The Saracen Incident

by Jack Bowie

  Easy to check her out. He hated loose ends.

  Chapter 4

  Carnegie Mellon University, Pittsburgh, Pennsylvania

  Monday, 7:30 a.m.

  “DID YOU SEE the UConn game last night? That Husky freshman center was unstoppable!”

  Rachel Flanagan exhaled a frustrated sigh, leaned back in her chair and dropped a stubby, well-gnawed Faber pencil on the conference table. It was bad enough that Rydell had to have his weekly staff meeting at 7:30 Monday mornings, but having to sit through her colleagues’ inane recaps of the previous weekend’s college basketball results was worse than dinner with her ex’s parents.

  Flanagan was Deputy Director, Operations for the CERT Coordination Center. She had important work to do. Why the hell did she have to endure this crap?

  CERT was one of the country’s most important organizations in the war on cyber-terrorism. It had been born in the aftermath of the Internet Worm Affair. On November 2, 1988, Robert Tappan Morris, a student at Cornell, sent a new type of computer program into the Arpanet, a then-limited network of government agencies and federally-funded university research laboratories. By invoking hidden, so-called “trapdoor”, capabilities in key Arpanet programs, taking advantage of accidental bugs in other routines and intelligently guessing user passwords, Morris’ program gained access to other user accounts on his computer. It copied itself into those accounts and uncovered pointers to related accounts on other machines in the network. The program then sent itself to those machines, where it repeated the process, burrowing into the fledgling network “like a worm”. A day later, over six thousand systems in the Arpanet had been infected, spending all their cycles running the worm program and grinding the network to a halt. Although not called that at the time, a new kind of terrorism had been created.

  The danger portended by the release of the Morris Worm forced the Defense Advanced Research Projects Agency, funder of Arpanet, to seriously consider how to deal with security on the nation’s burgeoning computer networks. Along with NSA’s National Computer Security Committee, the Agency created a Computer Emergency Response Team as part of the Software Engineering Institute at Carnegie Mellon University in Pittsburgh. This team, eventually simply called CERT, was to watch over Arpanet. The Arpanet grew, eventually being consumed by the Internet, and CERT’s role, and visibility, expanded in kind. A few well-orchestrated articles in the popular press had assured the organization’s position as a major player in the global information debate.

  By the mid-nineties, CERT had changed its name to the CERT Coordination Center, or CERT/CC, in recognition of their evolving role in an ever more complex computer security community. CERT/CC now gave workshops and training courses in system management, network security, and disaster survivability. But their most critical mission was still the analysis and identification of network vulnerabilities, or incidents. This was where Flanagan had come to make her mark.

  “Gentleman,” Rydell suddenly barked, oblivious to the female sitting across the table from him, “can we please get on with the meeting? I for one have a full day today.”

  Standard Rydell management style, thought Flanagan.

  Dr. J. Timothy Rydell was a poster child for CMU: computer science grad, Associate Professor of Computer Science, Assistant Dean of the School of Engineering and now Director of CERT. He was tall, just over six feet, with broad shoulders and only a slightly bulging waist line. His dark brown hair was neatly styled with just a touch of gray at the temples and his signature half-lens reading glasses perched perilously on the end of an aquiline nose. He was a bit too arrogant and autocratic for Flanagan’s tastes, but he did keep the academics at bay and the federal funding flowing.

  Half an hour later the managing staff had rolled through a long list of standing items, none of which had caused Flanagan to even pick up her pencil. But they were getting close to the reason a plain manila folder sat on the table in front of her.

  “There’s only one item left on the agenda,” the short, rotund man on Rydell’s right announced. Edward Candela was the Center’s chief administrator. “Rachel, it’s your topic. What’s this about?”

  “We received this on Sunday evening.” Flanagan opened the folder and handed a single page of printout to each member of the staff. “It suggests that the sender identified a threat in one of George Washington University’s gateways.”

