The Saracen Incident

by Jack Bowie

  “We don’t know that. Look, maybe this is too serious for us. We can contact the FBI and let their folks handle it. I don’t want anyone to get hurt.”

  Her team silently glanced at each other around the table. It was fifteen seconds before anyone said anything.

  “Hell no,” Spaulding said. “The FBI wouldn’t know what to do if we did tell them. And I’m not about to miss out on this one. I’m in, Rachel.”

  “Me too,” Lighthorse said.

  All eyes turned to Pratt. Her head was bowed as if she was praying. Then it tilted up and Flanagan saw a mischievous twinkle in her eyes.

  “Shit, yes,” she said loudly.

  No one had ever heard Pratt raise her voice, much less curse; it was the perfect tension breaker.

  The team exchanged high-fives while Flanagan passed out Braxton’s detailed instructions for accessing the Century diagnostic port.

  “Here’s what I have so far. This gets us into the diagnostic port. I’m hoping that you three can use what you find there to figure out what the rogue does and then determine the destination for the messages. Easy, huh?”

  “Sure, Rachel,” Spaulding said sarcastically. “No sweat. Do you have anything at all on the command set for the port?”

  “The last page. It’s some notes on general capabilities and command formats. No guarantees, but it should be roughly correct. Work out an approach yourselves and see what you can come up with. We’ll get back together at 9:00. I’m going to try to get more background.”

  She picked up her notebook and left the Ops Room.

  When Flanagan got back to her office she dropped into her chair and put her head down on the desk. There wasn’t any way for her to get additional information on the rogue; she simply used the excuse to leave her team alone. She had learned a long time ago that it was better to set a direction and then get out of the way. Her continued presence would only inhibit their thinking.

  But would they be able to do it? How could she expect them to crack a rogue that had been hiding in the Internet for years? And one with insider access and knowledge as well?

  But she did expect it. They were the best. If they can’t defeat it, they all had better start looking for new jobs.

  Chapter 67

  Carnegie Mellon University, Pittsburgh, Pennsylvania

  Monday, 9:00 p.m.

  FLANAGAN WASTED THE next half hour reading the latest Internet Monthly Report from the IETF. A few minutes to nine she walked back to the Ops Room. Her team was sitting exactly the way they had been when she had left almost an hour before.

  “Okay, where are we?” she asked as she walked to the front of the room.

  The engineers looked at each other sheepishly, none wanting to go first.

  “Braxton didn’t give us enough data,” Lighthorse began. “We can’t figure out what capabilities are really present.”

  “The gateway is just too complicated,” Spaulding added. His hands fidgeted nervously on the desk top. “There’s no way to determine where the rogue is or what it’s doing.”

  Pratt sat silently staring at some papers in front of her.

  This was not a good start. But she wasn’t going to let them off the hook this quickly. She started walking around the table. “What about a memory map and process list? Can’t you figure out something from that?”

  “There over two hundred processes in that system,” Spaulding replied. “We can’t check out every one of them.”

  “Nobody said this was going to be easy. What are we supposed to do? Just forget about it and hope nobody else finds it?” Flanagan’s voice was growing louder by the minute. She kept walking, then stopped behind Pratt. “Christie, what do you think?”

  Pratt looked up from a well-worn notebook. “I’m not sure, Rachel. The data from the diagnostic port is pretty sketchy. It could take a long time to figure out how to really use it. There is a pattern in the process allocations that might help, but . . .”

  “There’s no way to correlate those processes with the rogue,” Spaulding interrupted. “We don’t even know if the rogue is connected to any of them. It could be modifying the table to hide itself.”

  “I know, but if we map the processes to memory usage . . .”

  “You can’t do it. I’ve tried.” Spaulding slapped his palms on the table and leaned over toward Pratt. “You think you know more about rogue behavior than I do?”

  “Hey, slow down, Rick.” Lighthorse turned to his colleague. “Just ‘cause you can’t find it doesn’t mean it’s not there.”

