The words blinked onto the computer screen:
Plague gave a hoarse, almost deranged, yell, and that may have been unwise. But even if the neighbours had happened to hear, they could not have dreamed what it was about. Plague’s home was not an obvious setting for high-level international security coups.
It felt more like a place where a social welfare case might hang out. Plague lived on Högklintavägen in Sundbyberg, a markedly unglamorous area with dull, four-storey, faded brick houses, and the apartment itself had nothing much going for it. It had a sour, stale smell, and his desk was covered in all sorts of rubbish: McDonald’s containers and Coca-Cola cans, crumpled-up pages from notebooks, unwashed coffee cups, and empty candy wrappers. Even though some had actually made it into the wastepaper basket—which had not been emptied for weeks—you could hardly take a step in the room without getting crumbs or grit under your feet. But none of this would have surprised anyone who knew him.
Plague was not a man who normally showered or changed his clothes much. He spent his whole life in front of the computer even when he was not working: a giant of a man, overweight, bloated, and unkempt, with an attempt at an imperial beard that had long since turned into a shapeless thicket. His posture was dreadful and he had a habit of groaning when he moved.
But the man had other talents. He was a wizard on the computer, a hacker who flew unconstrained through cyberspace and was probably second only to one person in the field, a woman in this particular case. The mere sight of his fingers dancing across the keyboard was a joy to behold. He was as light and nimble online as he was heavy and clumsy in the other, more material world, and as a neighbour somewhere upstairs, presumably Herr Jansson, now banged on the floor, he answered the message he had received:
Then he leaned back with a delighted smile and tried to run through in his mind the sequence of events, savouring the triumph for a little while longer before going on to pump Wasp for every detail, and to ensure that she had covered her tracks. No-one must be able to trace them, no-one!
This was not the first time they had messed with a powerful organization. But this was on a new level, and many in Hacker Republic had actually been against the idea, Wasp herself most of all.
Wasp could take on just about any authority or person you would care to name, if it were necessary. But she did not like picking a fight for its own sake. She disliked that sort of childish hacker nonsense. She was not someone who hacked into supercomputers merely to show off. Wasp wanted to have a clear objective, and she always damn well analyzed the potential consequences. She weighed long-term risks against whatever need was being satisfied in the short term, and from that point of view it could not be said it made sense to hack into the NSA. Still, she let herself be talked into it. Nobody could quite understand why.
Maybe she was bored and wanted to stir up a bit of chaos so as not to die of tedium. Or else, as some in the group claimed, she was already in conflict with the NSA and therefore the breach amounted to little more than her personal revenge. But others in the group questioned even that and maintained she was looking for information, that she had been on the hunt for something ever since her father, Alexander Zalachenko, had been murdered at Sahlgrenska hospital in Göteborg.
Nobody knew for sure. Wasp had always had her secrets and actually her motives were unimportant, or so they tried to persuade themselves. If she was prepared to help, then they should just accept gratefully and not worry about the fact that, to begin with, she had not shown much enthusiasm, or hardly any feelings at all for that matter. At least she was no longer being awkward about it, and that seemed as much as anyone could expect.
Hacker Republic knew better than most that the NSA had outrageously overstepped its boundaries in recent years. These days the organization did not confine itself to eavesdropping on terrorists and potential security risks, or even just foreign heads of state and other powerful figures, but listened in on everything, or nearly everything. Millions, billions, trillions of communications and activities online were spied on and archived, and with each passing day the NSA went further and further and pried deeper and deeper into every private life. The agency had become one immeasurable, watchful, evil eye.
It was true that nobody in Hacker Republic could claim the moral high ground here. Every single one of them had made their way into parts of the digital landscape where they had no business being. Those were the rules of the game, so to speak. A hacker was someone who crossed the line, for better or for worse, someone who by virtue of his occupation broke rules and broadened the frontiers of his knowledge, without always being concerned about the distinction between private and public.
But they were not without ethics and above all they knew, also from their own experience, how power corrupts, especially power without control. None of them liked the thought that the worst, most unscrupulous hacking was no longer carried out by solitary rebels or outlaws, but by state behemoths who wanted to control their populations. Plague and Trinity and Bob the Dog and Flipper and Zod and Cat and the whole Hacker Republic gang had therefore decided to strike back by hacking the NSA and messing with them in one way or another.
That was no simple task. It was a little bit like stealing the gold from Fort Knox, and like the arrogant idiots they were they did not content themselves with breaking into the system. They also wanted superuser status, or “Root,” in Linux language, and for that they needed to find unknown vulnerabilities in the system, for what was called a Zero-day Exploit—first on the NSA’s server platform and then further into the organization’s intranet, NSANet, from which the authority’s signals surveillance went out across the world.
They began as usual with a little social engineering. They had to get hold of the names of systems administrators and infrastructure analysts who held the complex passwords for the intranet. It would not do any harm either if there was a chance that some careless oaf was being negligent about security routines. Through their own contacts they came up with four or five names, among them one Richard Fuller.
