John Sandford - The Devil's Code

"Gotta hurry," she grunted. "I don't know if the line'll hold. The door's heavier than I thought."

"Hang on, hang on." I didn't want the guy who was leaving to see me get out of the car. When he was up the hill, I hurried across the lawn. She'd stopped the door just as it touched the doorpost. I pulled it open, and snapped the line off the handle. We were in.

LuEllen had programmed Bloch's phone number into her cell phone earlier in the evening, and dialed the number as she got out of the car. The hallway leading past Bloch Tech was empty. I walked to the door, LuEllen close behind, and mimed a knock: we could hear the phone ringing inside. No answer.

As I mimed another knock, LuEllen turned off her phone and pointed a little battery-operated black light, the kind teenagers used to buy in head shops, at the keypad. The powdery crystals in the deodorant fluoresced in the lightexcept for the three that had no powdery crystals.

"Four-six-seven," she said. "But there are four digits in a Vermond lock. In this model. So they repeated one of them."

Nobody in the hall: I took a dime notebook out of my pocket and began scrawling number combinations as quickly as I could write, calling them out as I jotted them down. The thing about number pads is, with ten digits, there are 10,000 possible combinations. Getting inside with a brute-force attack is tough. And a few locks, but not this one, were alarmed, or would lock up, after a certain number of incorrect combinations. Then they could only be opened with a key.

But if you know the four digits involved in the combination. ah, then there were only twenty-four possible combinations. If one of the digits is repeated, like it was here, and you don't know which, the number goes up to thirty-six. But most people start their combination with the lowest number, in this case, a four. We started with four-four-six-seven, and went to four-four-seven-six, and to four-six-four-seven, and so on. We were lucky, hit it on the eighth combination, and pushed into the darkened office.

"Gloves," LuEllen said.

We pulled on vinyl gloves, and followed the hair-thin beams of the flashlights into the server room. The Dell servers looked like five little dwarfs, lined up for breakfast; the room was windowless, and windowless was good. The futon was rolled into a corner of the third room, with a fuzzy blue blanket tossed carelessly on top of it. LuEllen, using her flash, found a roll of tape in the outer office, and brought the blanket into the server room. We taped the blanket to the wall so it covered the door, and then LuEllen slipped under the blanket into the outer office, and closed the door behind her. I pulled the blanket so it covered the door completely, and turned on the light.

"Light's on," I said. Then I turned if off, and LuEllen pushed back inside.

"Almost perfect," she said. "There was a little tiny dot of light near the right corner."

We rearranged the blanket and I went to work on the machines. Servers are nothing but specialized computers, optimized for communications and storage. If you've got a relatively modern home computer, you could use that as a small server, with the right software. In this raid, we wouldn't be going after the content inside the servers. We wanted access, rather than content. I spent twenty minutes pawing through Bloch's software and service-maintenance manuals, and then got into the servers themselves. They were running on a standard off-the-shelf UNIX server package. I had root in five minutes, with an outside maintenance account. Then I dumped in a little access program of my own; I've done this before. After checking it, I shut down local access, turned the light off again, pulled down the blanket, and cleaned up the tape.

While I was working on the machine, LuEllen had been going through paper files in the outer office, using her flash. "All bullshit," she said. "Tax forms, bank statements, advertisements."

One of the forms listed Toby Bloch as owner of 100 percent of Bloch Technology stock. "Is that the guy you talked to?" I asked. I crumpled up the blanket and tossed it back on the futon, more or less as it had been.

"That's the guy. Toby."

"All right. Nice little business he has here."

With everything back in place, we listened at the door, heard nothing, and walked out; out to the car, and we were gone. Nothing to it.

But there was trouble back at the ranch. I wouldn't go online with the server until after midnight, when there was less chance that the real system operator was online. Instead, I checked with Bobby, to see if he had anything more on Jack Morrison or Firewall. He did.

look at news programs. firewall attacks irs with dos. big trouble now. attack maybe starts in switzerland. style feels german.

will look. anything on jm?

jm flies to baltimore-washington international on monday before shooting, returns same night. rented hertz, 64 miles. no more detail. also flies to bwi on thursday afternoon back friday morning. no car, no hotel on card.

thanks. will look at news.

this is *very* dangerous.

later.

I thought about that until LuEllen said, "What?"

"Jack Morrison was in town the night Lighter was killed," I said.

"That's not good."

"No. But Lane's lecture about Jack and guns. that's still pretty straight. I still can't see Jack shooting anyone." "What's this about the IRS?"

"I don't know," I said.

"Bobby seems more worried about that than about Jack."

"Jack's dead," I said.

I checked the Times and Washington Post online editions, but they had nothing on the attack on the IRS. CNN had a story, but like a lot of CNN stuff, most of it seemed to have been garbled by a mentally challenged paranoiac; I clicked over to The Wall Street Journal, which had a short item.

A denial-of-service (DoS) computer attack aimed at the internal revenue service has caused a major disruption in the handling of end-of-quarter business tax filings, an IRS spokesman confirmed this afternoon.

The attack, which began this morning, is continuing. The attacking group has identified itself as "firewall."

A denial-of-service attack attempts to flood the target with huge numbers of legitimate-looking transactions, eventually overwhelming the target computer's ability to cope with the numbers.

While official department of justice sources said that the attack is limited, one high-level IRS official, who asked not to be identified, said that there has been a major disruption of end-of-business-quarter tax filings. He said that "tens of thousands" of business quarterly returns were involved and said that the attack seemed to be spreading.

An FBI spokesman said that many of the DOS calls appear to be coming from small-college computer labs.

"What apparently happened is that some individual or group planted small attack programs inside these open computers, and designed them to go off at the same time. We are getting in touch with these schools as we identify them, asking that they go off-line long enough to remove the programs from their computers. Most of them have no idea that their computers are participating in the attack," FBI spokesman Larry Conners said.

Conners said that the attack program is an unsophisticated one, but the IRS official said that it takes advantage of the fact that the IRS computers must be open to the outside to receive legitimate tax returns. The attack involves sending and resending hundreds of legitimate-looking, but slightly flawed returns, which the IRS computers then attempt to return to the sender. As the volume built, the computers were no longer capable of handling the flow of traffic.

"Individually, the attack filings wouldn't be a problem; the problem is that they just keep coming, over and over, from so many different sources," the IRS source said.