  “I didn’t say it’s not there,” Spaulding shot back. “I said we can’t locate it the way Christie wants.”

  “Enough!” Flanagan yelled. The team snapped their heads toward her and slowly sat back in their seats. “We’re not getting anywhere this way. Maybe the approach is wrong. If we can’t break it from the inside out what can we do?”

  “We could try to track it,“ Pratt said hesitantly.

  “Like a black box,” Lighthorse added. “We monitor the outbound connections and follow the copy.”

  “Rick?” Flanagan asked.

  “It might work.”

  “Okay,” Flanagan said. “Take ten minutes and walk it off. Get some fresh air and come back with some ideas. I’ll check in later.”

  * * *

  She waited until 9:45. When she entered the Ops Room, the three were crowded in front of a complex diagram on the left white board. Spaulding was arguing, Pratt was silently staring at the diagram, and Lighthorse was drawing sweeping arrows on the wall. She couldn’t tell if he was planning an assault or diagramming communications lines. She backed silently into the hall.

  They asked her to join them at 10:05.

  “I think we’ve got a plan,” Pratt began from her position at the table. “We still don’t know what’s going on inside the gateway, the rogue is just too well disguised. But we think we can track the messages it’s creating. It‘s probably scanning incoming messages in a background process, selecting the ones it wants, then sending another message, maybe just a copy of the original, to another location. If we can track those messages, we should be able to locate the recipient. He’s our target.”

  “Can we pick out the rogue messages from the normal gateway traffic?” Flanagan asked.

  “We think so,” Lighthorse said. “Rick thinks we can isolate them by checking the message timing. But it means we need to seed the rogue.”

  “Seed it?” Flanagan asked.

  “Christie’s going to make up some sample messages,” Spaulding answered. “Mostly gibberish, but with lots of phrases that might fit a pattern matcher: stock symbols, numbers, and technical terms. We’ll send them through the gateway and see if they generate any unexpected traffic.”

  “If they do, Barry will track them with the Sniffer,” Pratt explained.

  “Braxton’s program might help in that,” Lighthorse said. “I think I can get it to report back to us from the downstream gateways. It’ll make the tracking go a little faster.”

  “It’s unlikely we’ll get the source in one hop,” Flanagan said. “Our experience says crackers take as indirect a routing as they can.”

  Pratt picked up the enthusiasm. “We’ll just take it one step at a time, Rachel. We may have to repeat the injection a number of times, but we’ll get there. How about it?”

  Flanagan was impressed. The initial frustration had disappeared and they were finally acting as a team.

  She would have loved to get her hands dirty in the experiment, but that was not how this was going to work. “How long will it take?” she asked, still playing the administrator.

  Lighthorse hesitated and looked across the table to his colleagues. All he saw were raised eyebrows and shaking heads. “We’re not sure. It’ll depend on how many hops we have to follow.”

  “But you can do it?”

  Lighthorse took one more glance around the table. This time he saw nods. “Yes.”

  “Then do it,” Flanagan said. “Call m
e if you need anything.” It was 10:18.

  The three took up positions at the workstations. Flanagan couldn’t resist and pulled up a chair behind them, keeping her eye on the monitor hanging overhead. Spaulding had connected it to the video from his workstation. It was his job to monitor the path of the messages. He called up a map of the Internet’s eastern seaboard connections. The screen flashed and a labyrinth of lines and dots appeared, each one a possible path for the message they would track.

  Pratt constructed the bait, a message made up of hopefully appealing phrases: a confusion of stock symbols, technology terms and names of Internet bigwigs. She sent the email into the gateway at GW.

  Lighthorse monitored the gateway using its standard management protocol, SNMP. It could only give him statistics on overall activity, not particular messages, but it would be sufficient to tell him if an internally generated message had been sent.

  Spaulding loaded their message identification program, the Sniffer, into the gateways connected to gw-gate’s six outgoing communication links and Pratt injected her first message. They waited for three minutes before Lighthorse reported. “Nothing unusual.”