Fuller worked in the NISIRT, the NSA Information Systems Incident Response Team, which supervised the intranet, and he was constantly on the lookout for leaks and infiltrators. Fuller was a decent sort of fellow: a Harvard law graduate, Republican, former quarterback, a dream patriot if one were to believe his CV. But through a former lover, Bob the Dog managed to discover that he was also bipolar, and possibly a cocaine addict.
When Fuller got excited he would do all sorts of stupid things, such as opening files and documents without first putting them in a so-called sandbox, a required security protocol. Furthermore he was very handsome and a little smarmy. Someone, probably Bob the Dog himself, came up with the idea that Wasp should travel to his home in Baltimore, go to bed with him, and catch him in a honey trap.
Wasp told them all to go to hell.
She also rejected their next idea, that they would compile a document containing information which looked like dynamite, specifically about infiltrators and leaks at the head office in Fort Meade. This would then be infected with malware containing an advanced Trojan with a high level of originality, which Plague and Wasp were to develop. The plan was to put out leads online which would lure Fuller to the file, and with a bit of luck get him so worked up that he would be careless with security. Not a bad plan at all—it could take them into the NSA’s computer system without an active breach that might be traceable.
But Wasp said that she was not going to sit around waiting for that blockhead Fuller to put his foot in it. She did not want to have to rely on other people making mistakes. She was being generally contrary and bloody-minded, so no-one was surprised when she suddenly wanted to take over the whole operation herself. Even though there was a certain amount of protest, in the end they all gave in, but not without issuing a series of instructions. Wasp did carefully write down the names and details o
f the systems administrators which they had managed to obtain, and she did ask for help with the so-called fingerprinting: the mapping of the server platform and operating system. But after that she closed the door on Hacker Republic and the world, and Plague had no reason to think that she paid any attention to his advice, for example that she should not use her handle, her alias, and that she should not work from home but rather from some remote hotel under a false identity, in case the NSA’s bloodhounds managed to track her down. Needless to say, she did everything her own way and all Plague could do was sit at his desk in Sundbyberg and wait, his nerves in tatters. Which is why he still had no idea how she had gone about it.
He knew one thing for certain: what she had achieved was legendary, and while the storm howled outside he pushed aside some of the rubbish on his desk, leaned forward, and typed on his computer:
—
Empty.
That was how it felt. Salander had hardly slept for a week and she had probably also had too little to drink and eat, and now her head ached and her eyes were bloodshot and her hands shook and what she wanted above all was to sweep all of her equipment to the floor. In one sense she was content, though hardly for the reason Plague or anyone else in Hacker Republic would have guessed. She was content because she had been able to get some new information on the criminal group she was mapping out; she had found evidence of a connection which she had previously only suspected. But she kept that to herself, and she was surprised that the others could have imagined that she would have hacked the system for the hell of it.
She was no hormone-fuelled teenager, no idiot show-off looking for a kick. She would only embark on such a bold venture because she was after something very specific, although it was true that once upon a time hacking had been more than just a tool for her. During the worst moments of her childhood it had been her way of escaping, a way to make life feel a little less boxed in. With the help of computers she could break through barriers which had been put in her way and experience periods of freedom. There was probably an element of that in the current situation too.
First and foremost she was on the hunt and had been ever since she woke up in the early light of dawn with her dream of that fist beating rhythmically, relentlessly on a mattress on Lundagatan. Her enemies were hiding behind smoke screens and this could be the reason why Salander had been unusually difficult and awkward of late. It was as if a new darkness emanated from her. Apart from a large, loudmouthed boxing coach called Obinze and two or three lovers of both sexes, she saw hardly anyone. More than ever she looked like trouble; her hair was straggly, her eyes threatening, and even though she sometimes made an effort she had not become more fluent at small talk. She spoke the truth or said nothing at all. As for her apartment here on Fiskargatan…that was a story in itself. It was big enough for a family with seven children, although in the years since she had acquired the place nothing had been done to decorate it or make it homey. There were only a few pieces of Ikea furniture, placed seemingly at random, and she did not even have a stereo system, perhaps because she did not understand music. She saw more melody in a differential equation than in a piece by Beethoven. Yet she was as rich as Croesus. The money she had stolen from that crook Hans-Erik Wennerström had grown to a little more than five billion kronor, so she could afford whatever she wanted. But in some way—which was typical of her—her fortune had not made any mark on her personality, unless perhaps it had made her yet more fearless. She had certainly done some increasingly drastic things of late.
She may have crossed a line by wandering into the NSA’s intranet. But she had judged it necessary, and for several days and nights she had been totally absorbed. Now that it was over she peered out of tired, squinting eyes at her two work desks, set at a right angle. Her equipment consisted of the regular computer and the test machine she had bought, on which she had installed a copy of the NSA’s server and operating system.
