Six Months of Lucky

The guard stopped it every morning. Nobody asked why it kept coming back.

Back in late March, something moved into a spare room.

It was careful about it. It made itself a folder with a name chosen to sound like part of Windows. It set two alarms, so it would be woken every morning when the computer started. One of them was dressed up as graphics software from NVIDIA.

Then it waited.

Every morning, about three minutes after the owner signed in, it got up and tried the door to the rest of the house.

And every morning, the guard on that door stopped it. Fourteen thousandths of a second, and it was back in its room.

For six months.

This was a computer at another business in Sydney, a busy office like thousands of others. The alert fired like clockwork. Blocked. Blocked. Blocked.

I know what you're thinking. Blocked is good news. The guard did its job, every time. So what's the problem?

You're right about the guard. It's the room.

How did it get in without the guard noticing? Because moving in isn't a crime. Windows lets programs ask to be started at sign-in, and plenty do. The guard judges what a thing does, not where it sleeps, and the first thing this one did was wait.

Stopping something isn't the same as showing it out.

A guard who turns away the same visitor every morning is doing what you pay a guard for. But the visitor never leaves. It gets another go tomorrow, and the day after that.

And it only needs the guard to miss one morning.

Guards miss mornings. The subscription renews on a card that expired in June, and the renewal email went to spam. The price goes up, so you let it lapse, because Windows has something built in anyway. A new laptop arrives, everything gets copied across, spare room included, and the antivirus can go on tomorrow, once you've found the login details. Someone turns the protection off for twenty minutes to install a printer and forgets.

None of those is a disaster. They're Tuesdays. And on any one of them, the thing in the spare room gets up at the usual time, finds the door open, and does the one job it was built for.

Six months of "blocked" isn't six months of safe. It's six months of lucky, with the same bet placed every morning.

So this week, WISECLICK started looking. Not at what had been stopped, but at why it kept coming back.

Every box in that room had another box inside it.

The first was a small instruction file, the kind that tells Windows to start something. It had been scrambled on purpose: hundreds of lines of pointless sums and dead ends, so anyone glancing at it would give up. Strip the nonsense away and it had one job. Open the second box.

The second box was a text file that wasn't really text. Unwrapped, it held a program. Unwrapped again, a compressed program. Then a compiled one. Then a box with three locks on it, each a different kind of encryption, with the key tucked inside the box itself.

In the last box was a tiny program with one purpose: take a block of raw machine code and run it straight from memory, without ever writing it to disk, which is where a scanner looks first. Packed alongside it were the tools for one more job, reading the passwords people save in their web browsers.

Nobody builds four locked boxes around something they're proud of.

If you've ever wondered what the difference is between "source code" and "binary", that room was the lesson. The scrambled file was source code: words a person can read, with patience. The last block was binary: nothing but numbers, meant only for the processor. Each box down was harder for a person to read. That's exactly why it was packed that way.

Here's the honest part. Because the guard stopped it in fourteen thousandths of a second every morning, it almost certainly never got past the door. Not once in six months.

We didn't rely on that. We emptied the room, switched off both alarms, reset the password and set up two-step sign-in from scratch.

The next morning, nobody tried the door.

This isn't a rare story. Most protection, free or expensive, is built to stop things at the door. That's the hard part, and good protection does it well. What it usually isn't built to do is ask why the same thing keeps turning up.

Stopping it is the job. Asking why it keeps coming back is the service.

Here's something worth doing tonight, member or not. Open your antivirus and find the list of things it has blocked. Then look for one thing: the same name, more than once.

One block is a door holding. The same block every day is a room that needs opening.

If you find one, that's not a failing. It's how those tools are built. Getting it out properly is where it stops being a five-minute job.

That's what a membership is. A guard on every computer that doesn't lapse and doesn't wait for the login details. Your files copied every night, locked as they're written. And a small team in Australia who look into anything that keeps coming back, with a real person to talk to when it matters.

After tonight's five minutes, you'll know whether anyone is living in your spare room.

And if they are, they won't be for long.

From $59 a month, about $2 a day, cancel any time. Already a member? Search WISECLICK in either store and sign in with your membership email.

Join from $59 a month

Stay protected, my friends.

The Most Secure Man Alive