CHAPTER TWENTY-TWO
At six in the morning, only a handful of bleary-eyed business travelers dotted the lonely concourse of Reagan National Airport. The only signs of life were the TSA checkpoints at either end of the main hall. Despite the soaring ceilings and panoramic windows, passengers rarely lingered to enjoy the view. The reason for the ticket to Seattle: Gibson expected to be here most of the day, and, if he camped out on the concourse, someone would eventually wonder what he was doing there. Better to blend in down at one of the gates. He’d parked in the long-term lot, even though he had no intention of catching his flight. His story needed to be consistent. If he drew attention from security, he was just on his way to Seattle to visit his daughter.
Gibson rolled his suitcase down to Terminal B and joined the bottleneck of business travelers catching early flights to cities like Chicago and New York. A TSA agent checked his boarding pass and ID and waved him through. Gibson grabbed a couple gray plastic bins for the conveyor belt and shuffled through the body scanner in his socks. Down at the main gate hub, he bought a coffee and found a seat far from his departure gate. A woman trying to wrangle two children glanced at him apologetically, and he smiled to let her know he wasn’t bothered. She smiled gratefully at her fellow traveler and went back to getting her kids situated.
The girl looked around Ellie’s age; at least Ellie’s age the last time Gibson had seen her. That had been a good day. He’d taken her to a movie and then for a banana split at the Nighthawk. The memory of her laughter made him grin. He held on to it, knowing he’d be making no new memories of his daughter in the foreseeable future. Maybe someday if he got lucky and she grew up forgiving. He thought about ditching the hack and catching the flight to Seattle after all. It was a pleasant fantasy as far as it went, but he couldn’t keep the reality of his situation at bay long enough to take it seriously. With a sigh, Gibson opened his laptop and got to work.
He’d built a virtual machine on the laptop, nesting it on a Windows platform. A tool for maximizing resources on servers, multiple “virtual” machines could be run on one physical computer while keeping the data and functions completely isolated from one another. Each virtual computer had its own resources and existed completely independent of the others. There weren’t many reasons to run a virtual computer on a laptop, but hacking an airport qualified. Although it took time to build, Gibson could erase all evidence of its existence in about forty seconds. If he drew unwanted attention, he could delete his virtual machine, and even if airport police seized his laptop, they would still not have the computer that had hacked them.
There were any number of programs for hacking Wi-Fi passwords, and all had plusses and minuses. Gibson preferred Aircrack-ng. The program tracked traffic to and from a router, gradually building the password from packet data. While it worked, he toggled over to the parent operating system and opened his résumé on the off chance anyone glanced over his shoulder. He sipped his coffee and waited; this was the easy part. Thirty minutes later, he logged into the Metropolitan Washington Airports Authority Wi-Fi. He was now inside their network.
To a point.
A network was a bit like a gated community, and the password only let him in the main gate. Inside were the servers, laptops, cell phones, and miscellaneous devices, each one a private residence—or network segment—that required the correct credentials. Gibson’s virtual computer was uncredentialed, so he found an airport employee’s computer connected to the airport Wi-Fi, attacked it, and borrowed its credentials to traverse the firewalls between network segments.
So far, so good.
Each network segment had a unique address, and his network mapper showed thousands of IP addresses connected to the MWAA network. Only the servers interested him, though, so he narrowed his search parameters. That left him with a couple hundred IP addresses to check. Still too many, but it was a start.
Security credentials would be stored in a database. SQL and Oracle were the industry standards. A quick search of the MWAA website careers page revealed that MWAA was currently hiring for a SQL database engineer. That narrowed it down. He used a port scanner called Nmap to hunt for servers that responded on 1433 and 1434, known SQL ports. This part took time because if he scanned hundreds of servers and their ports simultaneously, it would trigger alarms. Instead, he had to probe one server at a time, pausing between each. It took a few hours, but he narrowed the list to forty-six servers that responded on SQL ports.
After he missed his flight, he packed up and went to his gate. He told a tragic sob story about getting stuck in traffic on the way to the airport. Alaska Airlines ran only two daily flights to Seattle, and the second didn’t depart until almost seven p.m. The gate attendant regretfully informed him it was already full but dutifully added his name to the standby list. Gibson feigned dismay at the news, but it gave him a legitimate pretext to linger at the gate for the rest of the day. All the time he would need. Gibson found a seat near the counter that let him keep his back, and more importantly his laptop, to the window. Then he got back to the business of hacking the airport.
Thousands of IP addresses were now forty-six: time to sing for his supper. From the MWAA website, he knew that Access Control was a unified system supporting security cameras, credentials, and badge readers. Those were both mission-critical systems, so MWAA would operate them as a cluster, ensuring redundancy should any one server fail.
A program called Wireshark sniffed packet traffic to the forty-six servers, hunting for data from the badge readers. Gibson waited patiently, at home in a familiar world in which he felt comfortable and capable. He’d never fit the antisocial hacker stereotype, but for the first time he felt the relief that the binary world offered to someone overwhelmed by people.