“Not much would surprise me this evening,” said Giles, craning his neck to stare up at the towering glass edifice.
“I think I’ve got him,” Steve shouted in the chatroom. “Location’s in Rotherhithe, hang on… I can get you within a hundred metres, but you’re on your own from there. Stand by, I’ll ping you the location.”
“Steve’s found Bowman,” Bridge said to Giles. “He’s just east, in Rotherhithe.”
Giles copied the location from her screen, then leaned close to the bluetooth mic and said, “Well done, Steve. We’re on our way.” He turned to Andrea’s driver, who had remained ready in the driver’s seat. “Mind if I commandeer you?”
“My pleasure, sir.”
“Bridge, stay here and keep on those drones,” said Giles. “I’ll try to cut him off at source with an AR squad. Get the copper to find you a table,” and he slid into the back seat. Bridge lifted the HP off the car roof as it sped away with Giles inside.
The sergeant approached Bridge. “Tea’s brewing in the van, ma’am. Is he…?”
“Changed his mind,” said Bridge. “Now, can you find me somewhere to put this bloody computer down?” The sergeant led her to his car, fitted with a driver’s laptop stand over the gearshift median. He disconnected his own computer and tossed it on the empty passenger seat, then beckoned for Bridge to climb inside. As she swung the stand towards her and sat the HP on it, a constable appeared carrying two polystyrene cups of tea.
The sergeant took them, handing Bridge her cup and keeping the one intended for Giles. “Have a feeling I might need this.”
“Hold that thought,” said Bridge, as a background window on the screen lit up. “MaXrIoT’s locked on the signal,” she said to the chatroom. “Here we go.”
She punched Execute.
The ‘IoT’ in MaXrIoT stood for ‘Internet of Things’, the world of so-called ‘smart devices’ that had become so pervasive. Smart door locks, smart thermostats, smart kettles, smart TVs, smart dog bowls, you name it. The majority of these devices had security so laughable, it might as well not be there — passwords like 123456 that, once entered, put the device into ‘engineer mode’ where it could be made to do almost anything. And not all were housebound, domestic devices. Small business CCTV setups, car entertainment systems, even smart pedometers were the same. On many of these devices the password was permanently hardcoded into the firmware. Still others had literally no security at all, not even a simple password. If you knew where to look online there were archives listing default passwords and entry methods of entire product categories, just waiting to be hacked. Or you could download a ‘black hat’ package like MaXrIoT that did all the hard work for you. Point it at an online target destination, and the app would use that password archive to automatically hack as many smart devices as it could find around the world, making them part of an enormous ‘botnet’ that could be turned against the target.
Many people didn’t understand this as a real threat. What good was hacking a smart TV, anyway? What damage could it do? But it wasn’t the smart devices’ own capabilities that programs like MaXrIoT were interested in. It was their internet connections. Every smart device had a connection to the online world, which meant every one of them could be made to send a request to any other internet-connected device via its Internet Protocol address, or IP. A single request, for a webpage or network ping, might not seem like much. But when millions of devices all sent simultaneous requests, and continued sending them at the rate of a thousand every second, the traffic could overwhelm the target’s bandwidth and knock out huge data centres in what was called a Distributed Denial of Service attack, or DDoS.
But while programs like MaXrIoT existed for one sole purpose — to conduct DDoS attacks — and governments around the world had been trying to figure out a way to outlaw them for years, strictly speaking they remained legal. Not that the hackers who used them cared either way. These packages were developed and distributed underground, found only in the dark, secret, unlinked places of the internet, destinations only the best (or best-funded) hackers knew existed. There was a hunger for DDoS resources, and if one was somehow eliminated, ten more would take its place within hours.
Steve Wicker had been right. Trying to trace the wifi signal back to Bowman’s location would be difficult, and take time they didn’t have. Bridge could tell from the traffic that he was anonymising his origin, bouncing between servers around the world, and satellites above it, to obfuscate his IP address. But Bridge wasn’t trying to attack Bowman. She was attacking the drones.
Because the drones weren’t anonymised. Their IPs were child’s play to isolate. And once they were in its sights, MaXrIoT threw everything it had at them.
Bridge watched the counter rise as the package travelled the globe, recruiting smart devices to its botnet; from zero to a hundred in five seconds, then three hundred, seven hundred, a thousand, five thousand, and up and up it went. The DDoS immediately began filling the drone signal traffic with garbage, a torrent of meaningless requests and pings. Bridge exhaled slowly, trying to relax. It was going to work. Everything would be fine.
A couple of hundred metres above her, windows shattered as a bomb exploded.
82
The first explosion blasted glass into Andrea’s back and left her deaf in one ear.
She’d just arrived at the party. Her officers, along with the members of Special Branch in attendance, had done as they were told and begun moving people away from the windows without causing a fuss. But some of the partygoers were stubborn, demanding to know why the police were getting uppity and insisting they be told what was going on before they would move.
Andrea was arguing with one
