Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Dec 29, 2004

I couldn’t keep my eyes open. I had just finished twenty excruciating hours of forensic analysis on a client’s hard drive, and my head felt like Dr. Phil’s seat cushion (under pressure). I was sitting in a comfortable lounge at my local car dealership waiting for my vehicle to get routine maintenance.

“Why I make these appointments so damn early in the morning I’ll never know.” I whined to myself. I felt mildly refreshed as I spied a to-go container of Starbucks and a few boxes of Krispy Kreme doughnuts sitting on a nearby counter. I was half-way through my first cup of Holiday Blend and working on a chocolate glazed when my nemesis, the cell phone, rang at full volume. Not only did I realize that I was now fully awake, but so was everyone else around me.

Oops, sorry folks.

“Chief.” I habitually said into the squawking silver box.

“Good morning, sunshine! This is Rick over at Chelsea Healthcare. How are you?”

“Like wrapping paper on Christmas morning man - just waiting to get stepped on.” I joked.

Rick and I went way back - he was one of the first clients I ever had and kept in touch on a periodic basis to sample one of the several hundred beer flavors at the local pub. I wasn’t in the mood for a beer at 0800 hours.

“Always the joker. Hey, I have a really bizarre situation that I need some help with. We’ve been doing pretty well handling all of our own security incidents after you put together our incident response plan years back - but we’re kind of stuck on this recent happening.” Rick said in a serious tone.

“Someone stole the keys to the Coke machine again?” I said, fondly remembering the three days of hilarity that ensued when the Chelsea IT staff couldn’t get to Mountain Dew on a regular basis.

“I wish. This actually has to do with a potential customer of ours - an external incident. We’re struggling with legal, audit and the rest of the security staff on how to handle this. Let me put it this way, this individual isn’t even a customer yet and they are blaming us for stuff already.” Rick said in disbelief.

The boggle sound coming from my brain was loud enough that I’m sure the dealership receptionist could hear it. There I was again, bothering people.

“Um, Rick you know I’m not one for riddles, but what exactly are we talking about here?” I demanded, looking around for that magical Starbucks fountain of coffee.

There was a dramatic pause on the phone. I heard Rick cough and he said softly “She is claiming that we assisted in the theft of her identity.”

Yikes. I hope they have my vehicle done soon.

Source: archived original

Part II · Jan 3, 2005

Identity theft is serious stuff. Heck, I live in a city that is darn near the identity theft capital of the world! I knew my case load was light for the next few weeks due to the holidays, so I had to help Rick out.

“Ok, let’s talk details when I get there. I’m stuck at the car dealership for a while, but I can head over about lunch time. You want to meet at the usual place for burgers?” I asked, paying attention to the grumbling sound in my gut. It would appear that Krispy Kreme wasn’t being kind to my stomach.A few hours later my vehicle was in tip-top condition and I was busy punching the burger place into my navigation system.

“In one quarter mile, make a right turn onto I-999.” went the seductive female voice. Wowza. I need to travel interstate more often.

A little over an hour later, I was across town and nearing the burger joint.

“In two tenths of a mile, turn right. Your destination is on your left.” went the voice again.

Just in time. I was starving.

I pulled into the parking lot to find Rick sitting on the hood of his ride, his trademark cigar in his mouth.

“Chief! Hurry up - I’m starving!” Rick cried, cupping his hands around his mouth.

A few moments later we were seated in the burger joint, staring at two 1/3 pound burgers with everything. Life was getting better by the minute.

“So Rick, details man. You typically only get me involved when something ugly is going on. Start at the beginning.” I said in between bites.

“Well, as you know we launched a major e-commerce initiative a few months ago. Since you have our insurance I’m sure you got the flyer, right?” Rick asked.

“Yep - the blonde lady on the cover was pretty hot.” I joked, threatening another french fry with my fingers.

“That’s the one. Part of this initiative is to drum up substantial numbers of individual policies. It’s been working okay so far. A few weeks ago we had a call from a subscriber that was escalated directly to me. I knew something bad was going down when it hit my desk.” Risk lamented.

“Hey, it comes with the territory when you’re the CSO, bud. Get over it.” I joked. Rick made a truckload of cash, and frequently complained about it.

