10 must-read Books for Developers

I liked the article so reposting it. Hope you will enjoy !!!

Blog site Stackoverflow posed an interesting question: "If you could go back in time and tell yourself to read a specific book at the beginning of your career as a developer, which book would it be?"

The accumulated wisdom of Stackoverflow readers posted over the past three years reads like a who's-who of the programming book industry, but several missing titles caught my eye.

Here's the Stackoverflow list:

"Code Complete" by Steve McConnell (2004)". Tackles every facet of programming, with tons of examples.

"The Pragmatic Programmer" by Andrew Hunt and David Thomas (1999). Concentrates on nitty-gritty real-world approaches to solving problems through code.

"Structure and Interpretation of Computer Programs" (2nd Edition, 1996) "by Harold Abelson, Gerald Sussman, and Julie Sussman. Concentrates on breaking big problems down into little ones, and ensuring the pieces come back to build the whole. The book is available under the Creative Commons Noncommercial License, for free on the Web.

"The C Programming Language" (2nd Edition, 1988) by Brian Kernighan and Dennis Richie. Not only offers the definitive guide to C, but shows you how to program in general. My personal choice for the most important first book.

"Introduction to Algorithms" by Thomas Cormen, Charles Leiserson, Ronald Rivest, and Clifford Stein (2009). Gives fast ways to solve complex problems, using the right data structures. Comprehensive and quintessentially useful.

"Refactoring: Improving the Design of Existing Code" by Martin Fowler, Kent Beck, John Brant, and William Opdyke (1999). Shows you how to rebend a programming pretzel, taking poorly designed code and turning it into something even humans can understand.

"Design Patterns: Elements of Reusable Object-Oriented Software" by Erich Gamma, Richard Helm, Ralph Johnson, and John Vlissides (1994). Serves as a reference of object oriented techniques. I'm surprised to see this on a list of "beginning of your career" books because it's much more suitable for people with a lot of OOP under their belts.

"The Mythical Man-Month" by Frederick Brooks (1995)". A management classic in the finest tradition. While not a programming book, a must-read for every developer.

"The Art of Computer Programming, Volume 1: Fundamental Algorithms" (3rd Edition, 1997) by Donald Knuth. For anyone with a mathematical predilection, Volumes 1 and 3 ("Sorting and Searching") stand out as true bibles of the industry. With Volumes 2 ("Seminumerical Algorithms") and 4A ("Combinatorial Algorithms, Enumeration and Backtracking") published, plans are still in place for Volume 4B ("Graph and Network Algorithms"), Volume 4C (maybe Volumes 4D and 4E, "Optimization and Recursion"), Volume 5 ("Syntactic Algorithms"), Volume 6 ("Context-Free Languages"), and Volume 7 ("Compiler Techniques").

"Compilers: Principles, Techniques and Tools" (2nd Edition, 2006) by Alfred Aho, Monica Lam, Ravi Sethi, and Jeffrey Ullman. The 1,000-page "dragon book" focuses on compilers, but in so doing covers topics every developer should understand.

What's missing? I mentioned Knuth's Volume 3, but several others pop out.

If you veer off the developer-centric track for a moment, many classics would broaden the horizons of any aspiring analyst. "Godel, Escher, Bach" by Douglas Hofstadter (1979) and "Zen and the Art of Motorcycle Maintenance" by Robert Pirsig (1974) always come up as manifestos of the developer class.

Sticking to developing, though, I'm surprised that these didn't make the top 10:

"Clean Code: A Handbook of Agile Software Craftsmanship" by Robert Martin (2008), emphasizes the importance of building code that can be digested, working through lots of real-world examples. It covers some of the same ground as Martin's earlier book, "Agile Software Development," and sets the stage for Martin's new book, "The Clean Coder."

"Code: The Hidden Language of Computer Hardware and Software" by Charles Petzold (2000) should be on the short list of everyone who's involved in the computer industry, developer or not. Petzold covers the basics -- number systems, high-level languages, comm protocols, hardware, GUIs -- and doesn't overwhelm with jargon.

For anyone destined to a corporate IT job, these three should be required reading:

"Patterns of Enterprise Application Architecture" by Martin Fowler (2002) helps corporate developers recognize common patterns in real-world problems, and digs into solution details for each pattern.

"Coders at Work" by Peter Seibel (2009) takes case histories -- which is to say, influential developers' real-life stories -- and weaves them into a powerful view of how 15 of the industry's best and brightest kicked some serious technical butt.

"Peopleware" (2nd edition. 1999)" by Tom DeMarco and Timothy Lister emphasizes the human element in software development and how to put together a project that actually gets work done.

I won't say that list is definitive, but if there's a nascent developer, developer wannabe, or burned-out developer seeking inspiration in your circle of friends, do them a favor and get them one of these books.

This story, "10 must-read books for developers" was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Happy Reading ;-) !!!

