Worm: The First Digital World War (29 page)

Chapter 5: The X-Men

He and others . . . for being gifted
, “The X-Men Chronicles,” Marvel Comics, March 1995;
By mid-December . . . on the Internet
, infection numbers were being tracked primarily by Shadowserver and by Wesson at this point. The number reflects calls to command and control locations from different IP addresses, as they arrived at the various sinkholes. Efforts were made to avoid counting more than once a computer sending multiple messages;
Beyond this group . . . down the line
, Hruska’s article can be found at
arstechnica.com/security/news/2008/12/time-for-forced-updates-confickerbotnet-makes-us-wonder.ars
;
In the case of . . . effort against Conficker
, Vixie. A video of his Defcon 13 speech can be found at
http://www.youtube.com/watch?v=wP5TQlaWiuE
; “
Private sector . . . paralyze the United States
,” p. 165. The full report can be found at
http://www.uscc.gov/annual_report/2008/annual_report_full_08.pdf
;
The ad hoc group . . . over their heads
, Joffe, Porras, Wesson, DiMino, Ludwig, et al.;
We are the last line . . . if not now . . . when?
Conficker Archives 2/9/09;
Shades of Samuel Richardson, “Whenever I’m added . . . the suspense
,” CArchives. 3/2/09; “
I feel like . . . high school
,” WArchives 2/20/09; B
y the end of . . . melting completely
,” Campana.

Chapter 6: Digital Detectives

This may not be . . . fight for it
, “The Amazing X-Men, Age of Apocalypse,” April 1995;
At the October . . . hard to believe
, Campana, DiMino;
Brian Krebs . . . even respond
, DiMino. Krebs’s article, “Bringing Botnets Out of the Shadows,” March 21, 2006, can be found at
http://www.washingtonpost.com/wp-dyn/content/article/2006/03/21/AR2006032100279.html
;
Gratitude started . . . begin to stop it?
DiMino;
No one was deeper . . . command center
, Porras, Twomey, DiMino;
Finding that . . . government agencies
, Porras, Saidi;
Phil needed . . . back of his hand
, Wesson;
The Internet, unlike roads . . . to that domain
; Wesson, Joffe, DiMino;
At a time . . . Internet security
, Wesson;
So when Phil . . . for the suggestion
, Porras, first quote from PArchives 12/15/08, exchange with U.S. CERT, PArchives 12/15/08;
Setting aside . . . just 12,292)
, Wesson, CArchives 12/29/08;
There were . . . nation-state
, Porras, Wesson, Joffe, DiMino;
China was . . . overall strategy
, 2008 U.S.-China Security Review, both quotes from page 165;
Those who . . . wake-up call?
Joffe, Wesson;
When Chris Lee . . . source for the worm!
Lee;
Meanwhile, Phil . . . tripping over each other
, PArchives, 12/21/08; Dagon would become a central player in the Cabal.

Chapter 7: A Note from the Trenches

All the training . . . put to the test
, “The X-Men Chronicles,” Marvel Comics, March 1995;
T. J. Campana’s birthday . . . ruined his birthday
, Campana, Wesson;
For one thing . . . registered in China
, Joffe, Porras;
While the new variant . . . far enough
, Porras, Saidi, Joffe;
Particularly troubling . . . 8.9 million
, Porras, Joffe, Wesson. The F-Secure report can be found at
http://www.f-secure.com/weblog/archives/archive-012009.html
;
The level of sophistication . . . were pros
, Porras, Saidi;
In Phoenix . . . a good one
, Joffe;
Phil agreed . . . opening for me
, Porras, Wesson, WArchives 1/30/09;
T.J. began . . . “We’ll do the right thing
,” Campana, Joffe;
Just as the Cabal . . . on the horizon
,” Hruska’s Ars Technica article can be found at
http://arstechnica.com/security/news/2009/01/conficker-worm-spikes-infects-1-1-million-pcs-in-24-hours.ars
, and Markoff’s January 22, 2009,
New York Times
article at
http://www.nytimes.com/2009/01/23/technology/internet/23worm.html?scp=1&sq=Markoff%20new%20digital%20plague&st=cse
;
Rick was not exaggerat ing . . . nature of the threat
, Wesson, both emails from WArchives 1/31/2009;
The Defense Intelligence official . . . don’t call us
, Wesson. Woodcock’s email is from WArchives 2/1/2009;
Out in Menlo Park . . . then nothing happened
, Porras.

