Counting from Zero

by Alan B. Johnston

  With everything assembled, he retrieved what he had been using as a bookmark from his copy of The Innocents Abroad, bent out the connectors on the top, and connected it into the wiring harness of the motherboard. He grinned.

  No computer has a better battery life than this one – thanks Vince!

  Thinking of Vince brought to mind his difficulties with the U.S. Government, and the fact that at some point he needed to sort them out. He resolved to do so, but later.

  He powered up the computer and verified that the BIOS (Basic Input/Output System) functioned properly by running some tests and utilities. The rest of the install he would have to do on the network, so he packed up and took the Tube back to the hotel. With the new computer on his knee, he marveled at the weight of the unit, and did a mental calculation of how much lighter it would be in a titanium case... and how much more expensive.

  Back at the hotel, he met up with Lars who loaned him a memory stick with a secure kernel and operating system, which he proceeded to install. Then, he connected to the network, downloaded the source code of his favorite applications, compiled and linked them, generating the binary files. He then connected to his server and downloaded his disk image.

  Mick was back in business again.

  First, he changed all his passwords and generated new keys, revoking all the old ones. He was starting to feel better. He made a mental note to find out what Miles most enjoyed in eating/drinking/collecting and give Miles an abundance of it. He really owed him – Miles, of all people!

  Chapter 1D.

  From IRC Channel #314 for SecAdminAnonymous:

  . . .

  Anonymous_1: anyone clued in on last week’s DNS outage?

  Anonymous_6: what outage??

  Anonymous_1: .coop and .aero were down for 43 mins...

  Anonymous_5: they weren’t, just some domains... not that anyone cares!

  Anonymous_1: incorrect. See the logs at http://root-logs.cfm.c2b/cgibin

  Anonymous_6: WTF! how did this stay out of the blogs?

  Anonymous_1: no idea

  Anonymous_9: heard it was a pretty sophisticated ddos on them

  Anonymous_42: might just be a server outage

  Anonymous_9: there’s all kinds of crap happening these days that no one seems to notice

  Anonymous_19: one word for you zed.kicker

  Anonymous_9: never heard of them

  Anonymous_19: you will. remember the carbon web server Ø-day?

  Anonymous_1: of course. everyone got hit on that one.

  Anonymous_19: that was zed.kicker, too.

  Anonymous_1: who is it? how do you know?

  Anonymous_19: i’ve seen the source code... it is good stuff. someone with a clue

  Anonymous_6: probably usgov

  Anonymous_19: or .cn

  Anonymous_1: either way its bad. can you share the source?

  Anonymous_19: no don’t have it anymore will try to share if I can.

  Anonymous_1: cool... keep us posted

  . . .

  Chapter 1E.

  Mick O'Malley – knows how the emperor with no clothes felt. (7 comments)

  The next morning found Mick sitting in a conference session, sipping his espresso (not bad), and still trying to come to grips with the fact that someone had installed a keylogger on his computer. As soon as he saw Kateryna, he wanted to tell her everything that had happened.

  They left the conference and set off walking towards St. James Park as Mick told her about the keylogger. Kateryna was both amazed and concerned, especially about the implication that someone had physical access to Mick’s computer to install the bug.

  “How did you find the keylogger? How long had it been there? Who put it there?” she began excitedly.

  “Well, the mail Miles showed me was generated with a particular well-known piece of malware of Russian origin that is typically associated with both hardware and software keyloggers. I was fairly confident that I didn’t have a software keylogger… I mean, I’m not such an idiot that I could have a rootkit on my computer, so that meant a hardware keylogger. As for how long it had been there, I have no idea. I’ve certainly had strange things happen to me ever since I was in Los Alamos and Vegas... I guess whoever is trying to discredit me and disrupt my work put it on there. Think about all these things: the forged email to ISW, the threat in Los Alamos, the No-Fly list. Which were done by Zed dot Kicker and which were done by the government? And, who even knows I am working on this project?” Mick paused.

  “I know, it is incredible...” she replied, and they were silent for a few blocks.

  “The mention of three days in the forged email suggests that is the date they are working towards. If I had to guess, I’d say the full force of the botnet will be unleashed in all the ways they’ve been testing it: against web servers, mail servers, and DNS servers in the ultimate zero day!”

  “You could be right,” Kateryna replied.

  “I know I am. I need a break… something to give me an edge against this botnet... and soon,” he replied, and drifted off into his own thoughts.

  By the time Mick and Kateryna reached the park, their conversation, influenced by their surroundings, had moved on to other topics.

  “Walking around London and England makes me think of Jane Austen – Pride and Prejudice is my favorite novel of all time,” Kateryna replied.

  “I know how you feel. Myself, London makes me think of Sherlock Holmes,” Mick replied. “You can’t beat Victorian times. By the way, are you familiar with ‘steampunk’?”

  “No, what’s that?” Kateryna asked. Mick raised his eyebrows.

