Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.

Part I · Jan 23, 2006

“Four hundred clams?” I thought as I stared at the price tag of the combination coffee/cappucino machine. I was wandering around a local department store in desperate need of a new coffee machine. I had recently taken a much-deserved break from field work. While I had a lot more time to concentrate on life matters, I was realizing quickly that my bank account was starting to look a little pale.

RING

A quick glance at my cell phone showed me that I had an incoming call from Scrap.

“What the hell do you want?” I joked. “I’m shopping.”

Scrap cleared his throat.

“Boss, you are not going to believe this, but I have a ’live one’ here. I’m two days into my gig here at Treesoft, and this job has exploded into something much, much bigger. I’m going to need your assistance. This isn’t exactly a small video game developer.” Scrap said as he blew cigarette smoke into the mouthpiece of his cell phone. “And you need to get here with a serious quickness.”

I closed my eyes and let out a sigh.

“Scrap, I’d love to help but I have a million things going on, a coffee machine to buy, and I just picked up a new X-box game. I’m booked!” I said as I exited the department store and headed for my vehicle.

“Chief, seriously. You need to get on a plane and meet me here tomorrow.” Scrap begged.

It was not like Scrap to beg like this. Something must be up.

“Okay, you went to Treesoft to meet with the president of the company and do a risk assessment. That’s all I remember. How did this assessment get out of hand?” I asked as I climbed into the driver’s seat of my vehicle.

“Let me put it this way, I spent my first day giving presentations to executives. The second day, I was doing interviews with staff members and my cell phone rings. The president and General Counsel of Treesoft wanted me in a boardroom in ten minutes.” Scrap said, excitement building in his voice.

“And? AND?” I cried as I maneuvered my way onto the freeway. “Out with it man! What happened?”

Scrap inserted a dramatic pause. “Apparently a customer of theirs sent them some disturbing documents that they found on the internet through a Google search. I looked through some of the documents, and it’s everything from company memos to source code!”

“Ah.” I thought to myself, “confidential information flapping in the wind of cyberspace.”

I put on my turn signal and exited the freeway.

“Scrap, are you thinking network penetration? Unhappy employee? Network gnomes? What?” I asked.

“I’m not really sure yet. News of the leaked documents has already hit some gamer news sites. We need to move fast.” Scrap said.

I walked into my house, quickly grabbing my laptop and travel bags.

“I’ll be there tonight. I’ll call you when my plane lands.” I said as I hung up.

With any luck I’d get a seat on the last flight out.

40122-060720-318352-10

© 2006 All Rights Reserved.

Source: archived original

Part II · Jan 25, 2006

“Christmas? No, it was Thanksgiving!” I mumbled quietly to myself shortly after my plane touched down. I was trying to remember the last day that I had actually slept more than four hours in a row.

Sleep is the one luxury that most investigators don’t get a lot of. During the deepest of slumbers, their minds are constantly working cases. “Did I check all of the slack space on that captured drive? Did I interview all of the maintenance staff? Did I zip my pants up before or after I set that last coffee free?”

After carefully locating all of my carryon baggage, I made my way to the airport’s food court. I was in luck; a Starbucks with a chinese food take-out located within fifty feet. After scoring a piping hot cup of java sweetness and a tray of orange chicken, I was on the phone to Scrap.

Well, I would have been on the phone to Scrap if I had brought my spare cell phone battery.

Damn.

I inhaled my chinese food and savored every last drop of my perfect house blend before scampering off to find an electrical outlet to plug my phone in to. I was having no luck until a green-aproned Goddess of the bean stepped in.

“Do you need to plug that phone in, hon?” she asked as she pointed to an empty electrical receptacle behind the Starbucks counter. “Let me hook you up with another coffee.”

Great saints of caffeine, I was saved!

I plugged the A/C adapter into my phone and placed a quick call to Scrap.

“Jeez boss, what took you so long? Your plane landed an hour ago!” Scrap whined. The faint sound of traffic could be heard in the background. “I’ve been circling this airport forever. You know where to meet!”

I thanked my sweet savior one last time with a generous tip in the tip jar and made my way to the arrivals curb.

“YO!” Scrap yelled as he did an impressive power slide into the empty curb in front of me.

Several minutes later we were on the road and headed to Scrap’s hotel.

“Details man. What’s going on?” I asked impatiently.

“You’re going to love this!” Scrap said as he rolled down the window an inch and lit a cigarette. “So, Treesoft has been working on this major new console title for Majorcorp for about year now. Well, one of the reasons I’m doing this risk assessment is because Majorcorp is going to purchase Treesoft.”

I looked unimpressed. “Scrap, everyone knows that Majorcorp is going to buy Treesoft.”

“Wait! I haven’t even gotten to the good stuff yet. A year ago, Treesoft went from two hundred employees to three hundred employees. They started leasing a ton of office space, and they purchased an unreal amount of computing equipment.” Scrap said as he smashed his cigarette butt into the ashtray.

“Good grief. You think they are inflating the company to up the purchase price and the perceived value of the company?” I asked.

Scrap laughed. “Hey, I’m not that smart. I didn’t figure this out. It was in one of the memos that ended up on the internet. So the Treesoft guys are in a panic. They think the deal is going to cave in, and they want answers yesterday.”

“Interesting. So where are you at in your assessment?” I queried as I started taking notes on a fresh notepad.

“I have most of the requested documentation together. They provided that when I walked in the door. I was about a quarter through the interviews when the suits pulled me aside to tell me about the leaked documents. I haven’t had time to do anything else since I called you.” Scrap said. “Now you know why I wanted you out here fast. This is getting uglier than those dancers in Atlanta that spilled beer on me.”

I peered at Scrap through my sleepy eyes. Sometimes I just wanted to hit him.

An hour later, we were camped out in Scrap’s hotel room developing our strategic plan. I took a moment to examine the documents retrieved from a website by some Treesoft customers. The website was a bulk file-sharing website called “FFS” or the “Freak’in Filesharing Site” that had a unique revenue scheme. Anyone could upload a file and get a unique URL to share with potential downloaders. However, the downloaders had to pay a monthly fee or they had to wait two minutes before the download would begin; plus, the download speed was throttled.

The documents were interesting. There were five documents total. Three were plain text files containing large amounts of what appeared to be game source code. The other two documents were Microsoft Word documents containing one Treesoft memo each.

The first memo was from the Treesoft CFO to the ‘Executive Planning Staff’ where he detailed a plan for ‘sudden necessary growth’ and ’necessary capital expenditures’. The second memo was from a project manager to a Vice President describing a dire situation with their upcoming release. Apparently the development team was several months behind in squashing critical bugs.

The plot thickens.

