Washington, DC: Tuesday,
October 21
st, 9:13 AM, 2003
Looking at the front page of the Internet Storm Center was a daily routine, like looking outside to see what the weather was like before going outside or choosing what to wear. From time to time there were interesting things, like a sudden spike in scanning for a service that might indicate that there’s a new vulnerability. But this time, it was different. “Upward Scanning Trends:TCP port 1734, unknown.” It was the same port as used by the ZFon software.
Chapter 6
The Internet Storm Center operated as a free service of SANS, a respected computer security organization and educator. It operated by making available a software client that volunteering companies and orga- nizations could use to submit their logs from IDS and firewalls; these logs contained data on port scans and attempted attacks. By collating the sum of these daily reports from hundreds of volunteers, it could piece together an overall view of what was happening on the Internet. When one com- pany was scanned, it could examine the ISC’s data and see if they were being targeted specifically, or if it might be part of a larger effort underway that encompassed the entire Internet.
“Hmm.” Reuben clicked on the item, bringing up a chart detailing the activity trend over the past month, listing the sources and total targets of probes.Toward the left, a flat line indicated nearly zero scans, until three days ago, when the number abruptly peaked up to over fifty thou- sand targets per day, and a few thousand sources.The activity formed a sudden plateau that continued through to the end of the graph, only fluc- tuating slightly.
What was particularly interesting was that the number of scans wasn’t quite high enough to gather much attention in and of itself; it was dwarfed by the scans for certain other ports, for example, and the site’s default graph of probes didn’t even show it. But the fact that there was any scanning, for an application with no publicly known vulnerabilities, was extremely significant. It meant that someone knew that it was vul- nerable, and that they were looking for targets. And what was really scary was that since the volunteers submitting data to the ISC were a definite minority, the amount of scanning going on was at least two orders of magnitude worse than the numbers shown on the graph.
“Dear God.”
Someone out there knew, and they were getting ready to attack.They were scanning to find the vulnerable systems. And with so many already- compromised systems from which to scan, they’d find nearly all of them. Hackers, good ones at least, never attacked major systems directly from their own machines.They hacked other systems, like home computers on DSL or cable modem lines, and used those machines to forward attacks for them.Thus, they covered their tracks, as such systems were either properly
secured (and thus not usable by the hacker) or entirely wide open with no logging of any sort. Even tracing back the attacks to these systems resulted in a dead end, since there was no way to figure out where the attack origi- nated. And some hackers with a purpose set up hundreds or even thousands of such systems to use at their disposal for large-scale attacks.
He stared at the screen for a minute, not sure how freaked out to be.
We both knew this might happen, get a grip, he thought.This isn’t the end of the world, this happens to all sorts of applications and the sun keeps coming up.
He tried to reassure himself, but the truth was, for all the times he’d known of this scenario occurring, it had never happened to him.Then he decided that he was seriously freaked out.
Reuben found himself in the midst of a huge dilemma; if he kept his mouth shut, he’d wittingly be complicit in whatever hacking was about to take place. But if he spoke up, he’d probably end up sacrificing himself for the greater good as the DoJ went after him for violating his NDA. And even if he did raise the alarm, the attacker, whoever he was, would still have culled a long list of vulnerable systems; as soon as word got out that there was a weakness, his hand would be forced and the attacks would commence almost instantly.Goddamnit! This is what we tried to pre- vent in the first place! Why didn’t they just listen to us?
His hand slowly went for the phone; maybe MadFast had a better idea. He looked up the phone number, dialing it in; he and MadFast almost never spoke voice, instead preferring the asynchronous conve- nience of e-mail. But in this case, Reuben felt it best not to leave some kind of trail in the wake of their conversation.
“Hello, Frank here.”
“Hey man, it’s Reuben. We’ve got a problem, man. Look at ISC’s front page.”
“’K. Hang on.”
Reuben heard the phone shift around on MadFast’s shoulder and the rapid tapping of keystrokes, followed by a few seconds of silence. Some clicking of a mouse followed, and Reuben knew that MadFast was most likely following the same steps he did.
MadFast took a deep breath, and exhaled. “Shit. What you’re calling about is obvious, I assume?”
“Yeah. Unless there’s some other vulnerable app we both worked on that I’ve forgotten about. I don’t know what to do…any ideas?”
“Uh, no. Not right yet.”
