by Reece Hirsch
“Great. If there was another copy on Middendorf’s home computer, we can work with the Dutch police to retrieve that, too.”
“But that, my friend, is only the beginning.” Ed glided over to a monitor in his desk chair. “Check this out.”
Chris sat down next to Ed and studied a string of computer code on the screen. Ed watched his face for the moment of recognition. About a minute later, Chris said, “It’s a worm—a virus.”
“You got it,” Ed said.
“But it’s not like anything I’ve seen before from a hacker. This coding is extraordinarily complex. And it’s huge.”
“Not your father’s malware, right? It’s about twenty times the size of most viruses.”
“What does it do?”
“I can’t tell yet. The adversary is pretty good at masking his intentions.” Computer security experts commonly referred to a black hat hacker as “the adversary.”
“What do you have so far?”
Ed leaned forward in his chair, bringing his face to within inches of the monitor screen. “I’m still working on unpacking it. It’s heavily encrypted. What I do know is that the exploit is designed to hide itself once it’s infected a computer. That’s why I’ve given it a name—Lurker.”
“How does it hide?”
“It’s pretty cute, actually. Once Lurker invades a computer, it shuts down whatever security system is installed. But then it goes further. The virus blocks the computer from communicating with a list of top computer security websites and blocks all Aspira security updates.”
“So it’s targeting the Aspira operating system.”
“It seems so, but I haven’t found its way in yet.”
Most computer viruses are designed to exploit a vulnerability in a computer system or program, which serves as their point of entry. Since Middendorf had obtained the source code for Aspira, it was likely that he had uncovered some chink in the program’s digital defenses.
“And get a load of this,” Ed said, pointing at a segment of coding. “It can use Bluesnarfing to spread itself wirelessly to any devices that are linked to an infected computer by Bluetooth. And it plants a beacon so that information on the infected system is beamed back to the hackers. They can monitor the infected computer and activate the virus remotely from a command-and-control server whenever they want.”
Chris frowned. “Bad news for the client.”
“Let’s hope that Middendorf didn’t share the source code with any of his hacker buddies,” Ed said.
“Probably a safe assumption. He seems to have hidden the flash drive, because he was holding out on whoever killed him. And they clearly weren’t done with him when I showed up.”
“Now look at what else I found on the drive,” he said, pushing off from the desk and rolling over to another monitor.
Chris leaned over the screen and saw strings of what appeared to be messages from an Internet Relay Chat network. IRC was a favorite mode of communication for hackers because it didn’t require an account, and messages were nearly untraceable—unless one of the participants copied the thread.
The content seemed innocuous—boasts about firewalls breached and information pilfered. Hackers were even more self-aggrandizing than rappers.
“Looks like the typical hot air,” Chris said.
“Keep reading.”
Chris pointed to a line of text. “Here’s Black Vector talking to two of his hacker buddies, named Enigma and Ripley.”
Chris examined the message board postings more closely. “Look at what Enigma has to say here,” Chris said, pointing at a line of text on the screen.
ENIGMA: We were beginning to worry about you.
RIPLEY: I came by your apartment twice yesterday and no one answered the door.
BLACK VECTOR: I’ve been around.
ENIGMA: We need that source code.
BLACK VECTOR: Not a problem. We can meet up on Friday. I’ll text you with a place and time.
ENIGMA: That’s three days. I can’t wait that long. You know that there’s no backing out at this point, don’t you? Circle the date—January 14.
RIPLEY: He’s right. We need you.
BLACK VECTOR: I still think you could make the same point with a smaller event. People are going to die. Maybe a lot of people. Wasn’t Albuquerque enough for you? I didn’t think this was what we did.
Chris stopped reading and sat up straight, remembering the news coverage a week ago of the midair collision in which twenty-one passengers were killed. “These are the people responsible for the virus that took out the Albuquerque airport.”
Ed nodded grimly. “Keep reading. It gets worse.”