Source: archived original

Discussion of Part II · Mar 29, 2006

Continuing our discussion from Part I of this Q/A session, I answer yet more reader questions!

Hill asks: This may have been answered earlier in your blogs, but I only started reading a few months ago. How do you get into this business? What experiance[sic], training do you have? How did you get started consulting, did you work under a mentor first, like Scrap? I’m all ears. And thanks for such an entertaining read.

Answer: This is the #1 question I am asked in the blog and in e-mail. My adventure in this type of business started just before the internet boom of the mid 90’s. I had always been interested in computers, and have my father to thank for buying me my first personal computer: a Commodore Vic-20! I checked out every book on computer programming from the local library and got to work. Later in life, I continued my passion for computers and electronics through various learning experiences - and had my first run in with ‘unauthorized use of an electronic system’. That’s the nice way of saying that I got busted for gaining entry into a certain organization’s VAX system through a modem and a username/password that they were nice enough to DISPLAY ON THE SCREEN AT LOGIN. Nope, I’m not making that up. Remember - this is a long time ago before computer security was the topic on everyone’s lips.

Fast forward a few years through college, and I’m smack dab in the middle of desert shield/storm as a member of the US Military. Most of my work was in signal intelligence, but I was constantly being pulled away to set up IBM personal computers and ’network the SOB’s together!’ as my first seargent liked to say. It was at this point that I realized how serious computer security was - and, how to investigate unauthorized usage. This knowledge paid off in spades, as I was able to use my knowledge in other realms within the US military / federal service.

Moving the time wheel forward, I’m out of the military and employed with several internet startup companies. Most startups didn’t have security as a line item in their business requirements (or their business plan for that matter). I spent a great deal of time redesigning networks with security in mind, and associating with knowledgeable folks on the internet. I went to every technical certification course I could, and later every security certification course I could afford. During the late 1990’s, these types of certifications paid off nicely.

Consulting is a funny business. I started off doing consulting as a side project, and it eventually took over my life at some point - and strictly on a referral basis. However, constant travel and a heavy workload eventually took it’s toll on my business and personal life. It was at this point that I decided to hand the majority of the consulting business off to associates (like Scrap) and concentrate my work on a single (albeit large) employer.

I had so many mentors through my journey that I couldn’t possibly begin to name them all. I did have one cowboy though who taught me the most important lesson of them all: put your life first, your work second. I encourage you all to read that last part again until it sinks in. =)

I’m sure there will be more details in some sort of a published work eventually …

Michael Boman asks Have you ever thought about having your casefiles produced as hardcopies? I sure wouldn’t mind buying a hardcopy of the best casefiles over a year (for the right price), especially if they were edited to a “Hackers Challenge” kind of format. lulu.com offers on-demand printing so it would not require you to fork up any money up front.

Answer: Are you kidding? I’ve been working on it for what seems like an eternity. Luckily, most of the work that goes into these case files is ’timeless’ so to speak. It’s not like I’m writing a book on Office 2003 or anything. =) The book is a spare time project (remember that whole life before work thing?) and to put all your minds at ease - it’s about 85% done at my last estimation. Publishing, well - that’s a whole other topic. Thanks for the tip on lulu.com.

CBK asks When you’re building a casefile do you start with a goal in mind (exposing wireless security) and pull pieces together or do you start with a case and pull bits and pieces in to flesh it out and add things?

Answer: Excellent question from a very loyal reader (yo!). As I’m sure every monkey knows, my writing is very monkey-formula. I start with pieces of cases scattered everywhere in front of me, and I try to piece things together to do two very important things: (1) Educate the reader and (2) Entertain the reader. Let me tell you, #2 is much harder than #1. I do have a goal that I write towards, and sometimes I actually write backwards (as another reader pointed out to me in e-mail recently). 75% of the work that goes into these case files is continuity checking - making sure that I drop clues at the right parts, and wrap them up at the end. I’ve had several readers ask “Why do you put the surprise stuff in the end like that? How can we solve the case w/o all the data being present?!?”. Well, I’ll be honest. I don’t expect you to - however, it doesn’t stop readers like TuxGirl from doing it on a regular basis. Part of the monkey-formula is pulled right out of the Scooby-Doo cartoon (no, I’m not making that up). One of the things that I loved about Scooby-Doo as a child was that there was always this killer revelation at the end that you couldn’t have possibly picked up through the story. I’m quite sure that the writers did this to make Fred & the gang seem that much smarter. This is not my purpose. I’m just a monkey - I do it for the sheer hope that when the surprise happens, the method being described will stick in your brain, and you’ll pull it out down the road on your own case.

Donathan writes I want to know of a case what went bad for you and/or Scrap. One that you couldn’t solve, one that your findings/techniques were questioned, maybe the perp of the case went after you personally when you caught them. Basically, when all went down the toilet, how did/do you handle it?

Answer: Ho, boy. We have had some doozies. I have to save some of these for the book, but I’ll share a quick summary of one. Scrap and I were tasked with investigating a bookkeeper who was ‘cooking the books’ at a consulting firm. The partners knew she was doing it, but they couldn’t prove it with hardcore evidence. There were other complications: she was a minority, and played the minority card at every opportunity. The partners knew that unless they had a smoking gun, she would retain a lawyer and quite possibly put their consulting firm out of business. Scrap and I set up video surveillance, key-logged her workstation, and made nightly visits to the office to make forensic copies of her workstation’s hard drive. One night while we were in the middle of an imaging session (we’re talking 11PM at night), she visits the office with her 300-lb gangsta-looking boyfriend. When she saw what we were doing, we had to think quick. We passed ourselves off as computer repair people. She wasn’t buying it. Homeboy had a gun stuck in the front of his trousers. (I’d like to point out that neither I nor Scrap have ever carried a weapon while consulting.) Scrap managed to distract them with some banter while I dialed one of the partners on my cell phone and left the line ‘open’ praying to all hell that he’d answer and know what I was doing. I lucked out - he figured it out and raced to the office. The rest of the story? Well, you’ll have to keep reading the blog. =) I have never had my life threatened, however Scrap has - twice. Maybe you’ll all understand why he disguises his voice on the podcasts now.

Case asks a fantastic question: _In Leaky Leaf IX the Chief wrote about running an nslookup on the IP address found in the Limewire log:

scraptop:~ scrap$ nslookup 64.xx.xx.xx Server: 10.0.1.9 Address: 10.0.1.9#53 Name: xx-xx-xx-64.gamersbeatches.net

Chief, although we see in the end that you verified the gamersbeatches.net connection with the corroberating e-mail evididence, were you ever concerned that TreeSoft’s nameserver had been altered and was fed you a red herring? Do you ever double-check lookups by using non-internal nameservers?_

Answer: It is part of our standard procedure to never trust a DNS server on a local net. Ever. I suppose I could have mentioned this as another lesson in the story - and I’m going to add this to my lessons to add to a future case file. In this circumstance, Scrap used a web browser and verified the DNS response with a well known lookup service. =)

Charlene asks: _One thing I’d like to know. I’ve tried to figure out what was one of the first virii in existance.

