Network Forensics: Tracking Hackers Through Cyberspace

by Sherri Davidoff, Jonathan Ham

""This is a must-have work for anybody in information security, digital forensics, or involved with incident handling. As we move away from traditional disk-based analysis into the interconnectivity of the cloud, Sherri and Jonathan have created a framework and roadmap that will act as a seminal work in this developing field."" - Dr. Craig S. Wright (GSE), Asia Pacific Director at Global Institute for Cyber Security + Research. ""It's like a symphony meeting an encyclopedia meeting a spy novel."" -Michael Ford, Corero Network Security On the Internet, every action leaves a mark-in routers, firewalls, web proxies, and within network traffic itself. When a hacker breaks into a bank, or an insider smuggles secrets to a competitor, evidence of the crime is always left behind. Learn to recognize hackers' tracks and uncover network-based evidence in "Network Forensics: Tracking Hackers through Cyberspace."Carve suspicious email attachments from packet captures. Use flow records to track an intruder as he pivots through the network. Analyze a real-world wireless encryption-cracking attack (and then crack the key yourself). Reconstruct a suspect's web surfing history-and cached web pages, too-from a web proxy. Uncover DNS-tunneled traffic. Dissect the Operation Aurora exploit, caught on the wire. Throughout the text, step-by-step case studies guide you through the analysis of network-based evidence. You can download the evidence files from the authors' web site (lmgsecurity.com), and follow along to gain hands-on experience. Hackers leave footprints all across the Internet. Can you find their tracks and solve the case? Pick up "Network Forensics"and find out.

Genres: Technology, Nonfiction, Technical, Programming, Computers, Hackers

577 pages, Kindle Edition

First published May 31, 2012

Reviews

[Mark Galassi · Rating 5 out of 5]

This book is extremely well written. You read it and you get a feeling of clarity and organization within a topic that is really messy and shifting.

To read this you should be aware of a few computer-science-y things first, like knowing what various protocols are, or you might find it too technical. You don't need to be a super-hacker -- just someone who knows as much as a sysadmin should know.

[Takedown · Rating 4 out of 5]

Good book for beginners.

[Mushtaq · Rating 5 out of 5]

Definitely, gets you going on the long and excited path of Network Forensics.

[Jean-François · Rating 5 out of 5]

If you are new to the world of digital forensics, and more specifically network forensics, go no further : this is the book you need. That is provided you have some knowledge of networking.

With a lot of examples and detailed commands, the authors show you how to use opensource tools to dissect a packet capture or a log file to expose the smoking gun. Some of the examples come from the forensics challenges, others from real life.