“Eat your burger Chief. So anyway this customer is a female, and she doesn’t even live in this state. Right away, we have a distance issue - we can only talk to her on the phone. Secondly, she says that she went through the application process on our website and used a home phone number that was brand new. She had just gotten the service that same day.”

I sat back in my chair. I knew what was coming already.

“She claims that thirty minutes after filling out our application, she received a call on her new home phone number that she hadn’t given to anyone but us. The call was from a competitor - well, not really - a broker. They told her that they were aware that she was shopping for health insurance on the web.”

Let the finger-pointing begin.

Source: archived original

Part III · Jan 13, 2005

“Rick, give me a minute to digest this - and my burger.” I said as I sat quietly, staring at the ceiling.

The scenario was sounding all to familiar, but I didn’t want to jump to conclusions.

Chelsea had a potential customer that filled out an application for health insurance on their website. The customer used a contact number that was an hours-old home phone number. The customer hadn’t given out this number to anyone but Chelsea. Minutes after submitting the application, the customer receives a call from a health broker wanting to sell her insurance. A quick analysis of the situation let me to think one thing: information interception. But how? Need input!“Where are you at right now, Rick? If you followed the incident response plan that I wrote for you, you should have performed some sort of security analysis on the machines in question, a physical analysis of your network devices and connections, a logical analysis of who had access to the information submitted, etc.” I said, putting Rick on the hot seat.

“Absolutely Chief. My team went into action immediately. As a matter of fact, we should head over to the office now so you can talk with the team and guide us through this.” Rick suggested. The retainer fee he slipped across the table was quite the motivator. I guess he knew I’d want to jump on this.

I followed Rick back to the office, mesmerized by the cleanliness of my vehicle. What DID they use to clean this interior? It smelled like a mixture of wax and cologne.

Rick escorted me to the security desk where I promptly received a contractor badge with my picture affixed to the bottom of it. I bet they don’t take too many pictures of chimp-like creatures on a day-to-day basis around here.

Clue banana in hand, I walked into the spacious conference room and placed my laptop bag in the chair next to me. A few moments later Rick’s security and privacy staff milled into the room and took their seats. The staff had grown quite a bit thanks in part to recent HIPAA Privacy and Security regulations. Ah, the government at work. How quaint.

The lights in the room began to dim, and a staff member began an impressive-looking presentation on the incident at hand. Several slides later, I was exposed to some new information - a timeline! I grabbed my trusty Powerbook, popped open textedit (notepad for all y’all windows folks) and started taking more case notes. A summary of the notes looked like this:

_ 09/02 - Customer places call to Privacy Office, files a formal complaint. 09/02 - Privacy Officer reviews complaint, forwards complaint to CSO. 09/02 - CSO reviews complaint. 09/02 - CSO activates incident response team. 09/02 - IRT begins investigation. 09/03 - IRT performs security analysis on all servers involved 09/04 - IRT reports nothing out of the ordinary. 09/04 - IRT performs network device analysis 09/05 - IRT reports nothing out of the ordinary. 09/06 - IRT performs intensive log analysis. 09/06 - IRT begins interviews of staff with access to data. 09/07 - IRT reports nothing conclusive. _

A dead end? Why am I always called in when there’s a dead end?

This is just getting better and better.

Source: archived original

Part IV · Jan 20, 2005

“We’ve got a big, fat goose egg.” said Paul Verselle, manager of information security at Chelsea. “My team has left no rock unturned, no log unread, no configuration unchecked. That data didn’t leave our network.”

I smirked… “Paul, you sound pretty confident. And you may be right. The information may have not left the Chelsea network in electronic format. It could have left via a voice call, fax or even a photocopy. Do you have a list of the employees that have direct access to that data? And I need a list of all employees that work in your network group - anyone that has direct access to the telecom hardware around here.”

“We’re way ahead of you there, Chief.” Paul said as he flipped ahead in his presentation. “Here’s a list of all employees that have direct access to the data - there are ten of them. The network team consists of 11 engineers, however only 5 have direct access to the datacenter - which is the only practical location for a tap.”