I helped clean up one on a CDC 6400 back around 1978._

Answer: Wow! A CDC 6400? I’ve only read about them in books. =) To answer your question, I would like to refer you to The Computer Virus Timeline at infoplease.com. I’m not sure I could post a better answer than what you’re going to read there. For those of you that haven’t seen this - it starts in 1949!!!

I hope you’ve enjoyed this Q/A session. Please, post more questions as comments to this blog entry - you just might get an answer!

Next up - The Conclusion to Lascivious Lawyer !

~ Chief

27005-060329-187187-97 Rate content: https://web.archive.org/web/20140910134117/http://esbn.org/esbn/verify.asp?id=2700506032918718797&rate=yeshttps://web.archive.org/web/20140910134117/http://esbn.org/esbn/verify.asp?id=2700506032918718797&rate=no

Source: archived original

Part III · Jan 31, 2006

The next morning was my introduction to the wonderful world of Treesoft.

“Where did these guys find their lawyers, Microsoft?” I wondered to myself quietly as I scanned several sheets of 8 1/2" by 11" paper with my newly-caffeinated eyes. Scrap and I were seated in a small conference room at Treesoft filling out non-disclosure agreements. Scrap was taking an extraordinary amount of time reviewing the last few paragraphs on the second page of the NDA.

“These guys are pretty serious, man.” Scrap said pointing to a paragraph under his thumb that read:

**“You acknowledge and agree that due to the unique nature of the Proprietary Information, any breach of this agreement would cause irreparable harm to Company for which damages are not an adequate remedy and that Company shall therefore be entitled to equitable relief in addition to all other remedies available at law.” **

I reviewed the paragraph out loud, and then sauntered back towards the beginning of page one.

“Scrap, this is the same NDA that Treesoft employees sign. Interesting.”

We had barely finished signing and dating the documents before Treesoft’s General Counsel, Ed Notincourt, appeared at the doorway.

“Guys, I have the executive staff assembled next door. Everything okay with the agreements? You ready?”

I handed Ed our documents as we left the conference room and rounded a sharp corner hallway into a much larger conference room.

The conference room was well lit and equipped with every type of presentation equipment imaginable. The executives stood up from behind their side of the large conference room table and we exchanged handshakes and business cards.

“Welcome, Chief! Your associate advised us that you would be joining us due to the recent events.” said a very well-dressed man who identified himself as Pete Warginoff, the President and Chief Executive Officer of Treesoft.

“Thank you. I’ve had a change to catch up with Scrap and review the Treesoft documents that were sent to you. These appear to be rather sensitive in nature.” I replied as I took my seat. “How can we be of assistance?”

Pete motioned to the casually-dressed gentleman sitting to his left, John Smackoff. John was one of the original founders of Treesoft and needed no introduction to anyone that had played a Treesoft title in the past five years. He had an almost religious following amongst some hardcore gamers.

“Chief, I’ve helped build Treesoft into the company that it is today. We started as two people working in my apartment years ago. I have made sure that any employee of Treesoft has a vested interest in the success of our titles and this company. It upsets me greatly to know that an outsider, or perhaps an insider, has passed these documents outside of our company at such a critical path in our future.”

Ed cleared his throat removed his gold-rimmed glasses from his face. “We are in active negotiations with Majorcorp to be purchased very soon. The purchase would greatly benefit every employee of Treesoft, as they are all private shareholders of this company. It is our collective belief that someone gained access to our equipment and removed this information with the sole purpose of derailing this acquisition. The timing is just too coincidental to be anything else. We want you to follow-through with what Scrap had originally planned on doing; a risk assessment of our assets. However, we want you to expand this into a full investigation of how the information was retrieved, who retrieved it, and what their true motivation was.”

I was scribbling on my notepad in a ferocious manner while trying to maintain eye contact with the executive team. I was hoping that none of them noticed how many times my pen had wandered off of my notepad and marked on their very expensive looking conference room table. Whoops.

The last remaining executive leaned forward in his chair and peered at me over the large smile that had engulfed the lower part of his face. Dave McEww was the Chief Financial Officer of Treesoft, and apparently spent a lot of his salary on haircare products.

“I’m going to send an email to our staff letting them know that you are here as part of the Majorcorp acquisition. You have full access to our resources. If at any time you run into resistance or have any questions, please let me know and I’ll take care of you personally.”

Somehow, that didn’t make me feel any better. Dave was putting off a serious used-car salesman vibe.

“Thanks Dave. We’re going to use a ‘closing net’ process. This means that we’re going to start at the physical and electronic perimeters of your facility and network, and then move inward. We will provide you with daily status updates.” Scrap said, almost as if he just woke up from a long nap.

Our meeting was interrupted by a knock at the conference room door. An attractive young woman entered the room and presented Pete with a document as she whispered in his ear and left as quickly as she entered. Pete’s executive smile turned into a “we’re all out of hazelnut creamer” frown as he slid the paper across the table to me.

It would appear that the stolen document count was now up to six.

Source: archived original

Part IV · Feb 9, 2006

The sixth document appeared to be an ‘open issues’ list with Treesoft’s next big title called “GLOOM”. John motioned to me to pass the document to him.“This is amazing. Our dirty laundry is getting aired out in the backyard of the internet.” John said with an apathetic sigh.

“John, have you or any other member of the management team interviewed your employees regarding the documents? Perhaps a disgruntled employee is slowly releasing these documents in an effort to draw attention to problems within the company?” I asked.

John looked like I had called his mother a moose.

“That’s ridiculous! We have a pretty tight-knit group here. If there were internal issues, someone would bring them to my attention. We are very employee friendly here. What hurts one of us hurts all of us.” John said in a harsh tone.

Scrap and I excused ourselves from the meeting after discussing some logistical issues with the management team and retreated to the conference room to grab our stowed gear.

“All we need now is a tent.” Scrap joked as he unpacked our equipment bags in the last remaining empty office at Treesoft. John had arranged for us to set up shop in an office near the development team.

Our first goal in this investigation was to isolate and contain the breach, if it existed. Scrap had provided me with a diagram of the Treesoft network to assist in my planning.

“According to this diagram, this network is very simple. There is a single connection to the internet via a high speed DSL connection. There is one router, one firewall, and a single core ethernet switch with multiple ethernet blades.” I said as I traced my finger along the surface of the Visio document.

