 |  |
Being a ghostwriter is an interesting profession. You meet interesting people with interesting occupations. The people who need your services know their stuff; they just don’t know how to tell other people that they know their stuff. They approach you with enthusiasm and a lot of information. The only thing they lack is an understanding as to why you don’t charge the same as their neighbor’s son who’s in high school.
I’ve managed to get past that, for the most part. I never planned on getting filthy rich as a writer and, to be totally honest, that’s worked according to plan. But some of my jobs have been quite lucrative. Still, I’m always open to a deal if it piques my interest. This was one of those deals. It came by email.
To the Attention of The Writer:
My name is Jack Sullivan. I represent EBG Ltd., a small group of independent banks with locations across Western Europe. We want to retain your services as our personal emissary at the Black Hat conference to be held at the Mandalay Bay hotel.
We have reason to believe that one or more attendees at that conference will attempt to infiltrate our banking system. We have visited 911WRITE.com and understand that you have the computer knowledge necessary to blend in with the hackers who will be in attendance at the conference. We would like you to write an evaluation of whether our perceived threat is a real threat.
As we would prefer to keep our involvement under the radar, we would like to pay you in the form of any conference related fees. Let me know what passes you require, and we will purchase them in your company name. We would be happy to discuss any further remuneration after the conference concludes. If this is amenable to you, please reply at your earliest convenience.
Very truly yours,
J. Sullivan
Media Liaison EBG Ltd.
Sullivan offered an intriguing proposition. I took him up on his offer. The $6,500 ticket to ride was a little more than I was willing to spend but with EBG offering to foot the bill, it could open up writing opportunities that would go well beyond the conference itself.
I spent the next two days learning everything that might keep the average person awake at night or, at the very least, afraid to turn on a cell phone. After researching all the training sessions, I decided that the Black Ops Hacking - Master Level session would be the session most likely to attract anyone looking to infiltrate a banking network. In addition, an all-access pass would allow me to wander throughout the entire conference in the hopes of overhearing something that would point me in the right direction. It was nothing more than boots on the ground reporting 101, but it would be nice to return to my writing roots. I soon learned that I probably should have spent some extra prep time exploring my inner geek.
As you might expect, Cybersecurity is big business with big business interests.
This inevitably leads to dueling cybersecurity conferences on the Las Vegas Strip. The larger of the two is the irreverent DefCon conference which is immediately followed by the corporate Black Hat conference at about half the size and worlds apart.
DefCon pits the best and the brightest hackers against worse case computer hacking scenarios. The attendees could best be described as geeks on steroids. They have little if any regard for authority and they always pay with cash in an effort to avoid big brother looking over their shoulders. They seem to have adopted my philosophy that names are not important because their name tags don't have any. I know what you're thinking, why wear name tags without any names on them? I couldn't tell you. My best guess is that it's their way of giving the finger to the Black Hat attendees who do put their names on name tags. Defcon attendees call security guards “goons” and are definitely not Ivy League, but neither are the hackers that represent the biggest cybersecurity threats to this country. Although they wear T-shirts emblazoned with anti-authority sayings or inside nerd jokes and their jeans may have seen better days, they are very good at what they do. The one thing both conferences have in common is that all the attendees eat, drink, and sleep computer security. Although the jeans and shirts that the Black Hat attendees wear may be more expensive, they are Defcon attendees at heart.
The main lecture was on hacking the electrical grid system. Although it wasn’t exactly the subject I was hired to investigate, I figured that it would be a good way to make contacts that might lead me to people knowledgeable on the subject of hacking banking systems.
The conference room was full of geeks much more fascinated about the subject matter than I was. Which is why I resurrected a technique that I had first used in grade school, I choose a seat in the back of the room with empty seats on either side of me. I preferred not to have anyone ask me questions. I also wanted to be able to spot attendees asking questions from the audience. I figured that was a good way to narrow down the attendees to a group who might be interested in infiltrating a banking system. As it turned out, everyone in the room was interested in infiltrating something.
It was fifteen long minutes into the presentation, and I was beginning to think I might have bitten off more than I could chew, when someone sat down in the chair to my right. He seemed to be intensely focused on the presentation except for moments when he would type notes on his laptop. Hoping for some clarity of the topic, I took quick glances at his laptop screen whenever he turned his attention to the speaker’s PowerPoint presentation. When the presentation was over, he lowered his laptop screen and turned to face me.