  Everyone tried to hide their disappointment.

  “Here goes message two,” Pratt said as she hit the key.

  Flanagan could sense the tension growing in the room. It was one thing to put the plan together; it was another to make it work. Would Pratt be able to generate a message interesting enough for the rogue? They had no idea what type of information it was looking for.

  Spaulding fidgeted in his chair and it let out a squeak. Flanagan threw him a withering glance.

  “Sorry, nothing,” Lighthorse finally said.

  Pratt’s third message was a combination of high tech industry symbols and business data she had extracted from a D&B on-line database. She sent it off.

  Only the eerie buzz from the workstation’s fans broke the silence as they waited for the result.

  Suddenly Lighthorse let out a war cry. “Message count anomaly.”

  Immediately Spaulding followed. “Positive return. SURA-gate, a gateway into the Southeastern University Research Association subnet.” He highlighted the link and the SURA-gate node on the workstation map. The path glowed bright red. They had their first hop.

  Each step took them about fifteen minutes to set up. As the minutes passed, the red line slowly zigzagged across the monitor above their heads. The line took long leaps across the screen then jumped back before it pushed out again. The rogue was not going to make it easy.

  By 11:30 they had gone as far as they could. Her team was exhausted. Flanagan could see it in their faces and the way they hunched uncomfortably over the workstations. The message had traveled through seven gateways on its way to its destination. Hardly a direct route considering the target was only fifteen miles from where they had started.

  They identified the last drop from InterNIC’s site database. The answer confused them; they had expected a secret government agency or foreign company. Reality was much less glamorous.

  Flanagan copied the address into her notebook and thanked the team for their efforts. They erased the diagrams from the boards and shut down the systems. Flanagan collected the piles of paper containing their notes. She wasn’t about to leave any evidence behind.

  “What now?” Lighthorse asked as they filed from the room.

  There was now no question that someone had introduced a very dangerous rogue into the Internet infrastructure. It monitored communications and tapped confidential transmissions. Flanagan had to get back in contact with Braxton and see if he could supply the missing pieces of the puzzle.

  “Now I try to find our consultant,” Flanagan replied.

  She flipped the light switch and the room turned black.

  Chapter 68

  Vienna, Virginia

  Tuesday, 12:15 a.m.

  “DO YOU THINK CERT has found anything?” Goddard was sitting on the floor of the room polishing her nails. It was the third time she had done them since he had returned from making the call to CERT/CC.

  “Susan. I just checked at midnight. It’s only been a half hour. I can’t just stay connected and wait. Someone’s liable to be monitoring the account.”

  “They must have some answers. Try again.”

  “Okay.”

  Braxton had been alternately entering through his CERT/CC, Cambridge, and GW accounts to throw off any authorities. He logged in and checked his CERT/CC mail account.

  “I’ve got mail from Rachel!”

  “What is it?” She jumped up and looked over his shoulder:

  From: sFlanagan@cert.org

  To: braxton@cerberus.net

  Subj: Century Rogue

  Adam,

  We could not disable the rogue, but did track the receiver to a company in Reston, Virginia named Theater Electronics. I hope this is of some help.

  I cannot keep this unreported. How would you like me to proceed?

  Regards,

  R.

  “My God! It’s him.”

  “Him who? You know who did it?”

  “Greystone. Robert Greystone. He’s an executive at Theater here in D.C.”

  “He’s Bob? Do you know him?”

  “I should. He was the one that got me interested in computers.”

  “What?”

  Braxton’s reply was interrupted by a loud knock on the door.

  “Who could that be?” Goddard asked.

  A deep voice came through the door. “Adam Braxton. It’s Detective Fowler. Open up, we need to talk.”

  They exchanged questioning looks, then Goddard hopped off the bed and headed for the door. “Hang on, Detective,” she yelled.

  “Susan, wait up. Make sure it’s . . .” Braxton said as she turned the knob.