SOC Interview Questions 1

Below are the questions collected from friends who attended interviews related to Security Operations Center (SOC).

Difference between Probe vs Scan.
Difference between Security event and Security incident.
Wwhat is incident response (IR)?
How will you carry on Network forensics?
How will you carry on Memory forensics?
What is APT (Advanced Persistent Threat)?
What is IOC (related to APT)?
What is ROT13?
What is C2 (Command and Control)?
Difference between normal threat vs APT ?
Vulnerability vs Threat vs Exploit vs Risk.
Different Evasion techniques of Malware?
Different ways of compressing Malware?
What is threat agent?
Explain drop by downloads.
Difference between Symmetric and Asymmetric encryption?
How do you collect image for Forensics without modifying the integrity of data on the PC/Laptop?
(http://darshanams.blogspot.com/2010/09/forensics-1-extracting-image.html)
Size of Registers in CPU? Are registers same for different CPU's?
How to change Linux root password?

Will come up with more questions once I get in touch with other friends.

Endianness: Different Processors

Endianness refers to the way data is represented in memory by different processors. For details about endianness you can refer
http://en.wikipedia.org/wiki/Endianness

We will run below code on two different CPU architectures, Intel and MIPS
*******Start of Code endi.c ********
#include
#include

int main()
{
        int magiclhtona, magiclntoha, magiclhton1, magiclntoh1, htonli2, htonsi2, ntohli2, ntohsi2, htonli6, htonsi6, ntohli6, ntohsi6;
        magiclhtona = htonl(0xa1b2c3d4);
        magiclntoha = ntohl(0xa1b2c3d4);

        magiclhton1 = htonl(0x1f8b0800);
        magiclntoh1 = ntohl(0x1f8b0800);

        htonli2 = htonl(25);
        htonsi2 = htons(25);
        ntohli2 = ntohl(25);
        ntohsi2 = ntohs(25);

        htonli6 = htonl(65535);
        htonsi6 = htons(65535);
        ntohli6 = ntohl(65535);
        ntohsi6 = ntohs(65535);

        printf("magiclhtona=%p magiclntoha=%p,magiclhton1=%p, magiclntoh1=%p, htonli2=%d htonsi2=%d ntohli2=%d ntohsi2=%d, htonli6=%d, htonsi6=%d, ntohli6=%d, ntohsi6=%d\n", magiclhtona, magiclntoha, magiclhton1, magiclntoh1,htonli2, htonsi2, ntohli2, ntohsi2, htonli6, htonsi6, ntohli6, ntohsi6);
}
    return 0;

*******Endof Code endi.c ********
To understand the output we should know what is he endianness of the Processors we are using
Intel        Little Endian
MIPS     Big Endian

Output on Intel processor
[praveen]# ./endi
magiclhtona=0xd4c3b2a1 magiclntoha=0xd4c3b2a1,magiclhton1=0x88b1f, magiclntoh1=0x88b1f, htonli2=419430400 htonsi2=6400 ntohli2=419430400 ntohsi2=6400, htonli6=-65536, htonsi6=65535, ntohli6=-65536, ntohsi6=65535

Output on MIPS processor
praveen# ./endi
magiclhtona=0xa1b2c3d4 magiclntoha=0xa1b2c3d4,magiclhton1=0x1f8b0800, magiclntoh1=0x1f8b0800, htonli2=25 htonsi2=25 ntohli2=25 ntohsi2=25, htonli6=65535, htonsi6=65535, ntohli6=65535, ntohsi6=65535
praveen#

Modify endi.c source file by adding below code
        int htonli8 = htonl(65538);
        int htonsi8 = htons(65538);
        int ntohli8 = ntohl(65538);
        int ntohsi8 = ntohs(65538);
       printf("htonli8=%d, htonsi8=%d, ntohli8=%d, ntohsi8=%d\n", htonli8, htonsi8, ntohli8, ntohsi8);

Output on Intel Processor
htonli8=33554688, htonsi8=512, ntohli8=33554688, ntohsi8=512

Output on MIPS Processor
htonli8=65538, htonsi8=2, ntohli8=65538, ntohsi8=2

Hope this will help someone somewhere to understand endianness on different Processors.

Building Binary from multiple C files: Using custom header, accessing variables across multiple .c files

One of my friend requested me to add basic stuff related to C programming. Initially when I started coding I was skeptical using custom header files, using same variable in different .c files and building binary from multiple C files. This post probably clears all those doubts.

Below shapshot shows content in header file (praveen.h) and code in different C files (sharedvar1.c, sharedvar2.c).

Below snapshot shows how to compile multiple C files to create a single binary and also output of the program.

Also we have learned how to access single variable across multiple files.

Hope this might have helped from someone somewhere :) !!!

