Gennady picked up his gun and turned to Tom. “Go double-check the doors and all the windows.”
Chapter 52
By three a.m., Gennady had completed a translation of the document’s first section:
Security Clearance: Top Secret, Level 3
Categorization: Information cyber-warfare
File Number: SVR-11-1078-52
Codename: Florentine
Background
Between 2001 and 2005 the SVR placed six assets within Microsoft’s Redmond, Washington and Bangalore, India engineering centers. Since their introduction, these assets introduced back doors into a series of Microsoft products and systems that enable the SVR to covertly broadcast attack commands to Windows computers, worldwide, and then execute these commands on preset trigger dates. This system was designed to enable Russia to launch Internet-scale attacks on hostile nations or blocs, and provides Russia with an unrivaled cyber-warfare capability.
SVR studies estimate that roughly 85–90% of the world’s computers now run on Florentine versions of Windows. Roughly 82%–87% of these computers are permanently or semi-permanently connected to the Internet and may be targeted. This gives Russia control over between 69% and 78% of the world’s computing infrastructure and the ability to launch massive-scale digital attacks.
Due to the immense strategic advantage conferred by the Florentine system, it has been classified at the highest level of secrecy. Disclosure of this document, project, or any related materials to those with less than a Level 3 security clearance has been categorized as an act of high treason under Russian law.
The remainder of this document describes the technical nature of the Florentine system and provides specific details on the following items:
1. Attack logistics (launching, targeting, and timing attacks, payload creation)
2. Attack management (monitoring attacks, cancelling attacks)
3. Florentine distribution statistics, by country
4. Attack propagation/saturation estimates
“I’m willing to bet that the Florentine.exe file we found inside the video is a Command and Control program,” I said.
Gennady looked at me questioningly. Tom looked up, shaking his head. “What? Sorry, I’m spent.”
“If what this document says is true, most computers around the world have this back door built into them. So let’s say the Russians want to launch an attack. How do they go about doing it? They need some way of contacting all those computers and unlocking their back doors to send them the attack. I’m betting that’s what the software on the thumb drives is for—it’s a Command and Control program. Some disaffected Russian intelligence guy must have figured he could take an early retirement by selling a copy of it to the highest bidder. I wonder how Richard Lister got hold of it—this is big-time stuff.”
“If you’re right, and the wrong people got control of this thing …” Gennady’s voice trailed off.
“We need to get this to the NSA as soon as possible,” I said, glancing over at the clock. “Gennady, do you think you can translate the rest by morning? I can help with any technical terminology that doesn’t make sense.”
Gennady nodded warily. “Yeah. Let’s do it.”
When I woke up, I found Gennady sitting at Tom’s computer desk perusing a stack of printed pages. He looked exhausted. Next to the stack sat his gun, an empty coffee cup, and a half-eaten plate of scrambled eggs.
“What time is it?” I asked, bleary-eyed.
He consulted his watch. “Seven-thirty. You fell asleep around three, and I figured you needed the rest. I finished a rough translation of the rest of the document.” He shook his head wearily. “This is either the world’s first digital atomic bomb, or the world’s most elaborate hoax. I can’t figure out which.”
“Based on recent events, I’m guessing it’s the former.”
After using the bathroom and grabbing a plate of cold eggs from the kitchen, I reviewed the rest of Gennady’s translation. He was unable to translate some of the more arcane technical terms, but overall, the nature of the Florentine project was crystal clear.
The Florentine’s design, frightening in its simplicity, effectively granted the Russians the ability to take control of virtually any and every Windows-based computer on the planet—without being discovered and blocked in the process.
“The brief said something about using Windows Update to distribute attacks,” said Gennady. “Does that make sense to you?”
It did. And it scared me. “The Russians knew in order to launch an attack, they couldn’t just directly connect to the world’s billions of computers and send each of them the attack. That would fail. Most of the computers they’d want to target would be protected by firewalls.”
Gennady looked confused.
“A firewall is the digital equivalent of a security guard. It blocks all unauthorized attempts to contact the computers that it protects. Most computers are shielded behind some type of firewall, so any attempt by the Russians to initiate contact to them would be blocked immediately. Not to mention that to attack that many computers, they’d have to generate an immense volume of network traffic. That would stand out like a sore thumb to the NSA. But it looks like the Russians found a way around both problems by leveraging Windows Update.”
“How?” he asked.
“Microsoft uses the Windows Update system to distribute new updates and fixes to computers around the world. Once per day, at an essentially random time, each Windows computer wakes up and contacts Microsoft’s Windows Update website to check for new updates. If it finds any, it downloads and installs them automatically.”
“Okay, but how does that help the Russians?”
“I’m getting to it. While Windows Update was designed to deliver official software updates, the system is in theory capable of sending down any type of data. And if an attacker—for instance, a Russian mole inside Microsoft—somehow obtained control over the Windows Update website and could post an attack payload file, all those billions of computers would happily download it along with their legitimate updates.”
Gennady nodded in dawning understanding. “It’s like poisoning a waterhole—you don’t have to hunt down the animals, they die when they come to drink.”
