Kicked Around

Erik opened the link, which led to a site called "Illudium." The direct URL was a "Contact" page that contained the statement: "For a price, I'll do pretty much anything." Erik navigated around Illudium for awhile. There were various links to other websites on the ROT network where there was free porn downloadable as torrents, revenge porn sites, and links to 0-day exploits. Erik looked at the original "Contact" page link that led him to "Illudium." He re-read the statement: "For a price, I'll do pretty much anything."

"Maybe someone paid this guy to go after Lara?" Erik thought. "That doesn't make any sense though. Unless she pissed someone off. Maybe, the asshole customer that she rejected paid this Marvin to do something. Maybe they're the same person. What could she have said to piss somebody off this much?"

Erik turned back to Lara's website, trying to find just how Marvin was able to get in initially. Erik checked the common vulnerability databases online and found nothing recent for the version of the Content Management System Lara was using. "There could be some type of zero-day exploit in the wild that no one from the CMS project knows about," Erik thought. " That would be why there's no patch for it. But, people would be using that to attack bigger sites. This CMS is used for much bigger shit than some college chick's porn site."

Erik decided to run commands to check differences in the files, which compared two files line-by-line. He checked the files from the CMS project site with the code files he had installed on Lara's website. There were no differences found. Then, Erik started looking through the plugins he had installed. Each one of them had a vibrant community around them with donation pages, bug reports, and source control repositories to help contribute. All of them, except one, the plugin that Erik used to upload captured video from the cam sessions automatically.

"That's odd," Erik thought. "I could have sworn this was the most popular plugin for this type of automatic video upload. I had to pay $20 for it too." Erik searched around and found that it was the "recommended plugin" to use for this purpose. The plugin integrated seamlessly to the most popular video chat client. There were several positive reviews on the site, but on the plugin page, there were no updates for the past year.

Erik checked the time and realized he needed to leave for Math class. He rushed out and caught the bus just in time. When he arrived at the Math class, Jessica was sitting there already, still looking very upset. Erik walked by her and sat down. She was texting on her phone and didn't even acknowledge that he walked in the door.

"She looks so sad," Erik thought. "I wonder what happened with her and Dave..." Erik's mind drifted back to Marvin and Lara's website. "Maybe it's the plugin. But then what? If it's a vulnerability in the plugin, then I can send it to the plugin developer, and hopefully, he can fix it for everyone else. Otherwise, I need to turn off automatic updates for that one so that it doesn't override the patch with the bad code. I'm getting too far ahead. I don't even know if that's the problem."

When the Math instructor arrived, she handed Erik his test. Erik received an A-. Several students were also missing from this class. The instructor in the Math class gave the same explanation as Professor Hand that several students scored far too low to have a reasonable chance of passing the class. Then, the instructor went into the next lesson.

Erik wasn't able to focus on the class, his mind kept drifting. "What if it's something different altogether? What if there's some 0-day in the web server? Maybe in the kernel? No, that just can't be. This would be a big deal. There would be security researchers all over it. But wait, what if they knew about it and they're using it to exploit sites on their own? What if the researchers are hacking websites with the vulnerabilities that they find and only disclosing after they've built up their own botnets in a bid to silently pwn every server on the Internet to use for their own evil, chaotic means? Oh my god! I've stumbled upon the greatest Internet security conspiracy of all time!"

Erik laughed at himself. As far as panic attack-prone, anxiety plagued nerds go, Erik knew he was one of the most paranoid people that ever owned a computer. But, as far as conspiracy theories go, he was pretty sure they were mostly bullshit. Still, he always gave himself a good laugh when his anxiety became too much to handle and generated wild theories that could be intertwined with the other "unexplainable mysteries of the universe." It was a defense mechanism, a way of keeping a handle on himself, through ridicule and laughter.

After class, Erik followed Jessica, along with the other students, out of the classroom and onto the bus. She still looked so unhappy that it made Erik want to cry. When they got off the bus, she exited toward the girl's side, and Erik went to the cafeteria. He picked up a tray and took it back to his room to continue his research.

