Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · May 21, 2004

(Intro)

Perry Mason was known for only losing one case in his history of practicing law. I have not been so lucky in the world of information security investigations.

Things are rarely what they seem, people lie, computers malfunction, and the curve balls fly faster than an angry spider monkey hopped up on Starbuck’s finest ground beans. I’ve often been asked about a case that didn’t pan out as I intended - my first reaction is to always respond with “All of them.”

The case file you’re about to read has been compiled from my memory and the case notes of another securitymonkey-type that worked with me. Like all the case files on this site, the events actually happened - but the details have been heavily modified to protect the identities of those involved. (And to protect my monkey butt.)

(/Intro)

** When Things Go Bad - Part I ** All I wanted was a day off. It was a beautiful day outside, the pool was a very comfortable 80 degrees, and the grocery store down the street had ribeye steaks on sale. I had just cleaned the coffee grinder and was preparing a nice half/half Jamaican/Columbian blend when my cell phone rang.

ring

It was a fellow investigator that I periodically handed off work to.

“Chief.” I said into the squawking silver-colored box.

“Chief! Dave here. Busy?” Dave asked.

“CURSES!” I screamed into the phone. I had just spilled a pound of beautiful Jamaican coffee beans all over the kitchen floor. Thoughts of also spilling a pot of hot water, some milk and sugar, and skating around the floor with a straw in my mouth ran through my mind. I needed a cup of coffee bad.

“Alrighty then. I have a live one here that I need an assist on.” Dave said, calmly ignoring the coffee emergency on my end of the phone.

“Whatcha got?” I asked, carefully picking up the beans one by one.

“Fredrick VonHeffer called my office today and left me a nonsensical voice mail. I didn’t quite understand his message, but he’s on his way to the Rainforest Cafe to have lunch with me in an hour.” Dave relayed.

“Fredrick VonHeffer? The guy that just took his little CRM software company public?” I asked.

“The very one.” Dave responded. “And you’re not going to believe this, but he’s accusing TouchThemSoft of information theft and wants me to prove it. We’re talking a serious lawsuit here.”

“Information theft? We talking another intellectual property theft case, or a patent infringement case?” I asked as I poured the recently picked-up beans back into the grinder. Sure they came off the floor, but they would still make good coffee.

“Not sure. But I’m meeting him in an hour. Have plans? Care to join?” Dave asked.

“Rainforest Cafe you said? Lots of monkeys there. Count me in.” I said as I deafened Dave with jet-engine blast of noise from the coffee grinder.

“Chief - one more thing. I think this is a little beyond what we normally work on - he’s convinced that his company is under some sort of surveillance too.” Dave yelled into the phone. Obviously Dave wasn’t respecting my coffee grinder right now.

“Aren’t we all?” I joked. “I’ll meet you in an hour. Bring your gear. If this case is legit, we might need to do some after-hours recon at their office.”

“Roger that.” Dave said as he hung up.

So much for enjoying my beautiful day.

Source: archived original

Part II · May 28, 2004

“Eeeek! Eeeek!”

The screams of monkeys filled the air as Dave and I walked into the Rainforest Cafe.

“Feels just like home.” I said to myself, fighting back a few tears. Monkeys are family-oriented, you know.

“So where are we meeting Mr. VonHoover?” I joked.

“Chief, it’s VonHEFFER. He said he’d be on the south side of the restaurant.” Dave replied.

A quick examination of the south side of the restaurant produced no VonHeffer. I glanced at my watch… we were a few minutes late.

“Time for some coffee.” I said as I walked towards the bar.

“I’ll get us a table on the south side of the restaurant.” Dave said as he flagged down the hostess.

I had just been served a fine smelling blend of java happiness when I felt a tap on my shoulder. I turned around, grumpy that my coffee was being interrupted…“You Chief?” a clean-cut businessman-looking chap asked me.

“Uh, sure. And you are?” I queried.

“VonHeffer - Dave over there said to invite you to our table.” he said.

I scurried over to the table, tailing behind VonHeffer. He glanced around the room several times and sat facing the entrance.

