Looking Glass, page 18
I drop out of the city's network and open my eyes. Look up at the ceiling. It's featureless stainless steel with a rather grimy looking light fixture in it. Look over at Brian. “Whatcha watching?”
Brian is leaning against the freezer wall, plugged into another net through his Visor handheld. “Perimeter surveillance. Nothing exciting. Did you get what you need?”
“Um … no. The only surveillance I found in the area were traffic cameras. They're on a dedicated fiber network.”
“You saying we're dead in the water?”
Close my eyes again. Look at the traffic surveillance network plans a moment. I don't do this kind of thing. I'm one of the good guys, one of the people who keeps the net going. We few. We happy few… I'm not a cracker. I'm not a criminal. You broke into the city network. That's a twenty-year sentence already when they catch you. Don't remind me. Open my eyes to look at Brian again. Are you in this, or not? I guess I am. “Got any bridges? Say, a nice Penguini with OC3 passthrough and wifi?”
Brian's lips curl into a smile. “You're gettin' serious about this.” He holds up the little piece of electronics from the bag. Basically an open architecture penguin processor with bridging and routing software and various network interfaces. Common cracker tools. Also handy for network testing, which is how I know about them. The two overlap a lot. Both dig deep into how the network works.
I look at him steadily, then down and away. “Brian, I've already crossed the line. Turned to the dark side. Something I didn't ever want to do. I have to live with that now.” Look back at him with the Shroud stare. His smile fades. “And if you think for one second that I'm going to back down now, and live with doing all this and failing, you don't know me very well.”
Brian nods slowly. “Yeah, well, we just met, remember?”
“That didn't slow you down last night.”
Brian snorts again. An amused sort of snort. “So what's the plan?”
I pull the schematics and a map up onto his HUD. “Okay. There are 2,600 cameras in the system.” They light up on the map as I mention them. Standard presentation stuff. “Each one is connected locally to its intersection switch.” The intersection switches in the picture he's seeing highlight themselves obediently. “Each intersection switch, in turn, feeds one and only one of thirty-six regional hubs, over an OC12 fiber line.” Light up the regional hubs. Zoom the map to the Asylum. “These hubs feed the central traffic monitoring facility, which is in the city government complex.”
Brian raises an eyebrow. “You want to break into city hall?”
I shake my head. “No. We can't take over the whole traffic surveillance and control system without people noticing. We don't need to control the whole system anyway, we only need one regional hub.” I pull up another map. “The hub we want is here. Number 27, serving the Tenderloin, Mission district, and Civic Center areas. TurnTek M300 real-time switch. We're in its coverage area right now. The hub is in a utility closet in the Civic Center.”
“So all I have to do is go where the hub is and patch you in? Should be pretty straightforward.”
“Not so fast. I have to reconfigure the hub, and that's going to mean rebooting it. Which means the last thing these cameras see will be you breaking into the Civic Center. They cover themselves. One imagines the Civic Center also has surveillance cameras of its own.”
Brian frowns. “That's bad. Is that the best you can come up with?”
Shake my head. “No. The system is designed so that a single fiber cut won't take out monitoring and control for an intersection. Each hub is also connected to an adjacent hub by an OC3 fiber line, so if the main line from the hub to the control center is cut, the backup line can be used to maintain control while the main line is fixed. Hub 27's adjacent hub is 28, at the corner of Oak and Grand. It's in the systems room of a parking garage.” Pull up the plans of the parking garage. “Underground. In the elevator equipment room. Break in, unplug the OC3 line, plug in the Penguini, plug the OC3 into it. Should be pretty straightforward. Right?”
Brian looks over the building plans. Nods a little. “Should be, yeah. It's the simple ones that get you, though. I'll be back within thirty minutes. If something happens to me, just disconnect and go. Take the deck with you. Catch a cab and go home.” He drops his house key in my lap. “Oh yeah. Don't forget to keep an eye on your security perimeter.”
“Be careful, Brian.”
He leans toward me, then stiffens. Straightens up. Nods a little. Then opens the freezer door. “Yeah. Yeah. You too.” With that, he's gone.
