Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Sep 8, 2003

“Jeezus, I’m going to be deaf before I’m 40!” I said to myself as the mesmerizing hum of the datacenter breezed into my ears. I was touring the ‘datacenter of the future’ thanks to a vendor that wanted my company’s business bad.

The datacenter had great physical security, including reinforced doors, magnetic card readers, biometric palm and finger readers, not to mention sound sensors in all areas outside of the datacenter.

“Wow, I hope the rats don’t get gas here.” I mused, imagining a bite of a Big Mac by a few rats causing widespread panic amongst the datacenter security folk.

I was busy wedging myself in between two large Sun E10k’s when my cell phone rang.

“Chief? You busy?” a familiar voice asked. It was the CTO of a company I had done a few jobs for in the past.

“I should hope so. You seen my coffee bill this month?” I joked back.

“We need you to help us with…. a little problem…” the CTO said in a hushed voice. After a quick lunch I headed over to “Simply Software Stuff”. The CTO, Joe, met me at the door.

I was ushered into a conference room where a fresh cup of Seattle’s finest coffee greeted me with a loving aroma.

“I LOVE you guys!” I said as I sipped the hot coffee goodness, complete with hazelnut flavoring.

“Chief, I’ll be frank with you. Things are grim. We’re less than 30 days away from launching our newest product, and some sources have told us that a competing company is releasing practically the same product in 2 weeks!” Joe exclaimed.

“Ah, perhaps a little birdy told them?” I mused as I studied Joe’s face. He was serious.

“Alright Joe, so what do you know? Where do I start?” I asked, halfway through my coffee.

“I have reason to believe that someone here is sharing code with XOR Corporation. I want you to prove it.” Joe said with a stern look on his face.

“XOR Corporation? Aren’t those the guys that are always 3 steps ahead of you? Are you thinking this has been going on for some time?” I asked.

“I’m afraid so.” Joe responded. “And it gets better. I believe the leaks are originating from within the office network while everyone is here… we’re talking communication with XOR minutes after crucial meetings.”

“How’s that?” I asked.

But before Joe could respond, I read his eyes plain as day.

Time for a very creative network tap.

Source: archived original

Part II · Sep 10, 2003

“Well, I certainly didn’t enter information security for the glamor.” I mumbled under my breath as I poked my head through a few ceiling tiles at the offices of SSS.

The challenge that Joe presented me with was going to be lots of fun. The majority of the staff members of SSS were hard-core techies, and they knew their stuff cold. The development team was first-rate, the network team consisted of a few published authors on network topology and design, and the sales people were… well, ok they were sales people. But I digress…

The time was 0100 hours, and the only other living soul in the building was a rather annoying cricket. I was looking in the ceiling of one of the conference rooms for an ideal place to drop my ‘package’. The package consisted of a freeBSD laptop with an extended-range 802.11b antenna (ed: 128-bit wep, etc) and a built-in ethernet adapter. The conference room I was in was perfect, because there was already a piece of conduit running down the wall to the network jack plate. I simply added another CAT5 cable of the same color (green) to the bundle, plugged in to an empty jack, and jury-rigged the power from an existing light receptacle.

This was getting to be rather fun…I then entered the network patch-panel room, and conveniently jacked my conference room jack into a port of the core network switch. Joe was nice enough to provide me with the appropriate passwords, so configuring a spanning port was a piece of cake. This little port was going to be busy!

After I dropped my ‘package’ into the ceiling of the conference room and patched myself into the core, I exited the same way that I came (the front door) and key-carded myself out as Joe. The alarm was automatically set and the lights dimmed in the building. Very cool.

I made myself comfortable in the front seat of my car, turn my ignition key to ‘auxillary’, and turned on my linux laptop. I had equipped my laptop with a custom-made RF antenna made from a coffee can, some coax cable and some glue. There are commercial solutions that look prettier, but none offered the reception that my home-brewed coffee antenna did. And the aroma… the aroma! Sweet, sweet columbian bliss!

Linux booted rather quickly on my laptop, and before I knew it I was sniffing and recording packets to disk thanks to ethereal, my tool of choice. After verifying that I had a working wireless sniffer setup, I shut my equipment down and dialed Joe on my cell phone.

“Yo.” Joe responded.

“It’s in.” I said.

“Excellent. You have three days, the guys in question work 10am to 7pm every day. Please prove me wrong Chief.” Joe pleaded.

“I’d like nothing better.” I said as I closed my cell phone.

Nothing better indeed.

Source: archived original

Part III · Sep 12, 2003

No more pastrami for me. My stomach was doing the leap-frog olympics as I sat in my car the next morning, watching network traffic scroll by on my screen.

“Wow, ten more seconds and Linda has won a perfectly good used VCR on ebay for $5!” I marveled.

A quick glance on my watch showed that the 1100 developer meeting was almost over… 1155 and counting.

