The Loyal Nine (20 page)

“Exactly!” exclaimed Lau. The room listened in silence, awaiting the basis for their professor’s excitement. “It came to me on the way over here. I heard ‘Enter Sandman’ by Metallica.”

“
Sandman
, I’m not familiar with that. Is it a virus?” asked Fakhri.

“No, no, no!” interrupted Walthaus.

Lau watched as Walthaus searched furiously through his jacket pockets until he revealed a small spiral notebook that was barely held together. Walthaus frantically thumbed through the book, stopping on one of the stained, crumpled pages. “Yes, yes. Here it is—
Sandworm
!”

“Congratulations, Walthaus, you go to the head of the class,” said Lau.

The kid has potential.
Lau turned his Red Sox cap backward and approached his computer station.
Game on!

Chapter 30

February 13, 2016

The Hack House

Binney Street

East Cambridge, Massachusetts

The Zero Day Gamers had spent all night studying the technical aspects of the Sandworm malware. Sandworm had been utilized in a Russian cyber-espionage campaign against the European Union, NATO and a broad variety of utilities. Ironically, Sandworm wasn’t a true worm virus. A malware program by nature, it exploited a true zero-day vulnerability, instead of mindlessly copying itself and infecting multiple systems in the same network. Essentially, it was a targeted virus. Sandworm was especially effective in a Windows-based environment, often inserted via PowerPoint files—INF files in particular. INF files were text files that contained components used to install software updates and drivers on PC systems.

Microsoft developed a patch that blocked applications like PowerPoint from sucking in and launching external files like an INF. The Sandworm malware circumvented the patch.

“I think we’re ready, Professor,” said Malvalaha.

Lau walked over to Malvalaha’s desk and motioned for the other Gamers to gather around.

“Windows will block an attempt by a typical INF file to enter the operating system,” said Malvalaha. “So what we have done is create two files with innocent-looking names, in this case—
slides.inf
and
slide1.gif
. I say innocent looking, because they are typical names and extensions used as part of the PowerPoint program itself.”

Lau stood back to allow the students to inch closer to Malvalaha’s screen.

“Slide1.gif has been created as an executable program file and slides.inf is designed as an installer file that will rename slide1.gif to
slide1.gif.exe
,” said Malvalaha. “Once inserted into the Clark Station server, slide1.gif.exe will create a registry entry that will allow activation of the Sandworm program. In this particular case, we will not be able to run the program directly, but the SCADA software will have ingested a yummy PowerPoint GIF-and-INF cocktail.”

Malvalaha leaned back in his chair to catch his breath.

“The malware itself is not embedded in our PowerPoint file. Rather, it is retrieved by a drive-by install—the download of updates to Java, Windows, ActiveX or Adobe will trigger the activation. We have obfuscated the malicious code in Sandworm to avoid detection by their antivirus software. When SCADA is used in any capacity today, the malware will activate, and the Clark Station will go offline.”

“Were you able to use Sandworm to affect the outlying generation plants?” asked Lau.

“We added an interesting twist to the GIF-and-INF cocktail,” said Fakhri. “We wrote the code to reject requests from the Chuck Lenzie Station as a potential DDoS attack. The normal operating functions of SCADA are compromised to the extent that Clark Station will deny SCADA access from the outlying stations.”

“There’s one more thing,” interrupted Malvalaha. “All of the major casinos have standby power systems. I’ve done some research on the standby system at Caesars Palace and found it to be typical of the major hotels that have a backup in place.”

“What is the standby system’s capability?” asked Lau.

“Most of the buildings have the typical battery-powered security lights that will remain on for an hour or so,” said Malvalaha. “But the batteries will eventually lose their charge. The major casinos claim to be cognizant of guest safety, but they are really more interested in keeping the slots running. They employ a more sophisticated backup system called a
paralleling system
.”

Damn.

“How long will the paralleling system maintain power?” asked Lau, his voice showing obvious concern about this new twist.

“Fear not, good sir,” said Malvalaha. “We’ve got this.”

Lau relaxed—a little.