Except that he's not. Pull up his context. I can see through his shades, hear through the transceiver. It's like a live action video game. He heads out to the car, climbs in. Hits the switch. Accelerates alarmingly out into traffic. I let his context drop into the background a moment, where I can see it and hear it, but it doesn't occupy my full attention. There's a detail I've been glossing over. I've never even seen a TurnTek switch. I have no idea how to set one up. Everything is BFR Systems on OmniMart sites. We like our networks to work.
Chapter 24
Dive back into the net. Look for documentation. When all else fails, RTFM. Read The Fucking Manual. Should be simple. Go to TurnTek's website. Except of course that there isn't one. News site hits. Archives. TurnTek went under five years ago. I'm dealing with genuine, unsupported legacy hardware. It's the simple ones that get you. I take the risk and run an open web search on TurnTek M300.
Two hundred hits. Pop the first one. And what do you know? The setup and configuration manual. The switch looks like a pretty simple animal. Configuration is 2-D graphical, basically no security at all. Which isn't all that surprising, since they're designed for dedicated fiber networks. Pretty easy. Basically I log in. Tell the thing what I want it to do. Add the new port in and set the bridging rules up. Reboot. Simple.
The Phreax R. Us forum is the second hit.
From: Sh0g0th@3x1t.net
Well there's a familiar name.
To: EVERYONE
Subject: TurnTek Manuals Online
URGENT! TurnTek manuals online are honeypots. B34rN423 got *burned* on a run last night using one of them. He got into the surveillance net in C. City, and the city cops came down on him. They shot him, he's gone!
Well that's just lovely. There are a thousand explanations. From what I've seen a lot of hackers just aren't very good. Shogoth himself, obviously, wasn't cautious enough somewhere along the line. The victim in this case could have set off any number of alarms along the way getting into the switch in the first place. It's the simple ones… Yes, yes. It could also be exactly what poor dead Shogoth says. Some operator got cracked one too many times and has left something nasty in that switch for the perps. There but for the grace of God…
Brian's voice. Loud and clear. “Shroudie.” Shroudie? Again? “Need the side view of the parking garage, elevator shaft.” He's there already. Shit. I send him the plan model of the building. Pop it up on his HUD in wireframe. Skin it down to the center core. “Thanks.”
I watch Brian's feed a moment. He's parked on the top floor of the parking garage, the sun beating down on pavement bleached almost white. Row upon row of cars, reflecting it back at him. The HUD sunglasses darken automatically. He pauses a moment, probably looking at the diagram, then clears it. Opens the trunk of his car and withdraws the gym bag. Digs into it. Then walks with purpose over to the elevator and presses the button. When the door opens, something happens. He does something but he doesn't look at his hands, so I can't tell what. The elevator doors don't close after him, though. He waits a moment, then walks back out.
I'm curious, so I ask. “What did you do?”
“Spray on condom over the optical sensor. Busy now, hon.” He leaves the confused elevator stuck on the top floor, and jogs down the stairs to the floor below. Close my eyes. Hon is a habit of speech for some people. It doesn't mean anything. And even if it did, so what? The simple ones that get you… Yes, yes, I know.
I move Brian back to the corner of my perception and get busy on the switch problem. TurnTek … Catherine, stop thinking like a hacker and think like a professional. Network. Who do you know who might know these switches?
One name leaps to mind. The question is, do I trust him? I watch Brian a moment. He's wedged the elevator doors open on the floor second from the top of the parking garage and is looking down the empty elevator shaft, then up at the bottom of the elevator car still parked on the floor above. Vertigo makes my head spin a moment. He reaches under his coat to his belt and withdraws a small device that looks like a set of brass knuckles. Reels a … his HUD sensors come up automatically … it's a carbon-nanotube monofilament line. He clips it to his belt, and casually reaches into the elevator shaft and squeezes the grip of the device in his hand. There's a muffled report, like a gun shot, and more monofilament streaks up through the darkness and hits the bottom of the elevator car. And sticks. Carbon nano-hair tipped, apparently, like gecko feet. He gives the line a tug, then nonchalantly steps into the elevator shaft and drops, a stomach-churning visual drop. I can hear the line reeling out of the handgrip, arresting his fall, see the flood of darkness as the elevator doors above him slam shut. See in the dark through his shades.
