Zero Day

by Mark Russinovich

  Although the Internet had proven itself enormously popular with the worldwide community and had become increasingly vital to the lives of individuals and the welfare of Fortune 500 companies, interest in safeguarding it wasn’t as high as it ought to be. Jeff was convinced that it would take a significant failure of the system or a coordinated cyber-attack to awaken everyone. Just as it had been impossible to put the United States on a proper war footing before Pearl Harbor, the same fate seemed to await the future of Internet security. No one liked being Cassandra, but he’d found himself playing that role, seen as an alarmist while his warnings were ignored.

  Jeff dragged his thoughts back to the present. “Though my primary concern was cyber-security, I knew the Internet could be used to organize and coordinate terrorist attacks,” he told Sue, taking up where he’d left off. “I wore out my welcome arguing for resources. I finally decided that only a seriously mounted terrorist attack against us with significant damage against a target that mattered was going to shake the lethargy of the intelligence community.”

  “I guess we got that on 9/11, didn’t we?” Jeff seemed to wince, and for a moment Sue feared she’d misspoken.

  After a pause he said, “You’d think so, but I’m still not sure they got the point.”

  Sue freshened their coffee and pushed the container of skim milk closer to Jeff. “Go on,” she encouraged.

  Jeff prepared his coffee as he continued, “In those days I spent a lot of nights trolling hacker chat rooms looking for signs of a plot.”

  “Not much of a social life.”

  Jeff smiled. “No. Probably about as active as yours.”

  “I might surprise you.” She pointed her raised cup toward him. “But finish the story. I’m waiting for the part about bosses not listening.”

  Jeff looked away. How much did he really want to say? He’d avoided the subject until now. But maybe it would be good to talk about it.

  First he told her how for most of 2001, he and his team, when available, worked to retrieve information from the hard-drive disks sent to him. Seized from various terrorists or terrorist suspects by a wide range of agencies throughout the world, the disks, or copies of them, had ended up in the hands of the CIA. If British SAS captured an IRA suspect, the hard drive from his computer, or its clone, would at some point find its way to Jeff’s desk. It was the same for the Mossad. Even the CIA’s own meager foreign-agent force produced disks from time to time.

  As is generally the case in intelligence, the individual bits of data he produced from these sources by themselves meant little. Once he plucked them from the disks, though, they were fed into a master program by his unit, where they might, or might not, assume their proper place in the database about the terrorist world. He never knew. In fact, he had no idea if anyone was routinely consulting the growing body of data his unit was compiling on the operations of various worldwide terror groups.

  “So what happened?” Sue asked. Jeff saw how eager she was and wondered for a moment how she’d react to the whole story.

  “I really can’t go into it. Let’s just say, my boss and I had a disagreement, and I left.”

  “There’s a story there you’ll have to trust me with sometime,” she said mischievously. “Is that when you started your own company?”

  “Yes,” Jeff said, glad to change the subject. “Turns out all those contacts I made with the Company were good for something. It’s been a bigger success than I ever expected. One job after another. So no complaints there.” He sipped his coffee and turned to the problem at hand. “Let’s get back to you. The bad news is that your records, financial as well as work product, are all but a total loss from what I can see. I keep holding out hope they’ll turn up somewhere, but I don’t think so.”

  “Is there anything you can do for us?” She looked hopeful and he hated having to disappoint her.

  “I’m trying to identify the virus sufficiently so that we can be certain it’s not in your nightly or weekly backup. With that information we can determine if they’re clean.” He held up a hand of caution at seeing her become crestfallen. “I haven’t found a hint of when you picked this up, so I can’t tell from the time frame which, if any, of your backups are clean. It could have been lurking in there a very long time.”

