Alex O'Donnell and the 40 CyberTheives

by Regina Doman

  “What was that?” she asked as the screen vortexed into black.

  “Looked like a number zero,” Alex said.

  “It was. The universal symbol for ‘super-user,’” Mr. O’Donnell said. “Once I logged in with the site administrator’s password, I spotted it right away. It’s his shortcut, a portal to the root account of the cave’s storage server. This is where the data for the main operations of the site should be found.”

  When a password box came up, Mr. O’Donnell hit ‘zero’ on the keyboard, and the password box dissolved into darkness. They all waited.

  What eventually emerged from the black vortex was something much less spectacular: a list of files and numbers and symbols. But apparently to Mr.

  O’Donnell, it was truly amazing. He exhaled in wonder. “I can’t believe I made it in here,” he said. “Now, I can actually get to work.”

  From that point on, Kateri found it much more difficult to follow what was going on. Hacking a computer, she recognized, was not a very dramatic project.

  It seemed to mean maneuvering through screens of numbers. Alex had screens of charts and graphs he was constantly checking through. She could only follow what was going on through the conversation, when it didn’t involve numbers and technical terms.

  For a long time, Mr. O’Donnell was silent, clicking through screen after screen and analyzing data. Finally he said of one column of endless numbers,

  “You know, this is interesting. I think it’s the password file. But there’s a lot more passwords than the ones I collected. I can’t tell if they’re all active users or not.”

  He typed something quickly. “I’m pulling up the logins from the last three months.” Then he whistled. “Hundreds of logins. This is a pretty active site.

  How many unique users?” He typed again, murmuring, “Sort by unique… Oh, wow. Like I said, this is a pretty active system. Exactly forty accounts are in use.”

  “Forty different people use this site?” Alex asked.

  Mr. O’Donnell shrugged. “Assuming one password per person, and that Admin doesn’t have two passwords. Safer to say there are forty passwords used to get into this site.” He shook his head. “Okay, I’m logging this session. But there’s bigger data out there to capture. Got to hurry!”

  “Can you find out who the users actually are?” Alex asked.

  “Possibly. If personal data is stored on this site, this is where I’ll find it. But I better move fast. There’re hundreds of files in this root directory.”

  A few minutes later, he whistled again. “Bet this is the personal data. It’s encrypted, but there are thirty-nine entries. I get it. Admin’s got personal data logged on all of the other users, but none on himself. I wonder if the users even know one another? I bet none of them know who he really is.”

  He typed. “Logging this session.”

  “Are you copying everything that’s in that file?” Kateri asked, squeezing her rosary beads. The realization that Mr. O’Donnell was accessing personal information on dangerous criminals had hit her now.

  “Yes. I’m just copying the files onto a tarball—sort of a zip file—connected through the cave site—compressing the data, bouncing it back through the servers I went through—not as fancy as a reverse DNS tunnel, but it’s safer because it’s just using the connection I already opened.” He glanced at Kateri.

  “Hope you understood at least some of that. The important thing is that it’s all going to be written to a CD-R on the drive right here.” He pointed to a flat box connected to the computer. “I’ll get a copy to the FBI, but I’m going to make a few dozen copies myself just to make sure.”

  “Great,” Kateri breathed. “Just checking.” She reminded herself not to bother Mr. O’Donnell while he was hacking. Not good to be distracting him when time was of the essence.

  She concentrated on her rosary, and she was on the Fourth Joyful Mystery when Mr. O’Donnell spoke again. “Okay, I found the bank. This is where the money is funneled into the site.”

  Alex leaned forward. “From banks?” Kateri squinted at the screen, but she couldn’t understand it. It was just more numbers and data.

  His dad was nodding his head. “From banks, and from other places. There’s a lot here. And the withdrawals are mostly electronic transfers, but a handful of checks like the one we were sent. Yep, the checks are issued to unknown recipients and locations. Only the amounts are recorded here.” His fingers flew over the keyboard. “Okay. Logging all of this. It might take some time.” After half a minute, he said, “Once I get everything, I’ll start transferring all the data to my computer, and writing it to the CD-R for safekeeping.”