“The consulting engineers who provided the Cummins Power paralleling system to Caesars Palace were very proud of their work,” said Malvalaha. “The engineers were so proud they detailed the entire project on their website. Here’s what I learned from their dot-com.”

Malvalaha went on to detail how the paralleling system at Caesars consisted of nine sections of switchgear and two sections of low-voltage controls, including a digital master control.

“Here is where they failed,” said Malvalaha. “The entire apparatus includes a DMC 300 digital master control, which employs a simple-to-use icon-based touchscreen interface. This simplifies their diagnostics and operation.”

“So,” started Lau, motioning for him to get to the point.

“Sooo,” interrupted Malvalaha, “they wired the DMC 300 control panel to the Nevada Energy SCADA system in order to receive instantaneous notice of an outage. Their client insisted that those slot machines never miss a beat.”

“Hell yes!” exclaimed Lau. “Let me guess, you stirred in a little something for the DMC 300 in the cocktail. When the grid goes down, the backup system will fail as well.”

“Yes, we did,” said Malvalaha proudly. “We’ve done the same for the rest of the hotels with similar systems.”

“Let’s get started,” said Lau. “The program will execute at what time?”

“I have it set for 8:00 p.m. Pacific Time,” said Malvalaha. “It will release the system in exactly forty-eight hours, as requested by the client. This should be an interesting Valentine’s Day weekend for Sin City.”

“Walthaus, are you ready?” asked Lau.

Walthaus had gained the respect of his peers and was allowed the honor of generating the keystrokes. He brought up his screen and was inside the Clark Station servers within moments.

“We have identified the optimal zero-day vulnerability in Windows as the
packager.dll
file, which is part of OLE, a Windows
Object—Linking—Embedding
property. Our GIF-and-INF cocktail will be embedded in an OLE object and installed into SCADA. Kudos to Trend Micro for creating a solution to the INF intrusion. Unfortunately, they didn’t consider our workaround. Just like that, SCADA drank up our cocktail and is ready to belch one hot mess tonight at eight.”

The group briefly exchanged high fives and settled back in their seats—like professionals ready to work on the next task. The Zero Day Gamers were becoming more proficient and expert at cyber espionage.
How far can this take them? More importantly, how high, or how low, will they go?
All important questions for later.

Chapter 31

February 13, 2016

Brae Burn Country Club

West Newton, Massachusetts

“Come on, girls, hurry up!” Susan Quinn hollered up the stairs for her daughters to pick up the pace. “Dr. Warren and his guest will be here shortly, and I don’t want you running around like wild Indians!”

“Suze, it’ll be all right,” said Donald. “J.J. won’t care. He loves the girls like a grandfather would.”

“He’s hardly old enough to be their grandfather,” replied Susan. She pulled a platter of meats and cheeses out of the Thermador refrigerator and placed them on the kitchen island. “I want the girls to learn some responsibility when it comes to being on time—especially when guests come over.”

“Honey, they’re ten and seven. They’ve barely mastered the concept of cleaning their rooms,” said Donald. As if on cue, however, the girls hopped down the stairs in perfect bunny-rabbit unison until, with one final slap, they reached the marble floor with their feet. “Come here, my gorgeous girls, and let me hold you.”

“No way, Daddy, we’re dressed and we’ve put our faces on,” said Penny, the Quinns’ oldest child.

“You have?” asked Susan. “Just where did you get these fabulous
faces
to put on?” She reached out for both of their mushes and gave them a squeeze, causing the girls to squeal with delight.

“Remember, Mommy, Uncle J.J. gave us each a make-up set for Christmas,” scolded Rebecca, age seven going on thirty.

Donald was amazed at how fast they grew up. He knew there would be a time in the not-so-distant future when he would have to scare the bejesus out of their potential suitors. He would be ready for them when the time came.

“Listen up, girls. We’re going to have some snacks for dinner tonight—meats, cheeses, shrimp and some raw veggies. Would you like to have some of that, or shall I fix you something else to eat?” asked Susan.

Donald admired his wife as she treated the girls like young ladies. Susan was excellent at providing the kids real-world choices. The girls might prefer a plate of hors d’oeuvres tonight rather than shoving mac and cheese down their throats just because it came in the shape of some creep named SpongeBob. Donald watched as the girls pondered their options. They whispered back and forth. This was a high-level decision.

