📸 Photo

CYBERWAR!

issued an alert about the BIND flaw, along with a link to the simple fix: two additional lines of computer code that rejected overlong queries. But CERT packaged its alert with two other BIND vulnerabilities that were of little consequence and understated the importance of the hole. Consequently, not everyone appreciated the gravity of the situation.

Max understood perfectly.

He read the CERT advisory with amazement. BIND came installed standard with Linux, and it ran on servers on corporate, ISP, nonprofit, educational, and military networks. It was everywhere. And so was the defective line of code. The only thing holding back a feeding frenzy of attacks was that nobody had written a program to exploit the security hole. But that was just a matter of time.

Sure enough, on May 18, an exploit program showed up on Rootshell .com, a computer security news site run by hobbyists. Max picked up the phone and called his FBI contact, Chris Beeson, at home. The situation was serious, he explained. Anybody who hadn't installed the BIND patch could now be hacked by any script kiddy capable of downloading a program and typing a command.

If history was a guide, government computers would be particularly vulnerable. Just a month earlier, a less serious bug in the Sun Solaris operating system had led to a hacker cracking computers at a dozen U.S. military bases, in what a deputy defense secretary called "the most organized and systematic attack to date" on American defense systems. Those attacks had set off a full-blown cyberwarfare false alarm: The Pentagon gave the intrusions the code name "Solar Sunrise" and considered Saddam Hussein the prime suspect until investigators traced the attacks to a young Israeli hacker who was just playing around.

Max called Beeson again the next day, when a hacker group named ADM released a weaponized version of the BIND exploit designed to scan the Internet at random looking for unpatched servers, then break in, install itself, and use the newly compromised computer as a platform for