Erik sat down at his computer and began to analyze the plugin code as he ate his dinner. The code was encrypted with a popular tool that requires a loader on the web server to run the encrypted code. This was typical for applications that were created using a scripting language, so that the creator can protect the code from piracy, reverse engineering or some other undesired use.

For Erik, the plugin was not readable. There was not much he could do to figure out how or what it was doing. So, Erik started to research a way of decrypting the plugin back into its original scripting language. Erik found a few programs that would do this, but none that were free. "At this point," he started to gather a thought, "Lara can pay for anything I have to buy to fix this."

Erik paid for one of the tools and attempted to decrypt the plugin code. The tool reported that the decryption process was successful, but when Erik looked at the results it still looked completely unreadable as if it was still encrypted. The file looked different, but it still appeared to be indecipherable nonsense. "Well that didn't work," Erik thought. "Fuck..." Erik opened another screen, paid for the next tool, and followed the same process. Again, the tool said the process was successful, but the file still looked like it was encrypted. "FUCK!," he said. "Does nothing fucking work anymore?!?"

Erik looked downward and put his head in his hands. "Alright," he thought. "If I can't see the code, then can I trust it? But I paid for it... And it's the top reviewed plugin... I can't be the only one that's having problems like this. No, it can't be the plugin. It's got to be something else. Does it? If I can't rule it out, what the fuck do I do? She needs this, and it's simple to use. If I find something else for her and she has to do all this shit manually, she's going to be pissed. Especially if I can't say that I know this is the problem. Maybe I just trust it? Same as the operating system, same as the web server..."

Erik looked up at the screen. He shook his head as he saw the numbers and letters that looked like encrypted gibberish. Then, he finally noticed that the first few characters of the file were the scripting language's start tag, followed by "eval ( base64_decode (" and then the encoded information. "What the fuck?" Erik said to himself. Erik scrolled down to the bottom and saw the scripting language's closing tag at the end of the file.

Erik switched the window back to the results of the first decryption tool. It showed the same thing. "Son of a bitch," Erik thought. "It did work! But, what the hell is base64 decode?" Erik did some more research and found that the code itself was base64 encoded, which meant that it was translated to look different using an open standard found in technology. After some more research, Erik concluded that this was a typical way for programmers to obfuscate code, which meant that the programmer was attempting to make it difficult for others to read the code.

Erik found a simple tool to decode the base64. The result was code in the original programming language. Erik could now read the code and find out what it was doing. The plugin appeared to do exactly what it was intended. There was nothing harmful here that he could see. The plugin wasn't communicating out anywhere, it wasn't attempting to download anything from anywhere, and the only account that it created was the one API account that Erik knew about when he first installed the plugin.

"Maybe that account uses a standard password, and the plugin creator knows it, and he's using it to get into the website?" Erik thought to himself. "It's a stretch, but is it possible?" Erik found where the account was created and it used a Psuedo-random number generator to generate a random number, then it appended a time stamp of the current date and time to the millisecond, and then used a one-way hash algorithm to hash the result. The hash was used as the account password when it generated the new account using the CMS API to create a new user. Afterward, it called a function called "exit_."

Erik was very familiar with hashes. Only weeks earlier, he used a rainbow table to crack a hash that held the password to his old High School's grade system. A one-way hash algorithm applies a mathematical function to produce an output that couldn't be "reversed." You could apply the hash algorithm on a value, but you couldn't un-hash the hashed value.

"Seems random enough," Erik thought. "The guy wrote this wouldn't know the timestamp when this thing was installed or the random number that was generated at the time the account was created. Hashing it at the end would generate a value that looks like a completely random password." Erik kept looking and stared at the final "exit_" function. The standard "exit" was part of the interpreter, which would exit the script. However, this function was called "exit_," which is not the same. At first glance, Erik missed it, but looking deeper he realized that he needs to figure out what this function did.