Dave introduced me to VonHeffer, brief personal histories were discussed, and then VonHeffer went into the details of our meeting.

“Here’s my situation in a nutshell gentleman: I just took my company HefferSoft public. A lot of this was made possible by how well my company is managed, how great our product is, and how happy our customers are.

Well, our chief competitor in our little neck of the CRM woods is TouchThemSoft. I was just made aware that a former developer of ours is breaking his non-compete agreement with us and is secretly helping TouchThemSoft develop a product that is using some patented technologies that we’ve spent years developing.

If TouchThemSoft beats us to market with this product, we could be screwed.” VonHeffer said, taking a drink from his now empty beer.

“Ok, this is nothing new. Dave mentioned that you’re under some kind of surveillance?” I asked.

“Yes, well - sort of. My attorney has begun legal proceedings against the former developer. Shortly after we filed on the former developer, we started noticing strange things. I am followed home almost every night. I will sometimes spot the same person at three different restaurants in four nights…” VonHeffer said in a nervous voice.

“Maybe they like a wide variety of food AND coffee.” I thought to myself.

“Anyone else under surveillance? Anything else going on?” Dave asked VonHeffer.

“Yes - our offices have been broken into twice, yet nothing was stolen. We have three security guards that patrol the interior of the building now. My home has been broken into as well, but like my office - nothing was stolen. My executive assistant’s home was burglarized two days ago - and they did steal something.” VonHeffer said, now sweating profusely.

“What did they steal?” I asked.

“Some money, some jewelry, her office keys … and her laptop.” VonHeffer said.

Yikes.

Source: archived original

Part III · Jun 4, 2004

Out of pure instinct I reached for my sidearm, the trusty clue banana… but alas, I had left it on the dash of my car.

VonHeffer sat at the table, a nervous twitch ran through his neck every few minutes. A coffee lover I see. Excellent.

“Well, let’s break this down.” I began. “We have a rogue ex-employee, a stolen laptop, stolen keys, and you are possibly under some kind of surveillance?”

“Yes.” VonHeffer said in between nervous twitches.

“Dave, let’s go for a walk.” I said as I grabbed Dave by the arm.

We excused ourselves and walked outside.

“What’s up?” Dave asked.

“This doesn’t feel right.” I said.“What do you mean?” Dave questioned me as he sat down on a bench outside the restaurant.

“Well, he’s either leaving something out, or making some of this up. Who throws surveillance on a previous employer like this? The ex-employee has all the cards. The non-compete is going to be hard to win in court, we both know that. If TouchThemSoft is responsible for the break-ins, what were they after besides the keys and the laptop? What do the keys go to? What’s on the laptop?” I asked.

“You want to do this by the numbers and see what happens? We’re talking some serious billable hours here Chief.” Dave said, dollar signs blazing in his eyes.

“You read my mind. Let’s sign the agreements and roll over to their HQ. We need to talk to their legal folks and find out if they have ever done any type of risk assessments. And I want to know what was on that laptop.” I said.

“Sounds good - but what do you want to do about this little surveillance issue?” Dave asked me as he lit up a cigarette.

“We can ghost chase. Call Mikey - put him on VonHeffer for a few days, take some pictures, you know… by the numbers. Have him do a covert on him though… if someone close to VonHeffer is ‘in’ on something I don’t want Mikey compromised. We’ll see if someone is really following VonHeffer.” I replied.

“Done deal Chief.” Dave said as he put out his cigarette under his shoe.

‘One last thing." I began.

“Yeah Chief?” Dave responded.

“Until we know this whole thing isn’t rotten, mum is the word on operational plans. We discuss nothing with the client.” I demanded.

“Your gut really bothering you on this one Chief?” Dave asked.

“Something besides the coffee? Yes.”

(Aside)

Pick out the holes in VonHeffer’s story. What was bothering my gut? Coffee is not an allowed answer.

