Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground Read Online Free PDF Page B

“penetration testing”—as it was called—had been dominated by the Big Five accounting firms, but Harrigan was already signing up clients by admitting something that no accounting firm would ever announce: that his experience came from real-life hacking, and he was freely hiring other ex-hackers.
    MCR would be billing out between $300 and $400 an hour, Harrigan explained. Max would work as a subcontractor, making $100 to $150. All for doing two of the things he liked most in the world: hacking into shit and writing reports.
    Max had found his niche. It turned out his single-mindedness made him a natural at penetration testing: He was immune to frustration, hammering at a client’s network for hours, moving from one attack vector to another until he found a way in.
    With Max making real money at MCR, Kimi quit her job as a barista and found more rewarding work teaching autistic students. The couple moved from the cramped apartment in Mountain View to a duplex in San Jose. In March, they got married in a church on a college campus in Lakewood, Washington, where Kimi’s family lived.
    Tim Spencer and most of the Hungry Programmers went up to Washingtonto see their problem child married off. Max’s parents, his sister, Kimi’s family, and scores of friends and extended family showed up for the ceremony. Max wore a tuxedo and a broad grin, and Kimi glowed in her white wedding dress and veil. Surrounded by family and beloved friends, they were a picture-perfect young couple beginning a life together.
    They posed outside: Kimi’s father, a military man, stood proudly in his dress uniform, her mother in a traditional Korean
hanbok
. Flanked by his own parents, Max beamed at the camera, while storm clouds gathered overhead in the Pacific Northwest sky.
    It was three years almost to the day since Max walked out of prison, and he had everything now—a devoted wife, a promising career as a white-hat hacker, a nice home. In just a few weeks, he’d throw it all away.

Cyberwar!
     
    ack home in San Francisco, a temptation was waiting for Max, written in computer code.
    bcopy (fname, anbuf, alen = (char *)*cpp - fname);
     
    It was one line of nine thousand comprising the Berkeley Internet Name Domain, an ancient girder in the Internet’s infrastructure, as important as any router or fiber-optic cable. Developed in the early 1980s with a grant from the Pentagon’s Defense Advanced Research Projects Agency (DARPA), BIND implemented the scalable Domain Name System, a kind of distributed telephone directory that translates strings like Yahoo.com, which humans understand, into the numeric addresses the network comprehends. Without BIND, or one of the competing programs that followed, we’d be getting our online news from 157.166.226.25 instead of CNN.com and visiting 74.125.67.100 to perform a Google search.
    BIND was one of the innovations that made the explosive growth of the Internet possible—it replaced a crude mechanism that couldn’t have expanded with the Net. But in the 1990s, it was also one of the legacy programs that were shaping up as the modern Internet’s biggest security problem. The code was a product of a simpler time, when the network was cloistered and threats were few. Now hackers were plumbing its depths and coming back with a seemingly endless supply of security holes.
    A high priesthood of network experts called the Internet Software Consortium appointed themselves keepers of the code and had begun furiously rewriting it. But in the meantime, the most modern, sophisticated networks in the world, with sparkling new servers and workstations, were running a buggy computer program from another age.
    In 1998, security experts discovered the latest flaw in the code. It boiled down to that single line. It accepted an inquiry from the Internet, as it should, and copied it byte for byte into the temporary buffer “anbuf” in the server’s memory. But it didn’t properly check the size of the incoming data.