The "exit_" function wasn't in the same file. It was a function that was included in a file called "Validate." The "exit_" function created a file called "certificate" in the same folder as the plugin. The contents of the file were also base64 encoded. From the code, Erik saw it stored the user account password in the file. Erik opened the file and decoded the contents. Sure enough, it was the password for the API account. "Why the fuck would someone do that?" Erik thought. Erik moved the "certificate" file to a different folder and then refreshed his browser. Erik's VM instance of Lara's site now asked for a certificate key.

Erik remembered that when he setup the plugin, it required registration. Erik had to put in Lara's email and the URL of the site to get the key. Erik re-entered the certificate key, and the site let him back into the plugin configuration page. Erik looked back and saw that a new "certificate" file was created. Except, this one was blank.

Erik looked into the code and saw that when the certificate key is entered, that's when the API account is created. There was a comment in the code that said "Save certificate key to the certificate file." Right after the comment, the new API user's password is stored in the "certificate" file, base64 encoded.

"WOW," Erik thought. "It's a BUG!!! He meant to store the key, but he stores the account password instead." Erik continued to research the code. He found that every reference to this key file only looks for the existence of the "certificate," but doesn't read the contents of the file. "Holy shit!" Erik thought. "Someone found out about this and used it to hack into Lara's site! That has got to be it!." Erik's heart was racing; his mind was firing off praise and joy now that the puzzle was solved. Erik felt very confident that he found the way that the attacker got into Lara's site. Now, all Erik needed to do was empty the contents of that file on installation and reset the API account password just to be safe.

Erik felt like a god. He found the hole, and he found a way to patch it without affecting the site's functionality. He was flooded with new nervous energy. Erik stretched forward and picked up a top that was on his desk. Then, he spun it in on his desk as his mind reset and started down a new track. He held his clenched fist to his lips, shaking nervously and deep in thought. "What about everyone else using this thing?" Erik thought. "They're all vulnerable to this." Erik thought more about it. The devious side of his mind thought about how it could be used to his own gains. These evil thoughts always gave him a laugh, but he never acted on them. After about 5 minutes of spinning the top while thinking how he could build a botnet of zombie servers, Erik decided that the right thing to do was to tell the developer about it. Erik's mind began racing about the pros and cons about notifying the developer.

"What if he thinks I've been using the bug to hack his customers?" Erik thought. "What if he decides to contact the police... or the FBI... What if they come for me? What the fuck do I do?"

Erik couldn't get his mind off of how the developer would handle this information. So, Erik decided to create a brand new email account and disclose the bug to the developer. In the email, Erik explained that he feels everyone else needs to know about it so, in 4 weeks, he will be publishing the findings to a full disclosure security mailing list. At that point, the entire security community will be aware of the bug, and it will most likely be added to the publicly searchable vulnerability databases that are on the Internet. Erik sent the email. This was Erik's attempt at disclosing the bug responsibly to the original developer to give them a chance to fix it without attaching his name to the finding.

It was now 5 AM Wednesday morning. Erik had worked on this all night long, into the early morning of the next day without even realizing it. Daylight was starting to peek through the window and after a night of highs and lows, Erik felt triumphant. He was still smiling, thinking about how incredible his find was, as he restarted his laptop into it's regular environment navigated to a porn tube site and took off his pants.

Chapter 21

Erik woke up to his alarm. He was still sitting in his chair, pants around his ankles, holding himself with cum all over his hand which had dried and glued his dick to his right hand. Erik's neck ached, and he was exhausted. The porn clip was still playing on repeat when Erik jolted awake and grabbed behind his lower head. "Fuck," he said. He started to pull away his hand, but the dry cum was tugging the skin on his dick with it. His dick was now soft, so it was stretching as he tried to pull his hand away, causing an uncomfortable ripping sensation. After a few seconds of gentle tugging, he separated the two body parts while a crusty trail of sticky whiteness lay behind.

Erik grabbed a roll of toilet paper and attempted to use that to wipe off the gummy, flakey residue, but it wasn't working. The toilet paper was ripping and sticking to both his hand and his dick as if he threw feathers over the tar that lay behind to complete the humiliation. Eventually, he grabbed his shower towel and scrubbed at his hand, leaving his dick to fend for itself. Erik was able to scrape off the residue from his hand so it wouldn't sully up anything else he touched.