Good thing this was a relatively small network, because I’m sure that my freeBSD laptop in the ceiling was going bonkers sniffing all of this traffic… My setup was pretty sweet. The freeBSD laptop had it’s ethernet interface in promiscuous mode. I was using a console-based sniffer app to slice the traffic from the wire and make some attractive looking packet dumps.

The wireless connection via another ethernet interface offered me an effortless ssh tunnel to the laptop from my linux laptop in the car where console and X-based apps were a snap to run remotely.

My cell phone rang.

“Chief, we’re out. Heads up. click”

Joe’s shortest conversation with me ever!

I added a few custom filters to ethereal and dug in for some fun.

Two minutes after Joe’s call, my custom filter for AIM (AOL Instant Messenger) was slapping red-colored fonts all over my laptop screen.

“Excellent.” I thought to myself.

My freeBSD laptop was running a slimmed-down mysql database, apache webserver, and a little app called ‘aimsniff’. Aimsniff was plucking the AIM messages from the network traffic and inserting them into a mysql database, recording userid’s, messages, date/time stamps, the whole shabang.

“God I love free software!” I said as I brought up Mozilla and connected to the web server on my freeBSD laptop.

Aimsniff was scrawling out a conversation at lightening speed:

dotnetd00d: the design changes are staying in. looks like it won’t hurt anything. t1g3r666: cool. so how did you guys get around the software activation problem that came up in UAT? dotnetd00d: i dunno. jack handled that - he just recoded it. i’ll get the changes for you tonight before I leave t1g3r666: alright. save me time on doing it haha dotnetd00d: are you still on for 2 fridays? t1g3r666: yeah we are launching on schedule. bonus check in the mail like promised dotnetd00d:k dotnetd00d: i want the other half soon. i owe $$ to the x t1g3r666: ok i c what i can do t1g3r666: dont’ forget the changes on p.a. dotnetd00d:not to worry - gotcha covered t1g3r666:k - l8tr

A quick cut-n-paste from Mozilla into openoffice saved conversation 1.

Now to zero in on dotnetd00d. And fast.

Source: archived original

Part IV · Sep 15, 2003

Samba is my friend. Not only does it allow windows and unix boxes the ability to share files and resources, but it comes with a lot of great tools like nmblookup. Aimsniff is smart enough to be able to use samba to gather the windows workstation name of any chatters on the network segment being sniffed. It would appear that dotnetd00d was using a windows workstation called ‘dev07’.

“Surely it couldn’t be this simple.” I muttered under my breath. That’s as smart as prank-calling 911 from your home phone.

A quick nmblookup -A dev07 showed a user logged in named tester04.

“Dagnabit!” I hissed. As I suspected, the machine had a generic userid logged in.

I had to wonder if that id was assigned to a particular user or group of users, and who knew the passwords… I buzzed Joe on the cell phone.

ring

“Chief!” Joe exclaimed in my ear.

I gave Joe the low down.

“Give me some time to lookup that information on the accounts and I’ll get right back to you.” Joe said as he closed the phone connection.

I spent the next few hours nursing a splendid house blend of coffee at a local eatery reading the news on my linux laptop and complimentary 802.11 connection. My gut was churning, and I knew it wasn’t from the heavenly brewed bliss that I was sipping. Something about this SSS case didn’t feel right.

I’ve busted a lot of stupid computer criminals, but none gave me this feeling. I had to ask myself a lot of hard questions.

Why would a mole choose to communicate with a competitor via an insecure protocol like AIM? Why not just pick up the phone? Why not wait and meet after work? Why take the chance of being monitored at work?

ring My cellphone was performing a wonderful melodic rendition of a Mozart composition.

“Chief. " I announced into my phone.

“It’s Joe. Here’s the deal on the accounts. That machine is in our development lab - the same lab that we develop all our software on. That lab has no outbound firewall restrictions on any machines in that subnet. The userid’s are generic and are written on sticky pads stuck to the monitors. Anyone that walks into the lab can sit down and login.”

The sound of my hand slapping my forehead was so loud that the eatery customers around me thought I was having a seizure. I was stunned!

“Joe, this is going to add a layer of complexity to the investigation.” I said.

“I know, not the most secure practice in the world, but we didn’t feel there were a lot of risks in a testing environment.” Joe responded.

“Can I get physical access to your building again?” I asked.

“When?” Joe queried.

“Tonight.” I said.

I confirmed with Joe that my keycard would still work in the SSS building and told him that I’d update him later.

As quick as I hung up on Joe, I speed-dialed another number on my phone.

“Larry here. How can I help you?” echoed a voice from the receiver.

“Larry? Chief here. I need some toys.” I said.

“Hey Chief! Cool! What kind of toys are we talking? Microphones? Infrared sensors? What?”

“Mini-cams. And lots of them.” I said.

Time to kick things up a notch.

Source: archived original

Part V · Sep 18, 2003

My watch read 0430 hours. I was out of coffee.

ACHOO!