(/Aside)

Source: archived original

Part IV · Jun 10, 2004

“Fancy Digs.” I thought to myself as I entered HefferSoft’s spacious lobby. I checked in with the receptionist and decided to warm up one of the leather chairs nearby. Dave was still outside, cellphone in one hand and a Newport in the other.

“Chief?” the receptionist said as she leaned over the marble counter.

“Yo!” I responded, eager to put down the People Magazine I had been browsing.

“Mr. Jones in legal will see you now - down the hallway, last door on your left.” the receptionist squeaked.

I motioned for Dave to speed things up outside and started walking down the hallway. Dave and I entered Mr. Jones’ office and took our seats quickly.

I asked Mr. Jones some very basic questions regarding HefferSoft and the situation that Mr. VonHeffer described. “When you get right down to it, there’s a lot going on around here.” Mr Jones began. “We had a key employee defect to the one competitor that is on the verge of putting us out of business. This is, of course, confidential.”

“Understood.” I said. “So what’s the risk? I take it your legal team has done some sort of risk analysis. What were the results? What are your big risks here besides a possible violation of a non-compete agreement?”

“Well, yes - there’s that. You see, the employee we’re talking about here is Mick Thomas - he’s basically the programmer that wrote the first version of our software in his apartment years ago. Mick always wanted a larger portion of the company. Taking the company public didn’t sit too well with Mick, even though he was given a very generous stock option plan.” Mr. Jones said. “Mick had it out with VonHeffer one afternoon, and we haven’t seen him since. We had some information leak into this office that Mick might be working at TouchThemSoft - turns out the information was good. "

“I’m trying to follow you here.” I said as I imagined how good a cup of coffee would be during this discussion. “What are the RISKS here? What does Mick bring to the table at TouchThemSoft besides his experience with VonHeffer and possible access to proprietary source code?”

Dave moved forward in his seat. “And better yet - what information was on the assistant’s laptop that was stolen? Was this information collected? I’d like to see this as soon as possible.”

“Yes Dave, I’ll have that information to you shortly. To answer your question Chief, we do have a list of concerns with Thomas’ defection - and there are more risks than those that you mentioned. " Mr. Jones said as he became suddenly tight-lipped.

“Yes? And?” I asked.

Mr. Jones shifted in his chair, covered his eyes with his left hand and inhaled deeply. This is never a good sign from a client.

“Thomas had access to… documents.” Mr. Jones said under his breath.

“What kind of documents?” Dave asked, practically falling out of his chair at this point.

“Damaging ones.” Mr. Jones said.

(Aside)

Looks like my gut instinct was right on this one. I smelled a smokescreen quick by observing VonHeffer’s body language and listening to him spill the beans.

What kind of documents does Thomas really have?

Why is Jones so uncomfortable right now?

What else was VonHeffer lying about? Why?

What kind of coffee will I be drinking next?

Is the surveillance claim a red herring? Why? Why Not?

(/Aside)

Source: archived original

Part V · Jun 18, 2004

“This is the best tuna sandwich I’ve ever had!” Dave exclaimed as he dripped tuna salad out of his sandwich all over the table.

“Dude, I’m trying to eat here.” I said staring at my grilled chicken breast and a side of fruit. You know you’re getting old when you make a serious effort to eat healthy every day. “Takes the guilt away from this double-espresso powered white chocolate caramel cup of coffee happiness.” I thought as I felt the caffeine rush to my brain.

We were both pretty exhausted from spending a marathon three hours in Jones’ office.

I wanted to establish a few things with Jones. What did he really know about what was going on? Did he trust VonHeffer? Did he have external motivators? How well did he know Mick Thomas?

Jones stated that he was oblivious to anything besides what we had already talked about - he had no reason to not trust VonHeffer - and he barely knew Thomas aside from their conversations in board meetings. Jones also refused to elaborate on the “damaging documents”.

“Hey Chief - you’re staring off into monkeyland again - what’s up?” Dave asked, waving his monkey paw in front of my face.“Have you heard from Mikey?” I asked Dave, refering to the tail-for-hire that was supposed to be shadowing VonHeffer and looking for the surveillance teams that VonHeffer described.