I put Brian in the background again and pull up the phone. What, exactly, is left to lose? Dial Lance's number. “I-Link, Carson Lance speaking.” He's in his tank again.
“Lance, Shroud. You son-of-a-bitch, why did you turn me into OmniMart?” Well, that … could have gone better.
“What are you talking about?” Lance sounds genuinely confused. I used to know the man. In the old days this would have been all I needed to prove his innocence. But I don't know him anymore. Do I?
“Who all did you tell that I'd been there?”
“Just the owner, and he knows when to keep his mouth shut. I told him it was important to keep this confidential, in case you didn't want to work for us. Shroud, what's going on?”
“I got picked up for identity theft as soon as I got to Caltech and tried to use my card.”
“Shit. Shit. Um … are you calling from the courthouse? I can't seem to get a trace back on your location. I can come testify as to who you are, no problem.” Not a trusting person…
“Thanks. That means a lot to me, Lance. I may need you to do that at my court date, but that's not until tomorrow. Right now, can you tell me what the security systems on a TurnTek M300 are like?”
There's a long pause, and I'm starting to get very afraid. “Do I even want to know what you're up to?” he finally asks.
“No. You don't. I don't either, but nobody ever said tiger hunting was easy, you know?”
Another long pause. Long enough to call the SFPD in another context. He's in a tank, after all. He finally answers. “Understood. Okay, an M300. Been a long time, but all the municipal RSTP/IP switches TurnTek made were pretty much the same security-wise.”
I glance at Brian. He's crawling through a wiring tunnel. He emerges inside the wiring closet. Nice.
Lance again. “They have a stealth security system. They look wide open, and it looks like you have full control the moment you jump in, but you're in a bogus environment and they're tracing you. Real communications from hub to hub or from control to hub are encrypted. You know the RCP44 algorithm?
Brian's looking at the rack of equipment he's just emerged from. I talk to him quickly. “Next rack over, Bri. That's the elevator controller. High voltage.”
Brian worms his way over to the other rack. “Now you tell me.”
“Sorry.”
Turn my attention back to Lance. “RCP44. Yeah, I know that one.”
Lance says, “Good. Oh yeah, one other thing. The alarms go off if the fiber times out. That would probably be bad. And don't forget these aren't BFRs, you have to reboot them when you change stuff.”
Switch contexts to Brian again. “Brian, freeze.” Brian freezes, his fingers on the optical fiber connection. “There's a wrinkle. You have about five seconds between when you break the fiber connection and when it has to be back up before the fiber timeout starts logging error messages and people start noticing. Turn on the Penguini. I need to set it up. We're going to have to plug it in hot.”
He lets it go gingerly and gets into a pouch on his belt, getting the Penguini bridge out. “Shroudie, when we get out of here remind me to talk to you about your timing. Okay, bridge is on, standing by.”
Lance is talking. “Hey Shroud? You still there?”
I switch back to the phone call with Lance while I log into the Penguini bridge, set it to go straight through and repeat what it hears to the blind drop site I picked out ahead of time.
“Thanks, Lance. Listen, I need to go. Thanks for your help.”
“No problem. Tell me about it some day?”
“No promises.”
“Okay. Be careful.”
“Yeah, thanks. You too.” Close Lance's context.
“Brian. Okay, the Penguini is ready to go. Five seconds, remember?”
“I remember, I remember.” Brian's hands are fast. He unscrews the plug on the fiber line. Five seconds. Four. He screws the fiber line into the Penguini. Three. Two. Screws the cable from the Penguini into the switch. One… “Done.”
“Okay, get out of there, if that thing's turned in an alarm, the cavalry will be arriving presently.”
Brian dives into the bottom of the high voltage rack again, pausing to pull the cover on behind him, and begins worming his way through the tunnel. I can feel myself hyperventilating. Brian makes it to the elevator shaft. In time to see the elevator car coming down at him. “Brian! Look out!”