ENIGMA: Every once in a while, there’s a moment when the world changes, but it takes a while for people to catch up to it. It’s like when the atomic bomb was invented. On January 14, we’ll show the world what a cyber Hiroshima looks like. An act of war—but waged in code. Albuquerque was just a trial run. Fitting that it was in New Mexico—just like Los Alamos.
BLACK VECTOR: You know what’s going to happen to us if they figure out that we’re behind this?
ENIGMA: Don’t worry, they’ll never find us—as long as we stick together.
BLACK VECTOR: This is just a little heavier than I’m used to, you know?
ENIGMA: You’re at home right now, aren’t you?
BLACK VECTOR: Yeah. Why?
ENIGMA: I just happen to be in the neighborhood. I can be there in five minutes to pick up that flash drive.
“Now look at the date of the chat,” Ed said.
“January 4, 7:00 a.m. This was only an hour or so before I arrived at Middendorf’s apartment. That means that this Enigma person must have killed Middendorf.”
“They were probably already watching his apartment building when they sent these messages,” Ed said.
“And Middendorf knew that he didn’t have time to escape, so he made a copy of the IRC chat and hid it to identify his killers.”
“So what about all this talk about cyberwar?” Ed asked. “Does this sound like a legitimate threat or just more hacker delusions of grandeur?”
“Given the sophistication of the coding in that virus and the connection to the Albuquerque airport event, I think it would be a big mistake to ignore this,” Chris said. “But that’s not our call, is it?”
“You’re going to take this to the FBI?”
“Right. If they’re really going to activate this virus on January 14, that’s only a week away.” Of all the federal agencies, the FBI took the greatest interest in combating large-scale computer viruses, but these types of threats were also within the purview of the Department of Homeland Security and the National Security Agency.
“But first, we need to share all of this with BlueCloud,” Chris said. “After all, it was obtained on their behalf and belongs to them. If they agree, we’ll disclose to the feds. We don’t want anyone thinking that we’re holding out on them.”
Chris knew that BlueCloud would have to produce the copy of the Lurker virus and the transcript of the message board chat to the FBI. If there was any truth to what the hackers were saying about the attack, then this was far too big to withhold.
But just because he shared the information with the FBI, didn’t mean that he couldn’t also conduct his own private investigation. If someone was going to track down the Lurker crew, Chris knew that his client BlueCloud would prefer that it be him so the matter could be handled discreetly. Like the hackers that he pursued, Chris thought highly of his own skills. He figured that he stood a better chance of locating Enigma and Ripley than law enforcement ever would.
“I’ve already begun running some Deep Web searches on the tags Enigma and Ripley,” Ed said. “No hits yet.” The so-called Deep Web consisted of more than one trillion Internet pages that cannot be indexed by search engines like Google.
Chris stared at a panel of whiteboard as if he were gazing through a window. “Enigma. That’s the machine that the Nazis used to encrypt their transmiss
ions during World War II. But what about Ripley?”
Ed smiled. “Ripley has to be a girl. Ripley? The movie Alien? She’s the patron saint of badass chicks.” He paused. “But why do you think it was so important to them to get the source code? They’ve apparently already found a vulnerability for the virus to exploit.”
“They’re in it for the long run,” Chris said. “With the source code, they could find new ways to keep the virus evolving. They could probably stay one step ahead of us for years.”
“It would have been nice if they’d mentioned which city they’re targeting,” Ed said. “Any guesses?”
“Well, they clearly want to make a statement. LA and Chicago are so sprawling it would be very difficult to take them down completely, no matter how sophisticated the virus. I’d guess they’re targeting a place more geographically concentrated—maybe New York, or San Francisco.”
Ed swiveled around in his chair. “I’ve never thought about it until now, but do you know if this building has a backup generator?”
After his meeting with Ed, Chris gave up on the notion of a peaceful morning of working from home. He sat down at his desk and started skimming the emails that had filled his inbox while he was out of the country.
