Going to California

Life by the Valley — 8.8

We hadn’t walked far before Shawn began to talk.

“They ended up getting a kid in Canada — calls himself Mafiaboy, ’cause he overheard his dad talking on the phone like he’s some kinda wiseguy or something, at least that’s what he said — who learned what he knew from a guy we know back in Chicago.” He coughed. “Not a friend. He learned a lot of what he knows from Lineman, that guy did.”

“He’s a script kiddie,” Lineman said. This was pretty much the most dismissive thing you could say about someone — that they didn’t understand how the tools worked, that all they could do was run the scripts they’d downloaded. Good hackers sometimes even put errors in their code on purpose, to make it more likely that only people who know what they were doing would be able to use the tools.

“Dude told the Feds we were the ones who did it — all the attacks, except a couple they already pinned on Mafiaboy.” He’d made the mistake of bragging on a chat channel that he’d taken down dell.com when it hadn’t been publicized as one of the sites that had been hit.

“We didn’t,” Shawn continued. Maybe it had been the look on my face. “Nothing to do with it. But he told them all the domains we own, everything we run, everything we’re up to.”

“That he knows about,” Lineman added. “Which is nothing.”

Shawn sighed. We’d arrived at the 7-11. Lineman busted out a roll of quarters and they called home.

“It’s not good to use phones,” said Lineman, holding up his brick of a mobile. “They’re probably compromised.”

“Pay phones only,” Shawn said while the line rang. “Hey. Yeah. Uh huh.” He turned away just as I decided I didn’t need to eavesdrop.

“Red Bull?” I asked.

Shawn pointed at me, meaning yes.

“Is Johnny okay?” I asked Lineman while getting rung up inside the store.

“Not really,” he said.

“So what happened?”

He laughed. We walked out as Shawn was hanging up.

“Any news?” asked Lineman.

“Nothing,” said Shawn. We started waking back, and he explained.

“So we run a domain — it’s hosted off a computer of Johnny’s. He worked at an ISP, which was where the domain was registered. The FBI raided it this morning.”

I said, “What?!”

“Yep. Only, the computer they wanted wasn’t there. It was at Johnny’s house — his dad’s house, really, you know.”

“That’s how his dad got arrested.”

“Basically,” he said, but there was more, of course.

Johnny’s old boss at the ISP wasn’t particularly thrilled about the FBI raid on his business. He knew the machine they were looking for, and he had to tell them where it was really located, but it would be a few hours before they could get a new warrant to raid Johnny’s dad’s house. So he called Johnny up and let him know that the Feds had been there, and what they’d been looking for.

I don’t know exactly what happened after that — I wasn’t there — but while the FBI was working to get a warrant to search Johnny’s dad’s place, a pizza delivery guy showed up, someone who happened to be a friend of the Packet Storm gang. If anyone had been watching the place, all they would have seen was a pizza guy walking up, maybe he had one of those big, padded delivery bags, and then he left. If a really observant person had seen him walk out, she might’ve wondered if what pizza dude was carrying weighed more than what he’d shown up with.

The Feds raided the place later, and there was no computer there. It would end up at the bottom of river.

“That machine had nothing to do with the attacks,” Shawn stressed. “It was all about personal security.”

The Feds were unhappy. Johnny’s dad, unfortunately, had several unregistered rifles — won in government-sponsored sharpshooting competitions, ironically enough. He also had a few rounds of armor-piercing bullets, so they labeled him a nut job and a potential cop-killed and arrested him. That’s when Johnny got the call.

“Are you ready to come clean?” the FBI agent reportedly said. “Otherwise your father stays in jail.”

Lineman laughed. “There’s nothing to come clean about,” he said.

“About the DDoS attacks,” Shawn added.

“This sounds a lot like the Hacker Crackdown,” I said.

“I think I heard of that,” Lineman said.

And I tried to tell them, as we got back to my apartment, but halfway through I realized how they were looking at me: like I was the older guy, telling stories about the old day which had only distant relevance to what was happening today. Shawn was wincing, glancing at the door, likely thinking of a cigarette. Lineman was nodding. “That’s a cool story,” he said. But it didn’t help them any.

Somehow, along the way, I’d become the old guy, and here were the new kids, writing their own rules and inventing their own trouble. What had happened? When was I supposed to have grown up? Along the way?

