Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Aug 20, 2003

Speed. I could not believe the speed of the computer that was in front of me. I had just received a Sun Ultra 60 dual-processor workstation, and I was carefully performing a stage1 install of Gentoo Linux on it. My office was alive with the magical hum that only a Sun powersupply can provide.

“Sweet Gina! Look at the compiler go!” I blathered as my eyeballs followed the code scrolling accross the console.

ring The phone rang impatiently.

“I hope this isn’t that gal I spilled beer on last night in the bar!” I thought to myself as I pressed the phone to my ear.

“Chief? Hi, my name is Debbie. I’m the receptionist at your Doctor’s office!” came a perky voice over the phone wire.

“Oh my God! You goofed on my test results!” I shrieked, clutching my chest in perhaps the best Fred Sanford impersonation ever performed by a white man.

“No, no silly! I still have your business card from the last time you came in and asked me out. Remember? I turned you down?” She said as I managed to stand back up.

“Uh, yeah sure! Hey I didn’t spill beer on you last night did I?” I asked

“Huh?” She replied.

“Nevermind.” I said in a sigh of relief. “What can I do for you, since we obviously aren’t going out on a date?”

“The Doctor would like to talk to you… about a theft in the office.” Debbie said, taking a much too serious tone.

“Tounge depressors?” I quipped.

“No - Patient Records.” Debbie shot back…“I’ll be right there.” I said as I looked around for my car keys.

The Gentoo compile would have to wait.

An hour later I was seated in the waiting room of my doctor’s office. Reading material was in abundance, but the quality was questionable… unless you like Oprah magazine and The New England Journal Of Medicine.

“Chief? The Doc will see you now.” Debbie said, opening the mysterious door-of-wonders that led from the waiting room to the “hallway of examinations”, commonly referred to as the “freezing meatlocker from hell” by most patients.

I seated myself on what appeared to be a vinyl chair wrapped in wax paper, and Debbie closed the door behind her as she returned to the reception area.

“I hope this appointment doesn’t involve me dropping trou” I mused.

“Chief! How are ya!” the Doc said as he bounced (literally) into the examination room. This guy has more energy than a roomful of third graders during a snack break.

“Good. I hear you’re missing some patient records?” I asked.

“Yes, I’m afraid I am. " He replied as he sat next to me on the finely-wrapped vinyl table.

“How did this happen?” I asked.

“Well, we just started using this document imaging software. We’re moving the paper records to electronic you know… and we noticed that a few days this week we were missing records from the database. Scans that we know we put in, but they don’t show up!” the doc said.

“And you’re sure you’re using this thing right?” I joked, getting the ‘duh’ look back from the doc.

“Yes, we’re using it the right way. Can you take a look?” he pleaded as we left the examination room and entered the office area.

The Dell PC was on, running Windows XP.

“Gag me.” I muttered.

I ran through a quick cursory examination of the operating system, settings and the application.

“Doc, are you working your staff late, or what?” I said, flipping through the application logs.

“Hey, this is a doctor’s office. Everybody goes home at … " he began.

“3:10am?” I asked.

Someone was performing an invasive procedure on this system.

[Continued in Part II]

Source: archived original

Part II · Aug 22, 2003

“Doc, you really need to get a better quality of coffee bean in here.” I muttered as I emptied the coffee pot into my road-worn styro cup.

I had been in the office all afternoon and most of the evening, pouring over system and application logs.

At first glance, it appeared to me that a user was logging into the application around 3:00am over the past week and searching for records. Once the target records were found, they were removed from the system.

The application stored all the documents in PDF format. The scanning engine did a great job - I was astounded at the quality of the scans.

Turning back to the system log files, I spied an unknown ip address…I had attached my laptop to the network earlier and made a nice nmap scan history of the entire network. There were just a few nodes.

192.168.1.1 - Netgear router to the internet w/firewall rules in place. 192.168.1.10 - Officemanager’s computer (the one I was on) 192.168.1.20 - JetDirect Printer 192.168.1.11 - Doc’s PC in his private office 192.168.1.254 - My laptop (I chose 254 because it was free, and was clearly different than the other devices)

The unknown ip address was 192.168.1.100. Hmmm.

I verified that no other portable devices were ever brought in or attached to the network.

I performed a wireless network audit using Kismet… no access points, no traffic at all. Hmmm.

I verified the location of all POTS phone lines. Only one for the fax machine.