“Nope.” Dave replied. “But let’s see how he’s doing?”

Dave picked up his cell phone and dialed Mikey’s number. Apparently Dave was more interested in his Tuna sandwich than talking to Mikey, because he handed his cell phone to me.

“Mikey.” I heard on the phone.

“Mikey - it’s Chief. What’s up?” I asked.

“Not a damned thing. I’ve been tailing this guy all day. We went from his house, to the gas station, to the book store, to the clothing store, to a restaurant for lunch, back to the mall, up north to a bar…”

“Ok - and no contacts?” I asked Mikey.

“Not one. Nobody is following this guy - and if they are, they are better than I am. I swept his car for locaters and he’s clean. I think he’s seen one too many James Bond movies.” Mikey joked.

“Alright - let’s go two more days and see what happens.” I said as I hung up.

Dave’s eyes widened. “Hey Chief, do you realize that this is the first time that we’ve followed the CLIENT?”

“When’s the last time we had a client that gave you the heebie-jeebie’s like VonHeffer? Did you get the profile of that stolen laptop?” I asked.

“I’m looking at it now.” Dave said, lifting a folder of documents from his lap.

“Please don’t get Tuna on that man.” I said.

“Well, I’m not the techie of the team - so help me figure this out. The listing is from a backup server that automatically backs up portables when they plug into the corporate LAN.” Dave said as he turned a few pages. “And this is where it gets REAL confusing. I’m looking through the directory listings of the C: drive and I’m not seeing anything even remotely interesting. There’s a total of maybe 20 word documents and a few spreadsheets, but nothing with file names that sound interesting.”

“That means nothing - anything could be in those files - or any other file.” I said wishing I had remembered to ask Jones for a contact to pull the backup tapes.

“Ok, ok… but here’s the best part… the backup software is configured to only backup drive C:!” Dave exclaimed.

“Yeah, what’s your point? Most laptops nowadays only have one big ass C: drive anyway.” I countered.

“Chief - there’s a drive D: on this listing…. and it’s stuffed with word documents and spreadsheets.” said Dave.

“Where are you going with this Dave?” I demanded.

“It’s a CD-ROM! Now I wonder if the CD-ROM was in the laptop when it was ‘stolen’?” Dave asked.

A CD-ROM huntin’ we are about to go….

Source: archived original

Part VI · Jun 25, 2004

(Aside) _ Time to back up for a second.

Through some keen observations by Dave, we’ve established that at the last time the executive assistant’s laptop was backed up (ie, last time it was plugged into the corporate LAN), there was a mystery CD in the laptop. This is the same laptop that was supposedly stolen from her home. The CD looks interesting, but how do we find the CD? How do we find out what was on the CD? Why was the CD made? Does the whole case revolve around this one CD?

One thing to keep in mind during this case file - the NAME of the case file. :-)

_ (/Aside)

Our story continues…

Paper as far as the monkey eye could see - scattered all over the table at the local Starbucks. Dave and I were entrenched doing some background work on the executive assistant, Mick Thomas, VonHeffer, and multiple binders of company policies and procedures.

Lots of interesting facts were added to our case notes:

• The Executive Assistant (EA) did indeed report the break-in and theft to the police, however no homeowners claim was filed on her possessions. Not uncommon - a homeowner’s claim is a death blow to ever getting homeowner’s insurance within three years. Don’t you love how the insurance racket works?

• Interviews with other staff members revealed that the EA and Mick Thomas were known to eat lunch together and socialize on numerous occasions.

• Mick Thomas not only had full access to the company’s CVS (source code) servers, but administrator and root access to all other machines. This was in violation of the company’s network security policy, but no violation reports were ever filed.

• A risk analysis was done by the legal department about six months before Mick Thomas left the company. All five stages of a RA were completed, and one of the largest financial risks mentioned was the theft of intellectual property (the source code) of their product line.

• The company CFO, Izzy Landers, has been on vacation since the theft of the EA’s laptop and unreachable by cell phone.

