system, but on the other hand we didn’t have to depend on the network being up,’
McMahon said. ‘We needed to have some chain of communications which was not the same as the network being attacked.’
A number of the NASA SPAN team members had developed contacts within different parts of DEC through the company’s users’ society, DECUS.
These contacts were to prove very helpful. It was easy to get lost in the bureaucracy of DEC, which employed more than 125000 people, posted a billion-dollar profit and declared revenues in excess of $12 billion in 1989.10 Such an enormous and prestigious company would not want to face a crisis such as the WANK worm, particularly in such a publicly visible organisation like NASA. Whether or not the worm’s successful expedition could be blamed on DEC’s software was a moot point. Such a crisis was, well, undesirable. It just didn’t look good.
And it mightn’t look so good either if DEC just jumped into the fray.
It might look like the company was in some way at fault.
Things were different, however, if someone already had a relationship with a technical expert inside the company. It wasn’t like NASA manager cold-calling a DEC guy who sold a million dollars worth of machines to someone else in the agency six months ago. It was the NASA guy calling the DEC guy he sat next to at the conference last month.
It was a colleague the NASA manager chatted with now and again.
John McMahon’s analysis suggested there were three versions of the WANK
worm. These versions, isolated from worm samples collected from the network, were very similar, but each contained a few subtle differences. In McMahon’s view, these differences could not be explained by the way the worm recreated itself at each site in order to spread. But why would the creator of the worm release different versions? Why not just write one version properly and fire it off? The worm wasn’t just one incoming missile; it was a frenzied attack. It was coming from all directions, at all sorts of different levels within NASA’s computers.
McMahon guessed that the worm’s designer had released the different versions at slightly different times. Maybe the creator released the worm, and then discovered a bug. He fiddled with the worm a bit to correct the problem and then released it again. Maybe he didn’t like the way he had fixed the bug the first time, so he changed it a little more and released it a third time.
In northern California, Kevin Oberman came to a different conclusion.
He believed there was in fact only one real version of the worm spiralling through HEPNET and SPAN. The small variations in the different copies he dissected seemed to stem from the worm’s ability to learn and change as it moved from computer to computer.
McMahon and Oberman weren’t the only detectives trying to decipher the various manifestations of the worm. DEC was also examining the worm, and with good reason. The WANK worm had invaded the corporation’s own network. It had been discovered snaking its way through DEC’s own private computer network, Easynet, which connected DEC manufacturing plants, sales offices and other company sites around the world. DEC
was circumspect about discussing the matter publicly, but the Easynet version of the WANK worm was definitely distinct. It had a strange line of code in it, a line missing from any other versions. The worm was under instructions to invade as many sites as it could, with one exception. Under no circumstances was it to attack computers inside DEC’s area 48. The NASA team mulled over this information. One of them looked up area 48. It was New Zealand.
New Zealand?
The NASA team were left scratching their heads. This attack was getting stranger by the minute. Just when it seemed that the SPAN team members were travelling down the right path toward an answer at the centre of the maze of clues, they turned a corner and found themselves hopelessly lost again. Then