Malicious Mobile Code: Virus Protection for Windows (O'Reilly Computer Security)

Some of Grimes's advice is by now obvious (don't run executable files that arrive attached to e-mail messages), but a lot of it will be news to Windows users and even system administrators. For example, he goes into considerable detail on how BackOrifice works, with particular attention to how black-hat hackers use it to build networks of compromised machines that they can use in further attacks. He's liberal with defensive advice, as well, describing how to adjust the settings of your browser, instant messaging client, and other software to stave off attacks. There's much discussion of Registry manipulation, too. More coverage of risks specific to Windows 2000 (and Windows XP, which isn't covered here at all) would make this book better, but since many attacks are generic to 32-bit Windows environments, Grimes's work remains current. --David Wall

Topics covered: Viruses, Trojans, worms, and other nasties--particularly those that can be distributed with e-mail messages, Web pages, or instant messaging tools--that can disable Microsoft Windows, or turn control of it over to unauthorized hackers. Coverage is explanatory, in a "know your enemy" sort of way, and includes lots of defensive strategies.

Product Description
Malicious mobile code is a new term to describe all sorts of destructive programs: viruses, worms, Trojans, and rogue Internet content. Until fairly recently, experts worried mostly about computer viruses that spread only through executable files, not data files, and certainly not through email exchange. The Melissa virus and the Love Bug proved the experts wrong, attacking Windows computers when recipients did nothing more than open an email. Today, writing programs is easier than ever, and so is writing malicious code. The idea that someone could write malicious code and spread it to 60 million computers in a matter of hours is no longer a fantasy. The good news is that there are effective ways to thwart Windows malicious code attacks, and author Roger Grimes maps them out in Malicious Mobile Code: Virus Protection for Windows. His opening chapter on the history of malicious code and the multi-million dollar anti-virus industry sets the stage for a comprehensive rundown on today's viruses and the nuts and bolts of protecting a system from them. He ranges through the best ways to configure Windows for maximum protection, what a DOS virus can and can't do, what today's biggest threats are, and other important and frequently surprising information. For example, how many people know that joining a chat discussion can turn one's entire computer system into an open book? Malicious Mobile Code delivers the strategies, tips, and tricks to secure a system against attack. It covers:

• The current state of the malicious code writing and cracker community
• How malicious code works, what types there are, and what it can and cannot do
• Common anti-virus defenses, including anti-virus software
• How malicious code affects the various Windows operating systems, and how to recognize, remove, and prevent it
• Macro viruses affecting MS Word, MS Excel, and VBScript
• Java applets and ActiveX controls
• Enterprise-wide malicious code protection
• Hoaxes
• The future of malicious mobile code and how to combat such code

What I got most from this book though was a perpective on dealing with virus (etc) problems overall. Identifying what area of a system needs examining, what precautions should be taken, and even classifying symptoms, was very enlightning. That it was also a major source in a paper I received an A on, doesn't hurt either. I am sure it will come in as a handy reference for some time yet.


A great security overview   March 17, 2002
 9 out of 9 found this review helpful

Keeping up with computer security is a full time job. Grimes has given a clear, precise primer of one aspect of computer security - viruses, trojans, worms - collectively known as malicious mobile code. The book is DOS/Windows centric, but this focus helps you see a) where the threats for the most part, and b) allows you to extend the types of threats into other operating systems. You are taken step by step through the development of malicious code and how and why they can work on some systems, but less effectively on others. The constant refrain of the book shows the author's philosophy: Use an up to date anti-virus product. But if somethign slips by, Grimes shows you ways to react, and lessen the impact if not to this once computer, but to the rest on the network. It is easily one of the most readable books I have encountered on the subject.

This book is an essential reference for any computer manager's toolkit. We can't stop the code writers from producing thier output, but we can work to lessen the impact they can have on us.


Well written book!   February 20, 2002
 3 out of 5 found this review helpful

I confess to some bias - I was one of the tech reviewers on this book. I work with network security all of the time, but one area I'm not an expert on is viruses. Reviewing Roger's book was a real education - I learned quite a bit. I also known from experience that writing about technical subjects can be difficult and dry - this book was an easy read all the way through. If you're interested in learning more about viruses, this is a must-have.


Highly Informative Look at Viruses, Worms, etc   November 6, 2001
 4 out of 4 found this review helpful

This book offers one of the best and most complete look at viruses, worms, Trojans, and any other type of program designed to "infect" a computer. It describes not only the various types of "malicious programs" out there, but also the environments in which they run. The book's second chapter discusses DOS based viruses, and even if DOS is not that popular anymore, it is good for a historical reference.

The book goes on to discuss Windows-related viruses, macro viruses, as well as Trojans and worms. Each chapter gives examples of what to look for if you suspect you have been infected, and the early chapters give summaries of "famous viruses of the past." Also discussed are attacks involving IRC and other instant messaging programs, browser technologies, malicious Java applets, and what types of attacks can occur with Active X. There's also a chapter devoted to email attacks.

The book finishes off with chapters on hoax viruses, which can be just as dangerous sometimes as real viruses, when people assume the hoaxes are true, how to defend against malicious code, and finally what the future entails.

Malicious code unfortunately is a way of life and this book offers lots of information on how to avoid them and also what to do if your computer does get infected.