Scrap passed me another piece of paper filled with his monkey-scratch scribbling. “Correct, and they are using a NAT scenario to route two RFC-1918 address spaces; 10.0.1.0 and 10.0.2.0. All servers and a few workstations have static addresses on 10.0.1.1-10.0.1.128, and 10.0.1.129-10.0.1.254 and all of 10.0.2.0 appear to be DHCP.”

“Alright, Scrap. We’re closing the ’net’ from the outside to the inside. What’s your suggested plan of action?” I asked, testing Scrap’s knowledge of our established procedures.

“First, I’m finding out what that attractive girl’s name is that brought Peter that sixth document a few minutes ago. Secondly, I’m going to get her phone number. Thirdly, I’m going to …”

“Scrap.” I said, cutting him off in mid-sentence. “The network.”

Scrap regained his composure. “Oh, right. The network. Locate all points of egress and ingress, attach a capture box to each point, assess the security of those points with the usual tools. Work backwards from the internet into the network, device by device. Sound like a plan?”

“Correct. We need to go all the way back and hit every server, network device, workstation… basically everything with an IP address. Then what?” I queried.

“I reverse direction, and work from the inside to the outside. What is this, a quiz?” Scrap snapped back as he emptied the last of our equipment bags.

“Just a refresher. I’m going to start my examination of the documents and perform the employee interviews. If you forget how to use nmap, just give me a call.” I said with a grin.

Scrap wasn’t amused.

I wandered over to the employee break room with my Powerbook and spied a fresh pot of coffee brewing.

“What timing.” I joked as I poured a fresh cup of coffee into a nearby styrofoam cup.

I opened up the lid to my Powerbook, entered my password and my desktop sprang to life. Peter had mentioned to me earlier that his assistant, Chandra, would be emailing a zip file containing all six documents. I appreciated that, but I wanted to grab the documents directly from the FFS site.

I scored a break room table near a wall which had an easily accessible network connection marked “Employee Use Only”. Ed had given us permission to attach whatever devices were necessary to complete this investigation, and by Joe my Powerbook was one of those devices.

After receiving a 10.0.2.x IP address from the network, I was able to access the internet.

“Ok, so I’m a nosey customer, and I want to research Treesoft. Hello, Google!” I said to myself as my copy of Firefox appeared. I typed in “Treesoft” into the Google search field and immediately received several thousand hits. Most of the search returns were web pages from Treesoft’s own website, game review sites, game retailers, and discussion boards.

Thirty minutes later, I saw them.

Source: archived original

Part V · Feb 13, 2006

I located all six documents on FFS’s site. There was no posting time, no poster identification, and nothing else to isolate who could have uploaded these files. I was treated to lots of ads for adult entertainment sites, gambling sites, and cheap pharmaceuticals. “Great.” I thought. “I get the same offers in my spam folder.”

I clicked on the first download link to download document number one, which was the Microsoft Word memo from Dave to the entire Treesoft staff.

** Your download will start in thirty seconds. Registered, paid members don’t have to wait! Click here to join today for only $15US a month! **

I had plenty of coffee left and a few minutes to kill. They weren’t getting my $15.

After going through the same process for the other five documents, I had them neatly arranged in a folder on my Powerbook. I immediately opened up Disk Utility and made a read-only disk image of this folder. I wanted to work with these files in the exact state that I found them.

I had two Microsoft Word documents and four ASCII text files. I dumped the metadata from the Microsoft Word documents first :

_ Document was created on Windows. Created : MS Word Revised : MS Word Last Author(s): 1 * CS * 2 * CS * 3 * CS * Summary Information Title : Memo Subject : Authress : EN LastAuth : CS RevNum : 4 AppName : Microsoft Word Created : 01.05.200x, 09:18:00 Last Saved : 01.06.200x, 11:33:00 Last Printed : 01.06.200x, 11:33:00 Document Summary Information Organization : Treesoft Games _

The second Word document had very similar Metadata. I identified CS as being Chandra Smith, Peter’s administrative assistant and EN as being Ed Notincourt.

Not a whole lot to go on here.

The three text files of source code appeared to have each line terminated by the familiar ^M control character. Interesting.

BEEP

My trusty Palm Treo alerted me to my first round of employee interviews that started in five minutes. I quickly packed up my Powerbook and headed towards a small conference room located near the administration side of the building.

When I conduct interviews in a company, I prefer to start with the ’lowest hanging fruit’. My first twenty interviews were with the the twenty newest employees to the company. None of these interviews were very productive towards establishing new leads for our case. Well, until I talked to my next interviewee; a developer named Eric ManDitt.

The following is a transcript from the last half of that interview:

_ Chief: Eric, I’m going to show you six documents that have been distributed outside of the company. These documents contain confidential information that has been leaked to unauthorized persons.

Eric: Okay.

Chief: These first two documents are company memos. Look familiar?

Eric: Um, well the first time I saw them was when they were posted to a couple of game sites. I’m too low on the food chain to get stuff like that.

Chief: Fair enough. How about this one? It discusses the schedule of the game you’re working on.

Eric: That’s familiar. Yes.

Chief: And these snippets of source code. These are from the game you are coding, right?

Eric: Yep. I guess. _

At this point, Eric was in deep thought and not really paying attention to my probing questions. He had ’the look’, which is usually an indicator that he had something to share.

_ Chief: Eric, is anything wrong?

Eric: No, not really. It’s just kind of weird I guess.

Chief: Weird? What? How?

Eric: Um, well my team would have the necessary access to that source code, but the only person on my team that would have those memos and the project schedule would be our lead programmer, Sven Svenson. It’s probaby just a coincidence. _

Coincidence, indeed.

Source: archived original

Part VI · Feb 17, 2006

My eyes were killing me. I had just finished up a marathon of interviews with Treesoft employees and was wandering back to my makeshift headquarters in an empty office. “Yo.” said a familiar voice behind me. Scrap entered the office with two venti cups of Starbucks pleasure. “You look like you need a date with the bean queen.”

“You could say that.” I mumbled. “Dude, I have never seen a company that employs so many robots. These people literally come to work each day, do their job, go home late, and don’t really socialize that much. The newest employees were quite friendly, the veterans were very dry.”

Scrap smiled. “So much for that culture of caring, eh?”

I noticed that Scrap had plugged his trusty Scraptop into the network and was busily looking through scrolling network traffic.

“You got something?”

Scrap seemed to not hear me. A few moments later he glanced up from his Scraptop.

“I’m trying like hell to figure out their network security policy here. It’s not documented at all. If you look at the firewall rules, they block everything on the ingress, but don’t block anything from the egress. However, they do use a smart proxy on ports 80 and 443 to track web usage.” Scrap said, tapping his pen on the desk in front of him.

