Daniel Suarez - Daemon

Merritt hit the water face-first and blacked out as the trapdoor snapped shut above him.

Among the agents surrounding the mansion a shout went up. It was quickly followed by hundreds of other voices shouting. Sobol’s mansion was now glowing orange. Then flames burst out through literally all of its windows. In seconds the entire structure was engulfed in flames reaching fifty feet into the air. The half-dozen outbuildings burst into flames, too, and were quickly roaring infernos.

Trear numbly watched the scene. It was the nightmarish Waco visual he’d dreaded—one almost certainly combined with the worst casualties ever suffered by the FBI in a single operation. And all of Sobol’s data were going up in flames. Along with Trear’s career.

It took Gragg nearly three and a half hours to crack the WPA key on Boerner’s second Wi-Fi network. He had to keep his car running the entire time to be certain he didn’t drain his laptop battery. Once he cracked the key, he configured his card to use it, and DHCP soon handed him an IP address on the wireless network. By that time it was roughly four in the morning.

But he’d slept a little, and buoyed by the successful crack, he felt good. If this was a test, he’d passed the first part. He might get out of this alive yet.

Gragg used Superscan to run a ping sweep and port scan for machines on this new network, but he discovered only the single workstation running the wireless access point. The workstation returned information on its operating system and coughed up the status of several running services—but its hard drive was sealed tight.

Gragg considered his options. He wanted a quick exploit that would give him a remote shell on the host machine with sysadmin rights. From there, he should be able to see into the hardwired LAN not yet visible to him.

Since he didn’t have the luxury of time, he opted for an attack that was effective against a wide range of devices: SNMP—a buffer overrun that exploited a known vulnerability in unpatched implementations of Simple Network Management Protocol. This service was present on the target, and it was worth a shot.

He switched to the command console and quickly keyed in the commands, pointing his exploit code to port 161 on the target machine. If the target was running an unpatched OpenBSD, he’d get to root pretty quick.

He executed the command, waited, and in a moment he got a return instructing him to telnet to port 6161 at the target IP address. He sighed in relief. Another hurdle overcome.

Gragg launched a telnet session and soon had a root prompt. He now owned Boerner’s workstation. Time to escalate network privileges.

Gragg searched the target machine’s domain but was disappointed by the results. His victim was linked to a single server—and that was sealed up tight. It barely divulged any information. Gragg took a look in the server’s shared directory and raised his eyebrows.

The directory contained a single Web page file. A page named HackMe.htm.

Gragg smiled. He was beginning to feel a connection with Sobol. Sobol wanted him to get this far—that’s what this was all about.

Gragg double-clicked on the file. A plain white Web page appeared in a browser window. It had logon and password text boxes and a SUBMIT button—nothing more.

There were options here. Unicode directory traversal? Gragg smiled. Logon. Sobol was encouraging him. This had all the earmarks of an SQL-injection attack, and he had a favorite one. In the logon and password boxes he entered:

‘or 1=1--

He clicked the SUBMIT button. After a moment’s pause an animation appeared with the words “Logon successful. Please wait….” Gragg felt a rush of endorphins. He’d just received high praise from his new mentor. He was getting more comfortable by the minute in this environment.

In a few moments a slick Flash-based diagram of a cinderblock building appeared with various features highlighted. It was an isometric view depicting the building right in front of Gragg’s car. He could see the antenna tower with a call-out label captioned “WI-FI ANTENNA ARRAY.” He moved his pointer around the diagram and noticed rollovers come to life as his mouse passed over certain features.

Gragg saw a sensor array depicted on the roof, and the illustration looked like it included at least one camera. Gragg pointed at the array, and a translucent drop-down menu unfolded to the right of it containing a submenu:

Ultrawideband Transceiver

HD Video Multiplexer

Acoustical Sensor Array

He was beginning to feel the rush now. This wasn’t a game, and it was clearly designed by a well-funded and technologically capable person. He had always sought the edge —and this was it. This was as far from Main Street as he’d ever been. This wasn’t the tattooed, pierced, neo-tribal rebellious bullshit of his generation. This was a quiet demonstration of networked power. This was it.

Gragg selected HD Video Multiplexer from the drop-down menu. A new browser window appeared containing a selection of six thumbnail images. They appeared to be streaming video feeds. Gragg saw an image of a car in one thumbnail, and he double-clicked on it—as anyone his age would do. It expanded to fill the window. It was a live image of his car. He waved his hand, and his hand appeared waving on the video feed. Gragg noticed a superimposed red bracket around his license plate. A call-out label showed the software’s interpretation of the tag number. It was correct. So Sobol was employing an optical license plate reader. Gragg knew it was commercially available software—used all the time on interstates and downtown roads. But Sobol needed access to DMV records to determine who owned the car. He must have cracked a DMV database in order to get his registration information. Gragg considered the hourly rate of the average DMV worker and realized that gaining access wasn’t a problem for Sobol.

In the background of the video, there was a similar bracket around the VW Vanagon’s license plate. Gragg couldn’t help but wonder what was up with that. The van was smashed all to hell.

He closed that dialog box and checked out the other video feeds. There were cameras placed all around the cinderblock building, guarding it from every direction. Every time the wind blew, the swaying branches were outlined by vectored lines trying to resolve into something recognized by the software. Gragg found himself watching the red lines appear and disappear like a lava lamp. Motion-capture software? This was sophisticated stuff. No one would ever suspect that this isolated blockhouse held so much processing power.

Gragg closed the video feeds and moved around to the other visible features of the diagram. He noticed that a garage-like protrusion extended from the rear of the building. He pointed his mouse at it, and the words “H1 Alpha” materialized beneath his pointer. That explained the damage to the Vanagon. There was an automated Hummer here—just like at Sobol’s mansion. Gragg smiled. It was Sobol. He was walking in the footsteps of a genius. To his dismay, there was no more information visible for the Hummer, so he clicked on one of the nodes around the base of the building. The label “Seismic Sensors” appeared. Probably for detection of approaching vehicles and people.

As Gragg scrolled around the base of the building illustration, a rollover displayed the red, glowing outline of a door in the front wall. He looked up at the real wall some twenty feet ahead of him. He couldn’t see any indication that there was a door in the plain cinder blocks. He hovered his mouse cursor back over the section of wall in the diagram, and a drop-down menu appeared. It had two selections: “Open” and “Close.” Gragg clicked “Open.”