Anthrax considered how to clean up his footsteps and secure his position. While he was hardly broadcasting his presence, someone might discover his arrival simply by looking at who was logged in on the list of accounts in the password file. He had given his backdoor root account a bland name, but he could reasonably assume that these three users knew their system pretty well. And with only three users, it was probably the kind of system that had lots of babysitting. After all that effort, Anthrax needed a watchful nanny like a hole in the head. He worked at moving into the shadows.
He removed himself from the WTMP and UTMP files, which listed who had been on-line and who was still logged in. Anthrax wasn't invisible, but an admin would have to look closely at the system's network connections and list of processes to find him. Next stop: the login program.
Anthrax couldn't use his newly created front-door account for an extended period—the risk of discovery was too great. If he accessed the computer repeatedly in this manner, a prying admin might eventually find him and delete his account. An extra account on a system with only three users was a dead give-away. And losing access to System X just as things were getting interesting was not on his agenda.
Anthrax leaned back in his chair and stretched his shoulders. His hacking room was an old cloakroom, though it was barely recognisable as such. It looked more like a closet—a very messy closet. The whole room was ankle-deep in scrap papers, most of them with lists of numbers on the back and front. Occasionally, Anthrax scooped up all the papers and piled them into heavy-duty garbage bags, three of which could just fit inside the room at any one time. Anthrax always knew roughly where he had `filed' a particular set of notes. When he needed it, he tipped the bag onto the floor, searched through the mound and returned to the computer. When the sea of paper reached a critical mass, he jammed everything back into the garbage bag again.
The computer—an Amiga 500 box with a cheap Panasonic TV as the monitor—sat on a small desk next to his mother's sewing machine cabinet. The small bookcase under the desk was stuffed with magazines like Compute and Australian Communications, along with a few Commodore, Amiga and Unix reference manuals. There was just enough space for Anthrax's old stereo and his short-wave radio. When he wasn't listening to his favourite show, a hacking program broadcast from a pirate station in Ecuador, he tuned into Radio Moscow or the BBC's World Service.
Anthrax considered what to do with System X. This system had aroused his curiosity and he intended to visit it frequently.
It was time to work on the login patch. The patch replaced the system's normal login program and had a special feature: a master password. The password was like a diplomatic passport. It would let him do anything, go anywhere. He could login as any user using the master password. Further, when he logged in with the master password, he wouldn't show up on any log files—leaving no trail. But the beauty of the login patch was that, in every other way, it ran as the normal login program. The regular computer users—all three of them—could login as usual with their passwords and would never know Anthrax had been in the system.
He thought about ways of setting up his login patch. Installing a patch on System X wasn't like mending a pair of jeans. He couldn't just slap on a swath from an old bandanna and quick-stitch it in with a thread of any colour. It was more like mending an expensive cashmere coat. The fabric needed to be a perfect match in colour and texture. And because the patch required high-quality invisible mending, the size also needed to be just right.
Every file in a computer system has three dates: the date it was created, the date it was last modified and the date it was last accessed. The problem was that the login patch needed to have the same creation and modification dates as the original login program so that it would not raise suspicions. It wasn't hard to get the dates but it was difficult to paste them onto the patch. The last access date wasn't important as it changed whenever the program was run anyway—whenever a user of the System X logged in.
If Anthrax ripped out the original login program and stitched his patch in its place, the patch would be stamped with a new creation date. He knew there was no way to change a creation date short of changing the clock for the whole system—something which would cause problems elsewhere in System X.