When Steve Gibson’s website was repeatedly attacked by a hacker, he discovered a secret society of cyber-anarchists. Stuart Millar reports
In one corner, Steve Gibson, world-renowned computer security expert with his own research corporation, regular adviser to the United States federal authorities and former child genius. In the other, a 13-year-old amateur hacker with a PC and a grudge. On paper it looked like a non-contest. And in reality it was, too, except the outcome was not the one you might have expected: on the evening of May 4 it took the kid little more than a minute to prove to the guru that in cyberspace nobody is safe.
Using some borrowed computer code, the hacker bombarded Gibson’s corporate website with millions of bogus requests for information, a killer blow that knocked the site clean off the Internet for 17 hours. Gibson, for all his credentials, resources and experience, became just another victim of a seemingly random hack attack. His assailant: a teenager from Kenosha, Wisconsin, going under the moniker “Wicked”.
That is where the story should have ended. But when Wicked’s attacks continued for the next two weeks, Gibson decided to fight back. He embarked on a mission to infiltrate the hacking community and track down his attacker. What he uncovered in the course of his investigation provides a unique, fascinating and terrifying glimpse into the murky world of the script kiddies, the growing army of amateur hackers who, equipped with a few strings of widely available computer code and a ruthless determination to leave their malicious mark on cyberspace, are wreaking havoc across computer systems worldwide.
Around the world hacks of the sort that Gibson suffered known as distributed denial of service (DoS) attacks are on the rise. There is nothing sophisticated about DoS attacks. They are the lead-lined cosh of hacking: hackers use software known as bots or zombies to take control of other people’s computers, then use them to fire off so many spurious requests for information that the target computer cannot cope and legitimate requests cannot get in. Now running at a rate of about 4 000 a week, they have become the weapon of choice for malicious hackers intent on inflicting most damage with the minimum amount of time and effort.
The list of victims is long and indiscriminate: political parties; Internet companies such as Yahoo; major corporations such as Micro-soft and Amazon; hundreds of unlucky individuals have all been hit. Even Cert, the world’s premier anti-hacking centre, was rendered helpless as its site was taken down for three days last month.
“Nothing more than the whim of a 13-year-old hacker is required to knock any user, site or server right off the Internet,” Gibson writes on his website.
Those on the receiving end of DoS attacks were painfully aware of that simple truth long before grc.com was hit. But beyond that, virtually nothing was known about the individuals responsible. Because of the number of computers involved and the complexities of Internet routing, few if any attackers had been tracked down. Until Gibson went after Wicked and, at last, some flesh was put on the bones of the script kiddies.
For more than 10 days after the initial assault, Gibson had no idea who his attacker was or why grc.com had been targeted. Then, on May 15, the day the fourth attack was launched, a new posting appeared on one of grc.com’s newsgroup sites: “Hi, it’s me wicked, im the one nailing the server with udp and icmp packets, nice sisco router, btw [by the way] im 13, its a new addition, nothin tracert cant handle, and ur on a t3 … so up ur connection foo, we will just keep coming at u, u cant stop us ‘script kiddies’ because we are better than you, plain and simple.”
Badly spelled it may have been, but this short burst of abuse, bravado and techspeak offered Gibson the break he’d been hoping for. He immediately sent off a polite reply via the newsgroup, inviting Wicked to contact him directly through the channel of his choosing.
Just a few hours later, Wicked was back in touch, e-mailing Gibson, using an account stolen from a customer of Internet service provider Earthlink. The message appallingly spelled and punctuated, littered with abuse and dripping with the venomous swagger of a wronged teenager made for revelatory reading.
“Yeah its me, and the reason me and my other 2 contributers do this because in a previous post you call us ‘script kiddies’, at least so i was told, so i teamed up with them and i knock the hell out of your cisco router.”
At last the motive was clear: Gibson or so Wicked had been informed had committed the cardinal sin of referring to two revered hackers, known as HeLLfiReZ and DrGreen, as “script kiddies”. In the vast lexicon of cyberabuse, this term features large: a derogatory description for those hackers lacking the skill or talents to develop their own software tools and forced to use “off-the-shelf” tools created and distributed by elite hackers, such as members of Subseven or Cult of the Dead Cow.
After making clear his firm belief that he was entitled to membership of the elite category, Wicked congratulated Gibson on managing to fend off that day’s attack, before ending with a warning: “Now ill find ways around it and we can keep playing these games, i find it very fun, shoutz out to hellfirez and drgreen, and yeah the hellfirez from subseven, hes a friend and he isnt a script kiddie u stupid fuck … good luck.”
That the teenager had been misinformed and Gibson was not guilty of the “script kiddie” offence was neither here nor there. The attacks were going to continue.
“He was like a child pulling the legs off a spider to see what it would do, watching it flail and attempt to get away from its tormentor,” says Gibson. “He believes that he cannot and will not be caught. Hiding behind the anonymity created by the Internet’s trusting technology, he exhibits no social conscience.”
Gibson wrote back, proclaiming his innocence and pointing out that he had publicly acknowledged the talents of elite hackers. Wicked replied, admitting he had perhaps “misjudged” Gibson he was after all acting on third-hand information. He volunteered to speak to his friends and call off the attacks. After which, on the evening of May 16, he launched another assault. Another e-mail explained why: “i just ddosed you, i aint stupid, i’m betting first chance ud tracert me and call fbi.”
Talking directly to his nemesis wasn’t going to work, so Gibson had to find a better way. First he tried to trace Wicked himself, without success.
Reluctantly, Gibson contacted the FBI. That he had not done so immediately after his site was first knocked out may have something to do with the 46-year-old’s roots. Since his early teens, Gibson has been working with computers. At 14 he began dabbling with hacking; at 15 he was employed by Stanford University’s famous artificial intelligence lab; at 17 he was appointed vice-president for systems development at a California IT company. By 30 he had founded his own research corporation. Whatever the perils of amateur psychoanalysis, it is tempting to wonder if in Wicked Gibson sees the dark-side mirror image of his former self.
So when the FBI informed him they couldn’t help either, Gibson was relieved. Now he was free to take the hackers on at their own game. After managing to get hold of Wicked’s zombie bot from an infected machine, he proceeded to build his own fleet of spybots to monitor and track the hackers as they talked to each other and exchanged software online. Eventually, he stumbled across “b0ss”, the elite hacker who had developed the zombie used in the grc.com attacks. Wicked had been lying he was a script kiddie after all.
In an unprecedented exchange reproduced on Gibson’s website, he introduced himself to a stunned b0ss and asked him to warn Wicked that if he continued with the attacks, Gibson would be forced to retaliate.
“If you see Wicked, tell him we had a nice chat and ask him to lay off. I don’t want to upset him, okay, but I need to and will defend my site.” b0ss, clearly still trying to comprehend how he had been tracked down, replied: “hehe [a chuckle], okay.”
That was the last that was heard of Wicked. Just in case Wicked or anybody else is tempted to take out grc.com again, Gibson has posted an open letter to hackers on the site: “I surrender. I surrender right now completely and unconditionally … I know that you can easily knock me off. That’s not even a question. But only if I’m here can I explain that to the rest of the planet.”