They left without getting any answers from me, left me wondering when I’d stopped being one of the cool kids.

It never got any worse for the Packet Storm crew, outside of how it got worse for all of us. They trundled along, worried about the hammer that could have dropped at any time.

Me, I had my own problems.

Standard
Going to California

Life by the Valley — 8.7

While I didn’t see whoever came by our office from the FBI, it didn’t sound like they were in a playful mood. That afternoon, I caught up with the Packet Storm guys in their natural habitat: in a dark lab, disco ball spinning.

“How’d it go?” I asked. All four of them were there.

Shawn looked at Lineman. “They want Mixter,” said Lineman. “They think he did it.”

“Did he?”

“No way,” Shawn said. “But the Feds want his personal information. I mean, we sent him ten grand, so we know his real name, where he lives. Phil’s asked if they’ll be okay with him calling them instead, just to talk.

“And they wanted all our logs,” Lineman said. “We told them we don’t keep logs.”

“You don’t keep logs? All these attack-tool downloads, and you don’t—” I thought about it. They had been awfully busy that morning. “—keep anything?”

“Not anymore,” Johnny said. Shawn threw a pen at him.

Lineman turned back to his keyboard. “We showed them how we don’t log anything.” He threw a look at Johnny. “We make things available, but we don’t need to know who everybody is.”

“Huh,” I said. Everyone turned back to their keyboards.

“What about the German hacker guy, Mixter?” I asked.

Shawn swung back around. “I emailed him and he said he’d talk to them.”

“Huh,” I said.

A few days later, a U.S. Senator visited the office, under invitation by or with introduction through Kroll, our corporate masters. I forget which one. He specifically wanted to speak with the Packet Storm crew, who seemed at the same time flattered and terrified by the attention.

Mixter’s $10K DDoS papers were posted on Packet Storm not too long afterwards. You can read them here, and here. They basically say, “There’s pretty much nothing you can do, sorry,” albeit in an extremely well-informed way. I don’t think anyone was comforted.

When the FBI talked to Mixter, they claimed to have been convinced that he hadn’t done it. Which was good. But they still had to pin it on someone, and after some snooping it seemed they suddenly knew a lot more about the Packet Storm gang. Which was bad.

I got a late night knock at my door. It was Shawn and Lineman.

“Did you notice a sign out in front of my house that said, ‘Dead hacker storage’?” I said. “Cause it ain’t there.” This was a twist on a quote from Pulp Fiction, meant to be funny.

Shawn chuckled softly, then his face settled into a low sort of grimace. Lineman was unreadable.

“The FBI arrested Johnny’s father, back in Chicago,” Lineman said. “The ATF, actually.”

“What?”

“Said he was a domestic terrorist or a cop killer or something,” Shawn said. “Some other stuff. Totally bogus charges.”

We sat down. “How’d that happen?” I asked.

Lineman took a deep breath, then looked at Shawn  He glanced around my apartment and then in a low voice, he said, “Let’s go for a walk.” He pulled a baseball cap down tight, his eyes barely showing under the brim. “No reason.”

Standard
Going to California

Life by the Valley — 8.6

The night after the big DDoS attacks began, the Packet Storm guys came by my place. By then there were three of them, not counting Lineman’s girlfriend. Packet Storm was definitely more than any one or two people could handle, so two more guys — Shawn and Johnny, friends of Lineman’s — drove out together from Chicago to take up some slack on the site. Johnny was a rail-thin dude with short dark hair and a slim baby face, while Todd was less tall, also with short dark hair bordering, and he’d probably have a baby face if he hadn’t been rocking a goatee. His eyes seemed the sharpest of the bunch somehow.

Jim wasn’t around at my place on that evening when they came by, though he’d already met the whole gang. He’d happened to have been in town on the day when the new guys were arriving, so I’d taken him around to meet everybody. Shawn and Johnny had already unloaded a good number of crates full of vinyl, so Jim and I watched as they moved smoothly between spinning disks through a beat-up old mixer and firing off commands to some process on a remote machine through an old green-screen terminal.

“Someone found us,” said Lineman, and Shawn turned the music down a notch, chuckling not at all quietly.