“Okay, me neither. What the fuck are we supposed to do? If we talk, we get sued big time. And it might not even help! But if we keep quiet, it’s partly our fault, whatever happens.”
“Yeah, but…yeah. I didn’t get into this kind of work to just let shit happen like this.”
“The only thing I can think of is to talk to Vince. He’s the one guy who’s been cool about this, maybe he has an idea. Hell, maybe they’ll LET us release now.You think?”
“Ah, right on! There’s an idea. At least it won’t hurt to talk to him. You want to do it or should I do it?”
“Let me. I’ve got a bit more insight into where he’s coming from at his end. As you’ve seen, the federal world is kind of surreal. I’ve got some people here to guide me through it, but you might make some mistake if you try anything, since you don’t have any help.”
“No shit. Okay, sounds like a plan. Let me know? And don’t let him screw us like he did last time.”
“Are you kidding? Of course I’ll keep you in the loop. And
remember, he didn’t screw us, he was as much of a pawn in it all as we were.” Reuben heard MadFast shrug on the other end.
“Yeah, I know. It just pisses me off.This sucks, we tried to prevent this, and they screwed themselves on it.”
“Yes, they did, but now we can help again. Look at it that way, and hang tight. In the meantime, I’m going to try and think of a way to work around the vulns…any thoughts?”
“No fricking way man, there’s just no way.You know how it works; it only uses one port.You can’t shut that off without making the thing use- less. And every service it runs is part of normal operation.”
“Okay, that’s what I was thinking too. Worth a try at least. I’ll call Vince now, and talk to you in a bit. No e-mail on this or anything, okay?”
As he got off the phone, Reuben felt a bit better. At least he wasn’t in this alone. And it always felt better to be doing something instead of just sitting idly while events progressed.
Back in 2001, as it turned out, ZFon had indeed addressed the lower- impact of the two bugs found. And they addressed the buffer overflow as well, only it took them a bit longer than a month. By that point, the soft- ware was being widely deployed throughout DoJ, and thoughts of the next version got sidelined in favor of a smooth and extremely overdue implementation. As it turned out, someone’s job was on the line for how delayed the VPN project had become, and in an act of personal survival they declared the product secure enough after just the small bit of work Reuben and MadFast had accomplished.They were firmly reminded of their NDA, and not permitted to even disclose their findings after a fix was available for both issues. And the vulnerable version stayed in place at DoJ, liberally distributed throughout their network.
And even worse, after some time MadFast went a bit deeper when he returned home, using a copy of the install files they’d kept for themselves. The buffer overflow turned out to be a root exploit after all, and there was a second one that one of Reuben’s untested payloads also triggered. The software was lousy with issues, and they couldn’t get anyone in DoJ to return their calls. Shortly after that, Vigility dropped the hatchet on the rest of Reuben’s unit, and Reuben just barely got a job working some- where else in time to keep paying the bills. And over time, he felt more comfortable that nobody else would ever stumble across any of the prob- lems they knew about, and that their worrying would all have been over nothing.
Well, so much for that hope, thought Reuben. Rather than call Vince right away, he decided to stretch his legs a bit and collect his thoughts. He got up and stepped out of his office, going down the hallway to the vending machines. He got a Coke, and stood there for a minute, his mind flipping over the motivating forces at play in DoJ and how Vince might react.
The federal government was notoriously uncooperative with private industry when it came to computer security. On more than one occasion, some kind of organization, task force, or group was created to help
industry, only to ask for information from private companies and not give any back in return.This could be tricky. I don’t think they’ll want to play nicely and let anyone else know,he thought.Boy, do I wish I could threaten to go to Congress and spill the beans. One of the nightmares of living in Washington, DC was that for all intents and purposes, you had zero representation in either the Senate or the House of Representatives. Reuben had done lob- bying in his college years, and knew how easy it could be to alert a law- maker to a serious issue, but only if you were one of their constituents.
No, that’s not the right way to go about this. If I get confrontational, we lose, just like that. Reuben tried to relax and not react before the fact.Maybe it won’t be so bad, maybe Vince can get it cleared for us to release so we can force ZFon to fix their software.This could turn out to be a good thing. Reuben felt hollow…no way could this be good. Even if everything followed a best- case scenario from this point forward, thousands of systems would be hacked and their privileged communications violated, at the very least.