“Does the firewall do any port logging in ‘ACCEPT’ mode at all? Are you telling me they could have people sending information out of the network through any port? That sucks.” I said in disgust. “If it is someone inside the network, we’re going to have a fun time proving something that happened in the past.”

Scrap sat up in his chair. “Hold on to your britches, boss. If the leakage continues, the listener box on the gateway will snag it. Maybe we just need to have some patience?”

I sipped my Starbucks and took a deep breath. For once, Scrap was telling me to calm down.

“You’re right. We wait. I have one last interview to do before we jam out of here today. Want to join me while I talk to Sven Svenson?” I asked.

“But of course.” Scrap said as we wandered down the hallway and headed towards Sven’s office.

knock knock

I knocked on Sven’s door, however Sven couldn’t hear me. His ears were covered in headphones that were pounding his brain with loud trance music.

“Sven.” I said. “SVEN SVENSON!”

Sven looked up from his keyboard and practically fell off his chair. With one swift movement, he removed the headphones from his head and stood straight up.

“Oh, hi! I am Sven. And you are?” Sven asked.

“I’m Chief, this is Scrap. We just need to ask you a few questions as part of a security risk assessment.” I replied as I glanced at the notepad in my hand.

“Sure! Okay. This is about that stuff they found on the web, right? Very bad. Very bad.” Sven said as he locked the screen on his workstation. “I was very upset to see that. My team wrote that source code, you know.”

Sven wasn’t a lot of help. Our interview established that he did have the memos stored on his workstation, and he did keep snippets of code laying around on his hard drive. All source code was kept on a CVS server, of which he was the administrator. Sven made it a point to mention several times that no programmers are allowed to email source code around, especially outside of the company.

Scrap and I returned to our temporary office to pick up our things before we headed back to the hotel. I took a moment to check my email, and Scrap was busy staring at the screen of his Scraptop again.

“Chief.”

I looked up from my Powerbook.

‘What?"

Scrap turned his laptop around. “Remember when we worked that case at that school? The kids that set up the P2P network using supposed DNS servers?”

“Yep. Why?” I asked.

Scrap pointed to an ethereal capture screen, which displayed thousands of connections between the external interface of the firewall and several unknown IP addresses.

Treesoft had some leaky leaves.

ESBN 79770-060217-996910-78

Source: archived original

Part VII · Feb 23, 2006

“They allow peer-to-peer clients on their network? Scrap, where’s the network guy? What was his name?” I asked Scrap in a machine gun fashion.“Well, boss, like I’ve been trying to say… nothing is really documented that well. The network guy, errr, Kurt is working on a dying mail server and hasn’t given me much time.” Scrap responded.

I crumpled up some fancy artwork I was drawing on my notepad and tossed the museum piece into the garbage can. “Alright, I’ll go find Kurt. Run back to the wiring closet and tap the inside interface of the firewall. I want to know what machine or machines are serving up that P2P soup. The minute you locate the machine(s), pull their plug(s).”

Scrap rubbed his hands together. “Roger that.”

I sprinted down the hall and almost ran John over.

“Woah! Chief! Something up?” John asked as he turned to walk with me.

“I need to talk to your network guy, Kurt. He really hasn’t been available much to answer our questions.” I said, almost out of breath.

John didn’t look happy. “What? I told everyone, especially Kurt, that they needed to be available. Let me take care of…”

“John, seriously… it’s okay. I’ll find him. Thanks anyway.” I said as I opened the door to Treesoft’s server room.

John’s behavior was very bipolar. One moment he was the happy company man, the next moment he was the only guy not wearing deodorant at a cocktail party full of fashion models. Strange.

I found Kurt curled up next to a large midrange server on the floor. He appeared to be locking the server’s external case and about to power the machine back up.

“Hey Kurt, all done?” I asked.

Kurt stood up and towered over me by at least a foot. The man was huge.

“Yeah, I think so. Looks like my RAID controller went south, but I’m hoping that my array is still intact. I guess I’ll find out after I hit the power button.” Kurt said as he powered up the machine.

“Kurt, real quick… Scrap found some P2P traffic between the internal Treesoft network and the internet. Do you allow P2P clients on the internal network?” I asked.

My neck was becoming stiff from looking up at Kurt, so I took a few steps back.

“P2P? Hell no. We went through this about a year ago. You found some P2P traffic? What machine is it coming from?” Kurt asked as he watched the server scroll POST messages on the server’s console screen.

“Scrap is finding that out now. Do you have a moment? We could really use your knowledge of the network.” I begged.

“YES! YES!” Kurt screamed as he slammed his huge hands together.

“Wow, I’m glad you’re excited about helping.” I laughed.

“Nah, my array is fine. Phew. There was a lot of mail on there. Okay, let’s go find your friend.” Kurt said with a grin.

We wandered down another hall and found Scrap sitting on the floor of the wiring closet, staring at his Scraptop screen.

“Yo.” I said as I walked in behind Kurt. “What do you have?”

Scrap looked up from the Scraptop.

“One internal IP address.” Scrap replied. “10.0.1.75, and I was about to see who owns that puppy!”

**scraptop:~ scrap$ nmblookup -A 10.0.1.75 Looking up status of 10.0.1.75 DELL1234 <00> - P TREESOFT <00> - P DELL1234 <03> - P DELL1234$ <03> - P SSVENSON <03> - P MAC Address = XX-XX-XX-XX-XX-XX scraptop:~ scrap$ **

Kurt did not look amused.

ESBN 91355-060223-830681-62

Source: archived original

Part VIII · Mar 2, 2006

“Sven? Sven is running P2P on MY NETWORK? Oh, let me take care of this!!!” Kurt said as he brushed by me on the way out the door.Scrap and I hustled after Kurt, fearing for Sven’s life.

Kurt made a beeline for Sven’s office, only to find an empty desk.

I glanced at my watch.

“It’s getting pretty late. Looks like we missed Sven.” I said as Kurt sat down in Sven’s chair.

“Bah, we don’t need him. So help me, if Sven has P2P software installed on this workstation I’m going to remove his hippie sandals and beat him to death with them!” Kurt said with a snarl of his lip.

Kurt wiggled Sven’s mouse, and a Windows 2000 desktop appeared on the monitor.

“Now I’m really pissed!” Kurt said. “Sven has been messing with the security settings on his workstation again. All of our workstations should lock after 10 minutes of inactivity.”

I made some notes on my notepad and watched Kurt as he maximized a Limewire client window.

“Well my friend, Mr. Sven is going to eat some sandle candy tomorrow morning.” Kurt said as he scrolled through Limewire’s library lists.