Erik put his pants back on and then rushed to the bathroom to wash his hands. He quickly pulled himself together for class and ran to the bus stop. At the bus stop, Jessica saw him walk up and looked over at him. "Hey stranger," she said. Erik was exhausted. He was so focused on getting to class that he didn't even notice Jessica standing next to him. Erik turned and stared at her for a second before he realized who she was.

"Oh, hey!" he said. "Hi. Heya... ah... How are you?"

Jessica smiled. "I'm OK," she said back. "How are you?"

"I'm fucking... I'm great...," Erik responded. "I'm just... a little tired..."

"Were you up late last night?" Jessica asked curiously.

"What? Oh, yeah... I was working on sh... stuff... I mean... I had work I was doing, and it kept me up late. The work did. I was working on it. And it just kept going. But I worked on it. And I found it. And it was great. So I just kept working on it..."

"Did you fix whatever you were working on?" Jessica asked.

"No," Erik said. "But I found out what happened. So I kept working on it. And then I found out some more. And it was like, WOW... And then I was, whoa... And then..." Erik stopped talking, finally realizing that he had been rambling this whole time. He looked at Jessica who was looking at him trying to understand what he was saying.

"I'm sorry," Erik said. I'm running on like an hour of sleep, and I have no idea what I'm talking about."

Jessica smiled back. "No, I'm sorry," she said. "I've been really out of it this past week, and I've been, kind of, ignoring you... and that's not right. It's just... I..." The sound of the bus stopping at the corner drowned out Jessica. She turned and entered the bus. Erik followed her. She took a seat, and Erik sat next to her.

"So, what's going on?" Erik asked.

"It's nothing," Jessica said. "I just wanted to say sorry."

"OK," Erik said. "No problem. I'm cool... No big deal... Just... all good..." He looked at Jessica who cracked a smile at him.

"So...," Erik said trying to think of something to keep the conversation going. "The test! Ah ha!" Erik said it as if he had a eureka moment. Then, he looked at a startled, wide-eyed Jessica. "Sorry... Umm, how did you do on that?"

"I got an A," Jessica said. "How about you?"

"C+," Erik said. "Seems like a lot of people did bad on it."

"Yeah," Jessica responded. "The day after the test, Professor Hand asked the class if we were all on drugs. He sounded really mad."

"Wow," Erik said amazed. "Did Bob flunk it?" Erik asked.

Jessica put her head down. "Yep," she said. She kept her head down and remained silent. Erik did a silent "yes" with a fist clench, knowing Bob was now out of the picture. Erik saw that the subject made her uncomfortable, so he took this as a cue to change the subject.

"So...," Erik said. "How's Lexi?"

Jessica looked up. "I don't know," she said. "I see her in the mornings when she comes back. She's spending a lot of time with Bret. She texts me stuff, but I haven't talked to her much this week. It's all internet movies and chill, you know."

"Oh," Erik said. "I've been busy with work, so I haven't seen them."

"What are you working on?" Jessica asked.

"The same website I've been working on all summer," Erik said.

"It's not done yet?"

"It was," Erik said, turning angry. "Then some fucker hacked it and put all kinds of shit on it and I've been trying to unfuck it for the past 3 days."

"O... K...," Jessica said realizing that she struck a nerve. "Good luck... with all... that."

"I'm sorry," Erik said realizing that his demeanor changed. "I've just been putting all my time into trying to figure out what went wrong and I finally found it last night, and I'm so tired, and I can't think straight, and if I catch this little fucker, I'm gonna..." Erik stopped himself. "I'm sorry... I'm doing it again. I need to go back to sleep."

Jessica laughed at him.

The bus pulled up to the building, and everyone exited. Jessica and Erik went to their first class. After class, they started talking again. They talked while waiting for the bus, they talked on the short bus ride back, and they talked after they exited the bus back at the dorms.

"So, maybe I'll see you around later?" Erik asked.

"I'll see you again later today," Jessica said.