 out of 5 stars Not bad for the 3rd iteration Feb. 22 2008
By Chris Gates - Published on Amazon.com
Format:Paperback
Disclaimer: I received a review copy of HE:Windows.

The latest HE:Windows takes us toe to toe with Vista and Server 2008 and gives us a recap of some Win2k3 and Win2k knowledge. I was torn between whether to give this book three or four stars. I ended up giving it a four because it was well written, hit the majority objectives it laid out, and would be useful for someone that didn't have the two previous iterations, if you have the other two keep in mind there is a fair amount of content reuse and if you do this for a living, it may come up short of expectations.

The book covers a lot of ground but at the end I was left feeling like the authors were saying that if I was pentesting a Vista host or Server 2008 host/domain I should just call it quits. Going back and rereading a bit of the HE: Windows Server 2003 book I felt they said the same thing in that book as well. This obviously ended up being not the case, and I don't think will be the case with Vista and Server 2008 either. Its also not a viable option for any penetration tester.

Some examples of what I am talking about can be seen in Chapter 4 where the SMB enumeration examples only work against Windows 2000 and maybe Windows XP SP1. No mention of how to actually start pulling that information out from current environments. The Active Directory section reused the old content and made no discussion of any current tools or changes in 2003 environments and 2008 environments which have pretty much eliminated anonymous binds to extract information. Chapter 5, Hacking Windows Specific Services reused a lot of content which was disappointing, especially disappointing was the reuse of the smbrelay content, especially with tools that work much better like the smbrelay module in the metasploit framework.

The rootkit chapter is pretty good and talks about a rootkit I had never heard of (Unreal rootkit)..

Client side attacks has a decent update to it covering phishing, ActiveX, office and pdf exploits and a bit of cross site scripting, but refers you to the HE Web Applications book for more detail, which is fair.

Physical Attacks section is mostly the same with some updates on wireless, keyloggers and bootkits but mostly just overviews not followable steps.

Ch12 windows security features and tools is probably what pushed the book from a 3 to a 4. It covered bitlocker, Vista Windows integrity control, server hardening, stack protections, and others information.
2 of 2 people found the following review helpful
4.0 out of 5 stars Worth the upgrade from Hacking Exposed: Windows Server 2003 July 2 2009
By Richard Bejtlich - Published on Amazon.com
Format:Paperback
I've been reading and reviewing Hacking Exposed (HE) books since 1999, and I reviewed the two previous Windows books. Hacking Exposed: Windows, 3rd Ed (HEW3E) is an excellent addition to the HE series. I agree with Chris Gates' review, but I'd like to add a few of my own points. The bottom line is that if you need a solid book on Windows technologies and how to attack and defend them, HEW3E is the right resource.

It has been fashionable for the last six or seven years for supposedly "elite" security people to laugh at HE books. Sure, the books don't teach you how to find zero-day vulnerabilities or write new exploits. The strength of the HE series is in its approach. HE books teach you about core Windows security technologies in a manner that you usually can't find elsewhere. Then the authors explain how to attack those technologies, as a penetration tester might. Finally they conclude with recommended countermeasures, as available. You can't ask for more in a security book: how it works, how to break it, how to fix it. There's something for everyone -- admin, red team, blue team.

My personal favorite sections included Ch 5: Hacking Windows-Specific Services, Ch 7: Post-Exploit Pillaging, and Ch 8: Achieving Stealth and Maintaining Presence. I didn't think Ch 6: Discovering and Exploiting Windows Vulnerabilities was very strong. I was disappointed by Ch 10: Hacking Microsoft Client Apps. Client-side attacks have been the dominant security problem for enterprise security teams for the last five years. You could probably write a whole book titled Hacking Exposed: Client-Side or similar! If/when the authors decide to write a 4th Ed, I'd like to see more coverage of client-side apps, like Adobe Acrobat, Microsoft Office, and the like.