  “That’s going to be pretty incriminating evidence. Stealing from a bank is what—mandatory ten years in federal prison?” Alex asked. Suddenly his eyes fixed on his own computer screen. “Dad. Don’t mean to distract you, but someone’s onto you. Intrusion detection system says we’re being portscanned.”

  Kateri wasn’t sure what it meant, but she could tell from Mr. O’Donnell’s tensed back and increased finger speed that it wasn’t good. But all he said was,

  “So they found us already.”

  Alex’s eyes were glued to the screen. “I’m checking our security. Looks good…enhancing security…well, guess I can’t enhance it any more… Okay, now the computer says that someone’s attempting a brute force SSH login.”

  His dad didn’t answer, but continued to click and type, click and type, the screens flickering by so fast that Kateri couldn’t believe he wasn’t dizzy. “For what it’s worth, I’m gumming up their processes while our data downloads. If this works, their banking system’s going to start shutting down, and the more they try to fix it, the more it’ll get confused.”

  “In other words, you’re stopping them from stealing money? Go for it,” Alex said, still watching his screen. “I can’t tell that this guy who’s trying to get in is making much headway.”

  “It’ll just take me a few more minutes,” his dad murmured, his fingers still flying on the keyboard.

  Then Kateri saw a bright red security box open on the computer. “Dad, he’s in!” Alex exclaimed.

  “How’d he get in? Run diagnostics. Find out and shut off the portal.”

  Alex quickly clicked on some menus. For a few seconds he searched and then groaned. “The front desk computer! He got in through there!”

  His dad moaned. “Of course. Probably got in through some lousy Windows bug that Microsoft hasn’t got around to patching.”

  “Kateri, shut down the computer at the front desk,” ordered Alex, and Kateri jumped to obey, but his dad said, “No, wait! You can’t! Our connection is coming through there. If you shut it down, what I’m doing is going to be cut off.”

  Saying something unflattering about Bill Gates, Mr. O’Donnell continued to click and type feverishly.

  “Dad, he just established a reverse command.com shell prompt on the network,” Alex reported, reading from the screen.

  “Close down his processes!”

  Alex hit the control-alt-delete keys simultaneously on his computer, scrolled through the menu that came up and hit “delete.” “It’s not working. I can’t shut him down. Looks like we just got a new administrator for this computer too.”

  “He’s already made himself admin.” Mr. O’Donnell said softly.

  “What does that mean?” Kateri queried.

  Alex was grim. “It means he can do anything he wants, including disrupting the CD record, so Dad loses everything he’s just gotten. And we can’t do anything to stop him—” All at once he sat up, “except—wait a sec—this!”

  He suddenly hit several keyboard commands in a rhythmic sequence, and the most colorful Internet Security Override program that Kateri had ever seen leapt onto the screen.

  The Samurai Cat was seen from behind, facing into the screen, but the same familiar balloon appeared over his head:

  Can I Has Swordfights?

  Alex attempted a cocky smil
e. “Bet our intruder doesn’t have privileges over de Cat.”

  Dad glanced at the screen. “He doesn’t. It’s prioritized over everything on the system by hooking into the Windows kernel’s system calls. A rootkit, but a good one. He can’t get around it.”

  Alex took up the gamer’s posture. “Until he defeats me.”

  “Um, yes. That’s the problem,” his dad said, his tone falling.

  “Not a problem!” Alex exclaimed, maneuvering his fingers to make the cat leap back and forth with his sword. “My plan is to be undefeatable!”

  Kateri swallowed. Despite Alex’s usual bravado, she could tell he felt the pressure.

  A large, spiral-shaped drill appeared hovering in the air over the cat’s head and jabbed towards the cat, who swatted it away easily with his sword. “That’s the other guy’s cursor,” Alex said, tapping the arrow keys to maneuver the sword. “Everyone always does that first. He definitely sees the Security Cat, all right.”