Brian snaps into motion and hauls himself down and back into the tunnel. His shades can keep up with the sensory flow of his motion, and so can I, with the deck. Barely. It would be easier in a tank where I've got serious bandwidth and my own body's feedback isn't making me tense. I let out my breath. He holds up the handgrip and squeezes it again. It immediately winds up all the slack in the monofilament.
The Penguini has begun relaying data. I set my cracking ice on it. If Lance is right, I should be able to see whether the alarms have been set off or not. If he's wrong, if he's selling me out… Blow, wind!At least we'll die with harness on our back! Well, on the bright side, at least my retirement will be taken care of.
“Here we go. Going up…” And so he is. Brian's elevator has begun heading upward. He levers himself out of the tunnel as the clearance increases, and the elevator effortlessly hauls him up underneath it. He pays out some line and swings to the second floor door, clings to it and gets out another tool. Then glances upward to see the elevator starting down again. “Uh oh…” is his only comment. He sets to work furiously on the doors with his pry-bar.
I'm faster. The Penguini has let me know about a few other wireless networks it can touch. I relay through it. Break one of the other networks. Jump into the elevator controller and send a command. It tells me it can't stop the elevator between floors. I send another. Watch Brian's context. Hold my breath. The doors open. He rolls through, and squeezes the handgrip a third time, severing the monofilament line.
Passengers' knees are showing through the open doors as the elevator slides down behind them. Brian stands up, dusts himself off, as the elevator stops at his floor. Brian nonchalantly steps into the car. “Going down?”
Breathe again.
My ice cracks the RCP44 encryption without too much difficulty. It's an older algorithm, solid enough for slightly sensitive data on a private network, but not really up to front-line service. I can see Hub 28 talking to 27, mostly exchanging messages that amount to, “I'm here. You there?” “Yeah, I'm here. You there?” The social lives of computers are not to be envied. Brian emerges from the elevator and gets into his car, drives to the entrance, pays his parking fee, and drives out.
I log into Hub 27 gingerly, via the encrypted communications from 28. Set up the new switching rules. Pull up Brian's context. He's stuck in traffic. “Hey Brian, got any ideas on how I can get some kind of real-world thing going on at the Civic Center that will make people not notice when I reboot this stupid hub?”
“Sure, no prob,” Brian reaches into his pocket. Pulls out a brand new disposable phone. Turns it on. I can't hear the other end of the conversation, but I don't really have to. “Yes, I think you can help me, actually,” he says. “I represent an organization called the People's Will. We have planted a radiological contamination device somewhere in the civic center's HVAC system. It will go into dispersal mode in sixty seconds. You may wish to evacuate the building.” Then turns off the phone, opens the door of his car, and tosses it under the wheels of the car next to him. “Give 'em an extra minute, to be on the safe side.”
I just stare for a moment, eyes open, looking through the virtual world at the deck in my lap. He basically called in a bomb threat. With no more concern than calling out for pizza. Man, proud man, Dressed in a little brief authority… Plays such fantastic tricks before high heaven As makes the angels weep. Close my eyes. Tik what have you gotten me into? Feel the Real. What have I gotten myself into? I wait two minutes and reboot the hub. It works as advertised.
Chapter 25
10:57 a.m. Monday.
Still at the Thai Orchid. Brian and I have a somewhat early lunch. I don't know Thai cuisine, or in fact any cuisine other than American fast food, so Brian orders. Tom ka gai, it seems, is a soup made of coconut milk, chicken, ginger, lime leaves of some species I've never heard of, mushrooms, miscellaneous other flavors, and chili oil. It has a light, fine burn that lingers in the sinuses, and a rich chicken flavor that balances it out. There is also a noodle dish called Pad Thai. Rice noodles, tamarind, peanuts, garlic, shrimp, along with a vague, wonderful fishiness I can't identify, scrambled-looking eggs, and chilies. Some kind of sprouts over top. Sweet and salty with a mouth filling flavor and searingly hot a few moments later. Oh yes, I think Thai food is my new favorite thing. The noodles are finished before there's much talking. They're that good.