I squinted my eyes and made a cursory observation of the files that Sven downloaded. Every single file was an mp3 audio file.

“What has Mr. Sven been sharing with the rest of the internet?” Scrap asked.

Kurt fussed with Limewire’s preferences.

“Good grief.” Scrap said as he shook his head. “Almost his entire C: drive is shared out!!!”

I peered at the configuration settings. Scrap was correct. Some key folders that were shared were:

** C:\DOCUMENTS AND SETTINGS

C:\TEMP

C:\WINNT

C:\LIMEWIRE

C:\STUFF **

“Kurt, can you click on the monitor tab? Can we see what people have downloaded from Sven’s workstation?” I pleaded.

“Sure thing.” Kurt replied as he clicked on the monitor tab. A huge scrollable list of files appeared on the screen.

We were about halfway through the list, when some familiar filenames began to appear.

As sure as the satisfaction gained from a venti americano at Starbucks, the six files posted to the web were present in the list. All of them downloaded a few days before Treesoft was made aware of the breach.

“Great milking monkeys!” Scrap exclaimed as inched closer to Sven’s monitor.

“Chief, we found six documents posted out on the web. According to these upload records, I would guess that at least a hundred .txt, .rtf, .doc, .xls, and .pdf have been downloaded.”

I closed my eyes. This couldn’t get any worse.

“Uh, dudes? Did you two notice that all of these Treesoft documents were downloaded by a single IP address?” Kurt said with a grin.

A clue.

[Post your theories! ~ Chief]

Also, please vote for me here, and next week we’ll be celebrating monkey style! (And no, I don’t mean hanging by our tails and flinging poo!)

ESBN 57021-060302-487343-27 Rate content: https://web.archive.org/web/20140910120053/http://esbn.org/esbn/verify.asp?id=5702106030248734327&rate=yeshttps://web.archive.org/web/20140910120053/http://esbn.org/esbn/verify.asp?id=5702106030248734327&rate=no

Source: archived original

Part IX · Mar 7, 2006

I was scribbling notes onto my notepad faster than Scrap writing phone numbers down at a singles convention. “Interesting. One IP address downloaded all of our ‘interesting’ documents, and they were all downloaded within about a sixty minute period of time on the same day.” I noted. “Looks like somebody found what they wanted.”

Scrap wrote the IP address on his monkey paw with an ink pen and disappeared down the hall.

“Kurt, how much of a problem have you been having with P2P software on the network? Have you considered changing the security posture of the firewall to, you know, block outgoing traffic on non-proxied ports?” I asked as I snapped a couple of photos of Sven’s desktop and his limewire configuration.

Kurt took a deep breath. Evidently I had hit a sore spot.

“Chief, you should have been here a year ago when I was hired. It was a zoo! Everyone had whatever they wanted on their workstations, there were almost no security controls in place. A large percentage of the programming staff had P2P stuff running day and night on their machines. When you have a small pipe to the internet like we have here, that slows up everything. Sven, here, was one of the worst offenders.” Kurt said as he pointed to a picture of Sven on the far wall. “He’s a damn good programmer, but has a thing for authority. Ironic that they made him a manager.”

“Indeed.” I agreed. “So you’re controlling the installation of unauthorized software by corporate policy? No controls on the desktop?”

“Yep. I tried to lock them down the Microsoft-recommended way, however the programmers install/uninstall stuff off their workstations all the time. I gave up. I talked to John and Peter one day and they decided to go on the honor system. You see how far that’s gotten us.” Kurt lamented.

I smiled. “Kurt, you’re a systems administrator. You’re never going to be able to make every user happy every day. It’s impossible.” Of course, when your sysadmin is as large as Kurt, you’re lucky when you don’t get pounded into paste after doing something stupid.

“Thanks. I need to head home and feed my cats. Here’s my cell number if you guys need anything.” Kurt said as he offered me his business card.

I made my way towards our ‘base camp’ of an office. Two bankers boxes of HR records greeted me as I unlocked the door.

“And I was worried about not having any bathroom reading later.” I chuckled to myself.

I dove into the HR records and selected Sven’s personnel record. Amazingly enough, Sven didn’t have a single disciplinary action form in his file. It would appear that his earlier P2P misconduct was forgiven with a verbal warning. As a matter of fact, I didn’t find a single disciplinary action form in any of the employee files.

“Now THAT is a first.” I said as I dropped the last record back into the box. I found nothing to help me generate a motive for the leaked information.

Frustration began to set in.

I was temporarily distracted from my unhappiness by Scrap’s footsteps running down the hall and landing in our office.

Scrap was out of breath.

“Chief… you… aren’t… going to… believe… this.” Scrap panted.

“What, that you need to cut down on the Newports?” I responded.

“No dammit, look at this!!” Scrap said as he handed over his Scraptop.

** scraptop:~ scrap$ nslookup 64.xx.xx.xx Server: 10.0.1.9 Address: 10.0.1.9#53 Name: xx-xx-xx-64.gamersbeatches.net

scraptop:~ scrap$ whois gamersbeatches.net Registrant: GAMERSBEATCHES.NET Entertainment, Inc (DOM-XXXXX) 12351 Third Circle San Francisco CA 94XXX US **

“Gamersbeatches.net? Scrap, aren’t those the guys that were almost bought by Majorcorp a year ago?” I asked as I reached for my Powerbook to do some research.

Scrap was still panting. “I… know… that’s why… I wanted… to show you… this.”

I brought up Google and quickly searched for several articles on the thwarted purchase of gamersbeatches.net by Majorcorp.

Scrap was busy hacking up a lung.

“That’s it! That’s right. These guys were knee deep in negotiations and the due diligence caved in on GB. They weren’t nearly as valuable as they claimed to be. They went from a game developer to a gaming news site.” I exclaimed as I grinned ear to ear.

Scrap had blown the case wide open.

67413-060307-591271-38 Rate content: https://web.archive.org/web/20140901135625/http://esbn.org/esbn/verify.asp?id=6741306030759127138&rate=yeshttps://web.archive.org/web/20140901135625/http://esbn.org/esbn/verify.asp?id=6741306030759127138&rate=no

Source: archived original

Part X · Mar 9, 2006

I couldn’t sleep a wink. Scrap and I were up late theorizing about the connection between gamersbeatches.net and Treesoft.Was this just a coincidence that Sven’s P2P application shared information that was sensitive to Treesoft? Was it a coincidence that someone at GB just happened to do a keyword search for items that turned up on Sven’s drive? If there was an insider at Treesoft trying to do the company in, why not just email the documents home or steal them on a thumb drive? Why go through all this hassle?

Scrap had fallen asleep on the floor of my hotel room and, as usual, was snoring louder than Delta Burke on a lazy Sunday afternoon.