  The cat threw his sword from hand to hand, then paused, the same way Kateri had seen Alex pause before a fight, waiting for his opponent’s first move.

  “Bet he’s pretty ticked off,” Alex said. “He’s trying to shut me down. Ah. He discovered he can’t. So bet he decides that the Cat Are Worth Fightings.”

  The cursor quivered in the air suddenly and dove down. Swiftly Alex parried via keystroke, and the huge drill bit went spinning away. But it quickly dove down again, like a massive hornet, and jabbed over and over and over again, slashing at the cat from every side. But the cat’s sword met it every time.

  The cursor pulled back, and then suddenly came in from the side, pushing the cat towards the side of the screen, but Alex parried every blow and finally, hitting two keys, gave a tremendous clout that sent the cursor flying and ricocheting off the corners for several seconds.

  “Ooh, bet that ping-pong action sequence made him mad,” Alex said, as the cat’s sword momentarily changed to a paddle and he sassily leapt from side to side. “Better get ready for a counterattack. I think this guy’s a gamer.”

  The drill finally stopped bouncing and drove abruptly down at the cat, stabbing and withdrawing, stabbing and withdrawing, switching from one side to the other. Alex rapped quickly in a constant staccato on the keys.

  Suddenly the cat staggered back, a red gash appearing on his arm. Kateri winced. “That’s not good.”

  “Just a flesh wound,” Alex said, parrying and striking back, sending the cursor flying again. “Dad? How are you doing there?”

  “If you can hold him off for ten more seconds, I’m going to grab the log of online activity,” Mr. O’Donnell said.

  “Can do,” Alex said. “Oops!”

  Blood spurted from the cat’s other arm. “Isn’t there an option where you don’t have to die?” Kateri begged.

  “Nope,” Alex said, squinting at the screen. “Dad made the cat tough to beat, but not impossible. Fair is fair.”

  The cursor came down again. Undaunted, the cat swept his sword again, dodged and kicked at the cursor, landing a few karate blows on its point.

  “He might hurt me this way, but I get health points for doing it,” Alex murmured, continuing his patter on the keys. “If I can get in one good kick—there!”

  Again the cursor bounced off the side of the screen crazily and bounced from corner to corner while the cat danced with a ping-pong paddle.

  All at once, the cursor vanished.

  “I got it,” his dad breathed hard. “I got it all. Written to the CD-R. Secured it by generating a signature checksum for the archive, and I’m keeping the hash for that offline. Okay, let’s shut down and get out of here.” He unplugged the box from the computer, then set back to work on the keyboard, working his way back through the menus.

  Alex remained poised at the computer, fingers over the keys, waiting, while the little cat on the screen held his katana at the ready.

  Kateri became aware of the faint whine of the computer’s cooling fans in the silence.

  “Is he trying to get around you some other way?” she asked.

  “Maybe,” Alex said. He flicked his eyes at a corner of the screen where the intrusion detection box was still open. “No, he’s gone. He’s shut down his internet connection to get rid of me.”

  “In that case, let me shut down Windows and patch that hole,” his dad said, closing down his computer. He got up, and patted Alex’s shoulder. “Good work, son. Thank you.”

  “No problem,” Alex said, as he continued to watch the screen. He tapped the keys, and the Samurai Cat leapt back and forth, sword ready.

  “Okay, I was wrong,” Kateri said. “Maybe video game skills can be useful, sometimes.”

  “Every once in a while,” Alex said lightly. Both of them continued to stare at the computer.

  “I think he’s not coming back,” Kateri said at last.

  “But they know where we are,” Alex said, almost to himself. “And they know what Dad stole from them. Sooner or later, they’ll be back.”

  And for once, Kateri didn’t doubt him.

  For the next few days, Mr. O’Donnell was working on the data he had captured from the cyberthieves’ site every moment he could spare.

  He had delivered a copy of the raw data to Agent Randolph at the FBI, who almost betrayed a sign of surprise and appreciation. But Mr. O’Donnell continued to sift through the information on his own, hoping to unearth more evidence for the FBI, and Agent Randolph had encouraged him to keep at it.