As a matter of professional curiosity, Chris always made a point of checking to see what was in his spam filter. Usually, he’d find an assortment of solicitations for male enhancement products, a few attachments hiding a virus or spyware, and, occasionally, a classic like the Nigerian prince scam. Today, there were 542 emails in the spam filter, an unprecedented number. Checking the quarantined messages, Chris saw that they all had the same subject line—“WE OWN YOU.” Each of the emails contained an attachment. Chris moved them to one of his forensic computers, then clicked the icon. He wasn’t afraid of infecting the law firm’s system with a virus, because the forensic computer was “air gapped,” meaning that it was freestanding and not connected to the Internet.
The attachment opened haltingly to reveal a pdf of a document. It was a death certificate with the seal of the San Francisco Department of Public Health. The name on the certificate: Christopher Riley Bruen. It looked very authentic. Chris had received more than his share of threatening emails from hackers, but there was something about this one that stopped him cold. Maybe it was the lack of an explanation. Maybe it was the care that had been taken in replicating the death certificate. Most likely, though, it was the stark directness of the message—you’re dead.
Then Chris noticed the realistically smudged date stamp in the corner of the certificate—January 14. This was not just a taunt from an angry hacker. It was a threat, apparently from Enigma and company. Or maybe it was a challenge.
He recalled the message from the person on the other end of the webcam in Amsterdam: “WE’LL FIND YOU.” And apparently they had.
CHAPTER 5
The headquarters of BlueCloud, Inc. was a half-hour drive south of San Francisco in the suburban town of San Mateo and consisted of three black-glass office towers strikingly arrayed beside an inlet of the Bay. It was a cool, windy day, and fast-moving clouds scudded in reflection across the buildings’ obsidian surfaces. Atop each of the towers was the company’s logo—the blue outline of a wisp of cloud. Chris had been summoned to complete his debriefing with the client about his all-too-eventful trip to Amsterdam. He would have preferred to dedicate his time to the pursuit of Enigma and his crew, but there was no getting around the fact that he needed a client to fund that enterprise.
No cars were allowed on the campus, so Chris parked his car in the lot outside the security gate. After showing his credentials to a guard in a kiosk, he was escorted to the meeting by a guy in an electric golf cart. The street sign for the road that circled the campus read “Cirrus Drive.”
They hummed across the immaculately landscaped corporate campus. Like a movie studio back lot, the place was a perfectly fabricated artificial environment, the work of a natural image maker who didn’t stop at designing a product. Judging by the uniformly attractive twentysomethings that strode across the campus in business casual wear, Chris half suspected that BlueCloud might soon be announcing a new foray into genetic engineering.
After parking the golf cart out front, the driver escorted Chris into one of the towers and deposited him at the office of Scott Austin, the company’s general counsel. Austin rose from behind his desk, a perfect specimen of his type—short, sandy brown hair graying at the temples, midforties, thickening in the middle, and a demeanor that transitioned easily from gruff command with outside counsel, to dignified subservience with corporate management. But today he seemed unusually cordial.
“My wife always tells me that lawyers lead boring lives,” Austin said, “but you’re like some kind of freaking Navy Seal.” He shook hands with more enthusiasm than Chris was accustomed to and motioned to the chair in front of his desk. “Did you really climb the fire escape and enter that apartment when you didn’t know if the killer was still up there?”
Chris grimaced in acknowledgment.
Austin asked him to recount the full story of what had happened in Amsterdam. After two days with the Dutch police, Chris could run through most of the narrative on autopilot. When Chris got to the part about the faked death certificate, Austin asked, “You get many death threats in your line of work?”
“Not enough to be blasé about it,” Chris said. He produced the flash drive containing the Lurker virus and slid it across the desk.
“Our security team can’t wait to get their hands on this.”
“It has strong encryption. They have their work cut out for them.”
