Why Syngress.com Needs Hack Proofing

by DIzzIE

[c]opyleft 2003

Introduction

Syngress Publishing is one of the most renowned publishing houses in the IT field, perhaps best known for its assortment of ‘Hack Proofing’ books. Which is why it is all the more ironic that Syngress.com is itself vulnerable to intrusion, allowing anyone to obtain any of the ebooks offered for sale on its website for free, with no particular skill in Internet Security.

Starting Out

In order to be able to obtain any ebook Syngress offers, one must first have a membership to the Syngress Solutions (‘[email protected]) service: http://www.syngress.com/solutions/index.cfm. Membership is obtained by entering a serial number on the registration website, http://www.syngress.com/solutions/registration.cfm. A list of 10 possible serial numbers appears on the copyright page of all Syngress books in the following format (the serial numbers in this example are purely fictional):

KEY SERIAL NUMBER 001 D363OPQHZ89 002 10LAWOUVF5D (etc…)

The registration website prompts for a random key (1-10), and asks you for the corresponding serial number. Thus, when going to the library or bookstore, write down all ten serial numbers. Once you are registered, you have access to that particular book, in ebook format. Of course, you may add to your list of available books by entering more serial numbers, but the tedium of spending a day writing down serial numbers can surely be averted. And in fact, it can be due to a gaping flaw which will now be explained.

Robbing Syngress Blind

When you have registered, and logged in, you see the book whose serial number you inputted listed under ‘Registered Solutions Books.’ Clicking on the book link takes you to a website for the book, which allows you to download a PDF version of the book, as well as do a few other things such as submit a question to the author, download any CD content (if applicable) and so forth.

What is important is the site URL for the particular book. It will be in the format: http://www.syngress.com/solutions/587_Hack_Wifi/ (the last portion of the URL, /587_Hack_Wifi/ is the unique path assigned to the book, in this case the path is purely fictional). What if you knew what the other paths were? Well, then you would be able to obtain any book you wanted.

Browsing Syngress’ online book catalog, for example Syngress’s security literature section, http://www.syngress.com/marketing/security/ebooks.cfm, it is seen that for most books, the table of contents, along with a sample chapter is available. The TOC/Sample Chapter, are located in http://www.syngress.com/book_catalog/587_Hack_Wifi/ (once again the last path is fictional). What you should have noticed is that the path is identical to the one in the /solutions/ folder. Thus, to obtain a copy of any book, it is as simple as appending the book path that appears in the /book_catalog/ folder to the /solutions/ URL.

It is interesting to note that, the reason that you must register is that if one tries to access any book in /solutions/ without being a logged in, registered member, one gets redirected to the Solutions homepage, http://www.syngress.com/solutions/.

Solutions

Needless to say, this indiscretion is likely causing Syngress’ profit margins to deflate slowly but steadily. Not being an expert in Internet Security, I can nonetheless propose what seems to be a common sense economical solution that can be done within an hour: change the naming conventions for the books, i.e. make sure the book path in the /book_catalog/ folder does not coincide, or is not even remotely close to, the book path in the /solutions/ folder. I hope that this article has raised awareness of the existence of such miniscule ‘holes’ that are then too often overlooked…