Page 275

Undergound. Go to Table of Contents.

   A new process had been added to System X, which Anthrax recognised. It

   was called `-u'. He didn't know what it did, but he had seen it before

   on military systems. About 24 hours after it appeared, he found

   himself locked out of the system. He had tried killing off the -u

   process before. It disappeared for a split-second and reappeared. Once

   it was in place, there was no way to destroy it.


   Anthrax also unearthed some alarming email. The admin at a site

   upstream from both System X and the company's system had been sent a

   warning letter: `We think there has been a security incident at your

   site'. The circle was closing in on him. It was definitely time to get

   the hell out. He packed up his things in a hurry. Killed off the

   remaining sniffer. Moved his files. Removed the login patch. And

   departed with considerable alacrity.


   After he cut his connection, Anthrax sat wondering about the admins.

   If they knew he was into their systems, why did they leave the

   sniffers up and running? He could understand leaving the login patch.

   Maybe they wanted to track his movements, determine his motives, or

   trace his connection. Killing the patch would have simply locked him

   out of the only door the admins could watch. They wouldn't know if he

   had other backdoors into their system. But the sniffer? It didn't make

   any sense.


   It was possible that they simply hadn't seen the sniffer. Leaving it

   there had been an oversight. But it was almost too glaring an error to

   be a real possibility. If it was an error, it implied the admins

   weren't actually monitoring the connections in and out of their

   systems. If they had been watching the connections, they would

   probably have seen the sniffer. But if they weren't monitoring the

   connections, how on earth did they find out his special password for

   the login patch? Like all passwords on the system, that one was

   encrypted. There were only two ways to get that password. Monitor the

   connection and sniff it, or break the encryption with a brute-force



   Breaking the encryption would probably have taken millions of dollars

   of computer time. He could pretty well rule that option out. That left

   sniffing it, which would have alerted them to his own sniffer. Surely

   they wouldn't have left his sniffer running on purpose. They must have

   known he would learn they were watching him through his sniffer. The

   whole thing was bizarre.


   Anthrax thought about the admins who were chasing him. Thought about

   their moves, their strategies. Wondered why. It was one of the

   unsolved mysteries a hacker often faced--an unpleasant side of

   hacking. Missing the answers to certain questions, the satisfaction of

   a certain curiosity. Never being able to look over the fence at the

   other side.