  Sue bit her lower lip. “I was afraid that might be the case.” She thought a moment, then gave him a wan smile. “So the worst-case scenario is that our current computers are fried. Useless. Whether or not we can recover the data from the backups, I’ll still have to install a brand-new system. It will kill me.” She made a face at the very thought of it. “It’s going to take weeks to physically put everything in place, then load and link the software, then at least a month to get all the bugs out. And we have to know how to find this virus before I can activate it with our old data so that someone doesn’t inadvertently reintroduce it. I don’t even want to think about that.” She looked into his eyes. “Save me from it all, will you? I’ll be very grateful.” She drained her coffee, then yawned. “Have you noticed these marathon sessions are getting tougher and tougher, the older you get?”

  “Give me a break, Sue. You’re a kid compared to me.”

  Sue smiled. “It’s been good talking, though. If I get canned, I might come looking for a job.”

  “It won’t come to that, I’m sure,” he said, though it wouldn’t surprise him if she ended up being the scapegoat. It wouldn’t be the first time he’d seen that happen.

  “I might come looking anyway.” With that, she gave him a warm smile and left for the IT Center, her short hair bouncing, lean hips swinging.

  * * *

  Back at the office a bit later, Jeff asked if she’d found anything useful.

  “Almost nothing.” She grimaced. “I examined the logs. As I’m sure you know, we’re hit thousands of times a day by malware looking for a vulnerability. Some of it’s generated by a living hacker, but most are by automated worms, trolling the Internet. It was a bit daunting, realizing how under assault we constantly are, but I didn’t see any failure in our protection. This obviously got through, but I can’t see when or how. Wish I could be more help.”

  “And Harold?”

  “I’ve had him reimaging the lawyer workstations and laptop systems in the office with clean system installs of the operating system and necessary applications. He’s also checking the e-mail archives and database for signs of tampering.” She yawned, covering her mouth with the back of a hand. “Last, but not least, I’ve got him screening all the complaint calls we’re getting from associates. They don’t pay me enough to do that.”

  She hesitated as if considering something, then said, “I’ve been meaning to mention a string I came across in your printouts, but you were awfully busy. I don’t think it’s anything important, but look at this.” Jeff leaned over and read:

  Sh3 w!ll n3v3r 13t ur sp!r!tz d0wn

  Sh3s a v#ry k!nk! g!r7

  Jeff realized he’d missed the text in his earlier scan. Sometimes the clues to a cracker were in the ego parts, those sections of code about himself he couldn’t resist inserting. “I never saw that. What is it?”

  “Don’t laugh, but I think it’s leet-speak,” she said, straightening up.

  Leet-speak was hacker language. Malware authors often left their calling cards in their code, even if it was only for them and other hackers to see. Since this one was originally encrypted, it was obviously not meant for the eyes of security investigators.

  “It’s ‘Super Freak,’” Sue said, dropping her arms.

  “‘Super Freak’? The song?”

  “I think so.” Sue wrinkled her brow. “How does it go? ‘She’s a very kinky girl, the kind you don’t take home to mother.” Sue’s singing voice was surprising deep and guttural. Now that she had the words and the tune, she was really getting into the song, swinging her hips, raising her voice. “Yeah! I’ve still got it! Our hacker likes Rick James punk funk. He’s not all bad.”

  “Aren’t you a bit
young to know Rick James? ‘Super Freak’ was … what? Sometime in the early ’80s?”

  “Rick James is classic.”

  Jeff looked back at the screen. “Okay, ‘Super Freak.’ But what does it mean? Is that the name of the virus? Or the cracker’s handle? Someone who’s a Rick James fan?”

  “Super Freak” might be significant, then again it might not, Jeff thought. Some virus code changed hands so many times all kinds of leet-speak from script kiddies crept in. It might not be connected to the virus’s author at all.

  “It might be his cyber handle,” Sue suggested. “You should be looking for it in any code you find. I’ll see if I can turn anything up in hacker chat rooms later.” She yawned again. “I’m beat.” She gave him a winning smile. “I’m going to lie down for a bit. I haven’t pulled an all-nighter since college.” She turned and walked away toward the couch, stretching as she did.

