The saga of Beat’s DAA continues.
You may want to go back to Beat’s part 5 here.
COPERNICUS ACCEPTED. KNOWLEDGE TARGET LINKING…..LINK ESTABLISHED AND ACTIVE BY DEFAULT. COPERNICUS IS ACTIVELY ENGAGED IN RUNNING PROCESSES AND CANNOT BE INTERRUPTED, ONLY OBSERVED. TO REVIEW RUNNING PROCESSES, ENTER PROC. FOR OTHER COMMANDS, ENTER MENU.
Beat entered PROC and reviewed the processes running on Copernicus. All the usual processes were running, none of them stood out. Most were for system maintenance, logging, and higher thinking correlation engines. He decided to poke around in the menus to see if there was more meat.
MENU:
- DISCONNECT FROM KT TARGET: COPERNICUS
- OBSERVE COPERNICUS
- OBSERVE DATA EXTRACTION PROGRESS
- OBSERVE CODE INJECTION PROCESS
- ABORT AND DISCONNECT
Beat honestly wasn’t much of a hacker but this sure looked like an attack toolkit. He tried item 2.
COPERNICUS OBSERVATION SELECTED….OBSERVATION VR MODE ENGAGED. PLEASE SWITCH TO VR FOR ENHANCED OBSERVATION
Once again Beat was going into VR. He wasn’t the biggest fan and frankly found it tedious when a terminal would suffice, but sometimes unique visual data presentations were best handled in VR. For example, a timeline of events where the user could drill down into event data to learn more. He was hoping this was the case.
As he placed the VR interface on his head, he heard a faint clicking in the background and saw Copernicus’ avatar again, the Greek statue bust wearing the garland. However, the statue seemed to be losing mass somehow. Something was removing parts of the model pixel by pixel, almost as if it were made of sand and being blown away slowly. Beat approached the model from the front; there was no reaction from the model. He truly was an observer and invisible to the AI. With a wave of his hand, he brought up an interaction panel with many choices. He listed the running processes again, hoping he had missed one the first time.
RUNNING PROCESSES IN COPERNICUS
Sqldb_helper
Proc
syslog
con_overlay
backup_dg
framedel
-MORE-
Beat had seen enough and wasn’t familiar with con_overlay. Everything else was old hat and appeared on any AI system. He sorted the list by how much processing power each process was using.
framedel
con_overlay
Sqldb_helper
Proc
syslog
con_overlay
backup_dg
Two little piggies led the pack with con_overlay confirming his suspicion. Now he wanted to learn what was using the most network bandwidth, so he sorted the list by concurrent connections and bandwidth.
backup_dg
con_overlay
Sqldb_helper
Proc
framedel
syslog
Pretty normal for the backup process to use a lot of bandwidth, if it was truly copying data from the AI to a backup. There could be exabytes of data moving across the fiber. However, there was the con_overlay again near the top of the list.
Beat waved his hand to activate the analysis menu. The analysis module helped with analyzing log data and seeing what the system had done in the past. He was presented with a horizontal timeline with dates above and below the timeline. The logs went back a decade, much to his surprise. Government systems were very strict, for legal reasons, about keeping a lot of log data. But a decade seemed excessive. Most data past 7 years was dumped to long term storage and removed from even government systems. But that log depth was only a hindrance because it extended the timeline. Otherwise, Beat didn’t mind that he had too much data to sift through. The forensic process was pretty fast as long as log data was there.
With a twist of one hand after grabbing a random timeline point for a date 3 months prior, the analysis tool displayed a list of options.
ANALYZE LOGS
FILTER LOG DATA
STANDARD REPORTING
He chose to analyze the logs and see what the system would give him next.
LOG ANALYSIS MODULE
PLEASE CHOOSE SYSTEM PROCESSES FOR ANALYSIS
Once again, he was presented with a list of processes. There were hundreds, so he had some filtering work performed, again using the CPU usage and network bandwidth consumption to narrow it down.
It wasn’t what he found, but what he didn’t find that was curious. No con_overlay process anywhere. He even asked Robert, verbally, to verify the existence of con_overlay data in the time frame. Robert confirmed immediately; it simply did not exist in the timeline date he chose. “However,” Robert stated, “the process log data for con_overlay is in the data pool beginning 72 hours ago.” Very helpful. Beat then instructed him to jump to the earliest appearance of con_overlay data, and the timeline advanced to 3 days before today.