“Me thinks we have a phantom machine on the network.” I thought to myself.

After downing the last of my coffee, I got down on my hands and knees and started tracing CAT5 network cable.

I traced the machine I was on to the wall jack, and the same for the printer and doc’s computer.

“I wonder what’s down the rabbit hole?” I mused as I unlocked the phone room door to the office.

I quickly located the patch panel for doc’s office, and traced each connection back to the netgear switch.

One cable to the internet… One cable to the office manager PC… One cable to the printer… One cable to doc’s PC… One cable to the spare CAT5 jack in the office… One cable…

One more cable? What?

The cable ran behind the Netgear device, down to the floor, and then snaked back up the wall into a removable ceiling tile.

Doc’s network was tapped.

Source: archived original

Part III · Aug 27, 2003

“MY EYES! MY EYES! DEAR GOD MY EYES!” I cried to myself as I happened to notice that the Sup had a severe case of plumber-crackitis.

“Alrighty, there ya go. You mess anything up and you gotta pay for it!!!” the Sup said as he staggered down the staircase. I climbed the ladder, and stuck my head into the crawlspace. Reaching for my trusty maglite, I noticed the smell.

Garbage. Ewwwww. Crawling about twenty feet, I located the CAT5 cable snaking up from the doc’s phone room. Using my maglite to follow the cable’s path, I noticed something most peculiar…A small 4-port hub. The doc’s cable was inserted into a port, and another cable was running from the small hub to a hole about 3 feet away.

Rolling onto my back, I looked at the floorplan that Mr. CheekCracks gave me, and stared in disbelief.

“Why would a cable be running to an empty suite?” I pondered.

The hub was powered on, so obviously that suite has electricity still.

I crawled out of the crawlspace and made my way back down the stairs and headed towards the sup’s office.

“Hey Sup, who was the last tenant of 110?” I asked loud enough to be heard over his radio-broadcast baseball game.

“Nobody. Nobody has ever been in that suite. I use it to store stuff.” the Sup yelled back, fixated on the tiny talking box.

“Can I look around in there?” I asked again in an even louder voice.

“Who are you, Magnum PI? Ah, whatever.” the Sup responded as he threw a keycard my way.

I left the Sup’s office in a hurry and made my way to suite 110. The door was locked. I used the keycard to unlock the door, and clicked the light switch.

Flourescent lights lit up the room, and I was greeted with about 30 large boxes of… crap. As I made my way around the boxes, I located a storage room . At the top of the storage room I saw the mystery CAT5 cable and a power cord running down the wall to a makeshift shelf.

Out of the corner of my eye, I noticed a 5-gallon bucket with a piece of canvas thrown over the top. The canvas wasn’t dusty like everything else. Hmmm.

I lifted the canvas slowly, remembering a recent encounter with a midget and a jack-in-the box, and flipped on my maglite.

“Nice laptop.” I mused.

Time for a stakeout.

Source: archived original

Part IV · Aug 29, 2003

“Thank heavens for Starbucks!” I stammered as I downed the last of my calorie-heavy coffee creation. I had been sitting in my car for about four hours. A quick check of my watch showed that it was 2:55AM and counting.

I flipped open my trusty linux laptop and finished up my case notes. I had more questions that answers at this point. Why a hub in the crawlspace? Why not just run a cable? I was just organizing a list of geek toys that I was going to buy with the fat investigative bill I was going to present to the doc next week when a flash of headlights caught my attention.

In what seemed like a total retro-moment in time, a VW station wagon pulled into a parking spot about 4 spots south of suite 110. Out stepped a young male, early 20’s, ponytail, ballcap and a smoldering cigarette. He was carrying a small nylon overnight bag over his shoulder.

I observed the subject entering the suite with a keycard. The lights were not turned on. Hmmm.

I pulled my car on the side of the building, and crept back up the stairs and into the crawlspace.

The journey through the crawlspace took a bit more time than yesterday, but moving quietly can be a challenge sometimes.

I made my way to the hole in the ceiling above suite 110, and peered down into the storage room.

The subject had removed the laptop from the bucket, and plugged the CAT5 cable into the ethernet port. While the laptop was booting, the subject lit up another cigarette and proceeded to remove a cellular phone from his bag.

I couldn’t make out the conversation, but I could see that the laptop was booting into Windows 2000 Professional. While talking on the phone, the subject proceeded to visit several adult-oriented sites, dating sites, and was using instant-messaging software.