Overall I strongly recommend reading HEW3E. It's not a five star book but you will learn a lot reading it. The target audience includes security-conscious admins, those who try to attack Windows systems, and those who defend them.
1 of 1 people found the following review helpful
1.0 out of 5 stars avoid this (and other such) nonsense June 14 2014
By Bruce D. Wilner - Published on Amazon.com
Format:Paperback
This book and its ilk offer precious little of any value. Of course, the book is very fat, but much of that volume can be attributed to (a) reviewing background material that has precious little to do with "hacking," whatever that might mean in the authors' stultified world view; and (b) the fact that, wherever two lines of code would suffice to illustrate a point, the authors instead to choose page-filling screen shots of nonsensical Windows tools that, ultimately, and I do mean ULTIMATELY, offer those two lines--if you succeed in hunting them down.

I earned my CISSP thirteen years ago, when it actually meant something, although the exam was--to be blunt--TRIVIAL compared to a challenging exam such as the CCP. This was before the Department of Defense legislated away the Orange Book and its associated core of intellectually vital output from leading researchers, choosing instead to buckle to the pressure of Microsoft and such (hey, they are, after all, in bed with them: one sees Microsoft Windows on even the OJCS's desktops).

Yes, modern security practitioners know a whole lot about computer and network security. That's why, almost weekly, we hear on the news about how the latest retail chain was hacked and N hundred thousand or K million credit card numbers were compromised. Your latest coterie of "CISSPs" will rush to babble about encryption, although encryption was never more than a Band-Aid approach, and the ease of stealing the keys is never mentioned. These keys live--guess where--in disk files that are no safer than the disk-file-resident ciphertext with which they are associated, but your Johnny-come-lately CISSPs, who have no experience with professional operating systems, have zero understanding of the underlying mechanisms and architectural strictures that make SECURE systems secure.

It makes one incredibly angry. Do you remember when some Russian group commandeered iPhones from afar? Yes, the iPhone comes out of the box with no identification and authentication mechanism, so Joe Anybody from across the globe enjoys the same privileges as the physical owner of the box. But, of course, security is "of vital importance" to Apple and Google and their ilk. S-U-U-U-U-R-E it is . . . I remember when I interviewed at Microsoft many years ago, before the genie was out of the bottle. Although nearly everyone enjoyed the freedom of a luxurious office, their current "security guru" was some clown in a cubicle who had the UNIX file permission algorithm PDL (yes, all six lines of it) displayed on his wall as if it were gospel--and as if a rhesus monkey couldn't memorize it.

Given the academic and experiential basis from which the authors proceed, one can almost feel pity for them rather than revulsion. But I did say ALMOST. The book is garbage because the material is nonsense. One can find any number of textbooks about, say, UNIX, offering spellbindingly accurate, broad, and deep coverage of this and that. But, look for "the Bible" on Windows security, and all you will EVER succeed in finding is a few vague mentions here and there, along with statements that the mechanisms are "in flux" or "difficult to understand," or other excuses that might fool a grade-schooler. Christ, they can't even get the terminology correct: an audit "profile" (as one might reasonably term it) attached to a file system object is called the "system access control list" or other such nonsense.

Even more pathetic than the content is the packaging--"Hacking Exposed," as if they're offering the keys to the kingdom. They're offering vague, quasi-applicable, extremely intermediate-level nonsense.
5.0 out of 5 stars Must have book! Feb. 23 2008
By Amazon Customer - Published on Amazon.com
Format:Paperback
This is a must-have book for anyone who works with Windows clients or servers as a part of their job. It gives a lot of detail, both on what security issues Windows security administrators face, as well as guidance on how to mitigate risks regarding Windows security. The checklists in the back of the book alone are worth keeping as a baseline lockdown policy.
5.0 out of 5 stars Five Stars July 28 2014
By Young Kim - Published on Amazon.com
Format:Paperback
I love it

Look for similar items by category


Feedback