  “Well, let me tell you about it!” Mick replied, then launched into an explanation.

  As the afternoon passed, they sat down on a bench in a part of the garden with a nice view of the lake. Kateryna took out a water bottle, twisted it open and took a sip. She raised the bottle and looked at him, asking a question without words. He nodded. She took another sip then passed it to him. He put it to his lips and felt a thrill of intimacy, putting his lips where hers had just been.

  Sitting in the afternoon sun, they watched some equestrian riders go by in the park as the clouds moved across the sky. They returned to the conference later, and Mick felt the stress of the situation had drained out of him.

  That evening, Mick was tired, but still couldn’t sleep. He was feeling keyed up over the logger. In his mind, he kept going over all the places his computer had been, looking for where an attacker might have had access to it to install the keylogger. He couldn’t come up with any instances that he had left his computer alone with a stranger.

  He was interrupted in his musings by a knock at the door. He knew Lars wouldn’t knock. Mick jumped out of bed and looked out through peephole, but didn’t see anything or anyone. He noticed a piece of paper on the floor that must have been pushed under the door. On it was printed:

  Alec, be at these coordinates at 2am. Turing

  Finally, Turing had made contact! He was impressed both by Turing’s knowledge of his Alec Robertson identity, and that he was staying in Lars’ room. Mick wondered what else Turing knew about him…

  He examined the printout carefully and realized it was printed using a dot matrix printer – how quaint!

  Mick put the coordinates into GPS and got a location in the East End of London. He checked the time and decided he had plenty of time if he left right away. He set off on the Tube, bringing his computer, determined to never let it out of his sight again. Ever.

  Arriving at the building located at the specified coordinates at slightly before the hour, Mick walked up to the door and knocked. A young man with multiple piercings and a Mohawk answered the door.

  “Hello, there. I’m Mick… I was told to come here?” he asked. The man nodded and stepped aside. Mick stepped inside and walked down a long, dark hallway. As he progressed, the music got louder, until he could barely hear himself think. He turned a corner and noticed a small room to the one side. In the room there
were a dozen or so people, all younger than him. A single bare bulb hanging from the ceiling provided illumination. The walls had peeling paint, and the unpleasant smell of stale beer and cigarette smoke permeated the room. Mick realized he was probably in a squat: an abandoned, illegally occupied building. On a table in the center of the room was a single computer. A young woman stood with her back to Mick, then turned around. She was dressed in punk style, with platform combat boots, fishnet stockings, miniskirt, and a ripped tank top. Her hair was short, spiky, and pink.

  “Mick!” she called out to him, and he stopped walking.

  “Yes?” She motioned for him to come in, which he did, glancing around the room at others. “Turing?” he asked.

  “You got my message?” she asked, smiling at him. He tried to place her accent, but couldn’t get further than Eastern European. Perhaps, as she said more, he could figure out more. He nodded and walked into the room.

  “So, the famous Mick O’Malley thinks he can take down Zed dot Kicker?” she asked. The others smirked and made barely audible comments in the background.

  “I plan to, yes. I’ve already broken the encryption and figured out the P2P routing protocol – by the way, thanks for the link! But I haven’t been able to disrupt the botnet controllers. Can you help?”

  “Perhaps. Are you sure you want to do this? You have no idea who you are up against. You are being targeted now, but if you take this further, you’ll have more to worry about than just the criminals.”

  “I am sure,” he replied. “And if these guys thought that threatening me and getting me into trouble would dissuade me, they couldn’t be more wrong. I will get this damn botnet!”

  “I believe you just might,” she replied, slowly walking around him, looking him up and down. “I have information that you will find very useful: the location of the criminals running the botnet, and something that could help you take control of the botnet. It is all on this computer,” she said, pointing at the machine in the middle of the room. Mick looked at her, waiting for more. She pointed again, and Mick walked over and sat down. He hit the enter key and the screen turned on, displaying a login prompt:

  login: |

  Someone in the back spoke up.

  “Doesn’t he know how to hack a computer?” he sneered.

  “Oh, I think he does,” replied Turing. “He’s so good at what he does, that he must have once been on the other side of the fence. He must have been one of us. If he can remember who he was back then, he’ll succeed.”

  “Is this some kind of a test?” Mick asked, making note of her emphasis.

  “If you want to think of it that way, yes. I am risking my life sharing this with you. I’m only willing to do so if you are in fact good enough to use it.” She paused and leaned over him almost whispering. “So, go get it!”

  Mick glanced around the room, then focused on the job at hand. He did enjoy a challenge after all, although it had been quite a while since he had broken into a computer like this. Turing was right – he had once been a hacker, and as a teenager had hung around with a crowd like this, and used to enjoy showing off. But that was a long time ago.

  First, he had to determine which operating system was in use – this only took a second. It turned out to be a popular closed source operating system, but the usual graphical user interface had been disabled, only allowing typing, a so-called command line interface. This eliminated a number of easier ways to get into the system, but not all of them.