“I take it you're a Black Hat newbie?”
Is it that obvious?” I said with a slight smile.
“I just hope you didn't get eyestrain looking at my screen.”
“Sorry,” I said. “I’m a freelance writer and I'm afraid that I may have exaggerated my knowledge of the topic in order to get this job.”
“And you thought sneaking a peek at my screen would give you an instant education?”
“Sorry. I was of grasping at straws.”
“So what’s your assignment, writer?”
“Is electric Armageddon fact or fiction?”
A smirk came across his lips as he said, “Is that all?”
“That’s only a working title. I’m trying to find out if it’s possible to bring down power grids.”
“There’s no easy answer to that question. A power grid is a lot more complicated than it seems. There are three grids, east, south, and west. Contrary to what you see in the movies and on television, taking down all three would be a Herculean task.”
“How difficult would it be to bring down one electric grid system?”
“The speaker addressed that question, while your attention was on my computer screen,” he said with a slight smirk on his face.
“The seminar was a little over my head. I wish I had taken a quick 101 course before taking this job. Rent is coming up and I’d hate to lose this assignment.”
“Tell you what, writer. For the price of a lunch, I'll give you a quick education.”
We headed out of the conference room and ended up eating bar food at the Rí Rá Irish Pub at Mandalay Place.
“Teach, class is in session.”
“Okay, let’s start with the basic design of a power grid. Picture a spider’s web. There can be dozens or even hundreds of individual compartments that make up the entire web. Each one of those compartments is perfectly integrated in order to create a strong total structure. That’s how it is with the three electrical power grids. Each grid is integrated with hundreds of power companies and each other. It would be a almost impossible to bring down any one of these grids. Again, think of the spider's web. In essence, that's what you're looking at.
Back in 2013, it was believed that a band of domestic terrorists tried to do something like that in a small way. It happened at a transmission substation just outside of San Jose, California. Guys with automatic weapons shot up the place and cut a transmission cable. It took about a month to repair the damage, but it didn't result in a major power outage because transmission lines were just rerouted to another substation.”
“You're saying that it can't be done?”
“There's isn’t a yes or no answer to that. It's more like maybe, kinda, sorta. It could be possibly be done by hacking into the system, but it would have to be an organized effort by hundreds of computers all working together. It would be similar to a denial of service attack, you know, when hundreds or thousands of computers access a company’s website at exactly the same moment in an attempt to overload the system.”
“That doesn't sound too far out of the realm of possibility. Actually, it sounds kind of easy.”
“Except these computers would have to do more than just bring down the service. They would have to stop hundreds of other computers from rerouting the transmission lines.”
“Sounds as if you’re talking about introducing a virus into the system.”
“Viruses are too unreliable. Because all the computers are not on the same network, it's highly probable that a virus would be discovered and neutralized before it could leave its point of origin. I work for a business that was hired by a power company to run a test scenario.”
Our discussion was interrupted when an inebriated thirty-something stumbled into the table. He grabbed teach’s wrist and, in the process, spilled his drink on the open laptop. My tutor jumped up as I turned to get the waiter’s attention for a towel. When I turned back, the drunk has wandered off. Teach was trying to dry the keyboard off with a couple of napkins he had appropriated from the table next to us.
The waiter brought over a towel and handed it to him. He continued to dry off the keyboard and his pants as we spoke.
“What do you mean, test scenarios?”
“You know, dry runs to test grid security. Nothing illegal.”
I was about to ask for his employer’s name, when I noticed that he was beginning to perspire as if we were in a sauna instead of an air-conditioned room.
“Are you okay?” I asked, as he began patting his forehead with the towel.
“I need some air. Can’t breathe,” he said as he stood up, knocking his chair backwards as he did. He paused, and I saw a look of shear panic on his face. Then his legs buckled as he dropped to the floor. I dove out of my chair and cradled his head in my hands.
He looked at me and whispered, “Denbigh.” Before I could say anything, his eyes froze into a permanent stare.
The bartender had already vaulted over the bar and was headed for our table as a crowd formed. The only one missing was the clumsy thirty-something. He was nowhere in sight.