Reuben had always hoped that things would work out a bit differ- ently here, and that nobody would ever notice any remaining weaknesses in the ZFon software. It looked like his hopes were not to be, though.
“Hey, you alright?” asked a coworker in mid-purchase of a soda. “Huh, what? Oh, yeah, I’m fine. Just thinking about something.” “Okay…you looked kind of in your own world for a second, that’s all. Sure you’re okay?”
“Yeah, just trying to figure out how to handle a client situation, that’s all. No big deal,” Reuben lied. “Just walking through the options in my mind.”
“Okay.”The man smiled back. “Gonna finish opening that Coke?” Reuben looked down He was holding the can in one hand, and had the tab half-lifted with the other, and must have just stopped in that posi- tion as his thoughts drifted. Usually, when he was this into his work he was in heaven.Today it was the opposite. “Ah, heh.You know how I get.” He finished opening the can and took a hungry pull of the drink.
The coworker nodded and finished his own purchase, waving as he walked off.
Reuben walked back to his office, and closed the door, locking it. He stared at the phone, and decided he’d just call Vince and figure out what he’d say on the fly.This was the kind of thing that could go terribly wrong if one thought about it too much. He sat down and looked up Vince’s number in Outlook, dialing the number nervously.
“Vince here.”
“Hey, it’s Reuben. How are you?”
“Hey! Good to hear from you! What’s new? Where you working these days? I hear where you used to be got hammered.”
“Ah, I got out from Vigility just before they dropped the bomb on everyone. When I left, they were all saying what a mistake I was making, but a month later I was getting calls asking if there were jobs open where I was. I’ve got to ask your help on something, though, and it’s important.”
“Sure. What can I do?” Vince was a nice guy, and easy to deal with. “Remember how MadFas…I mean, Frank and I warned how ZFon wasn’t quite secure still?”
“Yes…” Vince sounded a bit concerned.
“Someone’s scanning pretty much the entire world looking for run- ning instances of it.” Reuben waited to see how long it might take for the implication to sink in.
It didn’t take long at all. “Oh, boy. Hmm. Let me make some calls and see what needs to be done first. I want to be careful so that the wrong feathers don’t get ruffled over this, so that we’re free to address the situa- tion properly.” He was clearly as interested in dealing with this as Reuben was, thank God.
Reuben relaxed, feeling better now that there was a clear road to walk from here. “This can’t be a good thing. Whoever is scanning is doing it from a lot of different hosts, which means they’ve already got control of a lot of systems. If they are looking around like this, they have something large in mind.”
“Why don’t you think it’s more than one person scanning, then?” “Because what are the odds of hundreds or thousands of hackers simultaneously developing interest in the ZFon VPN on the exact same day?” Reuben had already thought of this.
“Good point. All right, I’ll see what the next step is. If anyone asks you anything, play dumb, okay?”
“Will do.Thanks, Vince.”
“Don’t thank me yet, this could be a mess.”
“Yeah, but at least you’re trying to help out. I feel safer knowing you’re involved, and I know that Frank does too.You’re more politically savvy about these things,and you’re connected in ways that neither of us is.”
“Well, if not for you two, we’d have been a lot worse off. I don’t see how I could just leave you twisting in the wind.”
“And that is exactly why I’m grateful.” Reuben smiled into the phone.
“I see, okay. I’ll give you a call when I know a bit more. Hang tight.” “Cool, will do.Talk to you soon.” He hung up and leaned back in his chair.I think we’re handling this well, come to think of it, he mused.Maybe this will be alright after all. He debated calling MadFast and telling him where things stood. He grabbed the phone and dialed him up.
“Hey hey.”
“It’s Reuben. I just got off the phone with Vince; he’s helping us out. He’s calling around and figuring the best way to handle it, and he’ll call me back when he knows. He’s fully on board, I think, and will help us avoid causing any political complications. Until then, play dumb if any questions come up, okay?”
“Right on. Anything you want me to do?”
“No, just sit tight. We need to see what Vince comes back with, and in the meantime, I’ve got our backs. I’ll let you know when I know more.”
“Right on.Talk to you soon.” “Yep.”
Reuben hung up and sat back, trying to think if there was anything he’d missed.Yeah, he thought.I miss the days when I was just a geek and it didn’t affect anything besides the systems I was directly responsible for.