“Speaking of taps…” I began, “have you walked every port on your network? No hidden WAPs or hubs laying about under the floor or in the ceiling? Or perhaps rigged as a tap and sent to another port on the LAN?”

Paul made eye contact with his lead analyst.

“Um, yes - yes - and uh no.” came a reply from the other end of the table.

“You haven’t checked for a rerouted tap?” I asked.

“We didn’t even think of that. We’ll send a few people back down to inventory the cables again.” announced the mysterious voice. The room was so dark I couldn’t make out the analyst’s face.

“My goal here (and sticking with our plan) is to isolate this incident - if we can eliminate the facility as the source of the leak (if there is a leak) we can move on to more productive activities.” I said, standing up from my chair.

I paced around the table to the front where the presentation screen hung from the ceiling.

“What about the potential customer? Are they cooperating? Has she been interviewed? Have there been calls from other places than insurance payers?” I asked in a pretty obvious tone of voice.

Silence.

“You mean to tell me that nobody here is working the ‘victim’ end of this?” I said as I stared at Paul, then glanced at Rick.

Rick cleared his throat.

“To be honest Chief, we haven’t contacted her post-incident because of our legal department. They are still trying to determine how to handle this.” Rick said, tapping his fingers on the table in front of him.

“We’re losing valuable time here. We need a decision from your legal department on whether or not we should pursue this outside of the company. Has the potential customer said or done anything past filing a complaint?” I asked, motioning to Rick to answer.

“Negative. Not a peep. I’ll call a meeting with General Counsel after this meeting and get an answer asap.” Rick said, making some notes in his portfolio notepad.

This was going nowhere fast. Lucky for me my plan was already formed - and about to be executed.

Source: archived original

Part V · Jan 31, 2005

I’ve found that for every year that I’ve aged, I’ve lost a certain percentage of my patience. Some things in life are worth waiting for (like a tall, hot, steaming cup of freshly brewed coffee from Starbucks) and the needle on the patience meter never moves. Other times, I struggle to not beat people over the head with a clue banana or two.Case in point: Paul’s management of this incident. Paul is good “suit” security manager, but lacks a technological understanding of information security. It was very evident in the remainder of the presentation. Note-taking was very poor, there was very little documentation of ‘who’ worked on ‘what’, and the timeline was useless as a result.

I left the incident briefing with an extreme lack of confidence in the security management at Chelsea. According to some intelligence from a VP at Chelsea (gathered in the restroom of all places), Rick had been asleep at the wheel for the past year vying for the CIO position. Great - a distracted CSO.

Rick had arranged for me to work in an unused office in the IT department. I had a LAN connection, a phone, and I was about twenty paces from the break room. Excellent.

ring The cellphone demanded my attention.

“Chief - Rick here. Can you meet me up on the fourth floor in about ten minutes? I’d like for you to be present when I talk to the GC.”

Were Rick’s ears burning?

“No problem - on my way.” I said as I picked my laptop bag off of the desk and headed to the elevator.

A few moments later I was stepping out onto the lobby of the fourth floor, and not a second too soon. The elevator music was a brain-chilling rendition of the “Friends” theme song as performed by a grade school orchestra (or so it sounded).

I made my way to the office of the General Counsel (that’s “head lawyer” in suit-speak) and identified myself to the receptionist.

“Chief, in here.” Rick said as he motioned me into a mahogany-covered office.

I had met the GC on my last visit, and he seemed almost surprised to see me.

“Chief! Hello! Have a seat.” said Jean-Claude as he sat down in his over-sized office chair.

“Ok Rick, I have reviewed the memo that you sent over. This is quite the pickle sandwich, eh?” Jean-Claude said as he glanced my way.

(“Pickle sandwich” is his favorite term to use to describe anything, and no - I haven’t a clue as to why.)

“JC, we need a ‘go’ or a ’no-go’ from you on this. Chief would like have the complainant interviewed for more information.” Rick pleaded.

“Yes, of course. Ce que! I think our position will be to not interview the complainant. It is my recommendation that we make sure our house is clean and move on.” JC said, folding his hands together as he looked at the wall behind us.

“I understand your position, however this could make our investigation much more difficult and we may not come to an adequate conclusion without an interview.” I said firmly.

