The Enigma Wraith

The team seemed infected with some unexplained reluctance to head into the operations area and get into character. Quip was texting with EZ like a pre-teen on a school bus ride. Petra was holding Jacob’s hand and talking about their next getaway vacation. Julie was staring out of the window completely lost in thought. Even Wolfgang seemed absorbed in his pink copy of the Financial Times of London to the exclusion of solving the computer problems that seemed to be mounting daily from what they were now calling the Ghost Code.

Quip prodded the team into the meeting room and asked, “So what do we know so far? It appears like we have some identifiable fragments that give us a general direction to look forward toward solving; we have the unsolved riddle of the grasshopper-loop that is a work in progress; and we have what appears to be a collection of seemingly random events categorized by appearing out of nowhere, flaring up like a supernova, and then imploding into nothing but not before offering one last taunt on the computer screen. Is that about it?”

Jacob added, a little annoyed, “Quip, you make it sound like we haven’t done last night’s homework assignment. We are not getting engaged early enough to capture the code breeding sequence or to get a full picture of its demise because it is cleaning up after itself. I can tell you what we do have is someone painting annoying messages on the computer screen when a coding routine that I wrote fails here in our center.”

Petra noted the strained comment and interjected, “Quip, we need more Ghost Code examples, not just snippets of fragments, if we are going to work this backwards to the source. The banking example in Ireland is the most recent one, but we are facing the same problem: it came, it delivered chaos, and it left with no evidence that it was even there. While this looks like a teenage hacker prank, it is a Proof of Concept exercise. If the code was fully baked then I can imagine our Ghost Code not restoring everything but instead painting ransom demands on the screen of every bank terminal until paid. I mean, why restore what had been taken, if the source code was fully evolved?”

Wolfgang and Quip both nodded in agreement.

Quip then questioned, “Are you suggesting these events are training exercises prior to a full scale onslaught?”

Discarding his earlier irritation, Jacob now observed, “That is an interesting observation, Petra. That might more easily explain why everything gets restored and the program cleans up after itself. That suggests that the program creator has further ambition for the code but is not willing to tip their hand.”

Quip considered the statement from Jacob and then asked, “Julie, do you have some observations on this topic?”

Without moving her gaze from staring out the window, she said, “Quip, I’m an operations and delivery technician. While I find all this discussion interesting, I’m not going to be able to help write encryption code or debug the grasshopper-loop. I can comment on the delivery issues I see. From what I’ve heard on the hydroelectric plant, the bank, and even the smart car, they all have the same thing in common from a delivery perspective: rogue code is delivered into a system that does not usually lend itself to being penetrated. As a cyber-assassin, I am always looking for ways to get in, deposit the payload, and leave with no one the wiser.

“This is precisely what these episodes have demonstrated and to points you are all raising. We are up against some very well trained cyber assassins.”

Wolfgang suggested, “We also need to start making inroads on following the money. There is always money in this sort of multi-layered activity.

“May I also make a recommendation here? Since we are not getting enough information remotely, perhaps we would be more successful if we had resources go to site? In that way we can do some forensics activity first-hand.”