Botnets: The Killer Web Applications

The book begins with real world cases of botnet attacks to underscore the need for action. Next the book will explain botnet fundamentals using real world examples. These chapters will cover what they are, how they operate, and the environment and technology that makes them possible. The following chapters will analyze botnets for opportunities to detect, track, and remove them. Then the book will describe intelligence gathering efforts and results obtained to date. Public domain tools like OurMon, developed by Jim Binkley of Portland State University, will be described in detail along with discussions of other tools and resources that are useful in the fight against Botnets.

* This is the first book to explain the newest internet threat - Botnets, zombie armies, bot herders, what is being done, and what you can do to protect your enterprise
* Botnets are the most complicated and difficult threat the hacker world has unleashed - read how to protect yourself

User review
Needs something more
Although containing some valuable nuggets on Botnets and providing a general overview of the threat, the book left me wanting more. The organization of some topics and the treatment of others felt disorganized and lacking the robustness I was looking for. Although interesting, filling up 3 ½ chapters of a 12 chapter book on Ourmon was a bit much as well. Things could have been condensed and edited better which I think would have brought forth the authors intentions more clearly.




User review
A few good chapters surrounded by weak material
I am wary of Syngress books that consist of a collection of contributions. The quality of the books usually decreases as the number of authors increases. Botnets is no exception, unfortunately. You will probably enjoy chapters by Gadi Evron (Ch 3, Alternative Botnet C&Cs) and Carsten Willems (Ch 10, Using Sandbox Tools for Botnets). I was initially interested in the book because of chapters on Ourmon (Chs 6-9, by Jim Binkley, tool developer). That leaves half the book not worth reading.

Botnets suffers extensively from nonexistent editing. It's clear the authors wrote the text and figures, submitted them to Syngress, and finished their involvement in production. There was clearly no copy or proof editing in this process. Right from the start, Fig 1.1 on p 6 demonstrates the sort of presentation I would expect of a 6th grader. I thought Fig 1.2 on p 18 was an even bigger joke until I read `New Bot Rallys [sic] to let Botherder Know It's [sic] Joined The Team` in Fig 2.1 on p 36. The main text is often as lame as these diagrams, with questions like `How much is the Microsoft bounty for virus authors and how do I get me some?` When the book isn't frustrating readers with poor English, it's repeating sections like the Ancheta and Maxwell cases from Ch 1 reappearing in Ch 2, or yet another `bot overview` in Ch 4 repeating ideas from Ch 1. Are readers expected to pay for this sort of shoddy, unprofessional material?

On the positive side, I thought the chapters on Ourmon were decent. Since Botnets is the only book to cover this useful application, you might want to check them out. I thought Gadi Evron's section, probably written in late 2006 or early 2007, did a good job predicting what actually happened in botnet command and control (specifically with respect to FTP). The CWSandbox chapter was a real surprise, and I think it's the best part of the book. A different publisher might consider given Carsten Willems his own book deal.

Finally, no author should ever post a five star review of his own book on this Web site. I subtracted one star from this review after seeing the lead author give his own book a first review of five stars. That is really disappointing and completely unnecessary.

User review
Understanding BotNets.
Working in the security arena for sometime, this is a must for those of us that wants to understand the underground aspects of BotNet. Good reference for your security library.ed

User review
Buy the book the hackers are already stealing!
The book must be good. Hackers are stealing electronic copies of the book by the droves.

If you are a IT type that needs to come up to speed about botnets quickly, as well as find out what tools and resources are available, this book's for you. If you are a manager that needs to know what the techies are talking about regarding bots, this book's for you. If you are in tech media and need a crash course, this book's for you.

The overviews in chapters 1 and 2 are intended as a presentation resource for management and awareness presentations. They should also help techs understand the big picture.

Chapter 10 on the CWSandbox is so good, the vendor for CWSandbox (Sunbelt Software) is now including it with each copy of CWSandbox they sell.

Chapters 6-9 provide an in-depth discussion of techniques to detect botnets using network traffic analysis as used in the open source ourmon tool. Network security types will probably get the most out of chapters 3, and 5-11.

Chapter 4 was intended as a reference on bot families and capabilities. The material isn't new but it is gathered in one place (with permission) for ease of reference.

If you want to begin analyzing the bot phenomena to formulate potential response strategies, this book is a good starting point. You'll like chapter 12, especially like the adaptation of the Financial Services Technology Consortium (FSTC) Phishing Solutions Categories to the botnet problem.

There are quality issues as noted in the previous reviewer but the authors felt an urgency to get information out as quickly as possible. I hope you enjoy it!

User review
A dissapointment.
To put it bluntly: this book looks like it was written by a high-schooler. The English is simply atrocious, with bad sentence structure, inconsistent use of the past tense, unreferenced demarcation of time,,. it's just plain poor. Take this sample paragraph:

***START QUOTE***
Early in 2002, SDBot appeared. It was written by a Russian programmer
known as sd. SDBot is a major step up the evolutionary chain for bots. It was
written in C++. More important to the evolution of botnet technology, the
author released the source code, published a Web page, and provided e-mail
and ICQ contact information.This made it accessible to many hackers. It was
also easy to modify and maintain. As a result, many subsequent bot clients
include code or concepts from SDBot.
***END QUOTE***

Then there are the pages of useless information. By useless, I mean quoting pages worth of collection files used by Cain. Or pages worth of court documents on a botnet-related settlement. No highlighting of the most relevant bits, or explanations as to how it pertains to the situation.

Oh, and the book also overtly references Wikipedia as it's prime resource of information for a section on botnet history. Not what Wikipedia may cite - but Wikipedia itself. This is not prime textbook material.

This would of course all be forgivable if the book had some good technical information. But it doesn't. Honestly folks, I thought I didn't know that much about botnets. But everything that's in this book, I already knew - with the exception of how to use Ourmon. This book feels more like a rehash of Symantec's information on popular botnet programs than it does a proper technical text.

The book also references papers that were published in January,,.2007. Given that the book is on the shelf already (barely a month later), one really has to wonder how much quality control Syngress Publishing puts into it's products. Yeesh.