Underground - Suelette Dreyfus (best novels ever .TXT) 📗

Anthrax reached for the knife, an ambulance worker appeared in the doorway. Anthrax put the knife down and walked away.

But he wasn’t so quiet after that. He started talking back, at home and at school, and that marked the beginning of the really big problems. In primary school and early high school he had been beaten up now and again. Not any more. When a fellow student hauled Anthrax up against the wall of the locker shed and started shaking him and waving his fist, Anthrax lost it. He saw, for a moment, his father’s face instead of the student’s and began to throw punches in a frenzy that left his victim in a terrible state.

At home, Anthrax’s father learned how to bait his son. The bully always savours a morsel of resistance from the victim, which makes going in for the kill a little more fun. Talking back gave the father a good excuse to get violent. Once he nearly broke his son’s neck. Another time it was his arm. He grabbed Anthrax and twisted his arm behind his back. There was an eerie sound of cracking cartilage, and then pain. Anthrax screamed for his father to stop. His father twisted Anthrax’s arm harder, then pressed on his neck. His mother shrieked at her husband to let go of her son. He wouldn’t.

`Look at you crying,’ his father sneered. `You disgusting animal.’

`You’re the disgusting animal,’ Anthrax shouted, talking back again.

His father threw Anthrax on the floor and began kicking him in the head, in the ribs, all over.

Anthrax ran away. He went south to Melbourne for a week, sleeping anywhere he could, in the empty night-time spaces left over by day workers gone to orderly homes. He even crashed in hospital emergency rooms. If a nurse asked why he was there, he would answer politely, `I received a phone call to meet someone here’. She would nod her head and move on to someone else.

Eventually, when Anthrax returned home, he took up martial arts to become strong. And he waited.

Anthrax was poking around a MILNET gateway when he stumbled on the door to System X.* He had wanted to find this system for months, because he had intercepted email about it which had aroused his curiosity.

Anthrax telnetted into the gateway. A gateway binds two different networks. It allows, for example, two computer networks which talk different languages to communicate. A gateway might allow someone on a system running DECNET to login to a TCP/IP based system, like a Unix. Anthrax was frustrated that he couldn’t seem to get past the System X gateway and on to the hosts on the other side.

Using normal address formats for a variety of networks, he tried telling the gateway to make a connection. X.25. TCP/IP. Whatever lay beyond the gateway didn’t respond. Anthrax looked around until he found a sample of addresses in a help file. None of them worked, but they offered a clue as to what format an address might take.

Each address had six digits, the first three numbers of which corresponded to telephone area codes in the Washington DC area. So he picked one of the codes and started guessing the last three digits.

Hand scanning was a pain, as ever, but if he was methodical and persistent, something should turn up. 111. 112. 113. 114. 115. On it went. Eventually he connected to something—a Sunos Unix system—which gave him a full IP address in its login message. Now that was handy. With the full IP address, he could connect to System X again through the Internet directly—avoiding the gateway if he chose to. It’s always helpful in covering your tracks to have a few different routing options. Importantly, he could approach System X through more than just its front door.

Anthrax spiralled through the usual round of default usernames and passwords. Nothing. This system required a more strategic attack.

He backed out of the login screen, escaped from the gateway and went to another Internet site to have a good look at System X from a healthy distance. He `fingered’ the site, pulling up any bit of information System X would release to the rest of the Internet when asked. He probed and prodded, looking for openings. And then he found one. Sendmail.

The version of Sendmail run by System X had a security hole Anthrax could exploit by sending himself a tiny backdoor program. To do this, he used System X’s mail-processing service to send a `letter’ which contained a tiny computer program. System X would never have allowed the program to run normally, but this program worked like a letter bomb. When System X opened the letter, the program jumped out and started running. It told System X that anyone could connect to port 2001—to an interactive shell—of the computer without using a password.

A port is a door to the outside world. TCP/IP computers use a standard set of ports for certain services. Port 25 for mail. Port 79 for Finger. Port 21 for FTP. Port 23 for Telnet. Port 513 for Rlogin. Port 80 for the World Wide Web. A TCP/IP based computer system has 65535 ports but most of them go unused. Indeed, the average Unix box uses only 35, leaving the remaining 65500 ports sitting idle. Anthrax simply picked one of these sleepy ports, dusted off the cobwebs and plugged in using the backdoor created by his tiny mail-borne program.

Connecting directly to a port created some problems, because the system wouldn’t recognise certain keystrokes from the port, such as the return key. For this reason, Anthrax had to create an account for himself which would let him telnet to the site and login like any normal user. To do this, he needed root privileges in order to create an account and, ultimately, a permanent backdoor into the system.

