📸 Photo

KINGPIN

avatar from a virtual world, painting her fingernails like Skittles—each a different color—and wearing contact lenses that tinted her eyes an impossible emerald. Money was tight for both of them: Charity worked as a system administrator for a porn website in Nevada, earning Silver State wages that were stretched thin in San Francisco. Max was nearly broke.

One of Max’s former clients in Silicon Valley tried to help by giving Max a $5,000 contract to perform a penetration test on the company’s network. The company liked Max and didn’t really care if he produced a report, but the hacker took the gig seriously. He bashed at the company’s firewalls for months, expecting one of the easy victories to which he’d grown accustomed as a white hat. But he was in for a surprise. The state of corporate security had improved while he was in the joint. He couldn’t make a dent in the network of his only client. His 100 percent success record was cracking.

“I’ve never failed to get into a system before,” Max told Charity in disbelief.

“Sweetie, you haven’t touched a computer for years,” she said. “It’ll take you a little while. Don’t feel like you have to get in today.”

Max pushed harder, only becoming more frustrated over his powerlessness. Finally, he tried something new. Instead of looking for vulnerabilities in the company’s hardened servers, he targeted some of the employees individually.

These “client side” attacks are what most people experience of hackers—a spam e-mail arrives in your in-box, with a link to what purports to be an electronic greeting card or a funny picture. The download is actually an executable program, and if you ignore the warning message on your Windows machine and install the software, your computer is no longer your own.

In 2003 the dirty secret of these attacks was that even savvy users who knew better than to install foreign software could be broadsided. “Browser bloat” was largely to blame. In the nineties a fierce battle with Netscape for control of the browser market had driven Microsoft to stuff Internet