  From: saracen@gwu.edu

  To: cert@cert.org

  Subject: Network Anomaly

  Have located network anomaly in GW gateway. SNMP analysis performed. Found consistent independent transmissions unrelated to incoming traffic. Possible rogue process present. Additional information to follow.

  Saracen

  Flanagan waited for the team to digest the message. “The email was originally classified Grade Three. I found it this morning when I reviewed the weekend message log. We have received no additional communication.”

  The first to react was Walter Eisenkranz, head of External Research Projects. “I don’t recognize the address as one of our researchers. Who is this Saracen? Does the message have any credibility?”

  “We have been unable to identify the sender so far,” Flanagan replied. “We have tried to confirm via email, but have gotten no response.”

  “Rachel, we get a lot of these claims and most are just red herrings,” Candela said. “Have there been any problems at George Washington?”

  “Nothing has been reported recently and all of our tests say the gateway is clean. Still, I’m hesitant to ignore the message. The description fits a pattern we have seen before from an occasional security audit. It may be that this is a new type of disturbance.”

  This was the critical moment. She couldn’t run with this one alone; she was still the outsider at the table and had moved ahead independently on too many projects already.

  “So what’s the problem?” Rydell finally asked. “Just have one of your people follow up directly with GW.”

  “Timothy, you know that we have to get the security advisory on the Eastern European virus out this week, and we’re finishing testing on the new firewall validation utilities. Between these projects and standard operations I just don’t have the resources. This will take more time than we have. Unless you want to reprioritize the other work?” She tossed the gauntlet.

  “You’re the operations expert, Rachel. I don’t understand why your ops staff cannot handle this as a standard request. It’s not like we have had any major network threats lately.”

  She glared back across the table, locking her eyes on her boss. He knew her staff had pulled three all-nighters over the past week tracking down a new credit card threat that had surfaced at Toys-R-Us. And Rydell had been the one who had added security certification of network programs to their responsibilities, without adding any new people. She wasn’t going to let him bully her on this one. It was time to tell him what it really took to run the Center.

  Just as she was about to release this flood of emotion, Candela interceded. “Larry, do we have any contractors that we could put on this?”

  It took a moment for Larry Grenacher to respond. Grenacher was head of personnel and human relations. With five years’ worth of job applicants in their pipeline, Flanagan couldn’t understand why they even needed an HR manager. And when the conversation turned too technical, Grenacher’s eyes glazed over.

  Candela’s question finally fought its way into his consciousness, and Grenacher looked around the table to see all eyes waiting for his response. He pulled a report from the neat stack in front of him and scanned down it with his finger. “Yes, we do have one contractor that could be used. He’s in Boston.”

  “How about it, Rachel?” Candela asked.

  “We could probably do that.” Flanagan broke her gaze from Rydell. “Boston’s not that far from Washington. I’ll check on his background after the meeting.”

  “Great. Thanks, Larry. We’ll review status next week. If there’s nothing else . . .” Candela glanced around th
e table, “then we’re done.”

  * * *

  Flanagan sat in her office reviewing the consultant’s file for the third time. The staff meeting had gone even better than she had planned. She had made her point, and had gotten authorization to proceed with the investigation. It was a good thing she had reminded Grenacher about possible staffing questions earlier in the morning; at least he hadn’t missed his cue. Maybe he wasn’t completely useless.

  What had surprised her was Candela’s suggestion of the consultant. She had figured she’d have to do it herself. Candela was a queer duck. He spent most of his time being a pain in everyone’s ass, but once a week he’d be sure to drop by her office and make a pass. So far she had been able to successfully divert the attention.

  Not that coworkers hitting on her was a surprise. She worked in a world dominated by males. At five foot six and slim, with dark red hair softly framing her face, she certainly wasn’t unattractive. An Irish heritage was right there for all to see, all the way to a dash of freckles over her cheekbones. As was a temper that was only slightly less fiery than her hair. But ever since a failed marriage while she was still an undergraduate at UPenn, men hadn’t exactly been a priority in her life.

