A Worm by Any Other Name

It has been two days since his epiphany, and he had spent almost all of that time awake. Getting together 10 friends that he trusted was harder than he thought. Of all the people he initially thought would fit the bill, he had settled on only eight. Capri made nine, and after much convincing on her part, he allowed her best friend in on the deal, too. That made 10; each armed with a map of five to six ATMs they would try to hit.

They had started with a map conveniently made available on NBSA s own Web site, and from there, the group identified which units were the new ones. Quietly, they made the rounds in a test run of sorts, withdrawing a little money at each one, and then matching up the physical address with the Location ID printed on the receipt. The plan was sewn up, and it was a good one.

In just a few hours, they would be poised for the attack, ready to become rich. And nobody, not even Knuth himself, would be any more the wiser.

It would be a fifty-fifty split, and he told them that he knew exactly how much each ATM was going to dispense, though that was a lie. He wanted there to be enough doubt in their minds to keep them honest. There was nothing worse than a dishonest person.

The worm code was complete, thanks to the mooks at NCR who provided code samples in PDF files via their own Web site. After much self-debate, Matthew had decided on a variant of the ASN.1 vulnerability. Most of the code on the Internet didn t work, but he had made a friend or two over the years who knew where to get what he needed.

Now all he had to do was finish his pi ce de r sistance . A few more hours of programming, and he would be ready. It was time for more Skittles. Opening a new package, he separated out the colors as he always did. There were always less green ones than any other color . He pondered the nature of green Skittles as he chugged down another Red Bull.

A couple of hours later, after plenty of testing, he was done. It was a masterpiece. He looked at his watch ”it was 3:12 p.m. , April 14th. Two hours to go.

He had no idea how many units would be infected once he launched the code. Since he was now concerned with only his favorite ATMs, he couldn t care less if any other machines became infected. He really did not have any idea when the worm code would saturate itself since he was not sure of the total number of hosts reachable on the bank s network. In any case, the worm would stop its initial propagation after 30 minutes of activity. He knew it was total overkill, but he wanted to be sure as many ATMs as possible were infected. If the box could load the ATM library and execute the dispense function call, it would start spitting out money (or filling the tray depending on the style). If not, he had put error checking in place to simply jump to the infection routine. Of course, he had no way of knowing if any of this would work, but even if the machines didn t actually spit out money, between the porn and additional vulgarities he programmed, that would be enough.

Then the fun would begin. The worm would go quiet after the initial 30 minutes, though any infected ATM would still be spitting out money (if it had any left). Then, at exactly 8 p.m. , every infected unit within the entire infrastructure would turn and focus its attention on the 390LB.border.nbsa.co.za subnet in a massive distributed denial of service attack. Some units would attack the 390LB.border.nbsa.co.za host directly, others randomly jumping around that subnet, as well as adjacent ones.

If Matthew s plan worked, the mainframe system itself would be completely taken out. The bank would, for all practical purposes, be shut down. And being a holiday, it would be quite some time before anyone could do anything about it. Matthew actually felt sorry for them. But that didn t last long.

He got up, stretched , packed up his things, and headed to his car. Via cell phone, he made one finally check with Capri regarding their position. We re ready, but, I m I m nervous, Matthew, she said. Don t worry baby, I ve thought this out completely. Remember, you re not doing anything wrong. You ll just be a lucky winner, as it were. Just don t get caught with the map, and you ll be fine.

But that was not the only call to be made that day regarding Matthew s perfect plan.

Mr. Knuth? said the anonymous female voice.

Yes, he said. I understand you have some information for me.

Yes, she said. It is about the man we talked about a couple of days ago. He is absolutely going ahead with his plan. I have first-hand information now.

Knuth sighed. That is unfortunate. Quite unfortunate indeed. You have the names of the others? His friends?

Yes, yes I do. Do I get paid now? she said in hesitation.

Yes, of course you do my dear. You have served me well. It will be as we arranged.

Matthew arrived at his familiar spot in the mall parking lot. Opening his laptop and connecting to the network, he verified he could reach what would be box 0, 1, and 2. All tests passed.

Heaven help them, he said, and he launched the worm.