He began hunting for vulnerabilities in System X’s security. There was nothing obvious, but he decided to try out a bug he had successfully used elsewhere. He had first learned about it on an international phone conference, where he had traded information with other hackers and phreakers. The security hole involved the system’s relatively obscure load-module program. The program added features to the running system but, more importantly, it ran as root, meaning that it had a free run on the system when it was executed. It also meant that any other programs the load-module program called up also ran as root. If Anthrax could get this program to run one of his own programs—a little Trojan—he could get root on System X.

The load-module bug was by no means a sure thing on System X. Most commercial systems—computers run by banks or credit agencies, for example—had cleaned up the load-module bug in their Sunos computers months before. But military systems consistently missed the bug. They were like turtles—hard on the outside, but soft and vulnerable on the inside. Since the bug couldn’t be exploited unless a hacker was already inside a system, the military’s computer security officials didn’t seem to pay much attention to it. Anthrax had visited a large number of military systems prior to System X, and in his experience more than 90 per cent of their Sunos computers had never fixed the bug.

With only normal privileges, Anthrax couldn’t force the load-module program to run his backdoor Trojan program. But he could trick it into doing so. The secret was in one simple keyboard character: /.

Unix-based computer systems are a bit like the protocols of the diplomatic corps; the smallest variation can change something’s meaning entirely. Hackers, too, understand the implications of subtle changes.

A Unix-based system reads the phrase:

/bin/program

very differently from:

bin program

One simple character—the `/’—makes an enormous difference. A Unix computer reads the `/’ as a road sign. The first phrase tells the computer, `Follow the road to the house of the user called “bin” and when you get there, go inside and fetch the file called “program” and run it’. A blank space, however, tells the computer something quite different. In this case, Anthrax knew it told the computer to execute the command which proceeded the space. That second phrase told the machine, `Look everywhere for a program called “bin” and run it’.

Anthrax prepared for his attack on the load-module program by installing his own special program, named `bin’, into a temporary storage area on System X. If he could get System X to run his program with root privileges, he too would have procured root level access to the system. When everything was in place, Anthrax forced the system to read the character `/’ as a blank space. Then he ran the load-module program, and watched. When System X hunted around for a program named `bin’, it quickly found Anthrax’s Trojan and ran it.

The hacker savoured the moment, but he didn’t pause for long. With a few swift keystrokes, he added an entry to the password file, creating a basic account for himself. He exited his connection to port 2001, circled around through another route, using the 0014 gateway, and logged into System X using his newly created account. It felt good walking in through the front door.

Once inside, Anthrax had a quick look around. The system startled him. There were only three human users. Now that was definitely odd. Most systems had hundreds of users. Even a small system might serve 30 or 40 people, and this was not a small system. He concluded that System X wasn’t just some machine designed to send and receive email. It was operational. It did something.

Anthrax considered how to clean up his footsteps and secure his position. While he was hardly broadcasting his presence, someone might discover his arrival simply by looking at who was logged in on the list of accounts in the password file. He had given his backdoor root account a bland name, but he could reasonably assume that these three users knew their system pretty well. And with only three users, it was probably the kind of system that had lots of babysitting. After all that effort, Anthrax needed a watchful nanny like a hole in the head. He worked at moving into the shadows.

He removed himself from the WTMP and UTMP files, which listed who had been on-line and who was still logged in. Anthrax wasn’t invisible, but an admin would have to look closely at the system’s network connections and list of processes to find him. Next stop: the login program.

Anthrax couldn’t use his newly created front-door account for an extended period—the risk of discovery was too great. If he accessed the computer repeatedly in this manner, a prying admin might eventually find him and delete his account. An extra account on a system with only three users was a dead give-away. And losing access to System X just as things were getting interesting was not on his agenda.

Anthrax leaned back in his chair and stretched his shoulders. His hacking room was an old cloakroom, though it was barely recognisable as such. It looked more like a closet—a very messy closet. The whole room was ankle-deep in scrap papers, most of them with lists of numbers on the back and front. Occasionally, Anthrax scooped up all the papers and piled them into heavy-duty garbage bags, three of which could just fit inside the room at any one time. Anthrax always knew roughly where he had `filed’ a particular set of notes. When he needed it, he tipped the bag onto the floor, searched through the mound and returned to the computer. When the sea of paper reached a critical mass, he jammed everything back into the garbage bag again.

The computer—an Amiga 500 box with a cheap Panasonic TV as the monitor—sat on a small desk next to his mother’s sewing machine cabinet. The small bookcase under the desk was