“Chief, I wish I could tell you that it was no problem - but quite honestly, we don’t want seconds on this pickle sandwich.” JC said, saying something to himself quietly in french.

(This won’t be the last time he uses that term - much to my displeasure.)

Our meeting was interrupted by a call on Rick’s cell phone.

“Pardon me.” Rick said as he answered the ringing box on his belt.

“Yes? Excellent. Meet us in Tony’s old office - yes that’s where the Chief is working. Thank you.” Rick said, closing his phone abruptly.

“Chief, Paul’s senior analyst has a CD-ROM that you requested? What’s up?” Rick asked.

I was about to roast a pickle.

Source: archived original

Part VI · Feb 11, 2005

The ball was in motion, and I was using a few pages from “Chief’s Classic Play Book”.

I met Paul’s senior analyst in my office. Thomas was sitting in a side chair with his laptop bag on the floor in front of him.

“Is it Christmas time?” I asked, cracking a smile.

“You tell me, Chief.” he quipped as he opened his laptop bag and removed a gold CD-ROM encased in a chain-of-custody bag. “Thorough… I’m liking this already.” I said as I made my entries on the COD bag.

I opened the bag and examined the CD-ROM. It was marked with a single number in magic marker.

“Tracking number.” I assumed as I slid the CD-ROM into my powerbook for examination.

The CD mounted flawlessly, and Thomas moved closer to lend some insight as to the CD’s contents.

“I followed your directions to the ‘T’, Chief. This is the web access log archive for the day in question. I filtered using the two methods you asked for. The first shows all access broken out by developer, network monkey, security personnel, etc. Essentially it’s every proxy ID we have. The second method was broken out by domain. I also completed a correlation analysis - it’s the openoffice document marked ‘CORANA’.”

“Close the door.” I said, motioning to Thomas with a wave of my hand.

I spent the next hour going through the logs with Thomas, stopping frequently to identify user ID’s and get explanations of traffic patterns to certain domains.

“Chief, I’m not quite sure of where you’re going with this… but if you have a hunch I wish you’d share!” Thomas said as he picked up the phone to ask the receptionist to bring us coffee. Heck, we were a stone’s throw from the break room. I had a feeling Thomas was having fun with this investigation.

(Quick Aside)

You’ve probably already figured this out, but I recruited Thomas in relative secrecy to retrieve several critical pieces of investigative evidence. Only myself, Thomas, Rick, Paul and “Mr Pickle” knew about the request I made.

(/Quick Aside)

Another few minutes of log parsing passed, and a knock at the door could be heard. Thomas opened the door and retrieved two large, 24oz cups of coffee goodness from the receptionist. I was really starting to be impressed with the skills that Thomas had - with information security and coffee selections.

My browsing through the log files came to an abrupt stop. I read the next several lines over and over again. My hunch had paid off big time.

“Uh, Chief… do you feel okay? What did you find?” Thomas asked in a very concerned voice.

“Interesting domain for a database analyst to spend time on - considering that it is banned by the security policy that I wrote a year ago for this place.” I said, pointing at the Powerbook’s screen with my pen that I was so busily chewing on.

“What domain would that be, Chief?” Thomas asked.

I drew an imaginary circle around the domain on the screen - and stared in disbelief.

Source: archived original

Part VII · Feb 21, 2005

Hundreds of years ago, kings built fortresses around themselves to prevent invasions by intruders and, in some cases, the populous from leaving. Chelsea Healthcare had hired me years ago to build such an electronic fortress, designed to withstand Ghangis Khan himself.

As any construction worker will tell you, a structure is only as strong as the weakest part. In the case of Chelsea Healthcare, the weakest part was proven to once again be the human element.

Our story continues… Thomas was staring at me like a deer caught in the headlights of a Toyota Tundra. He seemed to be paralyzed by curiosity and fear at the same time. I was almost entertained by his blank stare.

“Can I get to the administrative web page for the proxy server from this network?” I asked, waving my hands in front of Thomas.

“Uh, sure. Yeah. No problem. Here’s the IP address.” Thomas replied as he scribbled an IP address on a sticky pad.