  The first step was to gain access to the system. He would need to login with system administrator rights, also known as ‘root’ or ‘super user’, to the computer to find the information he needed. He tried some common tricks but they all failed. He tried a number of common usernames and passwords but none worked. Then he thought about what Turing had said about him remembering who he was. He looked quizzically at her, then typed:

  login: eireforce1

  password: ***************

  After a pause, the screen showed a command prompt, indicating that he had successfully logged in:

  $ |

  A murmur spread around the room.

  “Very good!” Turing said. “Next...”

  “I have no idea how you learned my hacker alias from all those years ago, or my favorite password back then...” Mick said, truly mystified. Turing just shrugged, and he focused back on the job at hand.

  Mick now was logged in and had command line or 'shell' access to the computer. He still needed to get ‘root’ access. He tried a number of approaches but they all were patched. An idea came to him as to how he could break into the system. It was a risky approach, but he suspected he needed to take a chance in order to succeed.

  Mick set about writing a script. Most of the script implemented a simple approach that he was fairly certain would fail, but he planned to hide a few lines of his real attack inside the script. The botnet steganography had given him the idea!

  Mick could see Turing looking over his shoulder and watching as he typed. As he entered the critical lines, he turned, caught her eye, and winked at her. Then he quickly scrolled the lines off the screen before she glanced back. If nothing else, he would definitely get style points for this exploit, if it worked!

  He finished up and got ready to execute the script.

  “Ready?” Mick asked, looking around the room. He hit enter, not looking at the screen. He saw the others staring at the screen, then heard their laughter. He turned to look and saw a series of error messages scroll off the screen. The computer beeped, then restarted, going through its booting up processes: loading the BIOS, loading the OS kernel. He swore loudly and profusely, as Turing walked up to him.

  “Don’t take it so hard, Mick. Not many could break into this computer. I’m certain none of these clowns could – they definitely aren’t in your league.” She looked disappointed, but at the same time seemed to be enjoying the feeling of superiority. The computer finished rebooting and was back to the login prompt.

  login: |

  “I don’t believe this computer even has any other accounts,” Mick snapped. “That’s the only possible reason I can’t break into it.”

  “Au contraire!” Turing replied. “Watch...” she said, turning to the computer and proceeded to login as the ‘root’ user:

  login: root

  password: **********

  She turned back to Mick and smiled sweetly at him, but was surprised at his expression, which had instantly changed from bewildered to smug. “Oh SHIT! You DIDN’T!” she shouted, turning back to the computer. She stared at the screen, which read:

  Thank you for the root password to this computer, Jasinski!

  Transferring files: 1ØØ% complete.

  $ |

  The others looked on in disbelief. One of the thickest, perhaps a boyfriend of a female hacker, asked another what had just happened.

  “The tosser wrote a script that made it look like the computer crashed and rebooted – it hadn’t! It was still running his script, waiting for her to enter the root password so it could login and copy all the files! He didn’t even hack the computer – he just used social engineering!” a kid explained.

  Mick was already thinking how he would tell the story to Kateryna. During the conversation, he had figured out that Turing was most likely the mysterious Jasinski that had helped foil the Halloween attack. No wonder Lars had been unsuccessful in trying to find ‘him’! Turing recovered quickly.

  “Very impressive, Mick, I must say. And yes, I am also known as Jasinski... although you have done me no favors by telling everyone here,” she replied irritably as she glanced around the room. “I was worried that no one would figure out that mail server attack, although it seems your friend Lars had it covered, no doubt with help from you.” She paused and became very serious. “I know how to cover my tracks – something you will need to be good at from now on... But you are quite good at this little game, I must say,” she said. Mick gave a little bow. “I am as good as my word, Mick. You have
the promised information. One file contains an address. If you want to catch those running Zed dot Kicker, you need to be there, very soon. And you will also find an X.509 certificate. That certificate is a Certificate Authority for Zed dot Kicker. You will be able to issue a new control certificate and revoke existing certificates using it. In short, you can now use it to control the botnet.”

  “You have a CA certificate for the botnet?” Mick asked, incredulous. “How?”

  “They helped out on my P2P open source project, but then I learned what kind of a-holes they were. They generated a cert for me to test a new feature. I told them I revoked it when my testing was complete, but I didn’t… I don’t think they have any clue it exists. I’m through with them now, and if you want to destroy their botnet, that’s fine by me.”

  “Thanks for all your help, Jasinski,” Mick began. “I appreciate it. And thanks for the challenge… I enjoyed it. Well, I’m off, then,” he said, heading towards the door. She followed him.

  “Wait! How did you break the botnet encryption? And how did you even find the botnet messages?”

  “You wrote the code, didn’t you? Can’t you guess?” he replied, surprised.

  “Not that part – someone else wrote the crypto,” she replied.