Twenty minutes later the subject picked up his cellular phone again, quickly closed all the windows open on the laptop, and proceeded to perform some commands at a command prompt. Within seconds I recognized a familiar window on his screen.

It was the document imaging software that the doc was using.

The subject proceeded to use the system for approximately twenty more minutes, made a phone call, removed what appeared to be a mini-USB hard drive from the back of the laptop, shutdown the laptop and left the area.

“Fascinating.” I thought to myself. “I need to examine that laptop.”

I made my way back down the stairs and crept slowly to my car. A quick glance around the parking lot showed that the subject had left.

I opened my trunk, removed Rosco (my portable forensic workstation) from my trunk and entered Suite 110.

I walked to the storage room, and noticed that the subject had returned everything to their normal places.

“Well, he’s a tidy little freak, isn’t he?” I joked.

I set Rosco up on a box that I removed from the corner of the room. I took several pictures of the area, the bucket, the laptop, and made some notes in my journal.

I put a pair of surgical gloves on and removed the laptop from the bucket. As I turned the laptop over so that I could take a picture of the serial #, I saw something that I couldn’t believe.

“Property of Newman Investigations. Reward if found.”

Looks like Magnum was involved in this after all.

Source: archived original

Part V · Aug 30, 2003

Things were getting more confusing by the second. I now had entirely too many questions and not enough answers.

Why was a private investigator pigeon-holed in a suite next to my doctor?

Why was this private investigator manipulating electronic records on the doc’s system?

Why not just pick the lock on the suite, bypass the alarm and do everything at the console? Or just steal the workstation? Or just steal the paper documents?

I was one confused monkey.

Two hours later, I had the laptop hard drive imaged. This was no easy task - the hard drive wasn’t easily removable. I had to take most of the laptop apart and use an adapter on the laptop drive so it would talk nicely to my ide ribbon cable.

I put the laptop back together, left everything as I found it, and called it a day.

Curiosity was killing me though, and I knew as soon as I returned home I’d be analyzing my recent hard drive capture…

After a fresh pot of coffee I began my examination of the encase drive image using FTK (Forensic Toolkit).

Aside from the usual porn site visits and some meaningless bantering in yahoo messenger, I wasn’t finding a lot… aside from a directory full of PGP-encrypted files that had sequential date filenames – and that’s what made my brain go click.

I picked up the phone and dialed the number I had copied off of the bottom of the laptop.

“I wonder if anyone has lost a laptop recently?” I mused.

The voice on the other end of the phone was James Newman, the owner of Newman investigations. I had never met James before, but I had read about his involvement in high profile investigations in the local metropolitan area.

As I suspected, James was missing a laptop - his laptop. It was stolen from his vehicle about three weeks ago.

James and I quickly agreed to meet for lunch to compare notes.

Perhaps things weren’t as complex as I was making them.

Or were they?

I met James at a burger joint twenty minutes from the doc’s office. James was nothing like I imagined - about five feet, five inches tall and a very portly fellow. Juding from how James demolished two gutbuster burgers and finished them off with cheese fries and two diet sodas, I could see why.

I brought James up to speed on what I was doing, the missing records, the mysterious pony-tailed man, the laptop, and the half-ass network tap that I found. James looked more perplexed the more I talked. He immediately asked me if I had attempted to open the PGP-encrypted files that I found.

I replied that I had not.

James looked relieved, took a deep breath, and began a long tale going back almost a year. My suspicions were correct - those PGP-encrypted files were James’s case notes from a current case he was working on. Apparently he was knee-deep in a PI’s paradise: a nasty divorce case. A wealthy husband was trying to divorce his wife. Wife hires newman to tail husband, suspecting infideliy. Newman finds out that the husband was indeed cheating on the wife, with an eighteen year old girl, about thirty years his junior. The girl was also three months pregnant.

Bells and whistles were going off in my head. I decided the best course of action was to work with James. James wanted to find out who the pony-tailed man was and how he came in possesion of James’s laptop.

“Wonderful.” I grumbled.

Yet another stakeout.

Source: archived original

Conclusion · Sep 2, 2003

Three days had gone by. James and I were learning things about each other that only two people cramped up in a car on a stakeout could learn. For instance, I learned never to let James eat any dairy products before beginning a stakeout. Evidently he is intollerant of all things cow.