I peered at the IP carefully and typed the address into my Mozilla Firefox browser. Bam! The administrative login page was brought up in mere seconds.

“Thomas, I need you to login to the proxy server so I can perform a quick search of the content filtering database.” I asked, sliding the beautiful powerbook across the desk.

Thomas logged in to the proxy server, and slid the powerbook back toward me.

“You’re in. Let’s see some magic.” Thomas joked as he maneuvered behind me for a closer look.

I clicked on the text box marked “domain entry” and typed in the URL I was looking for:

_ gotomypc.com _

“Holy shnikies! Are you serious?” Thomas said under his breath.

After a few seconds, the content filtering database returned the query.

_ Domain not found. The domain may not be spelled correctly, or the domain may have been removed. Please try your search again. _

“Just as I thought.” I said as I minimized Firefox. “Anyone with a proxy ID can access that site. I specifically banned that domain a few years ago. I’d like to know why it’s not in the database now.”

Thomas thought for a moment and took a long drink of his coffee.

“I can tell you how, Chief.” Thomas said.

“I removed it myself.”

Source: archived original

Part VIII · Feb 28, 2005

“I beg your pardon?” I asked Thomas as I sat back in my chair. “YOU removed that domain from the content filtering database? Why the hell would you do something like that?”

“It’s not what it seems, Chief. About six or so months ago we had a vendor come in that was demoing a ‘dashboard’ application that the suits upstairs were raving about. The vendor set up their equipment in the boardroom, and unbeknownst to us, needed to access gotomypc.com to run the demo. When they tried to access the site using the temporary proxy ID that we gave them, they were denied access. This delayed the demo by almost twenty minutes, and the suits were furious - including Frenchie.” Thomas explained.“So I’m going to guess that the suits demanded you allow access to that domain, and nobody ever put the domain back into the content filtering system?” I surmised.

“Yeah. Yeah, that’s it. What do we do now? What’s the plan?” Thomas asked as threw his empty coffee cup in the trash.

“First, we go hit Starbucks. This coffee is ok, but it has to be decaf. Second, all of the evidence that I’ve seen so far is circumstantial at best. I think I’m going to talk to Rick and ask him what he’d like to do. Our options are very limited at this point.” I replied.

We walked down the hallway on a long trek to Starbucks. My gut was right on the mark so far, even on low-octane coffee.

(Quick Aside) This is a rough place to be. You have some pretty strong circumstantial evidence against an employee, but nothing concrete. What are your options? These really depend on the client and what their goal is. You should have established the goal in your first meetings with the client. In this case, the goal was to find out how the potential customer’s information was compromised and given to an outsider.

Let’s summarize where we are so far in this case:

1. We know that a potential customer’s information reached a third party by two hypothetical means: a) Spyware on the customer’s computer. We can’t explore this avenue due to political and legal reasons. b) Inside job. Someone at Chelsea is sending out information to a third party.

2. We have established that an employee (a DBA) made a connection to another machine somewhere on the internet via the gotomypc.com service. Gotomypc works through proxy firewalls. a) We don’t know exactly where the other computer was b) We don’t know exactly what the DBA was doing

3. We have a theory - that the DBA has been passing information outside of Chelsea via this service. The recent event (with the potential customer) coincided with a login time in the web logs. a) We haven’t searched too far back in the web logs. How long has the DBA been doing this? b) We don’t have any other recorded complaints of information abuse/theft.

(/Quick Aside)

I called Rick on his cell phone while Thomas drove me to Starbucks.

I explained the situation to Rick in great detail. I was half-way through ordering a Venti cup of coffee when Rick dropped another bombshell.

“Are you sure that the DBA in question was Howard Ness?” Rick asked.

“Positive - the id was hness and the IP address in the web log was assigned to his workstation.” I replied.

Rick was silent.

“We have another problem.” Rick said.

Source: archived original

Part IX · Mar 9, 2005

“What do you mean he’s DEAD?” I blared into the phone. I paused for a moment and realized how stupid my statement sounded.

“Chief, Howard Ness was 61 years old and suffering from an inoperable brain tumor. He died a few weeks before all of this went down.” Rick responded.