At last, Austin came to the real point of their meeting. “We have another assignment for you. We want you to continue to follow the trail of those hackers. This talk about a massive cyberattack has the C-suite types rattled. If a vulnerability in our operating system caused the shutdown of an entire city … or worse … well, I don’t think this company could recover from a blow like that.”
“Not to mention the city and its population,” Chris said.
“Yes, of course,” Austin hastily added.
“I’ll need to share what we know with the FBI.”
“Understood. We certainly don’t want to impede their investigation. But we think you have a better chance of finding the hackers than they do.”
“I won’t disagree with you there.”
“And if you happen to learn anything about the FBI’s investigation of the Albuquerque event, we’d like to know about it. We’re just praying that the virus used in Albuquerque wasn’t exploiting a vulnerability in our system.”
“So when do I start?”
“Immediately. You’ll have a blank check when it comes to resources. This assignment could not be more important. Even the launch of our new smartphone next month has taken a backseat. To give you an idea of how big this is for us, Dave Silver wants to meet with you personally. You’ve been granted an audience with the great man himself.”
Chris was surprised at Austin’s tone of undisguised snark. “No one needs to tell me what’s at stake for the company.”
“But, you see, for Silver this is personal. He has nearly a billion dollars in stock value on the line. Given my current option situation, I can afford to have a bit more perspective.”
Chris understood that he was supposed to be impressed by a meeting with Silver. Chris had been outside counsel to BlueCloud for ten years but had never met CEO Dave Silver in person. The closest he had come had been a primitive videoconference several years ago that had been so choppy that Silver might have been communicating with him from the Space Shuttle. Chris nodded in what he hoped was an appreciative manner. He knew that in the corporate culture of BlueCloud, proximity to Silver was the coin of the realm, the ultimate badge of acceptance. Out of BlueCloud’s more than fifty thousand employees, Silver only dealt directly with The Hundred, an ever-changing group of anointed insiders who were invited to a supersecret annual corporate retreat hosted by Silver i
n Carmel.
As if on cue, and without a knock, the door to Austin’s office opened and in stepped Dave Silver—the man, the legend, the brand. Austin stood and waited for Silver to speak, as if he were the president of a nation rather than merely a company. Silver didn’t bother to make even a token apology for interrupting. He was accustomed to having everyone stop what they were doing when he entered a room.
Silver’s physical appearance wasn’t particularly striking. He was in his early fifties, thin, medium height, with a receding hairline. He was wearing gray slacks and a blindingly white button-down. But it was his blue eyes that commanded attention—Chris couldn’t quite decide whether they gave the impression of seeing everything or seeing nothing. In the press, the name Dave Silver was often preceded by the word “visionary” but, in fact, what made people like him compelling was their ability to be willfully blind to everything but their own view of the world.
“I wanted to meet you personally,” Silver said. “I was impressed with the way you handled that situation in Amsterdam. You kept your focus and got the source code.”
“I was just doing what you paid me to do,” Chris said.
“Everyone gets paid, but that doesn’t mean that they would do what you did.” Silver turned and said, “Why don’t we take a walk.”
Silver led him out of the building that housed the legal department and into another identical black-glass tower. Silver’s passage through the lobby generated excited ripples among the employees, like a shark gliding through a school of guppies. Everyone moved a little faster in Silver’s presence, heads swiveling, hoping to be noticed or not noticed.
They passed three increasingly forbidding security stations without so much as a word or the flash of an ID badge and entered a wing that bore a sign overhead that read simply “Lab.”
By this point, Chris knew where he was—it was the super-high-security laboratory where BlueCloud kept the prototypes for new products. The room was spherical and everything was pristine white—the desks, the chairs, the sheets that were draped over the white tables. It was part showroom, part working lab, part impregnable vault. The tables arrayed around the large room held the fetish objects that geek dreams are made of—the next generation of the world’s most popular smartphones and tablet computers, and maybe a new device or two that the world didn’t yet know that it couldn’t live without.