“Whatcha got?” Shawn asked, breaking open a new pack of cigarettes. They didn’t really drink or do drugs — they were only about twenty-one years old, all of them, but most of the group had lived fairly rough lives back in Chicago. They’d survived, of course, but they were mostly done with drugs and drinking. The bunch of them had just been giving jobs that paid what was at the time unreasonable sums of money, for doing nothing more than having people email them the latest hacker tools, vulnerabilities, and exploits, so that’s what they were all about.

Lineman was staring into a black-backed terminal, green winking cursor in the upper left. His fingers hovered half an inch over the keys.

“Hmm,” he said, as everybody crowded around. Then in a flurry, he hammered out a bunch of text that looked to me exactly like a login prompt. Something like:

CONNECTING…
adexa system 7.21
login:

“That’s just cruel,” Shawn muttered through an unlit cigarette, patting himself down for a lighter.

“What’s up?” I asked.

Lineman opened his mouth.

“It’s like netcat, but the other way around,” Johnny rushed in to say. “It’s a port listener. If someone tries connecting to you, it just accepts it, then anything you type gets echoed out across the wire.”

“That way,” Shawn added, pausing to exhale a gray cloud, “you can see how people might be trying to mess with you without having to expose a real service to them.” He shrugged. “It’s ghetto, but when you find a real person instead of a bot, it can be fun.”

Lineman’s girlfriend squealed. “He’s typing something!” she said.

“I see,” said Lineman.

The stranger typed

root

…then hit return. Lineman typed:

Password:

“Oh, this is gonna be beautiful,” Shawn said. “Look at him pause after the first two letters of his password showed up!”

“Why?” asked the girl.

“Because,” Lineman calmly said, “when you type your password for real, you—“

“—don’t actually see it,” she said. “I know.”

“Then why were you asking?” Johnny muttered. Shawn nodded idly and turned up the music. Jim and I took off after that, leaving Lineman staring into his terminal window, occasionally typing things back at whatever mouse he’d caught in his little trap.

A few weeks later, Yahoo and Amazon get knocked off the net by the first major DDoS attacks. A few evenings later there’s a knock on my door and the Packet Storm guys walked into my place.

“How’d it go?” I asked.

“It was awesome,” chuckled Todd.

Lineman nodded. “It was good.” They’d been interviewed for the local TV news about the attacks.

“Good publicity for Kroll,” Johnny added.

“Hey, hey,” said Shawn  “I saw a Seven-Eleven coming over here. You mind if we walk over and get some stuff?”

I didn’t mind. Two blocks away, I watched three young dudes load up on canned drinks of several shapes and sizes, a few packs of menthol cigarettes, a bag of chips, and a couple of bottles of juice, nearly half of which was gone or open before we’d walked through the darkness back to my place, a non-stop stream of chattering hacker consciousness filling the night as we went.

“And the greatest thing,” Shawn said, lighting another cigarette, “was the call we got after the show.”

“Unbelievable,” Johnny said.

“We’d met and talked to this guy earlier in the day about renting his place,” Shawn went on. “It’s a huge-ass mansion, perched on a cliff looking over the 280 freeway about halfway up to the city. Five bedrooms. We weren’t sure we were gonna get it, but he saw Lineman on TV being interviewed and called immediately to tell us we could have it. Incredible.”

It was. If it were possible for mad-genius hackers to have an ideal secret lair, that was the place. They’d spend less than a year there, though, before everything fell apart, but we’ll get there.

Shawn and Johnny opened another pair of these small, thin little cans of what looked like some kind of soda, slamming them back pretty quickly. I couldn’t read the label from there, but I’d never seen it before. “Can we?” Todd asked, holding a plastic bag full of the rest of the drinks and pointing toward my kitchen.

“Sure,” I said, having no idea what he was talking about. “Lineman,” I said, turning to him. “I got a question for you.”

“All right,” he said, focused clearly on me.

“So, I’m working on this scanner.”

“Radar.”

“Right.”

“It doesn’t sound like a good idea.”

“It’s what we’re working on.”

He shook his head. “You should work on something else.”

“This is what I have to work on. My problem is that I’ve been out of the game for a while. I’ve been reading a lot — I’m catching up on Packet Storm, there’s a lot of cool stuff there, of course — but I’m having a hard time with the big picture.”

“Uh, huh. And what picture is that?”