“I’ll call you back.” I told Rick as I closed my cell phone.

I sat motionless at my table inside Starbucks, staring blankly at my cell phone.

Was I at a dead end in this case already? Time to regroup.

“Thomas, I’m going back to my home office for the rest of today. Drop me off at my truck.” I said, still staring at my cell phone as if I was waiting for it to do a trick or two.

A little over an hour later, I arrived home and was eager to spend some quality meditation time thinking about the events that had transpired today.

I sat down at my desk and opened my folder of requested documents. I was drawn to the organizational chart of Chelsea.

“Howard Ness reported to the Database Development Manager.” I mumbled to myself. “The department had three full-time employees. One was Howard, one was the manager, and one… one was Jack Samuelson.”

After cross-referencing some HR employment records, it appeared that Howard and Jack had worked together for just under a year, and were situated in neighboring cubes.

Gut instinct took over.

I searched through the last 30 days of proxy logs for the “hness” id and found multiple hits on gotomypc.com.

“Ness is back from the dead!” I said sarcastically to myself.

I then searched for the id “jsamuels”, and saw a typically browsing history for a DBA. Hits to microsoft.com, oracle.com, various trade magazines and a couple of sports sites.

Wait. Something wasn’t right.

I scrolled back through another window that displayed the “hness” query. The userid was used on a machine with an IP address of 10.1.1.79.

I scrolled back through the window that displayed the “jsamuels” query. the userid was used on a machine with an IP address of 10.1.1.57.

However, for a brief moment in time (two http GET requests), both of the user ids’ came from 10.1.1.57.

Mr. Samuelson slipped up.

Source: archived original

Part X · Mar 21, 2005

“That’s what I’m telling you, Rick. This is all circumstantial at best. You’d have a better time prosecuting a pickle for being green.” I said to Rick, smirking that I had successfully used a pickle reference in front of Jean-Claude. I was sitting in Jean-Claude’s office with Rick, presenting a brief analysis of my case findings and going over my recommendations. In one hand I held my 20-page findings document, in the other a piping hot white chocolate mocha with extra whipped cream. I was well caffeinated and trying to apply the clue banana to this very strange case.

“What about forensic analysis of the workstation?” Rick asked, glancing over at Jean-Claude.

“With your permission, I can do this tonight after everyone has gone home. But you need to face reality here - there may not be much to go on. If Samuelson went to this much effort to populate your customers’ data into a system outside the company in near-real time, he’s not going to make this easy.” I said. “Unless he messes up - twice.”

“Twice?” Jean-Claude said as if suddenly awakening from a pickle-induced slumber.

“He screwed up once by accidentally using Ness’ ID on his machine. Thomas just scanned Ness’ old machine with a port scanner, and it looks like this workstation is mysteriously running a VNC server. It’s our theory that Samuelson is initiating a remote session on to Ness’ old machine, firing up a browser and initiating the gotomypc.com sessions.” I responded.

“Oui, but what about twice? He is going to screw up again?” Jean-Claude said, scrunching his nose a little higher.

“Yes - twice if he thinks he’s going to cover up his tracks well enough that I won’t find a few crumbs.” I said as I sipped the last of my mocha.

“Chief, what’s the plan? You have our support to do what you think needs to be done. Fill us in.” Rick said as he received a reassuring nod from Jean-Claude.

“I’m going to grab forensic images of both machines tonight, and spend the next day or two in my home office analyzing the data. If Samuelson left me anything at all, I’m going to produce it in my report and hand this case over to you as we previously discussed.” I answered as I tossed my Starbucks cup into the trash can.

“ARE you going to find something?” Rick asked.

Am I ever.

Source: archived original

Part XI · Apr 5, 2005

Like Scrappy on most of his blind dates, I was really beginning to regret showing up to this party. I received the proverbial “green light” from Chelsea management to grab the Ness and Samuelson workstations, and was sitting in my cozy bit of Chelsea real estate - on the floor.

“What the hell?” I asked myself, staring at the floor. My coffee buzz was wearing thin, and grumpiness was approaching. After a brief encounter with the delivery girl from the deli next door (15 minutes to deliver a sandwich and a large coffee - impressive!), I walked towards the elevator door.

