Angels Flight

Inglert in particular, had gotten a lot of play in the media earlier that year when they bagged Brian Fielder, a hacker of international reputation who headed a crew of hackers known as the “Merry Pranksters.” Fielder’s exploits and Inglert’s chase of her quarry across the Internet had played in the paper for weeks and were now destined to be filmed by Holywood.
    “All right,” Rider said. “Well, they’re friends of mine from when I worked Fraud. I called them and they were happy to come in to work this because otherwise they’d have to put on uniforms and work twelve hours tonight.”
    “They came here?” Bosch asked.
    “No, their office at Parker. Where the real computers are. Anyway, we talked over the phone once they got there. I told them what we had – this web address that we knew was important but at the same time didn’t make any sense. I told them about going to Mistress Regina’s place and I think I pretty much creeped them out. Anyway, they told me there was a good chance that what we were looking for had nothing to do with Regina herself, just her web page. They said the page could have been hijacked and that we should be looking for a hidden hypertext link somewhere in the image.”
    Bosch raised his hands palms up but before he could say anything Rider kept going.
    “I know, I know, talk English. I will. I just wanted to take you step by step. Do either of you know anything at all about web pages? Am I making even any basic sense here?”
    “Nope,” said Bosch.
    “Nada,” said Edgar.
    “Okay, then I’ll try to keep this simple. We start with the Internet. The Internet is the so-called information superhighway, okay? Thousands and thousands of computer systems all connected by a Telnet system. It is worldwide. On that highway are millions of turnoffs, places to go. These are whole computer networks, web sites, so on and so forth.”
    She pointed to Mistress Regina on her computer screen.
    “This is an individual web page that is on a web site where there are many other pages. You see this on my computer here but its home, so to speak, is on the larger web site. And that web site resides in an actual, physical piece of equipment – a computer we call the web server. Do you follow me?”
    Bosch and Edgar nodded.
    “So far,” Bosch said. “I think.”
    “Good. Now the web server may have many, many web sites that it manages and maintains. See, if you wanted to have a Harry Bosch web page you would go to a web server and say put my page on one of your web sites. Do you have one that features morose detectives who never say much of anything to anybody?”
    That got a smile from Bosch.
    “That’s how it works. Often you have like-minded businesses or interests bundled on one site. That’s why when you look at this site it’s like Sodom and Gomorrah on the Internet. Because like-minded advertisers seek the same sites.”
    “Okay,” Bosch said.
    “The one thing the web server should provide is security. By that I mean security from anyone hacking in and compromising your page – altering it or crashing it. The problem is, there isn’t a whole lot of security out there on these web servers. And if someone can hack into a server they can then assume site-administrator capabilities for a web site and hijack any page on the site.”
    “What do you mean, hijack?” Edgar said.
    “They can go to a page on the site and use it as a front for their own intentions. Think of it as it is on my screen here. They can come up behind the image you see here and add all kinds of hidden doors and commands, whatever they want. They can then use the page as a gateway to anything they want.”
    “And that’s what they did with her page?” Bosch asked.
    “Exactly. I had O’Connor/O’Connor run a uniform resource locator. In effect they traced this page back to the web server. They checked it out. There are indeed some firewalls – security blocks – but the default passwords are still valid. They, in effect, render the firewalls invalid.”
    “You lost me,” Bosch said.
    “When a web server is first set up, there are default passwords necessary for first getting inside. In other words, standard log-on names and passwords. Guest/guest, for example. Or administrator/administrator. Once the server is up and running these should be eliminated to prevent compromise but quite often it is forgotten about and these become back doors, ways to sneak in. It was forgotten here. Lisa got in