Chapter 8: Another Huge Win

Remember . . . ALWAYS!
“The X-Men Chronicles,” Marvel Comics, March 1995;
So far the effort . . . to crumble
, DiMino, Joffe, Wesson, Ludwig;
So when . . . almighty dollar
, Ludwig, DiMino. Campana email from CArchives 2/7/2009, Ludwig and Campana emails from CArchives 2/3/09;
The Atlanta conference . . . swift response
, Joffe, Campana, Twomey, Crain, DiMino, Wesson;
With typical enthusiasm
. . .
see them
, Ludwig email CArchives 2/8/09;
There was such . . . good guys
, Ludwig, DiMino;
Whatever the title . . . it happens
, Ludwig email is from CArchives 2/24/09, FBI agent quote from Joffe;
It was typical . . . Rick was concerned
, Wesson;
Unfortunately, many . . . against it?
Ludwig, DiMino;
Dre Ludwig, in particular . . . do to Dre?
Ludwig, DiMino, Lee, Wesson;
Andre, ever . . . done before
, DiMino. The quoted Ludwig email is from WArchives 1/31/09;
Rick denied . . . like betrayal
, Ludwig, DiMino, Joffe, Wesson, Vixie;
Dre posted . . . right people’s ears
, Ludwig email from CArchives 2/20/09;
On a sunny day . . . cloud of suspicion
, Wesson, Vixie;
Despite these . . . analyze them
, gleaned from February traffic on CArchives;
What they had . . . WIN!
Campana email from CArchives 2/4/09;
Dripping with . . . that goal
, Wesson email from CArchives 2/4/09;
Toni Koivunen . . . sits there?
Email from WArchives 1/23/09;
Rick wrote . . . economic goals
, WArchives 1/23/09;
If you’re on the highway
, Conficker poem can be found at
http://it.slashdot.org/story/09/02/20/239229/New-Conficker-Variant-Increases-Its-Flexibility
;
Markoff called . . . time bomb
,” Markoff,
New York Times
, February 14, 2009, “Do We Need a New Internet?” can be found at
http://www.nytimes.com/2009/02/15/weekinreview/15markoff.html?scp=1&sq=Markoff%20ticking%20time%20bomb&st=cse
.

Chapter 9: Mr. Joffe Goes to Washington

Today a massive . . . reality
, “The X-Men Chronicles,” Marvel Comics, March 1995;
Greetings to all . . . new variant
, CArchives, 3/6/09;
Phil Porras got . . . help fight it
, Porras, PArchives 3/6/09;
The really bad news . . . instead of 250
, CArchives 3/6/09;
F&*king hell . . . for Washington
, Joffe, all emails from CArchives, 3/6/09;
Rodney packed . . . eased with this information
, Joffe, Porras, Saidi;
Rick wrote . . . accurately
, WArchives, 3/7/09;
So on the same weekend . . . quantify the risk?
Joffe, CArchives 3/9–12/09;
It led to . . . eight days away
, CArchives, 3/14/09.