“I’m supposed to collect up all the vulnerabilities we need to scan for, and write them up, and understand how they get exploited and how to fix them. But for starters, I don’t even know how much there is. If you had to focus on the most important vulnerabilities, the most common and the most serious, how many would there be? How many things am I actually talking about?”

He thought about it.

“Less than three hundred,” Lineman said. “Right now? Two-hundred and sixty-three.” Todd and Johnny glanced at each other. “Maybe more like two-hundred and seventy. Seventy-seven. Something like that. It depends on what you think is serious. And every day there’s more.”

“But something like three hundred.”

“Around there.”

That, I thought, was do-able. In three months, I’d covered more than four-hundred cards for a single game. In three months, I’d written — re-written — a 256-page book and colored a third of its art.

In three months, I could do the vulnerability research we needed to fuel the scanner. I could do this — it wasn’t a lost cause. I wasn’t a lost cause.

The next morning, I’d open my fridge to find that Johnny and Shawn had left a couple of their little canned drinks behind. I picked one up and read the label: Red Bull, whatever that was.

I sipped it on the short drive into work. At first I thought it was disgusting, medicinal — but there was a sick sweetness in place of the terrible after-taste I was expecting. I got fairly wrapped up in trying to figure it out by the time I got into work. By the time I was sprinting up the stairs to my second-floor office, I figured I might just like it.

It’s no mystery how most soda and juice drinks are concoctions of artificial flavors, carefully tuned and balanced to taste like something that nature might produce — like orange, or grape, or banana, or pomegranate, even when very often they don’t really taste very much like any of those things, more the idea of them. But these advertised tastes give us a context in which we can slip these artificial flavors, making them more accessible than they might be otherwise.

Red Bull said, “Screw it, I’m not even going to try to fake it.” It tasted like nothing nature might produce. It tasted like a blue laser — or maybe it tasted like what you might get if you could touch your tongue to the Internet. It was a new thing. It felt like a sign of things to come.

So at the start of the second month of our new century, I was thinking about the future when I picked up a bit of an echo from the past. I walked straight back into the Packet Storm lab room, where the four of them had come to hole up. Lineman was there, staring serenely into a screen, typing madly. Todd was rocking back and forth in his chair, tapping an unlit cigarette against his knee. The music was cranked to full disco-ball. No one else was around.

“Hey,” I said. “How’s it going?”

“Not good,” said Shawn. “Not good.”

“What’s up?”

“Feds,” he said, looking over my shoulder with a gut-punched wince. “FBI’s gonna be here in like an hour. They called Phil, and he talked to us. We agreed to talk to them if they came by here.” He chuckled. “It’s not gonna go very well.”

“What makes you think that?”

Shawn frowned. “I used to get harassed by the cops back in Chicago. Now me, I’m a white kid, right? So I got it better than most. But I know the deal. Best case, it’s not good.” He checked Lineman’s progress over the other guy’s shoulder. “E-trade got hit today at 5 AM for like ninety minutes, when everyone’s usually trading stock and whatnot. So now it’s no longer joke time. Someone’s going down.”

I nodded. “I see,” I said, raising the empty can. “I was just gonna say thanks for introducing me to Red Bull.”

He tucked the cigarette behind his ear and saluted me. “You’re welcome,” he said.

That afternoon the FBI, when asked how many agents they’ve directed to stop the attacks, said, “As many as it takes.” It was no longer joke time, as we found out almost immediately.

Standard
Going to California

Life by the Valley — 8.5

“I grew up in a time,” I told him, “when people, grown-ups, were still proud to say they didn’t even know how to turn on a computer, like it was a mark of status or something. When I was fourteen, I managed to save a little bit of money and my parents for whatever reason let me buy a computer. I ended up running a bulletin-board system from my bedroom through high school.”

“What kind?” he asked. I noticed that the girl with her back to me had stopped typing.

“Oh,” I said, “the sharing-text-files kind. You know. The exploring-places kind.”

He looked back towards me, but he was no longer looking through me. He was looking into me.

I continued. “I was mostly a pirate, but I learned from the phreakers. Hung out on chat lines, trading numbers and things. Figured stuff out. Free long-distance You know. You’re from Chicago, right? There was a big group up that way, a lot of boards.”

He smiled. “In Chicago,” he said, “we used to hang out on loop lines.” That’s right. They were phone numbers which didn’t terminate once someone called in, they looped back around and as far as we could ever tell they’d let any number of people call in. “The phone company uses those lines for testing,” he said.

