Spy Story: Cyberhunt
"BisonBoy e-mail me
d_ragu@metamail.com" was the cryptic post made by user Dragu in the SuperHornet thread. BisonBoy frequented that thread, and that was the best place to grab his attention.The expectation didn't fail. Within an hour, Sanjeev got an e-mail from Rajeev Mallar.
Rajeev Mallar was a typical nut case, according to his family and community. He belonged to a wealthy respected Konkani family of Cochin. His father Sudhakar Mallar ran the biggest sanitaryware business in the city, and two brothers are heling their father running the business. But Rajeev, the youngest, was considered the black sheep of the family. He did neither try for higher education, nor joined the family business. Instead he dropped out at second year of his BSc Mathematics and became a full time amateur programmer. His involvement in busting a few high profile cybercrimes didn't really help his standing with the family, but when a multinational company hired him as project leader, even without formal qualifications, everyone was happy. Not many people knew that he turned out to be one of the foremost experts in computer security. Sanjeev met him in the forum, and this is not the first time they corresponded.
Within half an hour, a new sets of e-mail addresses were established and security keys exchanged, an extremely secure correspondence started betwen the two. Sanjeev e-mailed a big list of IP Addresses and access logs, and Rajeev went to work on the earnest. He took one of those "french leaves" and went home early that day.
The IP list and sever logs are carefully examined and the painstaking elimination process begun. It is not a simple task to trace an IP address, but Rajeev had a lot of custom tools he created to help automate a lot of the activities. Still the amount of work needed is phenomenal.As the day came to a close, he had figured out that none of the suspected IPs originate at the expected geographic location.
But of course, the target could have used an anonymiser proxy. There are proxy servers available located at a number of countries and regions, and a number of them are free, so anyone can use them. Tracing an IP Address beyond a proxy is practically impossible. His search has hit a brick wall. Drastic steps are needed. He sent another e-mail to Sanjeev, explaining a wild idea.
<==>
Edvin Mendez started sweating profusely. The Australian summer suddenly seemed blazing up. The task he was asked to pull off was tremendous. He knew Sanjeev Gupta personally. They had shared many a drink and many a stroll at Golden Gate Park. Even after his moving to Sidney, they used to catch up with each other whenever he visit San Francisco. However, this is the first time Sanjeev asked him for anything related to his RAW deal. Edvin was glad that he is in a position to help, but to be asked to shut down the whole website and make a new database seemed crazy. Sanjeev had to finally explain who the target was, and that information helped Edvin to get that last bit of determination.
He corresponded with his colleagues, the admins, all around the globe, and all of them went to work immediately. The databases are backed up and the scripts and widgets provided by Rajeev are integrated. The famous site went down without notice and when it came back, there was chaos. More than 20 thousand active members received shocking news of massive database corruption, needing sign up and verification of their account. Most cursed themselves and went about the business of signing up again and activating their accounts over e-mail. Only this time, the activation DID not have a code entry, but the user had to click a button. It was illegal, but in spy world, there is nothing that is illegal.
Within a couple of days, several gigabytes of data got accumulated from most of the users. Now the task of sifting through them began.After a couple more painstaking days, another list of IP Addresses, this time with extra information, went to Rajeev Mallar.
Finally he was able to locate a couple of IP Addresses. then with pleasure he saw the traceroute entry:
11 219 ms 217 ms 219 ms dist1-local03.napa.bellco.net [68.231.97.23]
12 219 ms 217 ms 217 ms adsl-38-234-85-254.dsl.napa.bellco.net [71.146.95.254]
He e-mailed Sanjeev, called his cell number, and hung up after three rings. It would be 2:00am Pacific Std Time now.
To be Continued