  “No problem,” Jeff murmured. “I’ll probably lie down a bit later myself. I’ve still got some juice, though, and will feel better if I can get something definite before taking a real break. Your boss will ask, I’m certain.” He looked over at Sue; she was already asleep.

  10

  BROOKLYN, NEW YORK

  MERCY HOSPITAL

  TUESDAY, AUGUST 15

  8:09 A.M.

  Daryl Haugen was given full access to the IT center in the basement of Mercy Hospital, where she found the staff cooperative. They’d taken the deaths of patients personally. Winfield had dropped by several times, but she had nothing to give him. Working not far from a furnace at an unused station, it had taken nearly a day of work to unlock the code she detected in the server. Yet, so far, she’d turned up nothing useful.

  She felt the adrenaline coursing through her despite the long hours. These crackers were so full of themselves, so certain they could fool everything, she went after them with a vengeance. She’d never been able to tolerate such self-satisfaction. She found it interesting that George Carlton, officially the man responsible for stopping this sort of thing, was no less egocentric. For some time she’d thought he was just pitching his department when he crowed about his accomplishments, but she’d come to realize he actually believed he was doing an effective job. Contempt scarcely described her true feelings toward him.

  Something had scrambled the hospital medication program; she just couldn’t identify it. Her staff in Virginia was on this, but thus far they’d come up with nothing useful. The more people of talent and skill she had engaged, the sooner they’d have a solution, so she’d been glad Jeff Aiken was available. He was bright, creative, and hardworking. From her experience she knew he had the knack of thinking outside the box.

  Daryl had located suspect code from a corrupted registry file and was now running it through a string analyzer, a program that dumped any data values in the file that could be represented with a printable character. Many code values translated to printable characters so there was a lot of garbage, but she also saw strings the programmer had in the code that referenced registry settings and files. Programmers often left debugging code that included messages in place that would be revealed in the string output. It took Daryl a few minutes to go over the strings, which largely looked like this:

  rX + %”/

  Lep

  }ccc

  oaaaa_ep

  LRI?9

  z_____/VK<-

  XRG???

  m988m

  4TTTTTAWK-

  999877766mv.,0A@UTTTU

  hRU

  8877666.,,,&&&1TU

  YRIPPPF

  m.1,,,,,2TW

  PPPP

  FFEEEDD

  As she scanned the text, Daryl spotted a few strings that vaguely resembled words, but weren’t quite English. One grabbed her attention because it looked as if it contained COM, the domain of most Internet sites:

  ABKCOM

  But it was missing a separating dot between ABK and COM that would show up if the string were actually a universal resource locator, or URL, such as ABK.COM. Had the programmer left out the period for some reason? Perhaps it was a mistake or an attempt to hide that it was a URL. Trying to find clues and vaguely feeling as if there was more to the snippet, she continued examining it, letting her mind take her where it would.

  Intuition struck. Picking up her pen, she wrote the letters backward in her notebook:

  MOCKBA

  Of course! That was “Moscow,” written in Cyrillic.

  Moscow! Why would that be a string? She searched for other clues in the text around it but found nothing. And why would a Russian hacker want to change the medication program in an American hospital?

  She shot out of her chair and began to pace. It made no sense.

  Of course the hacker could have copied code originally written by a Russian. But if it was Russian, the purpose of the virus should have been financial, since that’s what most Russian malware was about.

  Unless this was something else.

  Daryl had been a child prodigy, smart as a whip from the first. Her parents, both professors at Stanford University, had encouraged her wide-ranging interests from the time she was a toddler. As their only child, she’d received undivided love and attention. So easily had things come to her, the child Daryl had been surprised to realize how slow her classmates were, even in the accelerated classes she attended. As she moved into her preteens, she finally found her place at a prestigious academy.

