If the phase "a bible of malware" weren't a cliché, I would have used it to describe this book without hesitation. I read a lot of security (and specifically, malware) titles, but I have never seen a book that comprehensive and detailed, period.
The author appears to know _everything_ that was going on in the malicious software space since the 80s (for example, who knew that there were viruses written in DEC's DCL language)... A lot of effort is spent classifying various infection, in-memory, self-protection, payload and other virus strategies. I loved the section on malware self-protection, such as anti-debugging and anti-disassembly tactics and even self-brute-forcing virus code (I never knew there are sooo many of those tricks). Nowhere else I saw the detailed explanation of oligomorphic, polymorphic and metamorphic viruses... Note that while the book does cover the fun historical viruses, its coverage extends all the way to phishing attacks of the 2004-2005.
My other favorite part is the chapter on worms. "Vanilla" viruses often feel like the creatures of the past, and the worms steal all the glory. The other holds a view that worms are just a type of viruses that he justifies fairly well. Indeed, there is no accepted definition of a "worm".
The book is obviously aimed towards virus defense, although both sides are covered in [at times] excruciating detail. The entire part is dedicated to history and technology of virus scanning. Personally, I never saw it covered with that level of detail. Finally, I had a chance to learn what `heuristic detection' means. On the defense side, the book also covers behavior blocking and host intrusion prevention, which has a chance of emerging as the main approaches of virus fighting, supplanting pure signature-based scanning. Similarly fun was a section on network-level defense strategies (such as using ACLs, firewalls, etc).
A surprisingly small chapter covers malicious code analysis techniques. I would have appreciated a more detailed info on using VMware for malware analysis.
Overall, the book is very technical, but (if need be) can be read without diving too deeply into PDP11 assembly , just to get familiar with all the malware classifications, infection methods and other tricks. Highly recommended for technical security professionals, might also benefit others in IT and beyond. I think it will also fit the textbook profile for an advanced computer security course.
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA is a Security Strategist with a major security company. He is an author of the book "Security Warrior" and a contributor to "Know Your Enemy II". In his spare time, he maintains his security portal info-secure.org