• Izzy and VonHeffer were college roommates.

• Izzy used to work for TouchThemSoft about one year before the EA’s laptop was stolen. No non-compete suit was ever filed by TouchThemSoft over this move. Interesting.

“You know what I’m thinking?” I said to Dave as I took a swig of a most caffeinated house blend.

“This was a bad week to stop smoking crack?” Dave joked.

“If I was going to burn a CD with a bunch of potentially damaging (and we’re assuming damaging) documents on it, what machine would I use at my company?” I asked.

“Hmmm. Well, for starters you wouldn’t want to use your own machine - so let’s assume that the EA burnt the CD but she didn’t use her laptop.” Dave said.

“Yep, ok - now she needs to find another machine with a burner in it - whose machine is she going to use?” I pondered.

“One that she has access to? But with her login, she could login to any Windows 2000 workstation on that top-floor network.” Dave pointed out.

“Yes - but how many machines had a burner installed!” I expounded.

“Well, according to the hardware inventory… only two.” Dave replied. “One belonged to the VP of Graphic Services who used….. a powermac G4. And the other was in… oh this is nice!!!”

“Uh?” I replied.

Dave lowered the paper and smiled, spouting off “The only other machine with a burner belonged to…

Mick Thomas!!!

Let’s hope that the IT department didn’t follow it’s machine scrubbing procedures on that machine, Chief.”

Yes, indeed.

(Aside)

Ok sleuths… what is going on?

What are your theories so far?

Hint: Remember this case file?

And why the heck was I drinking a house blend instead of an imported bean?

(/Aside)

Source: archived original

Part VII · Jul 1, 2004

_ Memo from the Chief

Hello out there? You all have been very quiet lately. Is everyone on summer vacation BUT me? Or have you all gotten lost in the multiple layers of details surrounding this case file? Understandable. And remember, you’re reading a ‘summarized’ version of what happened. Icky.

Our story continues… _ Tracking down Mick Thomas’s machine was not hard. One phone call to the hardware monkeys and they knew exactly which machine I was talking about.

“So where is this workstation?” I asked the first monkey.

“(sound of him scratching his head) It’s the pretty blue tower machine sitting next to my supervisor’s desk.” said the first monkey.

“Put your Sup on the phone please.” I asked.

“Yes?” said the second monkey.

“You have workstation #WS000002 in your office, yes?” I asked the second monkey.

“(sound of him scratching some place I didn’t want to know about). Yes - it’s sitting right here next to my desk.” said the second monkey. “I use it every day!”

My heart sunk.

“Did you erase the contents of that workstation before you started using it?” I asked the second monkey.

“Nope. I just created a new profile. This baby has a mega awesome video card and Mick had everything tuned just right!” chirped the second monkey.

Dave and I just had a lucky break.

We headed to the hardware support area in the IT department and located the workstation. It was a bright blue tower - one that someone would use if they were a professional gamer perhaps.

“We’re going to need to borrow this machine for a while.” I told the second monkey.

He started to give me some grief about needing his machine, but I’m sure the sight of my trusty clue banana dangling from my belt made him change his mind. Fear the banana!

I pulled the power cord from the back of the machine and heard the fans go silent. We took some pictures, packed the machine in some anti-scratch wrapping and placed the machine on our trusty cart, leaving the screaming monkeys in the hardware support department to their daily grind of swinging from one cube to the next.

A few hours later I was combing an Encase image of the hard drive from the big bad blue workstation. It didn’t take me long to locate a series of CDR project files and disc images. Whoever was using Mick’s profile was not concerned about these files laying about in broad daylight.

There were ten images total on the drive. I proceeded to start burning CDR images one by one and labeling them accordingly by the image filename, date and time.

As the CDR’s were labeled, I handed them to Dave for examination. One by one, disc by disc, the procedure was rather slow.

I decided that the room temperature decaf I was drinking wasn’t cutting it anymore, so I volunteered to venture out to the coffee shop to acquire some good bean juice while Dave continued to examine the CDR’s.