Grabbing the timeline point gave him the analysis menu with one additional item.
ANALYZE LOGS
FILTER LOG DATA
STANDARD REPORTING
GAUGE EFFECTIVENESS
Gauge effectiveness? Of what? Seemed like an odd entry to add to this specific date. Naturally Beat chose that option. Suddenly the simulation darkened and a green neon grid stretching to the horizon filled his view, at waist level. 3D bars of different sizes rose vertically up out of the grid and each one could be selected. Two of them were sparking and seemed to be active, but this was supposed to be historical log data. The others varied in brightness, suggesting each entry’s age. Beat pulled the grid towards him so that the sparking bars were directly in front of him. He hovered his hand over the first bar to see the label revealed:
Con_overlay
The process had been alive for at least 3 days now and continued to fill the logs without interruption. Something was very, very busy. Most processes are a one-shot for maintenance that start, do their job, and stop, but this wasn’t one of those. This was live.
A better description was sometimes available by placing both hands cupped around the object, as if shading it from the light on both sides. This was no exception. As he performed this pantomime, the words “Con_overlay” dissolved and were replaced by “Connection Obfuscation Overlay v2.33”. The plot thickened. This process was probably designed to hide communication between the AI and something else. Back into analysis mode, Beat issued another question to Robert. “Robert, is this specific log file encrypted?”. Robert again replied immediately. “No. This appears to be plaintext and machine readable. Would you like me to tail the log and read it to you in real time?” “Of course, please do so”,
Beat said as he contained his enthusiasm.
Robert began rattling off time stamps and activities that the process had been performing, pausing each time a new entry hit the log. There were a ton of very long IPv6 addresses being read aloud along with connections established, new routes being added and old routes being removed, and frequent mentions of some system named DG. Beat asked Robert to rewind to the beginning of the log to get an idea of who or what started it. Robert went back to the initial timestamp of the log: 5/5/xx 13:01pm GMT and read aloud the first few lines.
LOGLINE DELETED
LOGROTATE DENIED
LOGLINE DELETED
BEGINNING PROCESS LOG
Someone had tried to cover their tracks when they initialized the process, but slipped up. The backup_dg process had been nearly as tall as the bar on the grid for con_overlay, meaning it was just as large and possibly the same age. Still, he had no idea how the data bars on the grid were gauging any kind of effectiveness or what that meant. Figuring Robert might know, he simply asked. Robert replied, “This seems to be a correlation engine that compares log streams with set expectations. Effectiveness has a criteria threshold set from 1-5 with 5 being absolutely successful and 1 being complete failure. If you’d like I can draw a trendline across aligned log sets to help”. And with that, more clarity was realized. The grid rearranged the data bars and there was a clear trendline going from zero to 5, over time. The level 5 data bars were positioned at the far right and two were still sparking. “con_overlay” and “backup_dg”. Robert asked Beat if the view was helpful or if he would like to request additional analysis. He seemed to be running code embedded specifically for this purpose. Beat requested additional analysis. The grid rotated up and the data bars became circles of differing sizes based on their size and age, laid out in a spider web. As expected, near the center were two logfiles. “con_overlay” and “backup_dg”.
Beat had almost found the smoking gun, he just had to push a little further to confirm all his suspicions at once. “Robert, are con_overlay and backup_dg the same age?” he queried. Robert replied in the affirmative. “Robert, who accessed this system 72 hours ago?”. Robert paused, then replied, “you did”.
The hair on the back of Beat’s neck stood up. This really rattled him because he believed his credentials were bulletproof and had never seen this happen to any ASE, ever. Someone was trying to make him a fall guy in case anyone took these same steps, which in the event of a disaster, forensics would definitely take these same steps to solve the puzzle. Well, most of them anyway.
“Holy fuck”, Beat said under his breath. He felt the floor drop out from under him as his stomach sank into a pit and his fight or flight reflexes started kicking in. He was truly panicked. Who would do this, why would they do it, and why did another AI lead him down this path? Did Cerberus know before he assisted Beat with gaining access? Would his current level of access throw a flag somewhere and send armed security to his location? But then he had an idea.
“Robert, identify me”. Robert answered, “you are Cerberus, AI CRB3, login ID *unknown*, last logon today at 16:22 GMT”.