She had run her own fuzzing programme, which searched for errors and tiny vulnerabilities in the platform against the test computer. She then followed that up with debugging and black box penetration testing and various beta test attacks. The outcome of all that formed the basis of her root kit, including her RAT, so she could not afford to neglect a single point. She was scrutinizing the system from top to bottom and that was why she had installed a copy of the server here at home. If she had set to work on the real platform, the NSA technicians would have noticed it immediately.
This way she was able to work without distraction, day after day, and if she did happen to leave the computer, then it was only to doze off for a while on the sofa or to put a pizza in the microwave. Apart from that, she kept at it until her eyes hurt, especially with her Zero-day Exploit, the software which exploited the unknown security vulnerabilities and which would update her status once she had actually gotten in. It was completely mind-boggling. Salander had written a programme which not only gave her ownership over the system, but also the power to control remotely pretty much anything on an intranet of which she had only patchy knowledge.
That was the most extraordinary part. She was not just going to break in. She was going further, into NSANet, which was a self-contained universe barely connected to the ordinary net. She might look like a teenager who had failed all of her subjects at school, but give her source codes in computer programmes and a logical context and her brain just went click, click. What she had created was nothing less than wholly new and improved malware, an advanced Trojan with a life of its own.
She found the pay-as-you-go card she had bought from T-Mobile in Berlin and put it into her telephone. Then she used it to go online. Maybe she should have been far away in another part of the world, dressed up as her alter ego, Irene Nesser. If the security people at the NSA were diligent and on top of things, they just might be able to trace her to Telenor’s base station here on the block. They would not get all the way through, at least not with the technology now available, but it would still be close enough and that would be very bad news. Yet she reckoned the advantages of sitting here at home outweighed the risk, and she did take all the security precautions she could. Like so many other hackers, she used Tor, a network by which her traffic bounced about among thousands and thousands of users. But she also knew that not even Tor was watertight—the NSA used a programme called EgotisticalGiraffe to crack the system—so she spent a long time further improving her own personal security. Only then did she go on the attack.
She sliced into the platform like a blade through paper, but she could not afford to become over-confident as a result. Now, quickly, she had to locate the systems administrators whose names she had been given and inject her Trojan into one of their files, thereby creating a bridge between the server network and the intranet, none of which was simple, not by any means. No warning bells or antivirus programmes must be allowed to start ringing. In the end she used the identity of a man called Tom Breckinridge to penetrate NSANet and then…every muscle in her body tensed. Before her eyes, her over-worked, sleepless eyes, the magic unfolded.
Her Trojan took her further and further in, into this, the most secret of the secret, and she knew exactly where she was going. She was on her way to Active Directory—or its equivalent—to upgrade her status. She would go from unwelcome little visitor to superuser in this teeming universe, and only once that was done would she try to get some sort of overview of the system. It wasn’t easy. It was more or less impossible, in fact, and she did not have much time either.
She worked fast to get a grip on the search system and to pick up all the passwords and expressions and references, all the internal gibberish. She was at the point of giving up when she finally found a document marked TOP SECRET, NOFORN—no foreign distribution—not particularly remarkable in itself. But together with a couple of communications links between Zigmund Eckerwald at Solifon and cyber agents at the Department for the Protection of Strategic
Technologies at the NSA, it turned into dynamite. She smiled and memorized every little detail. Then she caught sight of yet another document that seemed relevant. It was encrypted and she saw no alternative but to copy it, even if that would set alarm bells ringing at Fort Meade. She swore ferociously.
The situation was becoming critical. Besides, she had to get on with her official assignment, if “official” was the right word. She had solemnly promised Plague and the others at Hacker Republic to pull down the NSA’s trousers, so she tried to work out whom she should be communicating with. Who was to get her message?
She settled for Edwin Needham, Ed the Ned. His name invariably came up in connection with IT security and as she quickly picked up some information about him on the intranet, she felt a grudging respect. Needham was a star. But she had outwitted him.
For a moment she thought twice about giving the game away. Her attack would create an uproar. But an uproar was exactly what she was looking for, so she went ahead. She had no idea what time it was. It could have been night or day, autumn or spring, and only vaguely, deep in her consciousness, was she aware that the storm over the city was building up, as if the weather was synchronized with her coup. In distant Maryland, Needham began to write his e-mail.
He didn’t get far, because in the next second she took over his sentence and then continued:
It was a thrilling experience, no question, and yet…when she disconnected and all her log files were automatically deleted, then came the hangover. It was like the aftermath of an orgasm with the wrong partner. Those sentences that had seemed so absolutely right a few seconds ago began to sound increasingly childish and more and more like the usual hacker nonsense. Suddenly she longed to drink herself into oblivion. With tired, shuffling steps she went into the kitchen and fetched a bottle of Tullamore D.E.W. and two or three beers to rinse her mouth with, and sat down at her computers and drank. Not in celebration. There was no sense of victory left in her body. Instead there was…well, what? Defiance perhaps.
The Girl in the Spider's Web Page 7