Forensic Programming course Black Hat references


(maintained by Rob Slade)
The general public is usually fascinated by the "dark side" of computing, and the mysterious activities that go on there. There are, however, some good reasons why it is necessary to study what are frequently, and mistakenly, referred to as "hacker" communities. The first being that "black hats" are almost universally seen as "evil geniuses," and this characterization is wrong on at least two counts. The more important reason is that examination of the various types of black hat communities, along with their activities and motivations, provides valuable direction for the potential success of the forensic programming endeavor, as well as cultural indicators and signatures which may be of use in the process.

Because of the extensive availability of poorly researched material in this field, all references should be examined carefully. Probably the best qualitative and ethnographic research has been done by Sarah Gordon. "The Generic Virus Writer" papers make heavy use of interviews with a handful of virus writers, and challenge all the stereotypes. Many of Gordon's papers are available at http://www.badguys.org/papers.htm. Dorothy Denning has also done some serious work in this regard.

Although it has problems, probably the best text in this area is

"Hackers: Crime in the Digital Sublime", Paul A. Taylor

Others are:

"Underground", Suelette Dreyfus

"Hackers", Levy

"The Hacker Diaries", Dan Verton

"The Hacker Crackdown", Sterling

If you want to start to examine this culture for yourself, the tamest but most legible, and certainly most commercial, point of entry is 2600 magazine. Another "dark side" publication is Phrack, which also has an article on attempting to defeat data recovery computer forensic technology on UNIX systems.

Course outline, assignments, and syllabus available here or here.

Resources for lecture three, assembly language programming, disassembly, and other tools for forensic programming, available here or here.

For the course given at BCIT, a number of resources are available on the BCIT server at http://cstbtech.bcit.ca/FP.

Forensic programming table of contents: here or here.

Top level menu for security related book reviews: here or here.

Security glossary: here or here.