  After graduation, and a relatively painless divorce, she had fled west and held a number of increasingly high-profile jobs in computer security. From Oracle to Microsoft to Google, she had honed her skills and eventually reached the top of that coveted application backlog.

  She had only been at the CERT Coordination Center for six months now, and sensed her honeymoon period was rapidly coming to an end. She had been feeling more and more pressure from the Director and his administrator. Why did she think CERT would be any different?

  The email had bothered her from the start. CERT/CC received over one hundred messages a day about network problems, but this one felt different. It could be the opportunity she had been waiting for.

  This incident would get her personal attention.

  Chapter 5

  Cambridge, Massachusetts

  Monday, 9:00 a.m.

  THE NEEDLES STABBED at his naked body. His legs screamed with fatigue, the muscles in his back squeezed around his spine like a noose, and it hurt to even raise his arms. He tried to rub off the ground-in sweat and grime, but every wipe of the thin bar of soap brought throbs of pain from the open cuts on his forearms and hands. His body felt like it had been in a fight with a samurai warrior. Adam Braxton finally gave up on getting clean and simply let the steamy spray engulf him in warm relief.

  No matter how hard he tried to keep in shape, rock climbing trips with Paul invariably resulted in sore muscles, bloody appendages and a bruised ego. Why he continued to join his friend for these weekends of torture he didn’t understand, except that Paul’s companionship was the last vestige of what could be considered a social aspect to his very compartmentalized life.

  The steam was finally bringing some relief, so Braxton let his thoughts wander. He had fought all the previous night to find a comfortable position in his bed. Finally falling asleep around 6:00 a.m., he had subsequently been awakened only two and one-half hours later by a telephone call. A rude “Hello?” had been all he had been able to utter.

  The call from CERT/CC had caught him completely by surprise. A few months ago a friend had suggested he submit his resume as a contractor, but he had heard nothing in the interim. Now their Deputy Director calls and offers him a contract. A job with CERT could be high visibility and it would definitely help his bank account. The timing couldn’t have been better.

  Finally feeling human again, he stepped out of the stall and grabbed a faded towel from the hook on the wall. As he dried himself off, he took stock of the image in the vanity’s mirror. The sandy brown hair that Megan had found so attractive was still thick and curly, and his pale green eyes were alert and clear. His five-foot-eleven, one hundred sixty-five pound frame remained strong and taut. At least he had had the resolve to keep up his exercise regimen. More often than he would admit, jogging and climbing had been his only break from the anxiety of his professional life. The assorted bruises and scrapes merely added to his manly appearance, or so he told himself.

  He brushed his teeth, shaved, and smeared another coat of antibiotic over the angry red scratches on his arms and legs. Then he dressed and headed to the kitchen.

  That was when a loud “Morning, Adam”, echoed down the hall.

  Braxton nearly tripped as he spun around to locate the intruder. Staring into his study, he saw his neighbor, Paul Terrel, huddled over an Apple MacBook.

  Braxton let out a sigh and felt his adrenaline slowly dissipate. “Jesus, Paul. What are you doing here at this hour?”

  “Told Wallace I’d be working at home today,” Terrel explained, never once taking his eyes off the monitor. “Then I found my connection was down. You were in the shower so I didn’t want to bother you. Figured you wouldn’t mind.”

  Terrel was dressed in jeans and a plaid shirt, and his long black hair was pulled into a pony tail at the back of his head. He had moved into an apartment down the hall a year ago. Paul Terrel was young, less than 30, and worked as a programmer at Wallace Securities in Boston. Braxton guessed that the executives at Wallace were just as happy when he chose to work at home. He certainly didn’t fit in a world of suspenders and power ties.

  “Go right ahead, Paul,” Braxton said with a smile. He had given his neighbor a key for emergencies, but hadn’t expected morning visits. “What are you working on?”

  “Oh, nothing too exotic. I coded up some new quants and need to test them out.”

  “What the hell are quants?”

