“Why didn’t you tell me before?”
I was pacing in front of the huge flat-panel TV that dominated one wall of Chuck’s apartment.
“Figured you’d think I was being paranoid,” replied Chuck. Blurry images of a smoking aircraft carrier filled the screen behind me.
I’d returned to the Borodins’ in a rush and knocked loudly on their door. While hurrying the few blocks up from Whole Foods, I’d searched the news on my smartphone. The device had taken forever to respond.
There had been an incident in the South China Sea. A Chinese warplane had crashed. The Chinese were claiming it was an attack by American forces, but the Americans were denying they had anything to do with it, saying it was an accident. The governor of Shanxi Province, in northern China, was all over the news claiming it was an act of war.
Luke was fine when I arrived, but his fever had gotten worse. He was sweating profusely, and Irena said he’d been crying most of the time I’d been gone. I’d left him at the Borodins’, letting him rest, and gone over to Chuck’s.
“You didn’t think this was maybe important enough to share?” I asked incredulously.
“Not at the time, I didn’t.”
CNN was on in the background. “Sources in the Pentagon deny any responsibility for the crashed Chinese warplane, saying that it was the result of the inexperience of Chinese forces in operating at-sea carrier operations—”
“You haven’t had any food deliveries to your restaurants in several days and you didn’t think I might be interested?”
“—Poison Trojan has now infected DNS servers worldwide. The Chinese are denying responsibility, but the bigger issue now is the Scramble virus that has infected logistics systems—”
“I didn’t think it was relevant,” replied Chuck. “We have computer problems all the time.”
The virus that had shut down FedEx and UPS had moved on to infect the software of almost every other commercial shipping company, and the world’s supply chain was now starting to grind to a halt.
“I’ve been reading the hacker message boards,” added Chuck. “They’re saying that UPS and FedEx are proprietary systems, and that the speed of the virus means it must have hundreds of zero days in it.”
“What’s a zero day?” asked Susie, who was sitting on the couch next to Chuck. She was holding Ellarose, whose head bobbled up and down as she watched me pacing in circles. Susie was a real Southern belle, a brunette with delicate freckles and a slim figure, but her pretty brown eyes were now filled with concern.
“It’s a new virus, right?” Chuck ventured.
I wasn’t a security expert, but I was trained as an electrical engineer, and computer networks were my field of expertise. “Sort of,” I tried to explain. “A zero day is a software vulnerability that isn’t yet documented, and a zero day attack uses these to get into a system. It’s an attack that has had zero days to be analyzed yet.”
Any system had weaknesses. The ones that were known usually had patches or fixes, and the list of new software vulnerabilities expanded at the rate of hundreds per week for the thousands of commercial vendors in the world. With a typical Fortune 500 company using thousands of individual software programs, the list of vulnerabilities could hover in the tens of thousands at any given moment. It was an impossible game of catch-up against an adversary that only needed one hole to remain open among literally millions that an organization had to continually fix.
While everyone, private and government, struggled to keep up with the list of known vulnerabilities, against unknown vulnerabilities, or zero-days, the situation was even worse. There was nearly no defense, precisely because the attack vectors were, by definition, unknown.
Chuck and Susie stared at me blankly.
“It means an attack that we have no defense against.”
Stuxnet, the virus believed to have taken down Iranian nuclear processing plants in 2010, had used about ten zero days to get inside the systems it attacked. It was one of the first of a new breed of sophisticated cyberweapons. They cost a lot of time and money to build, so someone wouldn’t be unleashing these ones without some purpose in mind.
“What do you mean, an attack that we have no defense against?” asked Susie. “How many of these are there? Can’t the government stop it?”
“The government mostly looks to the private sector to protect this stuff,” I replied.
CNN had switched to a discussion between four commentators and analysts. “The thing that has me worried, Roger, is that computer viruses, especially sophisticated ones like this, are usually designed to infiltrate networks to get information out. These don’t seem to be doing that. They’re just bringing the computer systems down.”
“What does that mean?” asked Susie, staring at the TV screen.
As if answering her question, the analyst looked straight into the camera. “The only thing I can assume is that we’re being purposely attacked, with the only goal of inflicting as much damage as possible.”
Susie brought one hand up to cover her mouth. Saying nothing, I sat down next to them and tried calling Lauren for the dozenth time.
Where is she?