Zero Day: A Novel by Mark Russinovich, Howard Schmidt Page A

implications of what he’d just said. In recent years the Russian Mafia had hired the best software engineers in the former Soviet Union to create new viruses and unleashed them on the cyber world. They were making hundreds of millions a year, and the more they made, the more aggressive and creative they’d become.
    “I’m surprised the virus has been so hard to find,” Sue said, focusing his thoughts.
    “They usually aren’t,” Jeff agreed. “Typically, I spend most of my time recovering information and rebuilding systems. But lately I’ve been seeing more and more of this kind of thing. A cracker gets into your system to do damage, not to steal information. Not long ago a guy was caught who hired a cracker to shut down the Web sites of his major competitors. These were Internet businesses; as long as he got away with it, everyone’s customers went to him.”
    “That’s terrible!” Sue knew the Internet was used for scams, but she’d never before heard such a story. To her, the Internet should be benign, a resource to make life better, not a destructive force.
    Jeff knew what Sue was feeling. He often felt the same way. “I hate to say it, but that’s only one of hundreds of ways to profit from cybercrime. In the good old days, hackers were geeks out to make a name for themselves. Now they can earn money, sometimes big money, with the same skills and malicious intentions. There are even Web sites where you can download malware. You graft on something you’ve cooked up yourself, and you’re off and running. One guy got into a bank’s system and had a tenth of a penny—that’s all, just a tenth of a penny—taken from every transaction over one hundred dollars and wired into an offshore account. The bank’s computer was programmed to round pennies up, so it kept covering the shortage.”
    “What’s a tenth of a penny?”
    “I have no idea.” Jeff shrugged. “I guess they break currency down as far as they can. He could have asked for a twentieth, or a hundredth.”
    “What happened?”
    “Within four months he’d made over six hundred thousand dollars. Even then the bank’s computer kept covering for him. I don’t know how long it would have gone on if he hadn’t made the mistake of not deleting all bank-employee accounts from his scam. See, these people knew the system, and a lot of them balanced their checkbooks to the penny. One of them spotted that the accounting system was skewing and checked the programming. He found the virus, and it didn’t take long to find the crook.” Jeff took a sip of coffee. That hadn’t been his case, but he’d cracked one like it, and it had felt very, very good. In some ways the satisfaction he took from his work was more important than the pay.
    “I’m surprised our security measures didn’t stop this. They were supposed to,” Sue said.
    “All security systems are reactive in nature. That means the virus has a head start in infecting computers before it’s identified and enters the log of the antivirus and firewall programs. There are very sophisticated crooks who have taken to hiring crackers to deliver viruses that steal financial information. Computer security has become much more difficult now that there’s a great deal of money to be made. Russian crackers looted a French bank of more than one million dollars in 2006.”
    Sue shook her head in amazement.
    “Since your firewall and antivirus software didn’t spot whatever it is, it’s something off the charts,” Jeff said, rubbing his forehead, trying to ease his exhaustion away. “Something new, or something very sneaky—perhaps something targeted specifically at you. Any business makes enemies.”
    “I hadn’t considered that.” Sue shifted in her chair and pointed at Jeff’s computer screen.“But you think this is Russian.”
    “I can’t really put my finger on it. I’ve been able to read some of the code, and it’s just got a Russian feel to it.”
    “Maybe somebody copied