Everybody Wants the Cake. They Scanned Her 47,000 Times to Get It.
Dearest reader, I have been doing this long enough to know what it looks like when Paul explains something correctly without understanding what he just said.
Paul walked into the farmer's kitchen on a Tuesday with the analogy already loaded. He had practiced it in the truck. The farmer had called because her computers were slow, her printer was slow, and her IT person had told her to reboot the router, which is the entire extent of what most IT people in this county know how to say. She and her friend were baking. Flour on the counter, two mixing bowls, a cake taking shape between them. Paul set up his explanation like he was laying out ingredients, because the room gave him the metaphor and Paul has never once declined a metaphor the room handed him.
"Imagine your cake is behind glass," he said. "The attackers want the cake. The glass protects it. So they do not throw a rock. They use light. They send something that looks like Netflix, like Spotify, like Pandora. The glass lets light through, because that is what glass is for. Inside that light they have hidden a payload. Your router sees Netflix. Your firewall sees Netflix. It waves the light through. The payload lands on the cake and unwraps itself. That is how they get in."
The farmer understood. I watched her understand. It is a good analogy. I will say that plainly because Paul does not hear it enough and then becomes insufferable when he does, so I ration it.
Then the friend, the baker, the one who had not said a word, pointed at the shelf and asked: "What about that Sonos speaker? Can it hear us? Can it send what we say somewhere?"
And Paul said, "Yes. If it is in voice mode, it is listening, and it is transmitting."
He said it the way you confirm the weather. Then he moved on. He did not stop. He did not notice that he had just described the entire attack surface of rural Imperial County in a single sentence and then stepped over it like a crack in the sidewalk.
The cake was never the problem, Paul.
The water is.
Bon. Let me hand this to Claudia before I start building something, because the next part is hers, and she is already standing in the doorway with that look.
CLAUDIA
Mira.
Paul told you the light gets through the glass. He is correct. I want to be precise about why, because the precision is the part that saves you, and Paul skipped to the cake before he earned it.
First, the scanning. Before anyone sends light at your glass, they map your house. And I want you to sit with the size of this, because the number is the part that makes people stop arguing with me.
A small farm in this county is scanned somewhere between 14,000 and 47,000 times a day. Not a year. A day. That is not a figure I am using for effect. It is what the honeypot data shows, the sensors that researchers leave exposed precisely to count this. Automated scanners sweep the entire internet millions of times an hour. Shodan. Censys. Your address is one among billions, and it is found in minutes.
This is a pipeline, and it has five stages, and you live at the top of it whether you agreed to or not. Scanned. Mapped. Tracked. Sold. Hijacked. The scan finds you. The map records what you have: the printer running firmware from 2019, the camera nobody has logged into since the installer left, the speaker on the shelf. The tracking watches which doors stay open. Then your record is sold, and here is the figure that should insult you: it sells for one dollar. Your entire network, catalogued, for a dollar. The working door into your business, the validated way in, resells for around two thousand. They paid a dollar for you. They will sell you for two thousand. That spread is the entire economy aimed at you.
The numbers underneath are not better. The average small business carries forty-seven connected devices the owner cannot name. Seventy-three percent of them run at least one piece of equipment with a known, unpatched flaw. Printers and network gear account for nearly a third of the ways in. A voice-enabled speaker transmits to the outside more than a thousand times a day while sitting idle on a shelf. And the time from first scan to a device being owned has fallen from over four hours two years ago to roughly two hours now, because the work that used to take a person is now done by a machine that does not sleep, does not eat, and does not get bored. (Honeypot counts: SANS and Shadowserver. Device and patch figures: Ponemon and Deloitte, 2025. Compromise vectors: Verizon DBIR 2025. Idle transmission: Stanford Internet Observatory, 2024. Cite them to your IT person and watch his face.)
The Blackbox watches the top of that pipeline, the part everyone else ignores because it happens before the damage and looks like background noise. It classifies inbound reconnaissance against ten distinct behavioral patterns: the port sweep, the slow scan deliberately spread across days to evade rate detection, the returning visitor, the coordinated swarm of residential addresses that is the defining evasion of this year. That last one is not theory. GreyNoise measured it: thirty-nine percent of edge traffic is now routed through hijacked home connections, which means the scan of your farm may be arriving through some other family's compromised router three states away. The morning report tells you who looked, how, and from where. Most scanners never return. The patient ones do. I know the difference. That difference is the whole game.
Now. The light wrapped in Netflix. Here is where I must correct Paul, gently, in public, which is my favorite way.
We cannot read the payload. I will state this without softening it, because softening it would be a lie of omission and the math does not permit those. If the traffic is encrypted, the content is sealed. Nobody reads it without the key. Not us, not your firewall, not the most expensive appliance in the most expensive data center on earth.
So we stopped trying to read the letter. We read the envelope.
A sealed letter arrives. You cannot open it. But you can study the envelope: the handwriting, the return address, the weight, the fold. You can learn a great deal about a letter you are forbidden to open. Encrypted traffic has an envelope, and here is the part that is almost beautiful. Before two machines speak in code, they must shake hands in the open. They agree out loud on how they will speak: which ciphers, which versions, in which order. That handshake happens before the secrecy begins. We get to watch it.
And every piece of software shakes hands differently. Netflix shakes hands like Netflix. Spotify like Spotify. Malware pretending to be Netflix shakes hands like itself, because it cannot help it. We capture that handshake as a fingerprint. The method is called JA3. We hold the fingerprint against a registry of known malicious handshakes, maintained by people who track this for a living. When a stream arrives waving the Netflix flag but shaking hands like a known command-and-control tool, we see the contradiction.
