Robin Cook - Shock

"Oh, sure!" Joanna said. "Come in and meet my roommate."

Joanna took David's arm. She led him inside and introduced him to Deborah, who'd managed to get herself upright. Joanna then apologized for not having a thing to offer him to drink.

"No problem," David said. "We'll make up for it on another occasion. Now I know you ladies must be tired just getting back from Italy and all, so why don't we get right down to business." He peeled off his jacket made of black parachute fabric. From his pocket he produced a handful of floppy discs and held them up. "I brought along some tools, including my brute force password-guessing program. Where's your machine?"

A few minutes later David had the computer booted up and onto the Wingate Clinic's web page. With a rapidity that made Deborah blink, David browsed around the site. His fingers moved like a concert pianist across the keyboard. "So far so good,' he reported.

"Can you tell me what you are doing?" Deborah asked.

"Nothing yet," David said as he continued his surfing. "Just checking things out and looking for obvious holes in their firewall."

"Do you see any?"

"Not yet, but they're there."

"How can you be sure."

"One of the roles of a website is to provide the world with access to the organization's network. Here you can see the Wingate Clinic has it set up for people to send in health-related data and to get information back. Any time there is such an exchange there's the possibility of unauthorized access. In fact, in general, the more interactive a site is, the easier it is to hack. In other words, the more traffic, the more holes."

Deborah nodded but she wasn't sure she understood. Her use of computers was restricted to her biological research work, using the Internet as a resource, and sending E-mail.

"But what about passwords?" Deborah questioned. Whenever she used the computer in the lab, she had to enter her password, which only she knew. "Don't those keep people out?"

"Yes and no," David said. "That's supposed to be the idea, but it doesn't always work like it should. A lot of network managers are lazy and they never change the manufacturer default passwords, so that narrows down what has to be tried. Also with a www. server there's no limit to how many attempts you can make, so we can try a brute-force password-guessing program like the one I brought with me."

Deborah rolled her eyes for Joanna's benefit. "It's actually a lot of fun," David said, sensing Deborah's doubt. "It's like an intellectual arcade game."

"I can't imagine it's too much fun for the people being hacked," Joanna said.

"It's usually pretty innocuous," David said. "Most hackers I know aren't malicious. It's like an ongoing competition between them and the people designing the security. Or they're just doing someone a favor like me with you guys. You're not interested in doing anything other than getting the information that it seems to me you're entitled to."

"It would have been a lot easier if the clinic saw it that way," Joanna said.

All at once David stopped typing. He stroked his beard thoughtfully. "Well, I have to give credit where credit is due. Seems like a pretty tight site. Certainly no glaring holes. In fact it seems to me to be fairly sophisticated. They've got an authentication server. Does this organization have a lot of bucks to throw around?" "That would be my guess," Joanna said.

"I'm getting the feeling we're up against some pretty good security here," David said, "which means we'll have to get more sophisticated ourselves."

"What is it exactly that you would like to be able to do?" Deborah asked.

"I'd like the web server to recognize and authenticate us," David said. "Then we'd have the run of all their files. What I'm going to try now is to fill up the buffer on their new patient form and see if I can throw in some assembly-level commands in the space after the buffer to Bypass the authentication. It's like riding in through the CGI on the patient-form coattails."

"Could you tell me that in English?" Deborah said.

David looked up to Deborah's face. She was watching over his left shoulder. "I was actually simplifying the process when I just described it."

"Fine1." Deborah said, pretending to be irritated. "If that's the case, then I'll take myself over to the couch and lie down. I'll let you two computer wizards attend to business."

David looked up at Joanna over his other shoulder. "I want to make sure you understand that if I do this, and it works, there will be an electronic trail through your Internet service provider to this machine. If the hack is picked up, they could come after you. Are you okay with that?"

Joanna mulled the question for a moment. She knew what they were doing was technically breaking the law, yet the information was important to her, even necessary for her peace of mind in view of the changes in her life. And what were the chances such an intrusion would be noticed if all they did was trace their own eggs? She thought the chances seemed small indeed.

"What do you think, Deborah?" Joanna asked.

"I'm willing to leave it up to you," Deborah said. "I'm curious, obviously, but not as curious as you."

"Then let's do it," Joanna said.

"Right on, baby1." David said gleefully as he rubbed his hands together in anticipation of the challenge. He cracked a few of his knuckles before bending to the task. Again his fingers flew over the keyboard. The sound was like a continuous clatter rather than individual strokes. Images flashed on the screen in rapid succession.

After more than thirty minutes of intense concentration, David halted. He took an exasperated deep breath while flexing his fingers in the air.

"It's not working, is it?" Joanna said.

"I'm afraid not," David said. "This is no Mickey Mouse setup that I can assure you."

"What do you propose?"

David looked down at his watch. "This might be a long process. It's a more secure site than I would have imagined, and it's not letting me sneak in any commands whatsoever. I thought we were dealing with a Windows NT environment but it now looks like a Windows 2000 with Kerberos."

"Is Kerberos the authentication method developed at M.I.T.?" Joanna asked.

"You got it," David said.

"So what's your bottom line suggestion as the easiest way to get the information we want?"

David laughed. "Let me stay here for a week, and I'll try to bust in with stuff like the LophtCrack utility. Other than that, I'd suggest you find someone who works out there at the Wingate Clinic, who has access, and who would be sympathetic to your cause."

"Those are the only two choices?"

"No, there's something else. Get yourself or me into the server room." David laughed again. "Actually, that's the most efficient, foolproof way. Hell, it would probably only take less than ten minutes to create your own pathway. Then it would be a piece of cake, either from a workstation inside the network or even from offsite if you did it right."

Joanna nodded while her mind pondered the choices. She felt progressively committed, as if the more she hit up against barriers, the more she wanted to succeed, especially since she could picture a little girl somewhere nearby who looked like the photos she had of herself as an infant.

David glanced down at his watch, then back up at Joanna. "It's after ten. You want me to keep going here or what? I'm cool with it if you do, but like I said, I can't promise anything other than I'm sure I can crack this site eventually. I just don't know how long it will take."

"You've done enough," Joanna said. "Thank you." She stared off vacantly deep in thought.

David noticed the faraway look in her green, unblinking eyes. He waited for several beats, then stuck his hand up in her line of sight and waved it back and forth. "Are you with me, girl?"