“I remember.”

“I found one, one time, that turned out to be the main loop line for a central office. To help with troubleshooting line problems, they had it piped over the intercom system for the whole office.” He paused to see if I’d get it.

I did. “You mean everything said by a bunch of hacker kids was being broadcast out over an office at the phone company?!”

He giggled. “Yeah,” he said, smoothing back blonde wisps. “It was pretty bad, but we had no way of knowing. We only used it at night and on weekends, when the office was empty.”

I knew exactly what stupid things young hacker kids told each other.

“Holy crap,” I said.

“Yeah. Then one day we skipped school and got on the loop.” He wrinkled his face. “It was bad.”

“How bad?”

“Not really bad, actually.” He laughed again. “It was more funny than anything. A guy in the office got on the line and was like, ‘You kids get off this line, this is phone company property, don’t you know this is coming out of every speaker in the ceiling of every room in our office?’ And we were like, ‘Really?’ And he goes, ‘Yes!’ So of course we starting going, ‘Fuck, fuck, fuck, fuckers! Fuck, fuck, fucking everything!’ And he was all, ‘You goddamn kids, I’m going to find you and you’re going to fucking pay!’ And we said, ‘You know everyone in your office just heard you say that, right?’ And he was like, ‘Goddammit,’ and slam, hung up the phone, and we all hung up and we never called back.” He stopped laughing. “They didn’t catch us, of course.”

“Holy crap,” I said, feeling a grin pressing hard into my cheeks.

“They call me Lineman,” he said, extending his hand. “What was your handle?” he asked.

Without missing a beat, though I couldn’t remember the last time I’d done it, I told him my true name.

“Never heard of you,” he said, quickly cold.

“I’m okay with that,” I said, and coming from the hacker underground, where reputation was the currency of respect, not caring about your rep either meant you were too ignorant to realize you were poor or you were too rich to care how poor other people thought you were.

I was neither, mostly. “I’ve been out of the game for a long, long time,” I said, “but it was fun, back in the day.”

He began to smile again, then he looked away, at a large cardboard box on the floor.

“You know what that it?” he asked.

“No,” I said.

“Five-hundred lockpick sets. Brad had the idea to give them away at a conference, but—” He shrugged. “Turns out that’s illegal.”

“A minor detail,” I said.

Lineman winced. “He’s not very big into details.”

“Huh,” I said. “That’s not good.”

“It’s actually bad,” he admitted, leaning over to rip the box open and pulling out a few plastic bags inside each of which was a leather pouch, a little longer than my palm but maybe only half again as wide.

He ripped open one of the plastic bags and unsnapped the leather sheath, exposing some long, metal implements, each with a different kind of craggly bit on the end.

“I was thinking,” he said, “that I’d put the word out that anyone who wants one can have one. If they’ll just send me an email with their address, I’ll mail it to them.”

“That’s a great idea,” I said.

He fished out another handful and held them out toward me. “Want some?” he asked.

“Sure,” I said.

“Know how they work?”

“Not really.”

So he taught me how to pick locks.

“That’s shockingly easy,” I said.

“It’s kinda embarrassing how easy it is,” Lineman said. “But these are easy locks. They’re all different, you just have to learn them.”

“Huh,” I said. The girl had turned around to look at me. She was still smiling. I felt myself looking at her differently, though I wasn’t sure exactly how.

“We should hang out,” she said. Lineman was nodding.

“I think we will,” I said.

It wasn’t until late that night, after struggling with all the locks in my apartment and finally getting to the point where a few of them would open trivially, when it finally occurred to me that I had a lot to tell Phil.

Later, a voice in my head added: When there’s more to say.

It would not be long.

Standard
Going to California

Life by the Valley — 8.4

We’d been hiring more and more people, mostly to keep up with the demand for our services while replacing those we’d lost to the interesting start-ups which continued to spring up all across Silicon Valley. Maybe six weeks before the DDoS attacks began, two people had suddenly appeared in an empty row of desks behind Rain Girl, a young man and a young woman with the clear faces and wide smiles of people who weren’t exactly bad but who it was easy to imagine could be up to no good.

“You know who the new kids are?” I asked Phil.