  Kateri was nervous. As far as she was concerned, Mr. O’Donnell couldn’t get that processed information to the FBI fast enough. But even then, as Alex pointed out to her, what was going to happen? Even if Mr. O’Donnell could pinpoint the identities of each of the users of the Mystery Site, what good would that do? The forty users, if that’s what they were, could change identities and move. They probably did it all the time. And Mr. O’Donnell said it could easily be one person with forty different usernames. Or a thousand and two hundred, with thirty people each sharing one username.

  In any event, Kateri was expecting something to happen. So the events of Wacky Wednesday undid her completely.

  A week had passed since Mr. O’Donnell’s hack, and once again, the hotel was bereft of guests. The last one checked out at nine. So Alex had switched places with his dad to take his mother out shopping, and Sam and David, in a fit of stealthy rebellion, had managed to go along.

  So it was that Kateri found herself left alone to do all the rooms.

  Granted, there were only three rooms to do, but that didn’t help her mood.

  She pulled out the laundry cart and began to trundle down the hall to rooms 103 and 109. The guests had left these in relative disarray—they had used all the towels, unwrapped all the soap for some reason (maybe they had a toddler?), and the wastepaper baskets were overflowing and smelly. Kateri took a practiced whiff and wrinkled her nose. Yes. Diapers.

  She emptied the trash first and doused the cans with scented disinfectant.

  Then she washed down the solid surfaces, and on a hunch, did a deep-cleaning check and found plastic zoo animals thrust into the cracks of the mattresses. She removed them all (she was keeping a Lost and Found box whose contents grew increasingly interesting) and checked the ceiling light and found a burst balloon.

  Great. She would recommend replacing the fixture with something more impenetrable. Another thing for the To-Do List.

  Then, starting from the back of the room and moving forward, she dusted the furniture, made the beds, and cleaned the bathroom. She swept the bathroom, pushing the dirt out onto the carpet. Finally, starting from the window at the rear of the room, she vacuumed, saving her last pass to clean up the bathroom dirt pile on the way out. Door closed, room done, and ready for the next guest.

  Onto room 109. It took her a half hour longer to clean this room, where someone had apparently gotten sick. The bed mattress smelled disgusting, and she hurried back to the janitorial closet for additional cleaners. She deci
ded no one was staying in this room for a while as she scrubbed the mattress and yanked it off the bed to let it dry in the sunlight from the undraped window. She would tell Alex to take its keycard off the reservation list.

  It was much later than she expected by the time she wearily pushed the cart up to room 310 for the last cleaning. This one, at least, was fairly standard, but there was a curious smell in it that she couldn’t place and couldn’t get rid off.

  After searching every corner for the source, she finally located it beneath the solid box bottom of one of the dressers: a molding hamburger. It had left a round dark spot on the carpet. She tossed the offending item, overturned the dresser and scrubbed the bottom, and applied carpet cleaner to the carpet. Actually, she should probably shampoo the entire room. Another room that would have to be taken off the roster for a day or so.

  By noon, she finally pushed the laundry and cleaning cart downstairs, sweating and irate, and had only one thought: she needed a swim. She put everything away, glanced at the clock and wondered what was taking the O’Donnells so long? Well, she would just have to hope that someone else would answer the phone or the desk. In her room, she changed into her swimsuit and coverup, and then hurried to the pool. Maybe she could get at least a five-minute swim?

  She ran to the glass door, slamming into the bar to open it, and was crushed against the glass. It hadn’t opened.

  It wouldn’t open.

  Puzzled, she checked the handles. They wouldn’t budge. She needed the keycard.

  Hoping that if someone came to the desk, they would mistake her for a guest, she ran to the office in the lobby in her bare feet. Mr. O’Donnell, who was supposed to be taking over Alex’s shift, wasn’t there. The office was locked, and Kateri’s blue staff key wouldn’t open it.

  She remembered she had a copy of the red master key in her purse, which was in Alex’s car (Alex had taken the van to the store). She decided to dash out the front door and grab it.