I closed my eyes and struggled to get a few hours sleep. The facts of the case were whipping around in my brain so fast that my eyes were rotating in their sockets. Had I missed a clue? Had I overlooked an obvious fact? Was I making ridiculous assumptions?

“Screw this.” I said as I rolled off of my bed and nearly stepped on the Scraptop, perched carelessly on the floor. A quick glance at the clock revealed the time to be 0600 hours.

It was coffee time.

I grabbed my notepad and Powerbook and jumped in the elevator. I was a short walking distance from the temple of the brewed brown bean.

My eyes started to rotate again. The thoughts returned.

I had missed something.

Minutes later I was rushing back up the elevator, laptop bag slung over my shoulder and two venti coffees in my hands.

“Scrap! Scrap! Wake up and clean up. We need to drive over to Treesoft first thing.” I said as I handed Scrap his coffee.

Scrap rubbed his eyes. “Dude, I had the weirdest dream. I dreamt that Barbie from our Minotaur case was washing my car and eating a hamburger at the same time…”

I really should work alone.

Several hours later we finally arrived at Treesoft HQ. I unlocked our office door and threw one of the banker’s boxes of records at Scrap.

“What gives?” Scrap complained. “Did you switch to espresso or something? Calm down!”

His comments were a whisper. I had zeroed in on the bankers box that I wanted and was feverishly going through all of the current employee records again, one by one.

“You want me to go interview Sven when he gets in? You look a little psycho.” Scrap said.

“What?” I snapped back.

“Preoccupied! You look preoccupied.” Scrap responded, correcting himself accordingly.

“Fine.” I said as I waved him back out the door. I had found what I was looking for.

Scrap entered Sven’s office to a familiar sight. Sven was staring deep into his monitor, trance music beating into his ears via headphones.

“Yo.” Scrap said as he waved his monkey paws in front of Sven’s face.

Sven jumped. Again.

“Scrap! Scrap! Hey, I’m glad you’re here. Check out this wicked piece of japanese anime I snagged from some dude!” Sven said as restored a minimized media player window.

“Sven, what gives with the Limewire window? I talked to Kurt last night and he said that P2P software is banned here.” Scrap asked in a most sincere voice.

“Aw, Kurt is so anally-retentive about this network. I bet he burps up pearls. I just turn it on for searches. Okay, here’s the video!” Sven said as he maximized the video window.

“Seriously man, can I ask you what directories you have shared on your machine?” Scrap queried.

Sven looked confused.

“Uh, my ‘stuff’ directory. That’s all I ever share out. Check it out, I have movies, music, some cool pictures of sheep …”

Scrap ran around third base and aimed for home. “Sven, can you bring up your preferences in Limewire?”

Without a flinch, Sven clicked through menu options.

“Ya, and?” Sven asked.

Scrap reached towards the sky with his monkey paw and scratched his head.

The only directory shared was C:\STUFF.

98078-060309-897911-68 Rate content: https://web.archive.org/web/20140910142203/http://esbn.org/esbn/verify.asp?id=9807806030989791168&rate=yeshttps://web.archive.org/web/20140910142203/http://esbn.org/esbn/verify.asp?id=9807806030989791168&rate=no

Source: archived original

Part XI · Mar 14, 2006

“I swear, I don’t know. I seriously do not know.” Sven stammered as he made eye contact with everyone in the conference room.I was playing my hand forward and had decided to conduct an interview with Sven. Scrap and Ed were present in the room, carefully taking notes of the discussion.

“Well, I’m a bit confused Sven. Last night your workstation was unlocked, limewire was running and sharing very sensitive company files, and you don’t seem to know anything about this?” I asked as I slid a few photos of Sven’s desktop toward him.

Sven examined the photos carefully. His hands were shaking, and his face clearly showed a state of befuddlement.

“Chief, you have to believe me. I know that P2P was banned on the network. I know I shouldn’t have disabled the screen lock on my workstation. I most certainly know to never share directories with sensitive stuff in them! I have this exact limewire configuration on my home computer. I only share one directory, and that directory is full of pictures, movies, and other fun things.” Sven said.

I stopped my pacing around the room and took a seat directly across from Sven.

“Sven, let’s assume that you’re telling the truth about this obvious violation of company policy for a moment. Put on your detective hat. If you didn’t start that limewire session with the modified sharing preferences, who did? What is their motive? Clue us in here.” I said in a calm voice.

Sven started looking at the floor. You could almost hear the squeaking noise from the hamster running around on their wheel inside his head.

“I really try to follow John’s philosophy of ’everyone for the company, the company for everyone’. I haven’t made any enemies here, and if I have it was completely unintentional.”

Ed leaned towards me in his chair and slid a file folder towards me. I was puzzled that Ed chose this time to provide me with more reading material. Scrap sensed that this material was important and proceeded to ask Sven some technical questions about other possible workstation safeguards that Sven had disabled.

With Scrap providing cover, I opened the folder and found a stack of door reports for the Treesoft HQ building. I scrolled down the report for yesterday, and found several interesting entries.

**17:30 - MAIN - OUT - KURT 17:45 - MAIN - IN - CONTRACT - CLEAN1 17:47 - MAIN - IN - CONTRACT - CLEAN2 19:30 - MAIN - OUT - CONTRACT - CHIEF 19:30 - MAIN - OUT - CONTRACT - SCRAP 20:15 - MAIN - OUT - ERIC 21:30 - MAIN - OUT - CONTRACT - CLEAN1 21:32 - MAIN - OUT - CONTRACT - CLEAN2 **

I closed the folder and peered over at Scrap. Scrap knew what this look meant, and ended his questioning of Sven.

It was time to play an ace that I had tucked into my monkey fur.

“Sven, tell me about your relationship with one of your programmers - Eric Manditt.” I queried, careful to watch for a reaction.

“Eric? Eric. Yes, we have a history. Eric and I worked together in the past on a lot of games. I wouldn’t say that we are friends in a social sense, but we work well here at Treesoft.”

“Sven, didn’t you and Eric apply for the same job at Treesoft?” I asked, again looking for a reaction.

Sven seemed puzzled at my questions.

“No, no we did not. Well, wait. That is complicated. We both applied for programming positions. We were both hired as programmers. A few weeks after I was hired I was promoted to a management position of ’team lead’ which was a serious horizontal promotion, if you know what I mean.” Sven replied.

“And how has Eric taken to the role of your subordinate?” I asked.

“Okay, I guess? We have never spoken about the subject.”

I flipped over my ace.

“For the record, where did you and Eric work together before?” I inquired.

Sven’s expression changed almost immediately.

“Gamersbeatches” Sven replied.

The monkey holds a royal flush.