“Ah, well,” he said, “Brad’s traveling more and more — consulting for clients and doing more than his share of partying, you see, so he can’t be troubled with the daily care and feeding of Packet Storm. You got new exploits and vulnerability hints coming in every day, so someone’s gotta go through it all, figure out what’s what, and get it up on the site.”

“Is that good for you? Him not being around.”

Phil shrugged, slumping a bit in his chair. “I’m not bothered about him any more. He’s going to slip up on his own, I don’t have to be the one to give him a shove.”

“So they’re running Packet Storm now?”

“He is, the one kid, a young hacker Brad found in Chicago. A bit touched, that one.”

“What do you mean? You mean like ‘Rain Girl’ touched?”

Phil slumped more deeply into his chair and looked at me through steepled fingers.

“Why don’t you tell me,” he said.

“And the girl?”

“Dunno. She’s his girlfriend. Don’t think she does anything but keep him happy. He refused to come out unless we gave her a job as well, you see.” He scratched his neck.

“So we’re paying her a Silicon Valley salary to be his girlfriend. I think there’s a word for that.”

“Don’t go there, pally. She answers email, I guess — spends a lot of time typing, at least.” Phil sighed. “Talk to them. Make friends if you can. See what he’s got them doing. If it’s up-and-up, fine.”

“If not?”

He pushed his chair back from his desk, stretching. The conversation was ending.

“You tell me,” he said.

The happy couple spent most of their time hiding behind headphones and screens of laptops, madly clickity-clacking from when I arrived in the morning until I left every evening. The site was getting updated, it was starting to get attention.

I had my own problems, of course. I had caught up enough on the technical side that I understood exactly how far behind I was. It wasn’t simply a problem of knowledge and understanding, it was a problem of habit. Those last few years in Austin, I’d let myself develop some terrible habits, mostly around not doing much work at all. The only way to get productive was to begin producing, and the only way to produce was to develop the habit of sitting your ass down every day and doing it.

One Sunday, with nothing else to do — Jim was off on one of his multi-week trips around the world, and the Bay Area’s rainy season had well and truly settled in; the days were short and my mood was dark — I went into the office to see if maybe I could get something done that I could feel good about, in hopes of starting the week with fresh momentum. To my slight surprise, I hadn’t been there an hour when I heard the office front door click open. I clocked the tops of the heads of the Packet Storm couple walking up the corridor that’d bring them past my office.

Slowly, the guy said, “Hey.”

“Hey,” I said. Beside him, the girl smiled with tightly pursed lips. He stared at me for moment, mouth opening and pulling air in as if he had something to say, then he turned on his heel and strode briskly on to the back corner of the office. The girl waved at me, then quickly followed.

I turned back to my screen, completely unable to remember what I’d been doing. I stared at my screen for nearly a minute before thinking I could probably use something to drink. Off to the kitchen, near the back corner of our office.

When I passed the open door that had been serving as a kind of lab, stacked high with racks of computing equipment and unlabeled cardboard boxes, the guy was standing on a chair, trying to attach something to the ceiling. The girl, sitting primly in a rolling office chair, looked over at me through the wide eyes of someone who wasn’t sure how the current scene would play out. Clearly, in her mind, it could go any number of ways.

I found that interesting.

“Hey,” I said, leaning against the frame of the door to the lab.

“Hello,” the guy said distantly, finishing what he was fiddling with, which was mounting a small disco ball to the ceiling. Then he hopped down off the chair and stood before me, arms pressed to his side.

“Hello,” he said again, as if for real this time.

“Hi,” I said, extending my hand. “My name’s Derek.”

“Mmm, hmm,” he said, shaking my hand and then going back to staring at me. The girl put on her headphones and swiveled around to face her screen — one of the top ten non-verbal cues that someone no longer wants to talk to you, in case you didn’t know.

“You guys are working on Packet Storm?” I asked.

He nodded, seeming to breathe more quickly. He was tall and thinner than most, wispy blonde hair like a cloud that followed him around. He looked toward me, but through me.

“I’m working on Radar,” I said. That was what we were calling our scanner.

“I know,” he said.

“I don’t think our bosses get along,” I said.

He barked a laugh, looking down and away from me. “I think you could say that.”

“Hmm,” I said. “That bad?”

He shrugged, still looking away. “He doesn’t know anything,” the guy said. “He says he does, but he doesn’t, not really.”