“It’s a reasonable analogy,” I replied. “When an attack payload makes it down to a computer, the Florentine back door they’ve built into Windows immediately intercepts it, verifies its authenticity, and detonates it. Based on your translation, these payloads could do anything—steal confidential information, delete all your files, anything.”
“Is it realistic?” he asked. “Could that actually work?”
“Unfortunately, yes. Like I thought, that executable file we found in the video is essentially a Controller. It’s used to post attack payloads on the Windows Update website. The other file, Florentine.keys, contains the cryptographic authentication keys required to unlock and gain access to the system. Whoever’s in possession of these two files can distribute and launch an attack on virtually every Windows computer in the world in less than twenty-four hours.”
The phone rang three times before Rod Sanders, a former ViruTrax colleague in the Washington, DC sales office, picked up.
“Hi Rod, Alex Fife here. Have a minute to chat?”
“Alex Fife. It has been a while. You enjoying your retirement in, where, the Bahamas? Monte Carlo? While the rest of us still have to work to make a living?”
“Sorry to be blunt, Rod, but I’ve got an emergency.”
The line went silent for a beat. “Shoot.”
“You still work with our special friends over in Baltimore, right?” I was referring to the NSA, who was headquartered in Baltimore, Maryland. Rod, an ex-military officer, had a top-secret security clearance and was one of a handful of ViruTrax engineers with sufficient clearance to consult with the government’s three-letter agencies on their internal cyber-security-related affairs.
“Yes.”
“I’ve got some info
rmation that they need to hear about. It’s urgent. Would you happen to have a contact there that could get me to the right person, ASAP?”
“Cyber-intel?” asked Rod.
“Yes.”
“And this is urgent? You believe there is a material threat to national security?”
“Yes.”
“Give me a number where I can reach you. I’ll make some phone calls and get back to you within the hour.”
I gave him Tom’s number and hung up.
Five minutes later the phone rang.
“Hello,” said Gennady and I simultaneously.
“Hello,” responded Rod.
“I’ll take it,” I said. Gennady hung up. “Sorry, Rod, I’m at a friend’s place.”
“No problem. I chatted with one of my friends in Baltimore and they’re going to have someone call you at this number in about ten minutes.” He coughed up some phlegm. “These are good guys. Just tell them what you know and leave it to them.”
“I will. Thanks Rod.”
“No problem. If someone doesn’t call you in the next ten minutes, call me back and I’ll follow up. And good luck.”
“Thanks.”
The phone rang five minutes later.
“Hello.”
“Hi, I’m calling for Alex Fife.”
“This is Alex.”
“Hi Alex, this is Jon Whitehouse. I’ve been asked to call you to follow up on some information you have.”
“Thanks for calling so quickly.” I turned on the phone’s speakerphone so Gennady and Tom could hear.
“It’s my pleasure. Actually, you may not remember but you came to present to my team a few years ago. Your new malware detection method was groundbreaking, and actually influenced some of our data collection approaches.”
“Thank you,” I said, “I’m humbled I was able to help.”
“You did. All right, what did you want to discuss? This is not a secure line, so I’m going to ask you to provide me with only high-level details. Once I understand the nature of your problem we can figure out how to proceed.”
“Okay.” I took a deep breath. “I have credible evidence that the Russian FSB has introduced a back door into Windows that will allow them to control virtually any or every Windows PC and server connected to the Internet within a twenty-four-hour timeframe. It’s codenamed Florentine.”
“The FSB? Do you mean the SVR?”
“SVR?” The initials pinged something in my memory, but I couldn’t place the reference.
“The Russian Foreign Intelligence Service: Sluzhba Vneshney Razvedki, the SVR.”
“That rings a bell.”
“Okay. And the project’s codename is Florentine?”
“Yes.”
“Can you briefly tell me how it works?” Whitehouse paused a beat. “Scratch that, we’re not on a secure line. What evidence do you have?”
“I have documentation, written in Russian, describing how the system works, a Command and Control program supposedly capable of launching the attack. And a set of cryptographic keys that can be used to authenticate the Command and Control program to the system.”
“Okay. And how did you obtain access to this system?”
“It’s a long story. But the important thing is that the Florentine was being sold on the black market by a guy named Richard Lister. A guy named Arnaz Khalimmy was trying to buy it from him—”
“Spell that for me, please,” Whitehouse interrupted, “Arnaz what?”
I did, then continued, “But Lister died before completing the sale. Now that I’ve got hold of it, Khalimmy’s after me.”
“Has he obtained control of the system?” Whitehouse asked.
“He’s got an encrypted copy of the file, but doesn’t have the password. But not for lack of trying—he’s already murdered at least one person trying to get it.”
“I’ll be right back.” I heard a muffled discussion on the other end of the line, then Whitehouse continued: “Okay Alex, here’s what I want you to do. Gather up all the computers that hold a copy of the Florentine system and power them off. Unplug them. Gather up all media, thumb drives, portable hard drives, printouts, anything with Florentine data, and keep them safe until we come and pick them up. Make sure you get everything.” He paused. “Any questions?”
