Internet Forensics Paperback – Oct 17 2005
|New from||Used from|
Customers Who Bought This Item Also Bought
No Kindle device required. Download one of the Free Kindle apps to start reading Kindle books on your smartphone, tablet, and computer.
To get the free app, enter your mobile phone number.
""Internet Forensics" compiles a lot of information that has typically been available only by word of mouth or bitter experience. The average user will find themselves able to apply its techniques, and even if they choose not to, they will gain a deep understanding of how the Internet works. The book's clear style and firm grounding in reality make it an excellent read." - Gavin Inglis, news@UK, June 2006
Using Digital Evidence to Solve Computer CrimeSee all Product Description
Most Helpful Customer Reviews on Amazon.com (beta)
You won't become a security expert reading this book but It's an interesting and educational read for someone with some technical background who would like a surface level introductory. For me, this was a pleasure/entertainment read and I wasn't looking to use it as the basis for a career as a security expert.
I do like that the author provides real examples that you can try out yourself to explore further.
Sadly, Internet Forensics is not an exception to this rule. While I like this book more than some of the other recent O'Reilly security books, that isn't saying much. We've come to expect clear, authoritative books or inspired tricks and tips type martial from O'Reilly's authors, and instead we're given unfocused, incomplete pages.
To be fair, the topic of Internet Forensics is broad, not very well focused, and no one has written a good book on the subject. It's coming into the foreground, especially in this past year, as threat analysis has become popular. This is a new, wide open field, covering a broad range of malware, spam, phishing, and malicious website analysis coupled to tracking the origin and leading to takedown of the materials. However, this book doesn't really do a good job of much of that. And, at the end of 2006, some of the material feels positively quaint (even though it came out in late 2005). Although the author has defined his target audience in the introduction (infosec professionals, and software developers and IT operations people), I don't think they're well served with this offering.
Chapter 1, an introduction to the book, is short and scattershot. Nothing promised in the preface is really delivered (no overview of spam, phishing, or other threats). Instead, it's just some writing with little focus. This tone carries throughout the book. Chapter 2 covers the basics of IP addressing (what the heck?! if you don't assume your readership knows this, they're in the wrong place), and then talks about DNS lookups with dig and whois. The people reading this should know how to use these tools already, where are the suggested requirements for the reader? Sadly, no tips on disambiguating whois results (p 22) are given, not an unexpected finding in this book. And we start with the inefficient Perl scripts, too. All in all, we're not off to a good start.
Chapter 3 covers email, and sadly we waste time on the basics of email headers, and then go into making very good use of them. The coverage here is inconsistent and again, unfocused. By the time you finish chapter three with "is it really spam?", you're left wondering what the heck the author wanted you to learn. Chapter 4 is slightly better, focusing on on URL obfuscation. Sadly, none of the techniques given really hold up all that well any more. Again, we start with some basics and try and get somewhere, but along the way we're distracted and we've never really gotten a good sense of what's the objective.
Chapter 5 on websites tries to cover some ground, but again, it's too unfocused. We talk about mirroring a site (why "wget -r" isn't listed, which is a common way of getting a malicious phishing site or directory, I don't know) and we even talk about SQL injection, but I don't know what the author is really after. It feels like random observations thrown in with no overall goals. Chapter 6 talks about web servers, and we talk about headers and redirection, and then delve into Netcraft stats (why?) and honestly I'm not clear what was useful here. This felt more like introductory material than anything useful. If the readers are infosec professionals, they should know what a web server header looks like and how to properly fingerprint the server.
Chapter 7 is the complement to that, and talks about your browser. Again, some useful info, but it's incomplete. No real discussions about why you want to alter things other than some basic concepts. Chapter 8 talks about file contents, and there's some interesting basics on examining Word docs (track changes, strings, etc) but aside from some basics, there's not much great there. Sadly, no discussions on how to un-redact a PDF are given, just that it's been a problem.
Chapter 9, which is a nice departure from solid technical materials, comes up short. It's incomplete and disappointing. Chapter 10 talks about pattern detection and signature creation, but again, this could have been beefier.
Chapter 11, "case studies", is OK, but some better treatment to tie the lessons learned (or hopefully imparted) would have been nice. Finally, Chapter 12, "taking action", isn't very useful. No real great info or insight is here, and if you think that you'll be calling police departments about every phishing site, you're in for a sad wake up call -- there's just no way you can do that. One of the comments made in this chapter, specifically wanting to see a community response, tells me that the author (Jones) isn't well connected to the community that actually does track and respond to these threats.
Internet Forensics is a poor attempt at this broad subject. While I appreciate the scope of what the author is trying to do, the execution is weak and suffers from a lack of focus or discipline. A book twice this size covering a fraction of the material, well executed, would have been a better offering. If you feel you must get this book, make sure you get it at a steep discount.
Contents: Introduction; Names and Numbers; Email; Obfuscation; Web Sites; Web Servers; Web Browsers; File Contents; People and Places; Patterns of Activity; Case Studies; Taking Actions; Index
Unlike some of the internet security books I've read and reviewed, this one is actually understandable by those who aren't full-time network administration geeks. Jones examines the subject of tracking down computer crime (phishing, spam, etc.) by using forensic techniques to narrow down potential culprits. This isn't to say that there's a "follow these steps and nail the spammer" recipe that can be applied in all cases. Too many things can be forged, and spammers (in some cases) are pretty adept at hiding their tracks. But by learning how to read email headers, domain registrations, and patterns, you can learn more than you might expect. The nice thing about this book is that the information is explained in a clear fashion that doesn't rely on years of experience to follow. His explanation of mail headers and how to interpret them might be the first time I've ever actually understood what was going on. He also switches the view on some subjects (like web browsers) to help you understand how to better hide your own tracks to prevent others from finding out information about you. And if you're trying to track down someone who's abusing your site, hiding your own tracks might be critical in not causing him (or her) to bolt...
Important information, and extremely practical. I guarantee you'll walk away with a couple things immediately that you can use, and over the long haul the book will more than pay for itself...
By Robert Jones
ISBN 10: 0-596-10006-X | ISBN 13: 9780596100063
Very nice. This book covers various interconnected internet security issues including email forensics, the inner workings of SMTP, spam, phishing, hacked spam-bot servers, proxy servers, anonymous surfing, and DNS. This is a relatively easy read considering the topics and the book is generally written in such a way as to tie all the topics together into a cohesive analysis. This was helpful since real-world situation never involve only one of these technologies but instead require a progression. The book discusses both theory and practical application.
I found the information helpful and would like to see the next edition cover each topic with more depth. Also I would like to see more variation of the email topics. For example, a section on Outlook/Exchange specific emails, IMAP protocol emails, etc. could be useful. There were some sections that would benefit from more examples as well. For instance, a section on how to dissect Microsoft Outlook formatted emails using Cygwin or Linux would have been a nice edition.
I definitely recommend it and enjoyed studying the contents.
- Very good advice for both professional in the computer security field, hobbyist, and those concerned with personal computer security.
- Focus is on practical advice and examples
Look for similar items by category
- Books > Computers & Technology > Computer Science
- Books > Computers & Technology > History & Culture > Privacy
- Books > Computers & Technology > Internet & Social Media > Hacking
- Books > Computers & Technology > Networking & Cloud Computing > Internet, Groupware, & Telecommunications
- Books > Computers & Technology > Security & Encryption > Forensics
- Books > Computers & Technology > Security & Encryption > Privacy & Online Safety
- Books > Politics & Social Sciences > Crime & Criminals > Criminology
- Books > Textbooks > Computer Science & Information Systems > Computer Science