"But what about passwords?" Deborah questioned. Whenever she used the computer in the lab, she had to enter her password, which only she knew. "Don't those keep people out?"
"Yes and no," David said. "That's supposed to be the idea, but it doesn't always work like it should. A lot of network managers are lazy and they never change the manufacturer default passwords, so that narrows down what has to be tried. Also with a www. server there's no limit to how many attempts you can make, so we can try a brute-force password-guessing program like the one I brought with me."
Deborah rolled her eyes for Joanna's benefit. "It's actually a lot of fun," David said, sensing Deborah's doubt. "It's like an intellectual arcade game."
"I can't imagine it's too much fun for the people being hacked," Joanna said.
"It's usually pretty innocuous," David said. "Most hackers I know aren't malicious. It's like an ongoing competition between them and the people designing the security. Or they're just doing someone a favor like me with you guys. You're not interested in doing anything other than getting the information that it seems to me you're entitled to."
"It would have been a lot easier if the clinic saw it that way," Joanna said.
All at once David stopped typing. He stroked his beard thoughtfully. "Well, I have to give credit where credit is due. Seems like a pretty tight site. Certainly no glaring holes. In fact it seems to me to be fairly sophisticated. They've got an authentication server. Does this organization have a lot of bucks to throw around?" "That would be my guess," Joanna said.
"I'm getting the feeling we're up against some pretty good security here," David said, "which means we'll have to get more sophisticated ourselves."
"What is it exactly that you would like to be able to do?" Deborah asked.
"I'd like the web server to recognize and authenticate us," David said. "Then we'd have the run of all their files. What I'm going to try now is to fill up the buffer on their new patient form and see if I can throw in some assembly-level commands in the space after the buffer to Bypass the authentication. It's like riding in through the CGI on the patient-form coattails."
"Could you tell me that in English?" Deborah said.
David looked up to Deborah's face. She was watching over his left shoulder. "I was actually simplifying the process when I just described it."
"Fine1." Deborah said, pretending to be irritated. "If that's the case, then I'll take myself over to the couch and lie down. I'll let you two computer wizards attend to business."
David looked up at Joanna over his other shoulder. "I want to make sure you understand that if I do this, and it works, there will be an electronic trail through your Internet service provider to this machine. If the hack is picked up, they could come after you. Are you okay with that?"
Joanna mulled the question for a moment. She knew what they were doing was technically breaking the law, yet the information was important to her, even necessary for her peace of mind in view of the changes in her life. And what were the chances such an intrusion would be noticed if all they did was trace their own eggs? She thought the chances seemed small indeed.
"What do you think, Deborah?" Joanna asked.
"I'm willing to leave it up to you," Deborah said. "I'm curious, obviously, but not as curious as you."
"Then let's do it," Joanna said.
"Right on, baby1." David said gleefully as he rubbed his hands together in anticipation of the challenge. He cracked a few of his knuckles before bending to the task. Again his fingers flew over the keyboard. The sound was like a continuous clatter rather than individual strokes. Images flashed on the screen in rapid succession.
After more than thirty minutes of intense concentration, David halted. He took an exasperated deep breath while flexing his fingers in the air.
"It's not working, is it?" Joanna said.
"I'm afraid not," David said. "This is no Mickey Mouse setup that I can assure you."
"What do you propose?"
David looked down at his watch. "This might be a long process. It's a more secure site than I would have imagined, and it's not letting me sneak in any commands whatsoever. I thought we were dealing with a Windows NT environment but it now looks like a Windows 2000 with Kerberos."
"Is Kerberos the authentication method developed at M.I.T.?" Joanna asked.
"You got it," David said.
"So what's your bottom line suggestion as the easiest way to get the information we want?"
David laughed. "Let me stay here for a week, and I'll try to bust in with stuff like the LophtCrack utility. Other than that, I'd suggest you find someone who works out there at the Wingate Clinic, who has access, and who would be sympathetic to your cause."
"Those are the only two choices?"
"No, there's something else. Get yourself or me into the server room." David laughed again. "Actually, that's the most efficient, foolproof way. Hell, it would probably only take less than ten minutes to create your own pathway. Then it would be a piece of cake, either from a workstation inside the network or even from offsite if you did it right."
Joanna nodded while her mind pondered the choices. She felt progressively committed, as if the more she hit up against barriers, the more she wanted to succeed, especially since she could picture a little girl somewhere nearby who looked like the photos she had of herself as an infant.
David glanced down at his watch, then back up at Joanna. "It's after ten. You want me to keep going here or what? I'm cool with it if you do, but like I said, I can't promise anything other than I'm sure I can crack this site eventually. I just don't know how long it will take."
"You've done enough," Joanna said. "Thank you." She stared off vacantly deep in thought.
David noticed the faraway look in her green, unblinking eyes. He waited for several beats, then stuck his hand up in her line of sight and waved it back and forth. "Are you with me, girl?"
Joanna shook her head as if waking from a trance and smiled. "Sorry," she said. "I was just wondering about what you said concerning getting into the server room. How hard would that be once you were in the building?"
"It all depends," David said. "Obviously if they care about security, it's not like you can just walk in anytime you want."
"But it is physically a room," Joanna said. "It's not just computer jargon about something that exists in cyberspace."
"It's a real room all right," David said. "And it's got real hardware inside, which includes a keyboard and a monitor to access the central processor."
"How would you envision the room to be secured?"
"A locked door," David said. "All the ones I've seen have had a card swipe access. You know: like a credit card."
"Interesting," Joanna said. "If I were to get in there, what exactly would I do?"
"That's the easy part," David said. "You have some paper handy?"
Joanna pulled open one of the desk drawers and got out a fresh yellow legal pad. She handed it to David who proceeded to outline the steps that needed to be done. Joanna watched with full attention. At several points she asked for clarification, which David was happy to provide.
"And that's it," David said. He ripped off the page and handed it up to Joanna. She glanced over it again. Satisfied she had no further questions, she folded it and slipped it into her pocket.
"Thank you ever so much for coming over," Joanna said.
"Hey, my pleasure,' David said. He scraped back the chair and stood up. "Any time for a former classmate."
"By the way how's your Ph.D. thesis coming along?" Joanna asked.
"Now you're starting to sound like my mother," David said with a laugh. He gathered his floppy discs into a neat pile. "Unfortunately I'm running into a little writer's block along about the second chapter. How's yours?"
"Very well," Joanna said. "It's done."
"Done!" David squeaked before blowing out a lungful of air through pursed lips. He visibly sagged. "What a way to cut a friend off at the knees."