“We’ll take mac and cheese, please,” they announced in unison.
So much for your theory, Daddy-O
. The girls ran off singing, “Easy peasy, mac and cheesy. Easy peasy, mac and cheesy.”

“I’ll grab some wine,” said Donald. He made his way down the marble hallway to a built-in, climate-controlled, wine-storage nook. The McMansions of 2006 became the foreclosures of 2008. Nobody needed a 5,800-square-foot house with a built-in wine nook. But the Quinns were rewarded with this palatial home as a result of Donald’s agreement to spend a couple of years
away
. His
vacation
was now a distant memory. Their new life was filled with wine nooks, singing children and new friends, such as Dr. John Joseph Warren—J.J. to his friends.

He and J.J. became close friends after they met during Donald’s stay at FMC Devens. J.J. was an accomplished Army Battalion Surgeon who was deployed to Joint Base Balad as part of the 310
^th
Sustainment Command—located on the former Al-Bakr Air Force base north of Baghdad. J.J. rose to the rank of major during his decorated career with the Army. He spent time at FMC Devens monthly to visit with the handful of former military personnel who had run afoul of the law. J.J. offered them support and encouragement. Donald, who held the job of office custodian at the time, struck up a conversation with J.J. and the two became better acquainted.

Upon his release from FMC Devens, Donald watched an interview J.J. gave to Boston’s Fox 25 about his service. The reporter asked him about his time at JBB and what were some of the highlights. J.J. was borderline incredulous.
That’s a tough one to answer. It was either working on our brave men and women who lost parts of their bodies or Carrie Underwood visiting in ‘06.
What do you think?
Highlights
,
there were no highlights
. The interview was over.

J.J. carried a lot of anger with him following his retirement. He was disappointed in the lack of appreciation the veterans of the wars in Iraq and Afghanistan received in the media and by politicians. J.J. was particularly irate over the political football the war had become. Donald became his friend, confidant and sounding board. In a way, Donald was J.J.’s PTSD shrink.

As so many of the Army Medical Corps do, J.J. took a job with Veterans Affairs at the VA hospital in Jamaica Plain. The VA New England Healthcare System was headquartered in Bedford and the Jamaica Plain campus was where J.J. was assigned. Unlike many of his fellow members of the Medical Corps, J.J. wanted to make a real difference in the lives of the returning vets who were
damaged
. In addition to providing primary care for vets, VA Jamaica Plain was home to the National Center for Post-Traumatic Stress Disorder. He was having trouble coping with what he experienced in Iraq, so he wanted to help others with PTSD as well.

Once again, J.J. became disillusioned and the anger set in. When the Veterans Health Administration scandal surfaced in 2014, J.J.’s response was simple:
Where the hell have you media people been?
J.J. had observed how hospital administrators manipulated records in order to receive their coveted bonuses. He heard the complaints of the soldiers who were ferried from one waiting list to another, but never received treatment. J.J. realized the practice was systemic throughout the VA. When the reports surfaced in ‘14 identifying thirty-five veterans who had died while waiting for care in the Phoenix VA system alone, he submitted his resignation.

Donald recognized that his friend needed an outlet—a purpose in life. Donald and Susan introduced J.J. to prepping. The couple appreciated the importance of having a trained physician as part of their group. Just as important, J.J. was a real patriot. He proved that during his service as well as afterwards with his commitment to helping his fellow veterans. In addition, as if fate had waved her wand over the entire relationship, J.J. was a direct descendant of Dr. Joseph Warren, an original member of the Sons of Liberty who played an early, leading role in the War for Independence. J.J.’s bloodline was directly linked to our Founding Fathers. Members of his family were field surgeons at Bunker Hill. John, the younger brother of Dr. Joseph Warren, founded Harvard Medical School. J.J.’s familial roots ran deep into the soul of the United States.

Donald and Susan discussed bringing J.J. into the group at length. They broached the subject with the other members. A consensus was reached after a little background research and the Quinns were tasked with approaching J.J. about the matter.