I was in line at the coffee shop trying to decide between the columbian medium roast and the espresso of the day when my cell phone rang.

“Chief.” I responded.

“I see files.” Dave said on the other end.

“No kidding genius boy. Anything that interests us?” I asked.

“A couple of things actually.” Dave said.

“Do tell.” I joked as I placed my order for our coffees.

“Well, I found a complete dump of their accounting system - everything. A/P, A/R, income statements, balance sheets, you name it.” Dave announced.

“Really? And what’s the other thing you found?” I asked instinctively.

“Another dump of their accounting system - same time period according to some of the plain-text report files - but with one slight difference.” Dave said.

“Oh, I can feel this one coming!” I thought.

“The numbers are all different. They have two sets of books.” Dave almost whispered into the phone.

I almost dropped my coffee.

(Aside)

So, we have some things going on here. For whatever reason, Mick had a CDR image on his hard drive of a dump of the accounting system (which he had access to). Did Mick make the image? Did the EA? Why? Why not?

Discuss.

(/Aside)

Source: archived original

Part VIII- It ends badly · Jul 12, 2004

Things were bad, and were getting worse the further we dug. Dave and I could have worn signs around our necks that said “Designated tools of due diligence”. You can make the joke.

Here we were being brought into an organization because of some missing data, some employees being followed, and key members of staff possibly jumping ship to a competitor. What could it all mean?

I took a gamble with my next move. This game is all instict, and I’ve never found my gut to be wrong on matters like this. I grabbed my case notes and walked to Mr. Jones’ office in legal.

Time to apply pressure to this gaping chest wound of a case.I spread page after page after page of case notes out in front of me on Jones’ desk. I asked some rather pointed questions, but my gut was telling me that Jones really didn’t have a clue. It looked like I’d have to show my hand in this card game.

“Mr. Jones, are you aware that VonHeffer and certain other executives in this company have been defrauding your investors from the very beginning?” I asked.

“What do you mean?” Jones asked, looking like I was pusing bamboo chutes down under his fingernails.

“I have two sets of accounting records here. One set is the set that you used to file all of your financial reports. The information I gathered from these reports matches your public disclosures.” I said. “However, this other set of records tells a very different story. It would appear that VonHeffer and crew have been treating themselves to large cash bonuses, personal perks that were written off as expenses, and let’s not even talk about the company’s stock option plan.” I said as I placed the documents in front of Jones.

“How did you… find… where… what the…” Jones sputtered off.

I spent the next hour briefing Jones on what Dave and I had uncovered. I was going to throw the matter into his hands, collect our check and run away from this case as fast as my shoes could take me.

Mick Thomas caught on to the “questionable” accounting practices that VonHeffer and several other officers of the company practiced. The CFO was a personal friend of VonHeffer and disappeared on vacation. Thomas found the records, burned them to CDR media and escaped to TouchThemSoft as fast as he could. The CDR’s were his insurance against VonHeffer suing him from jumping ship.

Thomas and the EA were indeed having an at-work affair. Thomas had given the EA a copy of the CDR as insurance. When Thomas found out that VonHeffer was on to him, Thomas and the EA staged the break-in at her place to explain the laptop (and the CDR) just “disappearing”. It was later discovered that the EA had saved hundreds of incriminating e-mails from VonHeffer as her own “insurance”.

VonHeffer’s plan on bringing in an outside security investigation firm backfired in the worst way. The forensic evidence that we were able to find, label, preserve and present aided an attorney that represented some of VonHeffer’s largest investors. Needless to say that VonHeffer and his cronies wound up with some jail time. VonHeffer’s company was bought by a much larger company and it’s technology used in a much larger, more popular CRM solution.

Not every case goes smooth or even makes sense in the end - especially when things go badly.

(Aside) How did VonHeffer completely shoot himself in the foot?

Anyone want to take a guess at describing the entire scam that VonHeffer put together? This casefile only highlights the very basics.

(/Aside)

Next time, new case file - and it’s a weird one.

Source: archived original