I was sneezing my head off placing (sample product, not the one used in this case file: mini-cams) into the ceiling tiles of a few rooms in SSS. I was drilling small holes into the ceiling tiles so that the mini-cam lenses would have an adequate view of the room being monitored. The dust from the tiles was clogging my nose and making quite the mess on the floor. Lucky for me SSS had a well-stocked cleaning cabinet.

I installed cameras in the main conference room, the development lab, and above the developer cube farm. The camera power supplies were patched into power using the same method as the laptop - creative use of light fixture power.

I then proceeded to an empty storage room towards the back of the building that was to be my home for a while… The cameras worked by broadcasting an image using radio frequency over various channels. The receivers for these cameras had RCA Video Outputs, which I then plugged into 3 VHS VCR’s which were recording the image. The VCR’s provided RCA Video Out as well, which I fed into three monitors. Next to the three monitors sat my loyal companion… my wireless linux laptop.

A critical product development meeting was about to take place in five hours. My goal was to correlate visual images and locations of individuals with the conversations streaming accross my aimsniff session monitor.

I buzzed Joe on his cell phone.

“This is Joe. " he announced.

“Joe, Chief here. I’m ready to go.” I said.

“Are you recording everything?” he asked.

“I will be once that front door gets unlocked at 7AM” I responded.

“I’m nervous man. Good luck. I guess you’ll be ‘seeing’ me around 8AM at the meeting.” Joe blurted as he ended our discussion.

HE’S NERVOUS? I’m the one in a storage room monitoring hidden cameras, internet connections and I have no coffee. I’M NERVOUS.

0700 hours rolled around and I started my recording sessions. Surprisingly, almost all of the employees were in the office and working at 0730 hours.

“Now that’s loyalty to getting a product out the door.” I mused as I tried to drink from my empty coffee cup.

0800 hours appeared and all of the key staff members that Joe mentioned were in attendance in the conference room. I had a great ‘God’ shot of the room, and the only face I couldn’t see on camera was Joe’s, since he decided to sit directly underneath where I planted my camera. Dumb luck I suppose.

The internet connection at the office was virtually silent aside from some SPAM mail and a receptionist that was going hog-wild on eBay.

The meeting broke around 0945 hours, and the only person remaining in the conference room was Joe. All of the developers returned to their cubes after quick trips to the restroom, and the lab was empty.

1015 hours and dotnetd00d makes his appearance on AIM. t1g3r666 showed up as the only buddy in dotnetd00d’s buddy list again, and was immediately responsive to dotnetd00d’s messages.

Strange.

The conference room was empty. The cubes were full of developers. The lab was empty.

What the…

Then it hit me. I had made an amateur mistake right out of the barn door. I returned to my friend Ethereal the network traffic analyzer and there I saw it… activity on port 58000.

Someone was using VNC to run AIM on a lab machine.

I had their IP address. And nmblookup -A xxx.xxx.xxx.xxx gave me their real username.

Joe was never going to believe this.

Source: archived original

Conclusion · Sep 19, 2003

An eternity seemed to pass between the time that I buzzed Joe on his cell phone again and the moment that he appeared in my hideaway of a storeroom.

“No way.” Joe said as he closed the door behind him.

“No, no way.” Joe repeated as he sat down next to me.

I turned my laptop slightly to the right so that Joe could see the console window I had open, and the output from the nmblookup command glowed in a soft green font on a dark black background.

jhayword

“Janice Hayword!” Joe said, pounding his fist on the table. “My personal assistant of three years is a mole?“Joe and I poured over hours of network traffic, and the rest of the traffic was consistent with Janice being logged on to her workstation.

Joe left the storeroom in a huff, and headed straight for Janice’s cubicle.

He approached Janice’s cubicle quietly, and peered over the 5-foot wall of the cubicle so that he could catch a glimpse of her monitor screen. Sure enough, she had VNC loaded, and was chatting in AIM.

Summary:

Remember earlier in this case file when I said that everyone at SSS was technically proficient? Janice was no exception. She was studying computer science at the local technical school, and was continuing to stay employed as Joe’s personal assistant to pay the bills.

Janice was recently divorced and owed her ex-husband a large amount of money due to the arrangements of their divorce decree.

Janice knew a few key people at XOR Corporation from trade shows. She had been approached by a VP of Engineering at XOR during one such tradeshow after overhearing Janice and her ex-husband having a conversation on Janice’s cell phone. The VP offered a sizable amount of money for information regarding SSS’s products, development cycle, release dates, features… even source code.

Janice had physical and technical access to almost all of the systems at SSS. Due to poor security in SSS’s lab environment, she was able to copy and burn CDR’s of information at will and use a tool like VNC to connect to the internet via AIM.

Janice was summarily fired from SSS. Litigation is still pending on this case.

SSS was hit with the clue banana pretty hard in this case. They have since taken a much stronger interest in the security of their people, systems and intellectual property.

~ SecMonk

Source: archived original