116 Under attack (1)

That Wednesday morning, Sarah was ready to start working on hacking into a server of a multi-billion company in Malaysia which is tied to illegal smuggling of precious gems. Her goal is to find information related to this illegal activity.

She texted Aiden. "Double checking: You are available next two hours, right?"

"Yes", he confirmed.

Sarah looked at his reply and smiled. It warmed her heart knowing that she has his support.

Sarah stretched her fingers and second later they started flying over the keyboard.

This company had information in dozens of data centers across the globe. All data centers were similar in size and configuration, so her first task is to find where to look for the data. Once she got initial data from company servers hosted locally in their HQ, she was able to exclude number of data centers from options, but she was still left with nine data centers as good candidates. With nothing else to go with, she picked one and started getting through defenses. After about ten minutes, she was in... data was not there. She erased her traces from that data center and started looking into next one, and next one, and next one. Two hours almost passed, and she still didn't find the right data center.

She got a text from Aiden, "I have a meeting in 5 minutes. What is your status? Do you want me to cancel the meeting?"

Sarah thought for a second before responding. "I still need more time. Go to your meeting. All is good here." She thought that if after two hours nothing happened, nothing will happen. And she is almost done. Only two more data centers are left as options for where data is.

She continued getting into 8th data center. After superficial file searching, she found some of the data. 'At least it is not the last one', she thought.

She started comprehensive file search. Then she accessed databases and started searching for data there as well. Any relevant data was copied from the data center by her. Sarah estimated that within three minutes she will get all relevant files and then only thing left is for her to erase her traces. She looked at the progress... two minutes left... Laptop on her right had monitoring tools running. It started flashing with a warning that fifth server she used for bouncing signal is being attacked.

Sarah checked and noticed that scripts which were supposed to mask server address are not working. Also, scripts that are sending fake traffic are not working. Sarah frowned. 'With all these off, it will take them about a minute to get in and attack next server.'

She wanted to call Aiden but remembered that he went for a meeting. Even if she calls him, by the time he comes to his office it will be too late. She is running out of time. Options: continue file copy and risk being traced back, or abort. She analyzed her situation, 'If they take one minute for this server, I have four more lined up for bouncing signals. And scripts are working on those servers. With less than two minutes needed for file copy, I don't need to stress about being found.'

Sarah took her earpiece and called Eve. "Eve, you are receiving server address. Copy all logs from this server. On the D drive there is folder called scripts, copy that folder with its contents, and prepare to kill the server when I tell you."

She decided to proceed and get Eve to kill the compromised server as soon as Sarah is done with copying.

To Sarah's surprise, whoever traced her back breached through in about twenty seconds instead of one minute how much she estimated. 'It looks like he knows how to get in', Sarah thought. There is no other explanation for someone to breach their security so quickly. Sarah felt a sense of urgency. She has much less time than what she thought.

"Eve trace from where the attack is coming.", Sarah told Eve.

Notification was shown on the laptop: fourth server is under attack.

"Master, scripts folder exists, but it's empty. There is nothing to copy."

Sarah frowned, 'Is it possible that they get erased?'

The same scripts failed executing at that moment on fourth server.

Sarah quickly sent address of the third server to Eve, "Eve, do additional password encryption on this server. Then set up another firewall. Here, find scripts folder and copy it over." Additional security on third server will give her more time to finish copying. At the same time, it will give her a chance to see if they are progressing through server defenses so fast because other side is good, or because they have inside information. She hopes that whatever is happening with scripts is the same on all servers, and scripts get deleted only after the breach. By going for data from third server, she will have something to investigate. And it needs to be done now. They have process that when Sarah selects which servers to use for bouncing her signal, at that time scripts are copied to those servers, as well as tools and process get initiated. When she is done with her work and stops using servers for bouncing, all that gets wiped out. So, if she wants logs and scripts, it needs to be done now.

At the same time, if they get into server three, she will stop copying and turn off second one. She can't risk letting them get closer, no matter how close she is to finish her task.

Copying was almost done... 30 seconds left...

Sarah's office phone ringed. She answered on speaker. It was Daniel. "Do you see they are two servers in? You need to abort."

"I can do this.", she responded.

"Every time server is exposed, we are pulling it out of use for at least three months. It costs us a lot of money... and takes a lot of time and resources to create new server. You can't risk another exposure. Abort!", Daniel urged her.

Copy progress... 25 seconds left...

"Instead of wasting my time, why don't you investigate what is going on with our defense tools? How can they get in within twenty seconds? And why are scripts failing as soon as they touch our servers?!", Sarah hanged up. She didn't have time to argue with him.