  “Quants. Quantitative analysis programs. The traders like to have different ways of evaluating market or stock trends. That helps them make the best selections for their clients’ portfolios. The guys are insatiable. I can’t keep up with all their ideas.”

  “I guess that’s interesting. Good luck. Just don’t be too long. I’ll need the system in an hour or so.”

  “No sweat. I’ll be outa’ here by then. This stuff is my specialty.” Terrel grabbed a notebook from a pile at his feet and proceeded to type furiously on the keyboard.

  “What’s with all the paper?” Braxton asked, shaking his head at the mess on his floor. “Don’t you have all that in the Mac?”

  “Most of it. But you know me, a real throw-back. Sometimes you just gotta have paper.” Terrel turned and grinned. “But what’s got you working all of a sudden?”

  “CERT called this morning. They need help on an incident.”

  Terrel pulled himself away from the screen and looked genuinely pleased. “That’s great, Adam. Anything really interesting?”

  “It’s too soon to tell. For now it’s just a follow up on a message they received from George Washington University. I’ve got to track down the sender and check out a possible network problem.”

  “Doesn’t sound too bad. You gonna get to arrest folks in this new job?”

  “Afraid not, Paul. The Center’s job is investigation of threats. Arrests and prosecution are up to the FBI. And that’s fine with me.”

  “Too bad. With your background, you’d make a good cyber-cop. Guess you’ll just have to stick with being a gunslinger.”

  Braxton cringed at the sobriquet. “Paul, please don’t call me that.”

  “You should be proud,” Terrel replied with another smile. “You’re the guy the messed-up town calls in to shake things up and get rid of the bad guys. It’s a noble and long-standing profession. And now-a-days you get to just use your smarts and don’t even get shot.”

  At least literally, Braxton thought.

  “Good luck anyway.” Terrel returned to his Mac.

  “Thanks, Paul.” Braxton walked out to finally grab that cup of coffee.

  * * *

  After a quick breakfast, Braxton sat down in his dining room and peered out the bay windows to the scene below. It was a cloudy day in Cambridge, cool with the muggy feeling of impendi
ng rain. Looking down Brattle Street toward Harvard Square, he saw a couple of regulars from the neighborhood carrying grocery sacks and a cluster of Harvard students rushing to get to a mid-morning class. Life looked so normal on the street.

  Braxton had been taken by the energy and youth of Cambridge when he had first come to the Boston area. Harvard Square especially was intellectually electric, constantly charged by an influx of students, professors, and business people. It fit the style Braxton had envisioned for himself. Cambridge living costs had put a dent in his reserves since Megan had left, but he had managed to keep the apartment. It was still his home.

  He got up and moved into the living room. The inside wall of the room was one huge bookcase. He had had it custom built as soon as he moved in. When he was in school he would scatter books all over his apartments, but Megan had had a different decorating plan. He browsed the networking shelf, scanning early scholarly sources such as Quarterman’s The Matrix, to references like Applied Cryptography and finally Mitnick’s Ghost in the Wires and Stroll’s The Cuckoo’s Egg. Grabbing a few favorites, he dropped into the overstuffed sofa and leaned back.

  Time for some basic research.

  * * *

  The hour went by quickly. He had taken notes on the latest intrusion threats, and come up with some ideas on how to validate the programs in the gateways. He was about to get up when he heard Terrel slam a book shut.

  “Dammit.”

  Apparently things aren’t going well.

  His neighbor stormed into the living room, binders and laptop in hand. “Thanks, Adam. Looks like I’ve got to do a little more thinking. Damn series won’t converge quickly enough to be useful. By the way, some of the guys at work are up for a trip north. You interested?”

  “Sure, tell me when you get it set up. Your place again?” Braxton had quickly discovered that he and Terrel shared a number of interests besides computers. Both were hockey nuts, Braxton sticking with the Bruins and Terrel rooting for his hometown Red Wings. Terrel didn’t run, a sight that Braxton knew would have been rather amusing, but did climb. The past weekend’s excursion had been spent together in the White Mountains of New Hampshire.