Worm: The First Digital World War (25 page)

T.J. called for another phone conference, wherein all parties agreed to behave.

The countdown to C-Day continued.

John and Rick made a little wager on who could get the most TLDs enlisted—a thirty-year-old bottle of Glenfiddich Scotch. It was no contest. John ended up securing commitments from one hundred of the TLDs himself; Rick corralled the other sixteen. By the end of March, they had done the impossible. Poland had certain legal constraints; its registry could not by law set aside the projected domain names without being paid, and since there was no time to change the law. Rick pulled out his own credit card again.

The results amazed the Cabal; they had done it! The bot-master had challenged them to do the impossible, and they had done so.

John was more amazed than anyone else. The request was outrageous, and . . . yet . . . everybody said yes. Every one. Some took a little longer than others, but eventually they
all
signed on. The response improved his estimation of human nature, not to mention his liquor cabinet.

Rodney waxed Churchillian, calling it “our finest hour.”

Still, none of them was cocky enough to believe that when April 1 rolled around, the worm would be completely contained. There was the peer-to-peer issue to consider. Even if every last one of the possible domains was tied down to Chris Lee’s sinkhole, the bots could theoretically bypass the web lookups altogether and update themselves directly. So the cloud still hovered.

And the rest of the world was suddenly, as the clock approached C-Day, waking up to Conficker . . .
way up
. The effort now included hundreds of eager geeks worldwide laboring in subgroups of the Cabal. Knowledge of the effort had spread farther still, with all those government agency staffers Rodney and others had been beseeching for weeks. With so many people engaged and interested, the story started showing up everywhere, well beyond the prescribed borders of the cybersecurity trade blogs. Only, as it traveled, the message got distorted.

It grew.
And grew
. In mid-March, as the countdown moved toward single digits, alarms began to sound in the wider world. This enormous botnet was programmed to call home and get instructions on April 1, and
nobody knew
what was going to happen. A dedicated team of experts had been working around the clock for months to stop it, but there was no guarantee they would succeed. It was as good as the plot of a Hollywood thriller. Was the Internet going to explode? Would e-commerce grind to a halt? The vital computer networks governing the nation’s electrical grid, air traffic control, transit systems, telecommunications . . . were they going to fly off the rails? Would there be vast theft? Targeted takedowns? Cascading failures?

Again it was John Markoff at the
New York Times
who started things off, the first of the mainstream reporters to weigh in, just as he had reported first on the Morris Worm two decades earlier. Markoff had dinner with Rick in San Francisco, and his update on the Conficker threat ran a few days later, on March 19, under the entirely sensible headline, “Computer Experts Unite to Hunt Worm.”

“An extraordinary behind-the-scenes struggle is taking place between computer security groups around the world and the brazen author of a malicious software program called Conficker,” his story began.

He summarized the global nature of the threat, pointing out that the worm had built a botnet to match any in history, and referred to the struggle as “a cat-and-mouse game” that the Cabal was in danger of losing. He noted the government’s apparent lack of knowledge or interest. Typically, it was Rick who furnished the punchiest quote:

“I walked up to a three-star general on Wednesday and asked him if he could help me deal with a million-node botnet. I didn’t get an answer.”

“An examination of the [Conficker] program reveals that the zombie computers are programmed to try to contact a control system for instructions on April 1,” Markoff wrote. “There has been a range of speculation about the nature of the threat posed by the botnet, from a wake-up call to a devastating attack.”

Phil Porras told the reporter, “Perhaps the most obvious frightening aspect of Conficker C is its clear potential to do harm. Perhaps in the best case, Conficker may be used as a sustained and profitable platform for massive Internet fraud and theft. In the worst case, Conficker could be turned into a powerful offensive weapon for performing concerted information warfare attacks that could disrupt not just countries, but the Internet itself.”

The account was entirely responsible and accurate, but you don’t run a story in the
New York Times
using terms like “zombie computers” and “devastating attack” and “frightening” without stirring things up.

Holy shit! Within days the Cabal’s problem was no longer getting people to pay attention. Now it was trying to dampen what amounted to end-time hysteria—
Cybarmageddon!—
at least in certain circles of the press. The truth is that there was something predictable in these amplified alarms, an edge of . . . what to call it? Sarcasm. Sarcasm had crept in, and it was . . . frankly, annoying. Even insulting. The public relishes few things more exorbitantly than a good doomsday prediction. At least, the ones more apt to prompt a chuckle, as opposed, say, to something remotely real enough to get folks stocking the backyard bomb shelter. This particular cataclysm seemed safely confined to the nether world of cyberspace. There was no need to hoard canned goods, store water, load the shotguns, or assume the crash position. This was some sort of a
virtual
apocalypse, a meltdown out there in the parallel universe of incomprehensible computer systems, and . . . face it, not everybody was in love with his computer or the Internet anyway. So what if it had the geeks riled up? Remember Y2K? Predictions of worldwide collapse when the clock ticked over from December 31, 1999, to January 1, 2000? “Chaos 2000” painted in jubilant scrawls on highway overpasses? Despite the fondest hopes of doomsday-lovers every where, night had passed into day, the cocks had crowed, New Year revelers had awakened hungover, rubbed the sleep from their eyes, and life had resumed its normal petty pace. Besides, there was a healthy portion of the population who actually remembered the pre-digital age, who recalled that life had hummed along just fine and, if truth be told,
at a normal speed
. . . a more pleasant speed, before anyone had ever even heard of an iPhone. Remember the days when, if you had a problem with your phone, all you had to do was call Ma Bell, and a
person
answered, and a nice man came right out and gave you a new one, for free? Losing all this Internet crap didn’t sound like the end of the world to
lots
of people. So these reports of a pending
Cybarmageddon!
began coming with a noticeable wink. Call it the Y2K wink. Conficker even made David Letterman’s monologue—his comical announcer Alan Kalter called it “Con-
flick
er” and warned the
Late Show
audience to brace itself for a pending catastrophe: the thing had remotely turned on the webcam of Dave’s computer . . . and captured him nude . . . and . . .
the pictures will be coming soon to the Internet!