  Under the tutelage of a teacher from Spain, she’d discovered a natural affinity for language. Before she was twelve years old, she spoke Spanish, Portuguese, and Italian fluently. The transition into Latin and French in her teens was seamless. For a time her parents were convinced she would become a linguist, and they accepted that as her natural vocation.

  But Daryl also enjoyed mathematics and computers. As each drew her increasing interest, she found herself more and more in the world of boys. When she began to blossom at age fifteen, even the geeks with whom she spent most of her days noticed, though they were too awkward and shy to do anything, a situation she thought was just as well. The last thing she wanted was a collection of panting admirers getting in the way of her real loves, numbers and the computer.

  Daryl had gone to MIT at seventeen, then done her Ph.D. work at Stanford, while living with her parents. That had been nice, seeing them as adults, as equals. She’d come to appreciate the remarkable upbringing they’d given her. As she neared completion of her graduate work, Daryl had considered what to do. She’d always wanted to get the bad guys and briefly considered applying to the FBI. In the end she went with the National Security Agency, which had a greater use for her particular skills. The NSA intercepted foreign communications to develop intelligence information and relied extensively on computers to make it all happen.

  Daryl had always been most comfortable working alone, though consulting with Jeff Aiken had come naturally. In recent years she’d stayed in routine business contact with him, especially when working on a new virus.

  They had met at Langley, in the old CIA, the Company, before the 9/11 fiasco and the creation of Homeland Security, back in the days when the CIA thought it knew everything. She’d been sent from NSA as part of a show committee of cooperation. In fact, none of the American intelligence agencies cooperated significantly with one another, not the FBI, DIA, NSA, or CIA. But they were routinely admonished to cooperate, so committees such as hers were created, and meetings such as the one where she’d met Jeff were held from time to time.

  “See if you can find anyone there,” her boss had instructed, meaning, see if she could connect with someone useful, willing to share information despite the unofficial policy against such cooperation. Jeff had been a new face so she’d taken the open seat next to him, separated by the corner of the conference table.

  Jeff was a handsome man, one who took care of himself, she noticed as she waited for the meeting to start. Not at all like most of the others in the room. He placed a mug of black coffee on the coaster before him, then
said, “Could you hand me the Sweet’n Low, please?”

  The bowl was to her left. She’d reached over and handed him a pink packet. The moment their fingers touched, an electric shock went through her body. His hand hesitated; she was certain he felt the same thing. She looked at his clear gray eyes. He glanced at hers, then looked away. Clumsily opening the sweetener, he poured it into the mug, spilling almost as much as he put in the coffee. “I’ll need a napkin. I’m all thumbs today,” he’d said without meeting her eye.

  During Daryl’s junior year at MIT, when she was 19, she’d been heavily courted by the scion to one of America’s wealthiest and oldest families. With a name embarrassingly long and followed with the number IV, he was considered the most desirable catch on campus. When her dorm sisters first realized that “Four” was interested in their nerdy roommate, they’d been envious.

  Daryl had never before been courted, not like that, and found the experience interesting as a form of minor cultural ritual. Four was pleasant when he wanted to be but, she’d told her mother, not really quite smart enough for MIT. She wondered why he’d come.

  “Because Dad wanted me to attend Yale,” he’d told her one evening when she asked. “Anyway, I like it here, better since meeting you.”

  That night they’d gone to bed for the first, and only, time. In his room Four had stopped her from undressing, telling her he wanted the privilege for himself. She’d stood unmoving as he slowly unbuttoned and unzipped her out of her winter clothing. She’d observed the experience as if it were occurring to someone else, as if she were standing to the side. When at last she was down to her bra and panties, Four had pressed her to the bed, removed his clothes, then lay beside her. Then he slowly removed her bra and panties, breathing heavily as if lost in a trance.

  It was January, and from the uncovered window silver moonlight spread across her now nude body. Four stopped as she lay naked and said over and over, “Magnificent. Magnificent.”