Malicious PDF: Portable Document Files Compresion/Encoding/Obfuscation

Malicious PDF's has increased manifold which are used to infect computers with Malware of execute code when PDF files are opened. We will see various ways how javascript embedded within PDF's can be compressed or encoded to evade detection by IDS/IPS and Anti Virus. Normally many PDF Parsers crash while analyzing the malicious/malformed file but Adobe reader successfully opens the file which leads to infection.

Below is the malicious PDF file viewed in text editor.

PDF Parsers might have issues in analyzing following abnormal files:

1. Portable Document File Format does not strictly abide to its specification.

2. PDF Version might be malformed (NULL value, incomplete value etc) (can see in above pic)

3. May not contain endobj or endstream (atleast one string should be present within an object)

4. May not contain xref table

5. Names may be Encoded (/JavaScript as /J#61vaScript).

6. No %%EOF header

7. There might be multiple %%EOF headers or trailer’s  indicating incremental updates.

8. PDF embedded within other PDF (same object numbers in a single file).

9. Different types of Evasions/ Encoding can be found at

   http://blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/

Different Encoding/Compressions Filter types are

/FlateDecode

/ASCIIHexDecode

/ASCII85Decode

/JBIG2Decode

/LZWDecode

/RunLengthDecode

/SCIIHexDecode, 

/CCITTFaxDecode

/DCTDecode

/JPXDecode

This might not be the full list of Filters (not sure) .

Below snapshot shows highly obfuscated  PDF file

Good articles related to PDF's can be found at

http://blog.didierstevens.com/category/pdf/
http://www.decalage.info/file_formats_security/pdf

http://code.google.com/p/corkami/wiki/PDFTricks

For quick analysis of a PDF file you can upload to
http://wepawet.cs.ucsb.edu/

Live malicious PDF files can be found at
http://filex.jeek.org/archive_PDF.zip
Please do not open files in the archive with any of the PDF readers.

Comments are most welcome :) !!!

Message Queues- An Introduction

Processes can exchange messages using Message Queues. Sending process message is saved in a queue, Receiving process reads the message from queue.

Below program sends message to queue.

Below snapshot is the code for receiving process which reads message from queue.

Compiling msg_snd.c:

#gcc msg_snd.c -o msg_snd

Compiling msg_recv.c:

#gcc msg_recv.c -o msg_recv

Output:

Snapshot below

To check the state of Message Queues run ipcs -q command.

Pointers:

1. Include headers

         sys/types.h

         sys/ipc.h

         sys/msg.h

2.  msgq_id (message id) is an arbitrary number of type int generated by msgget() which should be passed as parameter/argument to msgsnd(), msgrcv()

msgq_id can also be generated using ftok()

3. key (key_t is of type int) is another arbitrary number. Same key value must be passed as parameter/argument to msgsnd() and msgrcv().

4. Message Type (mtype) is another arbitrary number. Same mtype should be passed as parameter/argument to msgsnd(), msgrcv()

5. mtype is passed as struct mbuf argument to msgsnd(), and long type to msgrcv()

6. for man page of any API run man command e.g.

        man 2 msgsnd

        man ipcs

This is pretty high-level overview of Message Queues.

Feel free to drop a comment.

Snort: Logging Alerts to Syslog Server

Life is so busy. It's been pretty long since my last post. Well coming to the post :) ...

We will get into configuration details of Syslog and Snort to log our alerts into Kiwi Syslog Server.

Add the following line to Snort configuration file
 output alert_syslog: host=172.16.232.161:514, LOG_AUTH LOG_ALERT
Snort configuration file can be found at
                 /etc/snort/snort.conf

In my case Snort is running on 3.3.3.9 on eth1 and eth0 is assigned with 172.16.232.171 IP which talks with Syslog Server.

Following command is used to run Snort
 snort -c /etc/snort/snort.conf -i eth1
-c    provide snort configuration file path
-i     interface on which Snort is sniffing the traffic

Output shown in above figure is seen when the Snort command is successful.

Modify syslog configuration file
                 /etc/rsyslog.conf
by adding line
*.*                                                     @172.16.232.161:514

where 172.16.232.161 is the Syslog Server IP Address and UDP/514 is the port on which it is listening.

*.* says log all types of alerts.

To make sure that Syslog Server is running on UDP/514 port uncomment below lines in the configuration file

$ModLoad imudp.so

$UDPServerRun 514

Above lines are commented by default.

Once the modified configuration is saved restart the Syslog daemon

 /etc/rc.d/init.d/rsyslog restart

Make sure to stop firewall or add rule to allow traffic on UDP/514 port.

When we send malicious payload or replay PCAP with malicious traffic on the interface where snort is running, we can see alerts in our Kiwi Syslog Server which is installed on Windows XP machine (172.16.232.161).

Below is the Packet Capture format when Snort sends alerts to Syslog Server.

Refer Snort Manual and/or Snort FAQ for further details.


Hope this will help someone somewhere.
Enjoy :) !!!