The worm was becoming a punch line. It had a hint of the
we’re-getting-our-comeuppance-here
appeal of the old
Godzilla
movies. Only this wasn’t a fire-breathing dragon emerging from the depths to exact revenge on mankind for having the temerity to split the atom: it was Big Brother; it was HAL; it was the long-awaited, long-predicted confrontation with The Machine, the incomprehensible monster with a billion arms that we had foolishly entrusted with all of the details of our personal and public lives . . . only . . . it really probably wasn’t. Who schedules Armageddon for April Fools’ Day, anyway? This was a billion-armed digital monster with a sense of humor!

On the last night of March, C-Day eve, CBS TV weighed in on
60 Minutes
, the most watched and most respected news program on the tube. The network had good reason to take Conficker seriously, its own computer network had been invaded by the worm. So CBS TV played it straight. After going to considerable expense and effort to scrub its networks, Murrow’s old channel found the worm no laughing matter.

But there was still the Y2K wink.

Correspondent Leslie Stahl reported soberly, telling millions of viewers, “The Internet is infected.” The story worked primarily as a warning against all forms of “creepy, crawly toxic software”—again, the wink! The segment was a terrific advertisement for commercial security firms, particularly Symantec, whose vice president Steve Trilling cheerfully explained the botnet thus: “Imagine a network of spies that has infiltrated a country. And every day, all of the spies are calling in for their instructions on what to do next.”

Stahl said, “So far, the bad guys who created it haven’t triggered Conficker. It’s just sitting out there like a sleeper cell.” Ever since 9/11, few Americans didn’t sit up straight in their living rooms at the talk of “sleeper cells.” But these malevolent terrorists were lurking right inside their home computer, perhaps right there
on
. . .
their
. . .
lap!
When Stahl asked what the worm might do, Trilling answered, “That’s the interesting thing. The only thing the worm is being asked to do is to ask for further instructions.”

The worm could turn menacing “in an instant,” Stahl explained, and added, “I’m hearing
Jaws
music.”

There it was again: the w
ink!

She wrapped up the report with:

“Conficker investigators have been talking about an April Fool’s attack . . . but nobody knows if the instructions will be benign, or something that could disrupt the entire Internet.”

So, there you had it. If you understood the risk and chose to actually think about it (the very thing Paul Vixie had said he consciously avoided doing), and if you followed the potential risks to where they might lead, there was more than a small chance that the word
Cybarmageddon
was entirely justified.
Hey, what if this was really it?

The Cabal had succeeded big-time in one way: They had publicized the hell out of the worm. They had come a long way from their initial press release in early January, which got mentioned in a few cybersecurity blogs. Now it was:

“An Unthinable Disaster in the Making!”—
New York Times
.

“A Threat That Could Disrupt the Entire Internet!”—
60 Minutes
.

“A Deadly Threat!”—
London Guardian
. This alarm was being amplified and interpreted by countless smaller news outlets throughout the world, but nearly always with . . . the
wink
.

All of this made the Cabal very uneasy; their reaction was not unlike the sensations they had felt when Rodney toured the capital beating the botnet drum. One of the great risks in pushing the global panic button is, of course, making a fool of yourself. They had wanted to be taken seriously, but this hardly qualified. This was . . . like . . .
virtual
panic. The public was not so much alarmed as
amused
. What the hell was going on?

The problem was the nature of the thing. The threat was
all potential
. If you told people that there was a dirty bomb in Times Square, they would understand immediately. But to grasp the threat posed by Conficker, you had to under stand how the Internet worked, how vital it had become to modern society, and how much damage someone could do with millions of computers all pulling at the same time on the same rope.

Rodney had his own little prayer for the moment: “Please, God, let it be an experiment that’s gone wildly right.”

So a million eyes were watching and waiting when the atomic clocks that calculate Coordinated Universal Time ticked off the final seconds of March 2009, edging toward C-Day, the moment when the C strain would receive its instructions, when the mighty botnet would wake up . . .

and!!!

and!!!

!!!

!!

!

. . . nothing happened.

11
April Fools

X-MEN, OUR DAY HAS COME.

—The X-Men Chronicles

History is done with Appomattox moments. Wars no longer end in ways anyone can describe as satisfactory, much less triumphant. In modern warfare there is no such thing as unqualified victory, or unconditional defeat. No more Lee handing over his sword, no more Shigemitsu scratching out his signature on the deck of the USS
Missouri
with newsreel cameras capturing the moment of total surrender, with people dancing in Times Square, kissing strangers. Modern wars peter out. Casualties mount. The public gets surly. The treasury coffers bottom out. The ruling party gets dumped. One no longer wins; one
claims victory
. Often both sides do. And sometimes both are right . . . in their own way.

Another signature feature of modern war: perception is paramount! In that category, Conficker was definitely a bust. A joke.