“OK, no more beating. Some questions for you: how was it that Kateryna happened to have her husband’s passport with her? And how did the Russians find you so quickly? And wasn’t it fortunate that Kateryna was there again to help you escape the Americans? To me, these seemed like unlikely coincidences, and à la Occam’s Razor, wouldn’t a simpler explanation be that she was more involved than she let on?”
“You don’t know her!” Mick countered.
“Actually, I have met her, although she didn’t know who I was. I’m sure you are aware that she has become quite famous for her work on the signatures of spambots—work that I suspect was mainly developed by you.”
“Yes, I know. I’m happy for her. She was in a difficult situation when I left her, and I’m glad she seems to have landed on her feet.”
“Yes, she was very fortunate, again, wasn’t she?”
“I think it is time for you to provide some proof. I’m not interested in speculation.”
“OK, then. Why don’t you get out your scan of Kateryna’s husband’s passport—the one that you used to get to Kiev? Don’t give me that look, I am certain you did a scan, both visual and RFID of the passport as soon as you got it.”
“You are right—I do have it,” he replied as he fired up his mobile. It took a moment for him to retrieve the file from one of his secure cloud servers. As the image of Milos appeared on the screen, he was moved by it, recalling the frantic events from six months ago.
Last year, in the course of his investigations of the Zed.Kicker botnet, Mick O’Malley’s name was added to the Do Not Fly list, so he had entered the U.K. illegally. Needing a passport to get to Ukraine, Kat had given him her husbands, which Mick was able to use given the similarity of their looks. It had worked well, perhaps too well.
In the meantime, Jasinski had pulled her mobile out of her pack and was opening up another file, which also looked like an image of a passport.
“Here is a scan of Milos’ Canadian passport, courtesy of the Canadian government,” she began.
“How—”
“Don’t ask. Re-search. Anyway, you can see that they have the same basic information including passport number and issue date, etc. But these two passports are not the same, are they?” Mick peered intently at the image. A sickening feeling spread through his body. He turned to her and shook his head.
“They are not the same passport. The watermark is slightly offset on my image.”
“Very good! Not many who aren’t trained can recognize the signs of a fake passport. It turns out that the Russian group in London who did this passport always makes this mistake. There was a criminal case a few years ago at the Old Bailey in which a faked passport was submitted as evidence, and it had exactly the same property.”
“So the passport I used was a fake.”
“Yes.”
“And Kat knew this.”
“I suspect she either had it made or was given it,” Jasinski said. Mick slowly shook his head.
“I can’t agree with that.”
“That’s OK, you don’t have to—just the fact that you are keeping an open mind is enough. I’d love to continue this conversation, but I actually need to make some arrangements for tonight. I need to find a decent hostel.”
“Lots of nice hotels around,” Mick replied.
“Sure, if you are made of money like you. I found an OK hostel in Sydney and I’m sure there are plenty here, too.”
“You could stay at my place I guess.”
Where did that come from?
“Really?”
“Or I could just pay for your room—I don’t care. Consider it a ‘thank you’ for providing me with the address of Cloud 8 plus plus last year.”
“Hmm. OK, why not? I can save some dosh.”
I hope this is a good idea.
“Let’s go then,” Mick suggested as he got up. They headed out the door, back onto the damp, darkening street. “Why did you take the bus down from Sydney?” he asked. After a pause she replied.
“You noticed my browser had been pointed at the bus booking site, didn’t you? A nice guess. Yes, I did take the bus down from Sydney last night. I hate flying—my flight from Dublin was torture. I wasn’t going to take another flight if I didn’t have to. I don’t mind buses—the seats are comfortable, and in an emergency, you can always get the driver to stop and get off!”
They caught a tram and rode a few kilometers to Mick’s house in Brunswick.
Chapter 3.
From the Privacy and Other Mirages Blog:
How hard is it for someone to learn my IP? What information can they get from it?
The way the Internet works, whenever you use the Internet for almost anything, you share your Internet address, also known as your IP. Anyone who is interested in you could learn your IP address in any number of ways. If they know your email address, they could send you a carefully crafted email containing a link or an image that is downloaded. If you clicked on the link or your mail client fetches the image, they would know your IP. If they know your address on a messaging or communications service, they could learn your IP by sending you a message or call request. Even if you block them or reject the request, in most cases they still get your IP.
Knowing your IP doesn’t automatically give someone an ‘X’ on a map showing where you live. However, someone who has your IP can learn quite a lot about you. They can tell your location, usually down to the city, if not the block. They can tell if you are using a mobile device or a computer. They can determine your Internet Service Provider (ISP), employer, or university. Under court order, government pressure, or by theft, they could get your account information and hence your name and address.
Unless you take very careful precautions and use Internet privacy software, don’t ever assume that you have any privacy on the net.
Chapter 4.