Chapter 10: Cybarmageddon

And is it . . . the entire world?
“The Amazing X-Men, Age of Apocalypse,” Marvel Comics, April 1995;
John Crain . . . daily list
, Crain;
I do not have
. . .
Dre Ludwig
, CArchives, 3/16/09;
The botmaster was . . . on the subject
, Crain, Joffe, Lee;
When one of . . . on fire!
CArchives;
The Cabal set . . . wrote back to Chris
, Crain, CArchives;
I believe . . . added stress
, all emails from the CArchives;
Rick kicked up . . . pick up the phone
, WArchives 3/18/09
; When I operate . . . to be friends again
, WArchives 3/18/09;
It is my humble . . . cold hard data
, CArchives, 3/19/09;
I am growing tired . . . so pipe down
, WArchives 3/19/09;
Finally, T. J. Campana . . . agreed to behave
, Campana, Joffe, Wesson, Vixie. Campana and Joffe emails from WArchives 3/19/09;
John and Rick . . . the message got distorted
, Crain, Wesson, Joffe, DiMino;
Again it was . . . stirring things up
, Markoff, Wesson, Porras. The article,
New York Times
, March 18, 2009, “Computer Experts Unite to Hunt Worm,” can be found at
http://www.nytimes.com/2009/03/19/technology/19worm.html?scp=1&sq=Markoff%20devastating%20attack&st=cse
;
On the last night . . . really it?
The
60 Minutes
report can be seen at
http://www.youtube.com/watch?v=Ar-l3FRUdGw
;
An Unthinkable Disaster?
3/19/09. In fairness, though, as we know, blurbs seldom are fair, the full headline reads: “The Conficker Worm: April Fools’ Joke or Unthinkable Disaster?”;
A Threat That Could . . . Entire Internet
, from the
60 Minutes
report;
A Deadly Threat, London Guardian
, 3/30/09.Again, in fairness, the complete headline reads: “Conficker Virus Could Be Deadly Threat or April Fools’ Joke”;
Rodney had . . . wildly right
, Joffe.

Chapter 11: April Fools

X-Men, our day has come
, “The X-Men Chronicles,” Marvel Comics, March 1995;
disaster warnings . . . sheep
, MWBlog, 4/1/09. The post can be found at
http://www.teamfurry.com/wordpress/2009/04/01/breaking-news-conficker-became-selfaware/
;
Wired . . . Me First
, Wired, 4/1/09. The post can be found at
http://www.teamfurry.com/wordpress/2009/04/01/breakingnews-conficker-became-self-aware/
;
But the prospect . . . turning back
, Joffe, DiMino, Ludwig, Wesson, Porras, Crain;
Some of . . . anything, WSJ
Blogs. These can be seen at
http://blogs.wsj.com/digits/2009/03/26/conficker-dont-believe-the-hype/
;
John Markoff of . . . Markoff didn’t come
, Markoff, Porras;
Three hours . . . giant raspberry?
Joffe, DiMino. The email is from CArchives, 4/1/09;
At his suburban . . . just in case
, DiMino;
Very early . . . created anyway?
Ludwig, email from CArchives 4/1/09;
Paul Vixie . . . usual state
, Vixie;
Rick Wesson . . . just started
, Wesson, email from CArchives 4/1/09;
John Crain . . . a move
, Crain;
One week . . . the worm won
, Joffe, Wesson, DiMino, Ludwig, Porras, Crain;
Of course . . . zero knowledge
, “The Conficker Working Group: Lessons Learned” can be found online at
http://www.conficker workinggroup.org/wiki/uploads/Conficker_Working_Group_Lessons_Learned_17_June_2010_final.pdf
. The first quote is from page ii in the Executive Summary;
It is a . . . the objective
, Joffe;
Nevertheless . . . do better
, President Obama’s complete remarks of May 29, 2009, can be found at
http://projects.washingtonpost.com/obama-speeches/speech/317/
;
Most members . . . point of view
, Joffe;
In June 2011 . . . military response
, from
New York Times
, May 31, 2011, “Pentagon to Concider Cyberattacks Acts of War.” This can be found at
http://www.nytimes.com/2011/06/01/us/politics/01cyber.html?_r=1&scp=1&sq=cyber%20security%20military%20response&st=cse
;
Despite the vagurness . . . implemen tation of Conficker
, Joffe, and the
New York Times
report by William J. Broad, John Markoff, and David Sanger, January 15, 2011, “Israeli Test on Worm Called Crucial in Iran Nuclear Delay,”
http://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html?_r=1&ref=siemensag
; This whole thing, the Vixie email is from CArchives 1/19/10;
T.J. has been . . . spam on the Internet
, Campana;
More than a year . . . gone down significantly
, Joffe, DiMino, Porras;
Ramses Martinez . . . antibodies
, Martinez;
And, oh . . . $30,000
, Wesson.