  The door flew back, slamming into Goddard’s side, and knocking her to the floor. Two men rushed into the room and kicked the door shut behind them. Automatic pistols with long canister-like silencers on their barrels appeared from under their coats and were quickly trained on the occupants.

  The shorter man immediately turned to Goddard. She started to get up, but he struck her across the face with the frightening weapon. She fell back against the wall and slowly slid down to the floor, a stream of blood flowing from the corner of her mouth.

  “Susan!” Braxton called out.

  The taller man turned to him. “Shut up and listen, Braxton,” he said. “Our job is to get a certain computer drive from you. You two be quiet and cooperate and we get out. Where is it?”

  Braxton tried to fight off his fear and think. He had never stared into the barrel of a gun before; it paralyzed him. The race through the woods in Massachusetts didn’t even compare. Then he looked into the eyes of the weapon’s owner and was even more afraid. This wasn’t a simple robbery. “Look, we don’t know anything about a drive. You’ve got the wrong couple.”

  Harding stepped up to him and thrust the extended barrel of his gun into Braxton’s left shoulder. The searing pain of the gunshot wound instantly returned and he doubled up on the bed. The intruder then slapped the side of Braxton’s head with the automatic. Blood spurted around his ear and he rolled onto his back.

  “There really is no use in continuing a charade, Braxton. You and Ms. Goddard here are quite famous now.” Harding grabbed Braxton’s collar and yanked the consultant up to his face. His eyes were cold and unfeeling. “We can make this easy or hard. Where is the drive? You wouldn’t want anything unpleasant to happen to her would you?”

  Harding nodded to his partner and Braxton heard a dull spit come from the corner of the room. Goddard screamed as a bullet splintered the molding next to her leg. She was trying to keep her composure, but he could tell she was hanging on the edge. Whatever was eventually coming, he couldn’t stand to see them torture her.

  “That’s enough for now, Ms. Goddard,” Harding said. “Although I doubt anyone around here would do anything about your screams. It’s probably standard evening fare.
” He pointed the weapon toward the computer lying next to Braxton. Nathan walked over and searched it for a flash drive. He shook his head.

  Harding glanced around the room and noticed a nylon bag by the dresser. “Check out that bag.”

  Nathan slid past Goddard, picked up the bag, and shook the contents out on the end of the bed: cables, a spare battery, a pile of installation disks and a couple of USB drives. He slipped a similar bag off his shoulder and opened a laptop. Braxton watched as he stabbed the first drive into the laptop and stared at the screen. What was he doing?

  A look of frustration crossed his face and he pulled the drive out, replacing it with the second.

  “No match,” he said. “It’s not here.”

  “Well, Mr. Braxton,” Harding said. “It looks like we start again. Where is the drive?”

  Braxton’s head was ringing. He couldn’t hear out of his left ear and his head and shoulder pounded with pain at every heartbeat. He rose up to try to say something and the man struck him again in the shoulder. He cried out and fell to the floor.

  “You bastards!” Goddard jumped up and ran toward the bed. Nathan tried to grab her as she passed but she knocked his arm away and dove to the spot where Braxton lay. “Why are you doing this?” she cried. “Don’t hurt him anymore. It’s in the bathroom behind the medicine cabinet. Just leave us alone!” She reached down and cradled him in her arms.

  Braxton felt the world slipping away, just like in New Hampshire, except this time he knew he wasn’t going to wake up. He reached out to grab her. If this was to be the end, at least she would be close. She took his hand and held it tightly.

  Harding nodded and Nathan grabbed the laptop, went into the small bathroom, and set it on the sink. A dirty shower stall filled the end of the tiny room. The chipped porcelain sink was wedged in the front corner; a commode sat between the two. There was just enough room for one person to squeeze along the right hand wall. A tarnished mirror covered the small medicine cabinet just above the sink.

  Nathan swung the door shut to get some more room and leaned over the basin. Running his hand around the sides of the cabinet, he felt the corner of a small plastic object. Pulling a small knife from his belt, he pried the object loose. It was another drive. He pushed it into the machine.