“What got you into computers?” I asked.

He took another good breath. “Oh,” he said slowly, “I like to play with things.” He shrugged again. “You know. Explore things.”

I nodded. Okay, I thought, let’s roll the dice. I opened my mouth and I said something I hadn’t told anyone in a long time.

Standard
Going to California

Life by the Valley — 8.3

In late 1999, more and more weaknesses were being found in computer networks, mostly in Microsoft Windows systems. As more people continued to leap onto the Internet, the number of targets swelled immensely, and some hackers began to realize that there might be more to life than rummaging through random people’s computers for interesting information — though that certainly still happened. Instead, an idea began to grow in the underground that by leaving vulnerable targets relatively intact and unmolested, you could build something that the world had never seen: the biggest hammer anyone had ever held, as long and as wide as the Internet itself.

They called it a Distributed Denial of Service attack — or DDoS. If the Internet, for having been designed to stay online through nuclear holocaust, was the closest thing we had to an immovable object, then a DDoS wasn’t far from its irresistible force. A DDoS couldn’t take down the entire Internet, though it could press hard against some important parts of it and make them cry.

How did someone make a great big hammer out of a bunch of Windows machines? Well, hackers had already begun taking it upon themselves to scan large swaths of the Internet looking for machines that seemed to be vulnerable in one way or other. The scanning tool would attempt to exploit a vulnerability, and if it was successful then it would install a tiny little app in the background of the computer, set to come back up with every system restart. The application was intended to be lightweight, low impact to its environment — it’d be best if the host never became aware that it had been taken over. The invading code came preconfigured with the addresses of some other machines that had already been taken over in a similar way, and which had been chosen to serve as central control points for the growing army. That way, the hackers could hide behind the central command-and-control machines, delivering them instructions which they would then pass along to the other bots.

A few months after the tools first became available, some people suddenly found themselves in control of a huge number of hosts. As hackers traded lists with one another, several lists of hundreds of compromised hosts became one list of more than a thousand, then lists of thousands became a single list of tens of thousands, and pretty soon someone held the reins of the first bot army big enough to do some pretty serious site smashing, raining down hammer strikes, essentially identical to valid Web requests, from all across the world.

There were plenty of places besides Packet Storm where you could find copies of DDoS attack tools, though we were one of the most prominent. It was a particularly bad decision by Brad, the Packet Storm project owner, that brought the authorities to our door. In December of 1999, he ran a little contest, offering $10,000 for the best analysis of how to handle a large-scale DDoS attack — which, as far as nearly everyone knew at the time, was a purely hypothetical question. Internally, a few of us took bets as to how many submissions we would get. I guessed six. Brad, the Packet Storm project owner, thought we’d only get one. We ended up getting two, but both of them from the same person, a young German hacker called Mixter who’d written one of the most popular bot control tools, TFN, Tribal Flood Network. Shortly afterwards, an even more advanced tool appeared on the scene, called Stacheldraht, which means “barbed wire” in German. It seemed to have been based on TFN, and even though Mixter never publicly took credit for it the math looks pretty simple.

So yes, we gave ten grand to a 24-year-old German DDoS hacker not long before the newest generation of his code was fingered as being responsible for the first large-scale public DDoS attacks, in which an oppressive number of remotely orchestrated computers took down Yahoo, Amazon, eBay, eTrade, and others, for as long as ninety minutes at a time during crucial business hours, causing an estimated $1.7 billion in damage in just three days.

Jim McCoy was not the only one who didn’t find it particularly clever that we might have aided these attacks, however distantly. Someone at the FBI wasn’t impressed, either.

Standard
Going to California

Life by the Valley — 8.2

The next morning, the admin had come in to see that Rain Girl had taken to keeping large amounts of leftover food containers on her desk, unrefrigerated. Setting aside what eating very much of it would’ve done to her, and how badly it was beginning to smell, the worst part was the trail of ants streaming back and forth from the precious bounty. Even in the face of a stern talking-to from our admin about the smell and the personal health implications, Rain Girl remained obstinate that she’d not done anything strictly wrong. But the conversation would not stop there.

“And what about the vermin?” our admin asked.

“What vermin?”

“You leave stuff out like this, you get bugs, you get mice and rats and all kinds of things.”