I inhaled.

The door opened and I stepped inside. Within a few minutes I was stepping out of the elevator and staring at the two mystery workstations in their natural habitat. One was on Ness’ desk, the other on Samuelson’s desk. Both workstations had a single network connection in a crudely-made junction box that ran through the cube farm.

Out of curiosity, I stepped over to Ness’ dek. The LCD screen that sat atop the workstation was turned off. I pressed the “on” button and wiggled the mouse a bit. Seconds later I was staring at… a Windows desktop?

“Eh!” I said out loud to myself in an apparent attempt to locate other nearby Canadians.

This workstation should have been locked through an Active Directory policy setting.

Austin Powers had nothing on me as I snapped about ten pictures of each workstation from every angle I could manage.

Back at Ness’ machine, I stared at the system tray. VNC was waiting. Now I couldn’t wait to image this machine.

I reached around to the back of both machines, grabbed the power plugs close to the base of the power supplies and yanked. The sound of power supply fans coming to a halt could be heard.

I placed both machines on a nearby mail cart and pushed them into the elevator.

Several hours later I found myself at the monkey crib, coffee brewing, a fresh pepperoni pizza (with extra cheese) smoldering on my dining table, and two workstations having their hard drives imaged by Rosco via Encase.

“Life, it is good.” I joked as I bit into the first piece of pie. Heaven.

Time for a nap.

ring ring ring went my cell phone. “What time is it?” I thought as I glanced at the clock on the wall. Three hours had passed since my pizza-induced coma began.

“Chief” I said into the phone, rubbing sleep from my eyes.

“No, there is no Jose here. No I’m not lying! Senora, JOSE NO ESTA AQUI, COMPRENDE?” I yelled into the phone. I hate wrong numbers - especially when the same lady calls me every other day looking for her cheating husband.

I wandered into my lab to take a look at the imaged hard drives. I placed the original drives back into sealed bags and marked the date/time on the label. “Think procedure!” I reminded myself.

I attached the image of Samuelson’s machine to my forensic workstation and built a case with Forensic Toolkit.

Several hours into the morning (and a pot and a half of premium columbian dark roast) revealed exactly what I thought I would find on Samuelson’s workstation. Not a damned thing except for the VNC client executable. Interesting.

I powered down the workstation and peered at the image of Ness’s workstation sitting on the workbench. It was calling my name!

I built an FTK case of Ness’s drive and began my search. I didn’t have to search long.

beep boop beep beep boop boop beep beep went my cellphone as I dialed with one hand and held my ego with the other.

“Rick? Chief. We hit the jackpot.” I said. “Schedule a meeting with Frency & crew for tomorrow.”

“Right. What did you find?” Rick asked impatiently.

“The hole in the dike.” I replied.

Source: archived original

Part XII · Apr 17, 2005

“I am quite confused.” announced Frenchy as I was halfway through my presentation. A quick glance around the conference room revealed that no one was surprised.

“Let me go over this one more time.” I said as I restarted the Keynote presentation running on my Powerbook.

“This entire situation revolves around the deceased, Howard Ness. After an analysis of the contents of Ness’ workstation, several facts are apparent:_

1. Ness had been in financial trouble for quite a long time. Several Microsoft Word documents that were recovered by FTK (Appendix A in your hardcopy reports) show letters that were exchanged between Ness and several creditors. Ness had amassed a personal debt somewhere in the neighborhood of $150,000 for signature loans. A lot of these loans were being used to pay for medical treatments that weren’t paid for by Chelsea.

2. Ness had been in contact with two individuals, relationship unknown, via Yahoo Mail. Appendix B shows these mails as web pages that were also recovered in my examination.

Relevant quotes are in bold:

** “… I have access to that information but I’m not quite sure what your ‘schedule of production’ means in your last email…”

“… providing you with 10 people a day will be difficult at best…”

“… I am unable to connect to the machine that you indicated at 203.xxx.xxx.xxx. I am unsure what to do at this point…”

“… payment should be made in money orders only. I have provided you with the PO box address…”

“… bring a partner into the arrangement that can help meet the production requirements…”

“… Sam will be in contact with you regarding his production requirements and abilities…” **

Please note that these excerpts are referenced to entire or near-complete emails provided in Appendix C.”