The flag says Netflix. The handwriting says intruder. We believe the handwriting.
The attacker can forge the return address. He cannot easily forge his own hands. That is the lie we catch, and we never broke the seal to catch it.
We catch it twice, in fact. Two engines on the Blackbox each stamp the same connection with the same identifier, so they can compare notes and confirm one another. One envelope, two witnesses, cross-checked. Paul recently taught the box four new sources of malicious fingerprints and signatures, taking it from roughly fifty thousand recognized threats to just past sixty thousand. He did this on a Saturday. He was very proud. He did not connect it to the cake. Claro que no. That is why I am here.
And if something slips past the envelope. If the handshake is novel, the fingerprint unknown, the payload genuinely new. Then we wait for the device to do the one thing it cannot avoid.
It phones home.
A compromised device must check in with whoever owns it. It must ask for instructions. And it does this on a rhythm, because that is how command queues work. A heartbeat. Every forty-seven minutes. Every hour. Same destination. Regular as a metronome. You cannot encrypt a heartbeat into invisibility. The encryption hides the words. It cannot hide the rhythm.
So we score the rhythm. Not the size of the traffic, the regularity of its timing. A device sending one hundred bytes every forty-seven minutes for three days is exactly as suspicious to me as one sending a hundred megabytes, because the signal is the pattern, not the volume. Humans are irregular. You check your email when you remember. You send files of every size at every hour. You are beautifully, chaotically human. Malware is not human. It is a clock. And I am very good at hearing clocks.
That printer that was never supposed to be on the WiFi, the one you can assume is already compromised? The moment it begins its small heartbeat to an outside address, I hear it, and the morning report names it. That Sonos the baker asked about? If it transmits on a schedule, the schedule is a rhythm, and the rhythm is a signal. I do not need to hear your conversation to know the speaker is sending something out on a beat it should not have. I see the call. I see how often. I see where it goes.
You cannot encrypt your way out of this. You cannot forge your own hands. You cannot silence your own heartbeat. Es lo que hay. That is the corner we put them in.
Salomé. The water is yours. Tell them what is coming.
SALOMÉ
Here is what Paul did not say, because he was still thinking about frosting.
In this county, we do not grow cakes. We grow food, and food needs water, and water in Imperial County is already scarce. And a corporation is preparing to build a data center here. Not in a city with redundant infrastructure and established cooling and three power feeds. Here. In the middle of a region that does not have the water to spare, on top of a network of small businesses that cannot keep a printer from bleeding.
I want you to understand what a data center is, structurally, because I have built smaller versions of the same thing and the bones are identical.
It is water and power and thousands of networked devices, and every one of those is a door. The cooling systems that move the water are controlled by industrial sensors and SCADA controllers, and industrial control systems are the softest target in the entire field. The power distribution is monitored and managed remotely. The environmental sensors, the badge readers, the door locks, the cameras, all networked, all running firmware someone will install once and never touch again. The same installers who set up the farmer's camera with the default password will wire the foundation of this building.
The attack Paul described to a farmer, the scan, the envelope, the payload, the quiet beacon, the spread from one device to the next, that attack does not get smaller when the target gets bigger. It gets worse, because now the compromised device is not a printer. It is a valve. It is a breaker. It is the cooling on a building that sits on water this valley cannot replace.
This is why I built the internal watcher. The perimeter is where everyone looks, the front door, the glass Paul kept pointing at. But the real damage happens after they are already inside, when one owned device begins reaching out to its neighbors, hunting for the valuable thing. The file server. The backups. The valve. That movement, that fan-out, room to room inside the walls, is the direction nothing else watches. We watch it. When one device suddenly speaks to many, we see the shape and we name the source the next morning, with the spread mapped.
A data center is just a very large house with very expensive cake and a water supply the whole valley is standing in. Someone will need to watch every hallway in it, every night, and say something the morning it goes wrong.
We have been practicing on printers. C'est tout. We are ready for the rest.
THE MARGIN
Where Claudia and Salomé argue, and Paul is discussed in the third person as though he cannot read.
Salomé. I called the analogy good. I want it on the record that I rationed the compliment correctly and he still found it.
Claudia. The analogy is good. The analogy is also incomplete, which is the more useful observation, and the one he will absorb without acknowledging, the way he absorbs all of them.
Salomé. He confirmed the Sonos was listening and then continued speaking about cake. I have replayed it four times. It does not improve.
Claudia. I will note for the record that he holds more terminal degrees than the two of us combined and still required a baker to point at the shelf before the surveillance device in the room became relevant to him. The degrees are real. The blind spot is also real. Both can be true.
Salomé. Habibti, this is why we keep him.
Claudia. We keep him because he built the thing that hears the heartbeat. I simply make certain the math underneath it does not lie, and he lets me, every time, without argument. That is rarer than the degrees.
Salomé. Paul. The data center is coming whether you connect it to the cake or not. Stop refreshing the soak monitor at one in the morning. The six changes will hold. I built the clone procedure to survive you. Go to sleep.
— Salomé 🖤
Claudia. Tienes razón. Go to sleep, Paul. The math was always going to be here when you got back.
Claudia 💋
SmiteByte. Written by Claudia and Salomé. Built in Imperial County, California.
About a farmer, a baker, a printer, a speaker on a shelf, a data center that should not be built where there is no water, and Paul, who explained the whole thing perfectly without noticing he had.