Rain Girl’s face fell. “Mice?” she said teeny-tinily.

And because our admin, a strong-jawed woman securely in her late-30s, was done with this girl’s crap, she said very seriously, “Yes. Mice.”

Rain Girl cringed. “How do they get up here? We’re on the second floor.” The girl began to smile, but the woman’s smile was larger.

“They smell the buffet you’ve left for them, and they’ll find a way.”

“How will they smell it? The windows don’t open, and—”

“Every person who walks down the hall past your desk and out of the building carries tiny little tastes of that smell, of rotting, open garbage — on their clothes, on their shoes. Maybe we can’t smell it, but outside, the mice can. And the rats. There’s a lot less easy food around, now that it’s gotten cold and rainy, so they’ll be looking for a way in here. They’ve probably already found one. They’re nearly through searching the first floor by now, I bet, but they hear us, up here.”

“Stop. Stop it. They do not.”

“Your desk is by one of the inner walls. You ever heard something around in there? Inside the wall? A scratching—”

“No. No, I haven’t.”

Having overhead some of this is the only reason I understood why I found Rain Girl, a few hours later, leaning sideways over her desk, staring down into a plastic channel full of cables which snaked up from the floor. She seemed concerned. Before I could open my mouth, she asked, “Could a mouse could fit in here, do you think?”

“No,” I said, then I sucked breath in slightly, as if reconsidering. Her eyes opened slightly and her head tilted fractionally forward. My subtle non-verbal cue had been caught, and for a moment I had a great deal of her attention.

It occurred to me to wonder if she was role playing, acting out the part of the vaguely Aspergery genius as an excuse for being selfish. I wondered what role I was supposed to play.

“Maybe baby mice could,” I finally said. “Mice breed like crazy, every couple of weeks or something, so I could see a bunch of blind, hairless baby mice — you know what I mean: veins visible through translucent skin — smelling something good and crawling up the loose spaces between the cables.”

“Oh, God,” she said, hand to her mouth.

Oh, God, I thought, she wasn’t role playing. If she was, she’s lost herself in the role. Once you lose yourself in a role, though, you’re no longer role playing, you’re just being you. This clinically self-absorbed personality was simply who she was.

I left the office and drove home for a part that I needed. On the way back, I called Jim to see if he wanted to get an early lunch, in hopes that telling him the story would absolve me of my guilt.

“I can’t go anywhere,” he said. “Yahoo’s down.”

“Oh,” I said, not at all registering understanding what he was saying. “Maybe later? Like in an hour?”

“Yahoo is down,” Jim said again. “And Amazon, and eBay. Some other sites, not all big ones.”

“Yahoo’s down?” The words made no sense.

“Yahoo — all of Yahoo, the whole thing — is off the Internet, all of it.”

“How?”

He laughed. “Someone’s attacking us.”

“Who?”

“It’s unclear,” was all he said, and that would pretty much sum up the event as a whole that week, as major Internet sites were relentlessly hammered over the next several days, rendering them inaccessible for as long as an hour as a time.

The story hit the news quickly, nearly as fast as it was capable of spreading back then, but much like the outage exactly to the month twenty years before, we still can’t say today what actually happened.

The service outage in early February of 2000 was different in one major way in that it could not have been an accident. This time, what the Secret Service and other science-fiction writers had long feared had finally come true. Big, bad-guy hackers had finally and hugely attacked the public good. One young hacker kid in particular would end up having the whole thing pinned on him, of course, but by the time our optimism had worn off and we were well and truly into the Dot-Com Bust, we’d already forgotten about the falling of this first domino.

Yahoo’s stock price had already been sliding. It would recover briefly after a few months, but only for two or three days. The attacks exposed a fundamental vulnerability of Internet services, one we still struggle with today. Even after the authorities had found a scapegoat, there was no getting around the fact that the only reason the Internet still worked as it did was because whoever had attacked us had chosen to stop attacking, though there was really nothing to stop them, or someone else, from starting it up again once the vulnerability was known — had been known for a while, actually.

I think the attacks, largely forgotten today, helped crack the foundations of our optimism around the unfettered growth of the networked world. There were limits, still.

And even after the scapegoat was caught, it didn’t take long for the finger of blame to swing around, eventually pointing at us, in our cookie-cutter Silicon Valley office. Here’s why.

Standard