PRObooks
Silence on the Wire
On rare occasions, a computer book breaks away from the safe harbor of rehashed subject matter. Instead of writing about the same mainstream topics that countless other professionals have revisited and revised, author Michal Zalewski, a self-taught security researcher, provides an out-of-the-box, thought-provoking book that escapes the everyday standard security practice discussions of firewalls and social engineering. Above all else, Silence on the Wire showcases Zalewski s knack for computing machines, mathematics, and vulnerability identification.
There s a reason this is not a mainstream book. Most of the ideas presented by Zalewski have yet to be developed into real threats. However, as many computer security professionals know, it s only a matter of time before an idea expresses itself into an actual reference implementation that can then mutate into a whole new category of threats. Zalewski stirs up the hornet s nest with several of the alarms he raises, but most would take so much effort that the most effective solution could short-circuit to a blunter conclusion. For example, there was a story in the news about an unfortunate car owner. His car featured biometric locks that could only be disabled with the scan of his thumb. Rather than spending an inordinate amount of time developing a biometric scanning hack, car thieves hacked something else more immediate and accessible: the car owner s thumb. This thought crossed my mind more than once while reading about some of the more obtuse, elaborate schemes that were presented in the book.
Silence on the Wire starts with the keyboard interface and moves through the routers to the topology of the network. For example, the first few chapters consider the problem of pseudorandom number generators (PRNGs) and their security implications with standard I/O. Zalewski cites the 2001 work of Dawn Xiaodong Song, David Wagner, and Xuqing Tian and their research on the timing analysis of keystrokes and timing attacks on SSH, placing these findings into a greater context of future security threats by merely sniffing electrical pulses emitted from pressed keys. Another example of this electronic pulse collection and analysis idea is the consideration of electromagnetic radiation (EMR) combined with the Transient Electromagnetic Pulse Emanation Standard (TEMPEST). This idea captures information displayed on screen via a highly sensitive radio that picks up the EMR signatures for later playback and interpretation. Other electronic indicators such as Quadrature Amplitude Modulation (QAM) and the blinking pattern of light emitting diodes (LEDs) on a hub or router make their way into the book, as well.
Part III branches out to the wild, wild Internet. Readers already concerned about the insecurity on the information superhighway will be downright paranoid after reading about passive fingerprinting and the so-called randomness that once graphed out don t look so random after all. Each chapter closes with a Food for Thought section that evolves the main ideas into scenarios that posit how such ideas could be used in the future.
Silence on the Wire also provides a glimpse of what s next in the increasingly sophisticated battle of security practices and unauthorized data capture countermeasures. This is the stuff of spy novels and CIA and NSA legend. In fact, one has to wonder about the number of concepts offered in the book that the NSA has already matured, or if perhaps the author had in fact smuggled some of the more clever and/or way-out ideas from those very agencies and shared them with us mere mortals.
Mike Riley
Rating:
Title: Silence on the Wire: a Field Guide to Passive Reconnaissance and Indirect Attacks
Author: Michal Zalewski
Publisher: No Starch Press
ISBN: 1-59327-046-1
Web Site: http://www.nostarch.com/frameset.php?startat=silence
Price: US$39.95
Page Count: 312 pages