Ja2 sometimes the #bandaid has to be ripped off, other times, you must carefully peel back the bandages. #wisdomin14Øchars #thoughtoftheday #imnotadoctor
Mick showed Jasinski around the small, single storey house where he lived—a tiny cottage built in the late 19th century. It was the same as thousands of others in the suburbs of Melbourne, with a wooden exterior, tin roof, surrounded by a small garden. It was built during the age of ‘Marvelous Melbourne’, the explosive building boom during and after the gold rush. Many of the grand buildings and cathedrals in the city were built during this period.
From inside the house, Mick could occasionally hear the passage of cars or trams on the main road, but it was nothing for him, having lived in London and Manhattan. Houses of this age had neither central heating nor air conditioning, and this house had never been modernized. Mick heard an exclamation of surprise when Jasinski entered the bathroom. She came out a few minutes later.
“You have a tree branch growing through your bathroom window!”
“I know,” Mick replied. The window had not been closed in years, and the branch stretched halfway across the room.
“Of course you know, it just gave me a start, that’s all.”
Mick showed her to the spare room where she opened up her pack and sat down.
“Now, tell me what you have been up to all these months. What are you doing with the botnet?” she began.
The botnet, short for a robot network of computers, she was referring to was known as Zed.Kicker. A botnet is a collection of compromised, or hacked, computers, known as zombie computers, organized to receive commands over the Internet and operate in concert. Zed.Kicker was a collection of software including a malware exploit used to grow the botnet and a peer-to-peer network used to control it. Mick had gained control of the botnet from the Ukrainians last year. So far, he had kept it out of the hands of nation-state actors, despite the efforts of the Americans, Russians, and Ukrainians. Despite his control over the botnet, he had not been able to do much in terms of dismantling it.
“Of course! No one has made any real attempts to take it back, although there have bee
n a few probes. I’ve been mapping the botnet. It is even bigger than I realized at first—it has taken a lot longer.”
“So you don’t have a complete map yet?” she asked, surprised.
“No, so many of the members are still dark—still sleeper PCs. I haven’t been able to activate them. Here’s what I have so far,” he replied, pulling up some graphs and tables. Jasinski looked them over for a few minutes.
“That’s all you’ve got?” she replied.
“Hey, how much of the botnet have you mapped?” he replied defensively.
Who the hell does she think she is?
“Fair enough, I don’t mean to criticize. You did a great job in taking it away from those a-holes. I won’t be happy until this botnet is eradicated.”
Either she means it or she is a terrific liar.
“Well, actually, I’m pretty disappointed with myself. I’ve been distracted with all kinds of other things. I really thought I’d be a lot further along by now.”
“Why did you leave Ireland?”
“Family. A cousin dropped into the motorcycle shop in Blackrock one day and introduced himself—he wouldn’t say how he found me. When he started asking questions about my sister, I really got uncomfortable. I made up a bunch of lies, then packed my bag and the next morning I booked passage on a freighter. Three months later, I arrived in here. My uncle has been great helping me get setup. It was risky to travel, but riskier to stay. I still could be in trouble, especially if anyone back in Ireland is capable of ‘re-search’. You found me, so could others,” he paused, looking out into space.
“I see. That’s why I’m glad I don’t have any siblings, and only one really annoying cousin.”
“Well, sorry to be unsociable, but I’m going to turn in now, and do some work on the botnet tonight. You are welcome to anything in the fridge—help yourself. The house will get really cold at night, but you can put an extra duna on the bed. The wireless password is Stone with a capital S and a zero for the O, dot the dot crows with a capital C and a Zed instead of an S. Now, g’night!” Mick sauntered out of the room and sat down in his room.
Mick checked on his computers. One computer was running a script and randomly browsing web pages, unattended. He used this computer to generate normal Internet usage that would help hide his real Internet traffic pattern. Mick noticed it was currently browsing a site called LOLCatz. He frowned and advanced it to the next random site. He settled down in front of his real computer and setup an encrypted tunnel across the Internet to his collection of secure cloud servers, and set to work.
From his experience as a consulting security researcher, Mick was paranoid about security on his computers and his Internet usage. This had prepared him well for his life in hiding. He used many tricks to avoid being tracked and surveilled as he navigated the net. He knew how easy it was for ‘back doors’ and malware to be installed and hidden on commercial software and operating systems. As a result, he religiously only used open-source software—software that he could download and inspect the source code to know exactly what it did and how it did it. He compiled his own executables from the source code, providing a level of assurance that few others had about their computers. It was time consuming, tedious, and more than a little obsessive-compulsive, but it had kept him—and the botnet—out of the hands of state intelligence agencies so far. However, Jasinski had tracked him down, and this disturbed him more than a little. He did admit to himself that he was enjoying having her around, and being able to talk about the things and people that really mattered to him.
Tonight, he was eager to get to work again on the botnet, an unusual feeling that he wanted to capitalize on. His first few months of hiding had been full of energy, but lately that had declined.
He missed everyone more than he admitted. He also found himself thinking increasingly of his family and friends, a casualty of this single-minded pursuit of Zed.Kicker. He wondered how his niece Sam was doing, what she was up to. Who did she ask when she had questions about the world? How did she deal with all the FUD—fear, uncertainty, and doubt—she found? Did she feel like he had abandoned her? In his mind, he knew that their relationship would change over time, and that she would become more independent and self-reliant. Of course, he wanted that for her. But he never refused a request from her, knowing that one day the requests would slow down and ultimately stop. It used to make him choke up a little when he thought of it, but he always comforted himself that it would happen gradually, and that he would have time to adjust. He just hadn’t counted on it happening almost overnight when, thanks to Zed.Kicker, he had to disappear.