On the fourth day, we struck gold. It was early in the morning, somewhere around 2am when the familiar VW bug pulled into the parking lot. James had his binoculars out, and in between creating his own cumulous clouds in the car and trying to drink MY coffee, he was humming some rediculous tune that sounded like a song from ‘Cats’.

As the subject exited the VW Bug, James focused his binoculars with an intensity I had only seen him have once before, and that was trying to get the top off of a pringles can.

“Unreal!” James gasped.

“What?” I asked him.

“Let’s move!” James said, pounding his hand on my dash.

I drove back to the side of the building, and parked my car as far out of sight as possible. James wanted to take this guy down commando style, judging from the weird gleam in his eyes.

I slid my keycard through the door access console, and James opened the door to the suite. I let James go ahead of me, following the lesser-known survival theory of “put the bigger guy in front of you”.

Peering over a pile of stinky moving boxes, we spied the subject hooking the laptop up the network and lighting a cigarette at the same time.

“This boy has talent” I joked to myself.

“Ready?” James mouthed as he gave me some weird hand signal that I had never seen before.

“Ok.” I mouthed back.

James approached the subject quietly, and after he was about 5 feet from the subject, announced in a booming voice “Hello Sergio!”

I froze. “James knows this guy? I can’t take any more surprises!” I screamed silently into the back of my teeth.

“Uh, what’s up Jim?” Sergio said as he sat down slowly, apparently forgetting that he had just sat the laptop on the same bucket ten seconds ago.

“Get off my laptop, fool. What the hell are you doing here, why did you take my laptop, and how the heck did you get in here?” James demanded.

Sergio sighed in contempt. “Dude, you KNOW why I took it, and I’m sure you KNOW why I’m here, so let’s stop playing games.”

“Pardon me, but what the (expletive) is going on here?” I asked. I felt like I was being dragged down a mountain slope head-first by man-eating elves.

“Sergio here is Beth’s ex-boyfriend.” James snapped back.

“Beth?” I asked.

“Beth is my client’s husband’s fling. The pregnant 18 year old girl.” James said.

My head was pounding. My specialty was computer crime, and this seemed more like a bad detective novel in a girly magazine (ed: not that I’ve ever read a girly magazine, mind you. Just what I’ve heard. grin)

Sergio proceeded to fill in the blanks under a brow-beating by James.

Sergio is a computer science student and amateur ‘hacker’ from the local university. Sergio and Beth had been together since they were 15 years old. Beth left Sergio for Newman’s client’s husband, which enraged Sergio. When Sergio found out that Beth was pregnant, he suspected that the baby might actually be his.

Apparently Sergio had a private meeting with Newman’s client and Newman’s client spilled the beans on Newman, asking Sergio to stay out of the investigation and let Newman do his job. Apparently Newman was taking too much time, hence Sergio’s theft of Newman’s laptop.

Sergio was frustrated that he couldn’t read the PGP-encrypted files on Newman’s laptop, so he decided to go right to the source: the doctor’s office. Through some cleaver social engineering, Sergio passed himself off as a telecommunications worker with the local phone company and acquired a master door card to the facility. (ed: Note that the facility did not program their cards correctly. The facility should have had a ‘vendor’ card to give Sergio which could have prevented him from using the card outside of business hours) He then performed the poor man’s network tap on the doc’s office. When I asked him about the network tap, he said it was a spur-of-the-moment thing, and he used the tools he had available to commit long-term surveillance of the computers.

I started my round of questioning. Sergio had gained access to the doc’s records system using the tap, however the application was password-protected. Good thing for Sergio that the doc’s office manager kept ALL the system passwords in a plain text file on her desktop! Sergio simply copied this file via windows file sharing. (ed: I later checked the file sharing settings on the XP machine in the doc’s office, and she did have full file sharing turned on with no permissions!)

I asked Sergio what he was doing in the records system. Sergio replied that he was searching for the medical records of Beth relating to her pregnancy, sexually transmitted diseases, etc. When I asked Sergio about the deleted records that the doc had told me about, he replied that the deletions were an accident, and the results of him learning the ins and outs of the system.

Conclusion:

Sergio was charged with several crimes relating to this incident, but later plea-bargained his way out of most of them in exchange for testimony relating to another crime.

Beth was indeed pregnant with Sergio’s baby. (per a paternity test)

Newman’s client divorced her husband and received a large sum of money in the divorce decree.

Newman received a hefty fee from his client. I never saw a penny of it.

The doc was so thankful for my help that he paid for my very first golf lesson.

I haven’t played since.

Source: archived original