_

Frenchy was rolling around in his seat like a fish thrown on a dock.

“Are you saying then, that Ness and Samuelson were involved in this type of activity?” French asked as he flipped through the Appendices of the report.

I attempted to make eye contact with him and gave an affirmative “Yes, that is exactly what I’m saying - and I believe this report will provide you with the information that you requested.”

Frenchy placed his head into his hands.

He kinda looked like a pickle sandwich.

Next update: The Conclusion!

Source: archived original

Part XIII · Apr 20, 2005

“Chief, can we skip to section 7 where you discuss the technical details? I’m still lost on this part.” Rick asked.

“Certainly. Section 7 details a flow of information using a very convoluted, if not inefficient, means of placing Chelsea customer information onto a system that was apparently owned by the two unknown individuals.” I began. _ “The flow of information went something like this:

Ness was privy to any new insertions into the tbl_new_websignup table of the db_chelsea_mkt database. Appendix G shows some SQL select statements that were recovered from the drive. Now, these commands could have been executed in the normal capacity of his job duties, however it would appear that he kept the results of his queries in Microsoft Word documents on his workstation.

If you compare the recovered documents in the last half of Appendix G with the list of compromised customer data listed in Appendix H, you’ll notice that all of the customers who have contacted you in ‘H’ are listed in ‘G’. Could be a coincidence, then again it could be a smoking gun.

Ness connected to gotomypc.com from his workstation to a specific machine on a daily basis outside of the Chelsea network. This machine was identified only by it’s IP address - which was recovered from his IE cache files in Appendix I. This is the same IP address indicated in the emails from Appendix B.

If you’ll flip back to the recovered MS Word documents, you’ll notice one called dtally.doc. Ness was keeping track of which sets of data he was submitting, and what that translated to in dollars. He was getting a mere $50 per submission. And from the same document you’ll notice that his ‘quota’ was 10 a day. $500 a day, seven days a week is $3500 a week, or $14k a month in cash. Very profitable for Ness.” _

The room was dead silent. Nobody was breathing. Was EMS going to be necessary here?

Frenchy coughed a few times and asked “Eh, now where did Samuelson fit into this?”.

“Let’s go over that one more time for clarification.” I said.

_ “Samuelson was working with Ness to meet the quota. I have been unable to determine why Samuelson was in ‘cahoots’ with Ness on this. There were some specific requirements for the people they were submitting, and to be quite honest I haven’t been able to locate what those specific requirements were from the forensic analysis of their workstations.

After Ness passed away, Samuelson took the entire operation over. He apparently wanted to keep the ‘heat’ off of his workstation, so he installed a VNC server application on Ness’ workstation, and connected to it from his own. Samuelson was keeping track of his activities the same way Ness was - and he stored the documents on Ness’ machine after Ness passed away.

If you look at the file creation date/time stamps on the VNC files, there is two minute difference between when the VNC server was installed on Ness’ machine and when the software was installed on Samuelson’s machine. Thanks to some quick support from technical services here at Chelsea, we were able to determine that no other machine in the the organization has VNC installed.

I want to point out here that (as I said before) while there is substantial technical evidence to support my theory, you will have to interpret this data as you see fit. I will leave this to your legal beagles.

Rick will have to follow up with his staff on why standard operating procedures were not followed to lock Ness’ account and secure his workstation after his death and termination from the company.” _

Stares of disbelief filled the room.

“So, a dead man has been responsible for sending our data out of the company? What a pickle sandwich this is!” Frenchy said as he closed his portfolio.

I’ve never wanted to slam my head into a boardroom table so bad.

The Chelsea legal team picked up the ball that I left them and ran with it. The last time I had burgers with Rick, he informed me that Samuelson was let go and they were still debating on a legal recourse. Insurance companies don’t like a lot of publicity.

Chelsea stepped up to the plate and informed the affected customers (or in most cases, potential customers) of the information disclosure.

Now if I can just figure out how to program all the local Starbucks locations into my GPS nav system in my truck I’ll be all set.

Where is that manual….

Source: archived original