It had to be significant. If there had been any previous versions, Hilzoy had accepted all the changes, effectively erasing them all. Except for these numbers. He wanted a record of these. But a hidden record, apparently. That couldn't be an accident. It had to mean something.
All right, what if he just performed the functions in the order of the hidden numbers? Worth a try.
He followed the steps, one through ten, then hit enter.
Nothing happened.
Damn. He'd really been hoping there.
He scrolled up to the menu bar again, checking each function. File, nothing new. Edit, same. Tools…
He blinked and leaned forward. The Tools menu had three new entries: Creation. Concealment. Delivery.
“Holy crap,” he said aloud. “This is it. It has to be.”
Hilzoy had built an Easter egg into Obsidian. And not the usual, just-for-laughs version you could find in so many DVDs and so much commercial software. No, this looked like a whole new application for the technology.
But an application for what?
His heart pounding, he started working the keyboard. He got so immersed, he lost track of time, and didn't even remember where he was until light started creeping into the sky outside his window. What he found was electrifying.
At six-thirty, he showered and got dressed. He put the gun Ben had given him in his pocket, acutely aware of its weight and bulk. He couldn't imagine what it would be like to carry a gun-make that two guns-all the time.
He went across to the other room to tell Ben. The tough guy had walked out last night when things had gotten heated, but whatever. Alex wasn't sorry for what he'd said. Part of him wished he'd said more. Maybe that was the problem. Ben was obtuse. You couldn't expect him to understand something, especially something he didn't want to understand, unless you beat him over the head with it.
He tried his key card, but it didn't work. Shit, Ben must have engaged the privacy lock. He might still be sleeping. But the hell with it, this was worth waking him for.
Alex knocked, then waited. No answer. He knocked again, louder. After a minute, he heard Ben's voice.
“Give me a second. Gotta put some clothes on.”
Half a minute went by, then Ben opened the door, wearing only a towel. He said, “You're up early.”
“I did it,” Alex said, walking in past him. “I cracked it. I know what Obsidian is really about.”
Ben closed and locked the door behind him. “Hold on,” he said. “I need to hit the head.”
He disappeared into the bathroom for a minute. Alex looked around the room. One of the beds had the covers pulled off it. There was a pile of clothes on the floor. Looked like the jacket and shirt Ben had been wearing the night before.
Ben came out wearing one of the hotel's robes. He sat down on one of the beds. “Tell me,” he said.
“We have to get Sarah. She needs to hear this, too.”
“She's probably sleeping, don't you think?”
Alex was a little surprised by Ben's solicitude. Yesterday he wouldn't even let Sarah stop to use the bathroom. Now he was concerned about not waking her?
“She'll want to hear this, trust me,” Alex said. He walked over to the common door and opened it, then knocked on the door on the other side. “Sarah, it's Alex. Are you up? I found what we were looking for.”
“I'll be right there,” he heard from the other side of the door. A minute later, she came in, wearing a hotel robe. Her hair was tied back, she wasn't wearing any makeup, she was rubbing sleep from her eyes… and she was still beautiful.
It was funny that she and Ben were both in the robes. “Am I the only one who was getting anything done last night?” Alex asked. He meant the comment to be funny, but neither of them laughed, or even said anything. In fact, they seemed almost awkward. Well, he had just woken them both up.
“What is it?” Sarah said, leaning against the wall next to the door.
“I found an Easter egg,” Alex said. “In Obsidian.”
“Easter egg?” Ben said.
Alex nodded. “A hidden feature set. Something the programmer builds into the application but doesn't document, that's only accessible via a weird sequence of commands. Hilzoy built one into Obsidian. He documented the sequence in his notes, and hid the documentation so that it was only visible if you checked the current set of notes against a previous version.”
“You're losing me,” Ben said. “What are the secret functions? And why document them if they're supposed to be secret?”
“The sequence was complicated. It had to be, otherwise someone might have stumbled onto it by accident. Hilzoy was afraid he would forget it. So he included it in the notes in a kind of invisible ink.”
“He wasn't worried someone would find it?”
“Of course not. No one else had the notes, they were just part of a backup copy of the program he kept with his lawyer, and why would his lawyer bother reading his programming notes? And even if I, or someone else, did read them, why would anyone think to look for earlier versions? And even if you did look for an earlier version, the clues he left wouldn't mean anything to you. You'd have to already know something was hidden, and be racking your brains trying to find out what it was, as Sarah and I were. And even then, you could easily miss it.”
“Well, what is it?” Ben said.
Alex wondered why Sarah was being so quiet. Ordinarily, she got impatient with other people's explanations and was quick to add her own.
“The whole thing is a Trojan horse,” Alex said. “On the surface, it's an excellent, efficient program for encrypting data. What it's really ideal for, though, is encrypting a virus.”
“Cryptovirology,” Sarah said, looking at him.
Alex nodded, pleased that she understood right away. “Exactly. Malicious cryptography.”
“Sorry, guys,” Ben said, “you're getting a little ahead of me here.”
“Okay,” Alex said. “You know what a computer virus is, right?”
“Sure. A piece of code that someone sneaks into a system to mess things up.”
“Yeah, pretty much. Now, there are typically two ways viruses get detected and blocked-signatures and heuristics. Signatures basically means the antivirus software has a list of known viruses with instructions to block or isolate them. It's like the name of a suspected terrorist. It goes on a no-fly list, and if the name comes up, the guy can't get on the plane. It's the name you're keying on, or in the case of viruses, a kind of digital fingerprint.”
“Okay…”
“The second method is heuristics. Here, the virus is unknown, and you try to spot it by analyzing typical virus behaviors. To stay with the airplane analogy, this would be like passenger profiling. The guy's name doesn't trigger any alarms, but is he doing things we associate with terrorist behavior. If so, he can't get on the plane.”
“Okay, I get it.”
“So the biggest problem for the virus writer is avoiding detection. If it's a new virus, you don't have to worry about its signature being detected, only viruslike behaviors. But if you eliminate all the viruslike behaviors, you're left with something that's no longer functional as a virus. Undetectable, maybe, but also useless.”
“So we're talking about concealment,” Ben said.
“Exactly. That's where the encryption comes in. You use the encryption to create a polymorphic virus.”
Ben raised his eyebrows, and Alex realized he didn't understand. He paused for a minute, trying to think of a way to explain.
“‘Polymorphic’ means constantly changing,” Sarah said. “We're talking about code that mutates while keeping the original algorithm intact. Which is, generally speaking, how encryption works. If you encrypt the virus, the viruslike behavior is hidden beneath a constantly shifting cloak. Antivirus software doesn't know what to look for.”
“Why hasn't anyone done this before?” Ben said.
“They have,” Alex said. “A Bulgarian virus writer who went by the name Dark Avenger created a polymorphic engine years ago. And a couple of guys-Adam Young and Moti Yung-wrote a whole book on it. But there's always been a built-in limitation.”