He sometimes wondered if he had pandered to her too much, took advantage of her curiosity and niceness. Perhaps his sister was taking up the slack. Or perhaps the Internet. He usually found this line of thinking didn’t make him feel any better, and so he distracted himself.
But distracting himself hadn’t been working lately. Even riding and working on motorcycles didn’t seem to give him the same pleasure it had in the past. The Melbourne summer and spring had been great for riding, as long as he didn’t mind a little rain.
These days, he was riding and working on Moto Guzzi brand motorcycles for a change. He had previously collected Ducatis, another storied Italian brand, with a huge collection of vintage and performance bikes still safely hidden in the U.S. But he didn’t know when or if he would be able to ride them again. He had never ridden a Guzzi until he test rode one in the shop in Blackrock. He clearly felt the different exhaust note, the different torque curve. He found the riding position less comfortable. But he also appreciated the differences. Moto Guzzi had been manufacturing and racing motorcycles for nearly thirty years before Ducati was formed. They had famously won at the Isle of Man motorcycle race many times.
Working on Guzzi’s was also quite different. He missed the desmodromic valves and other classic components of Ducati’s—Guzzi’s used a very early over-head valve (OHV) design that is commonly used in performance engines today. The distinctive flat, single cylinder engine that mounted horizontally didn’t exactly appeal to Mick’s sense of aesthetics, but he was coming to appreciate it. Mick wasn’t quite expert at working on their more recent V-twin 9Ø degree engines, but he was getting there. He even found himself enjoying working on Guzzi’s.
The first Guzzi he had purchased when he came to Melbourne was a 1952 Falcone, which he rode nearly every day. Its 5ØØcc engine and café racer feel really appealed to him. He did find the tram-infested streets of Melbourne a difficult place to ride. A month ago he had taken a low-side spill, braking hard to avoid a Holden turning right in front of him. He had bent the handlebars and slightly mangled the exhaust pipe. The crash had also had created an exhaust leak at the cylinder head that he knew had to be fixed before he could ride again. He wasn’t injured, with the exception of a bruise to his knee and elbow, but his confidence had been shaken. The bike still sat in a corner of his garage, waiting for him to borrow the tools he needed from work to fix it.
Having Jasinski show up was a distraction, but perhaps a welcome one for him. He continued his work into the night.
“Jaz! Jaz!” he whispered. Using just the dim light from the hallway, he peered into the room where she was sleeping.
Am I stupid to trust people?
Jasinski sat bolt upright in bed, and looked around. “Jaz, it’s just me, Mick,” he said. “Sorry to wake you.”
“Yes?” she replied, now wide-awake.
“You need to come and see this,” he said, turning away. She threw back the covers, pulled on another layer of clothing for warmth, and came out into the living room. “Come on in,” he called from his room.
She saw a set of HD screens full of text in constant motion, scrolling across the screen. She couldn’t read the information, but it appeared to be error messages. Mick was watching them, occasionally pausing the scrolling.
“I don’t believe it,” he was saying over and over again. He looked up at her. “Computers are disappea
ring from the botnet—tens of thousands of them at a time. It started an hour ago,” he said, glancing at the clock that showed just after midnight. The botnet’s size gave it power, and now apparently it was suddenly shrinking. “It’s midnight, and another set is disappearing!”
“Have you checked the IP address ranges?” she asked. He snapped his fingers, and then typed up a short script, which he executed. A moment later the screen showed a map of the world with a bunch of pins on it.
“The red computers disappeared an hour ago, the blue ones went away just now,” he explained. “Interesting!”
It was interesting—the clustering was clearly along time zones, nearly longitudinal stripes on the globe. The script had taken the Internet Protocol addresses of the disappeared hosts and looked them up in a database to get the approximate location of the computers.
“The red pins are closest to the international date line,” she pointed out.
“They are disappearing at midnight in their local time zone. This is no accident!” The botnet was going dark, but not at random. “Damn! Damn! Damn! This is not good at all!”
They stayed up another three hours, and watched as the new day began in successive time zones. There were a few computers that disappeared from other random time zones—most likely hosts with inaccurate clock or wrong time zone settings.
Mick had always observed some hosts coming and going from the botnet as computers were turned on, switched off, or lost connectivity to the Internet. Some were even cleaned, upgraded, or scrapped. But this was not a normal turnover or ‘churn’—this was the botnet shutting down… or worse.
I’ve lost control of the botnet!
“Clock,” Jasinski mumbled. Mick looked up at her.
“Yes, I know, midnight in each time zone, start of a new day, and the zombies disappear from the botnet. Got that already,” he replied impatiently. Jasinski shook her head.
Returning to Zero (Mick O'Malley Series Book 2) Page 2
