📸 Photo

KINGPIN

A high priesthood of network experts called the Internet Software Consortium appointed themselves keepers of the code and had begun furiously rewriting it. But in the meantime, the most modern, sophisticated networks in the world, with sparkling new servers and workstations, were running a buggy computer program from another age.

In 1998, security experts discovered the latest flaw in the code. It boiled down to that single line. It accepted an inquiry from the Internet, as it should, and copied it byte for byte into the temporary buffer “anbuf” in the server's memory. But it didn't properly check the size of the incoming data. Consequently, a hacker could transmit a deliberately overlong query to a BIND server, overflow the buffer, and spill data into the rest of the computer's memory like oil from the Exxon Valdez.

Performed haphazardly, such an attack would cause the program to crash. But a careful hacker could do much worse. He could load the buffer with his own small snippet of executable computer code, then he could keep going, tripping cautiously all the way to the top of the program's memory space, where a special short-term storage area called the “stack” resides.

The stack is where the computer's processor keeps track of what it's doing—every time a program diverts the computer off to a subroutine, the processor pushes its current memory address onto the stack, like a bookmark, so it knows where to return to when it's done.

Once a hacker is in the stack, he can overwrite the last return address with the location of his own malicious payload. When the computer is done with the current subroutine, it returns not to where it began, but to the hacker's instruction—and because BIND runs under the all-powerful administrative “root” account, the attacker's code does as well. The computer is now under the hacker's control.

Two weeks after Max and Kimi's wedding, the government-funded Computer Emergency Response Team at Carnegie Mellon University—which runs a kind of Emergency Broadcast System for security holes—