Experts publish 'how to' book for software exploits

The book pulls together information that could be obtained from security discussion groups on the Internet or from a university-level network security administration course, say Anley and co-author David Litchfield, also of NGSSoftware.

However, The Shellcoder's Handbook also delves into more arcane exploit writing topics that are not commonly discussed, such as format string bugs, which concern vulnerabilities in the way some programs written in the C programming language output data. Another chapter titled "Alternative Payload Strategies" discusses ways in which an exploit writer can subtly manipulate a compromised machine other than to produce a shell prompt, such as extracting data from a database or tampering with cryptographic services, Anley said.

The Shellcoder's Handbook and other books like it stir up controversy within the information technology security community about whether researchers should publicly disclose holes in software products, said Alan Paller, director of research at The SANS Institute.

Authors who publish software exploits walk a fine line between informing the public and lowering the bar for malicious hackers, he said.

"You don't want to make writing an exploit as easy as fixing a car," Paller said.

However, Paller believes that those defending networks from attack benefit more from books like The Shellcoder's Handbook, than do attackers.

"In the security world there's lots of advice, and a lot of it doesn't make much sense. So if you understand why you have to do certain things and can connect the defense back to an actual attack, that helps," he said.