“No.”
“Okay, give me your address.”
I quickly recited Tom and Gennady’s address.
“Okay. I’m going to have someone over there in the next hour. One of our team just arrived in LA to attend the USC Crypto Conference. We’ll have him head straight over from the airport.”
Someone mumbled something to Whitehouse. He hesitated a beat, then continued, “Alex … does anyone else know about this system? Who else knows you have it?”
“Just the two of my friends here and Khalimmy.” I thought a second. “And I’m not sure, but I think there’s also a Russian guy trying—”
“The Russians?” He whistled. “They must have discovered the leak.”
“That’s what I’m guessing, but honestly, I’ve got no idea.”
Whitehouse went silent for five pregnant seconds.
“Okay, Alex, listen to me very carefully. Do not discuss this with anyone else. Make sure your friends understand. Not a word to anyone. I’m going to have the local FBI office send over a car to pick you and your friends up. I need you all to pack for a few days of travel—clothes, any medications, enough for three or four days. And if you have any protection, a gun, a baseball bat, arm yourself. And lock your doors and windows until my colleague arrives. He’ll stay with you until the FBI can take you into custody. His name is Arnold Altschiller.” My heart skipped a beat. Arnold Altschiller was one of the fathers of modern cryptography—a seventies computer-science genius-hippy, an icon in the computer security industry.
“I’m going to give you my cell phone number and also his number,” Whitehouse said. “Call him first if you have any trouble. If you can’t get through to him or he doesn’t arrive within an hour, call me immediately or call 911.” He gave me the two numbers. “Do you have any questions?”
“No.”
“Good. Just hang in there and we’ll fix this thing.”
Chapter 53
While Tom and Gennady packed, I downloaded a freeware encryption program off the Internet and used it to encrypt copies of the original Russian document, Gennady’s English translation, the Command and Control program, and the Florentine authentication keys, then uploaded the encrypted files into my DropBox.com file-sharing account. Just for safekeeping. Not that I didn’t trust the NSA, but I wasn’t about to take any chances. Then I deleted all the decoded files from Tom’s computer, and packed the chassis into a cardboard box from Tom’s closet. I slipped Richard’s thumb drive and Gennady’s printed translation into a manila envelope and dropped that into the box as well, then carried the box over to the front door.
We waited at the kitchen table with a carafe of coffee, a box of Danishes, and Gennady’s semi-automatic. The doorbell rang exactly one hour and five minutes after my call to the NSA. I walked to the door, Tom, Gennady, and his pistol in tow.
“Who is it?” I asked, peering through the keyhole.
“Arnold Altschiller,” replied the man nonchalantly, “I’m here to see Alex.”
“That’s him,” I said. “No mistaking it.” I unlocked the door and motioned him in.
Altschiller stood five-foot-seven-inches tall, clad in Bermuda shorts, a Hawaiian shirt covering a developing potbelly, and gnarled Birkenstock sandals. Underneath a Mets baseball cap he sported a long, frizzy mane of white hair and a matching five-inch beard. The guy was one-hundred-percent seventies computer hippy.
“It’s an honor to meet you,” I said, shutting the door and engaging the deadbolt.
“Get to know me a little better and you’ll change your mind, Alex,” said Altschiller good-naturedly. “By the way, do you have a bathroom I could use? My flight from Germany just landed when I got the call, I�
��m about to explode.”
“Down the hall and left.” Tom pointed.
As soon as the bathroom door closed, Gennady looked at me questioningly. “That’s the guy who’s going to save us from the Russians?”
“He’s the father of modern cryptography,” I said. “Like the Einstein of cryptography.”
“Right now I think we need Mike Tyson, not Albert Einstein,” he replied.
“Back!” Altschiller said jovially, water dripping from his hands, face, and beard. “Pardon me, I should have introduced myself. I’m Arnold Altschiller.”
Tom extended his hand hesitantly. “Tom Chien.”
Gennady followed suit. “Gennady Cheryenko.”
“Nice to meet you both. Okay gents, have you packed everything up?”
“Yes,” I pointed to the box on the floor next to the front door. “Every copy we have is right here. Khalimmy—the guy who’s been trying to get the Florentine—has an encrypted copy too, but as far as we know, he hasn’t figured out the password.”
“Good. Okay, we’ve already called the FBI, so they should be here soon. Alex, I’m going to ask you to come with me to brief our team in Baltimore.” He turned to Tom and Gennady. “Gentlemen, you’re going to have to go into protective custody until we get a handle on this thing.”
“Is that really necessary?” asked Gennady.
“Yes,” said Altschiller, stroking droplets of water from his beard. “If what your friend has discovered is authentic, there are a lot of bad people who will go to great lengths to obtain it. Your knowledge of the system makes you both targets.”
A beat later, Altschiller’s mobile rang with a digital rendition of Handel’s Messiah. He pulled the phone from his belt, and, after checking the caller ID, casually stepped into the other room to talk. The doorbell rang a few minutes later. Altschiller walked briskly to the front door and stepped up to the keyhole, cell still to his ear.
The Florentine Deception Page 25