[Chief’s note: Ok investigators, wrap this up. Post your theories! So many of you have been so, so close!]

49941-060314-416542-20 Rate content: https://web.archive.org/web/20140910114013/http://esbn.org/esbn/verify.asp?id=4994106031441654220&rate=yeshttps://web.archive.org/web/20140910114013/http://esbn.org/esbn/verify.asp?id=4994106031441654220&rate=no

Source: archived original

Part XII · Mar 17, 2006

“So, boss, how are we tying this together?” Scrap asked as he reached for the salt shaker on the table. We were at a local deli digesting some wonderful sandwiches, and the morning’s events.“Lots of suspects, lots of motives, but no smoking gun. The details of our investigation have been kept pretty close to us throughout, so for the most part nobody knows all the pieces of the puzzle. This may be an opportunity for us to capitalize on their motive, and their assumption that we’re still in the dark on a number of matters.” I said with a mouthful of a french dip sandwich.

Scrap took a drink from his water bottle. “Do I smell another stakeout?”

“Could we be that lucky?” I replied with a grin. Of course we were going to do another stakeout!

Our plan was formed and agreed upon before our after-lunch coffee cups were cold.

We returned to Treesoft and initiated our trap. Scrap spent the next few hours putting together a ‘ScrapBag’, while I proceeded to interview some remaining staff. Our plan could only work if certain individuals had no idea that we were on to them.

My interviews left me fruitless, and my last appointment of the day was with Ed, the general counsel of Treesoft. It was shortly after 1630 hours, and Ed’s administrative assistant had gone for the day.

KNOCK KNOCK

I tapped on Ed’s partially open office door.

“Chief? Hey, come on in. Have a seat. I’ve been looking forward to our meeting today.” Ed said as he shook my paw.

“Thanks for taking the time to see me Ed. I wanted to update you on our progress. After our interview with Sven this morning, Scrap and I have developed a plan that I don’t want to share with you at this moment. However, I do need you to explain something to me which may help tie everything together in the end.” I stated as I sat down in a plush leather office chair.

Ed grinned from behind his glasses. “Chief, anything you need. Just ask. What can I help you with?”

I pulled a large file folder from my trusty chimp bag and spread the contents over a corner of Ed’s desk.

“Ed, this is the standard Non-Disclosure Agreement (NDA) that all Treesoft employees are required to sign, along with contractors like Scrap and myself. Every employee and contractor is given a copy of this agreement, and one copy goes in their employee folder. However, one employee is missing this agreement from his folder; Eric ManDitt. Did Eric sign this agreement?” I asked.

Ed immediately turned around in his office chair and started flipping through a filing cabinet.

“You’re almost right, Chief. The employee gets a copy, their file gets a copy, and unknown to the employee is the fact that the legal department keeps a copy too. Yes, Eric did sign one on his first day of employment. It’s right here.” Ed said as he handed me copy of the agreement marred by a large “LEGAL - RECEIVED XX/XX/XX” date stamp at the top of the page.

I grinned. “Any idea why Eric wouldn’t have a copy of the agreement in his file?”

“Well, human resources could have screwed up I suppose. Or, maybe he removed it without HR knowing? I’m grasping at straws.” Ed replied.

“One other question, Ed. Can you please explain to me this section of your NDA?” I said, pointing to a paragraph with my right paw.

**“You acknowledge and agree that due to the unique nature of the Proprietary Information, any breach of this agreement would cause irreparable harm to Company for which damages are not an adequate remedy and that Company shall therefore be entitled to equitable relief in addition to all other remedies available at law.” **

Ed thought for a moment. “Hmmm. I have to be honest, this NDA was prepared by our outside legal representation. What I can tell you is that it was intended to convey the threat of a lawsuit against the breaching party, or possibly the receiving party depending on the situation.”

I was writing notes as fast as my monkey arm appendages would push my pen.

“We are saying that money wouldn’t compensate us. Unless we can come up with a sum certain amount of damages, assuming we have mitigated any further harm, and the damages were forseeable at the time the contract was formed, we wouldn’t be able to bring a breach of contract action anyway.” Ed said, appearing a bit perplexed at the wording of the agreement.

My ears were perked.

“So what you’re saying is that you could make a prayer for relief in equity; that relief could be anything from money, to an injunction, to a …” I asked.

“Yes, yes. That’s what I’m getting at. It really depends on the situation. We might sue for damages, we might get an injunction, we might send out cease-and-desist requests. Can I ask what brought this up?” Ed asked as he pushed his glasses farther back on his nose.

“Just standard review of your agreements.” I replied with a grin.

BEEP

Scrap had sent me a text message on my trusty Treo.

The old lady has dropped her bag. Film at 11!

Nobody can say that Scrap doesn’t have a sense of humor.

I thanked Ed for his time and wandered back to our office, closing the door behind me as I entered.

“Did you push the old lady to make her drop her bag?” I asked with a grin.

“You could say that. The gym bag is on the credenza behind Sven’s desk. I told him I wanted to charge up some laptops, and asked for a power outlet. I also remembered to lock the bag this time.” Scrap said with a grin, remembering a recent case where Scrap’s camera equipment was stolen while deployed.

“Fantastic. If all goes well, we should have some good surveillance to review in about four hours.” I said with large smile.

This tree was about to get really constipated.

56592-060317-483055-27 Rate content: https://web.archive.org/web/20140910135156/http://esbn.org/esbn/verify.asp?id=5659206031748305527&rate=yeshttps://web.archive.org/web/20140910135156/http://esbn.org/esbn/verify.asp?id=5659206031748305527&rate=no

Source: archived original

Part XIII · Mar 20, 2006

Anyone standing outside of the conference room door would have thought that Steve Balmer was inside throwing chairs around. Certain members of Treesoft’s management team were not happy with my briefing.“Gentleman, if I may continue …” I said with my hands raised in front of me. “A number of your questions will be answered in this briefing.”

The room settled down abruptly as I switched the slides of my Keynote presentation.

“When my associate noticed that P2P traffic was entering and leaving the Treesoft network, we investigated immediately. The traffic was due to a P2P client installed on Sven’s workstation. There were no firewall safeguards in place to prevent this application from working as designed. Through our investigation, we learned that while Sven claimed to have only kept the application running while searching for specific music and video files, we discovered that the application was, in fact, running 24/7. The photographs on this slide are digital photographs of the limewire configuration, and of the documents being shared. You’ll notice that the six documents found on the internet are on this list.” I explained.

Scrap stood up from his seat and continued the briefing.

“After we isolated the source of the traffic (Sven’s workstation), we made a tactical decision to immediately close the point of the breach as quietly as possible. I initiated a block of the P2P traffic by performing an “ARP spoof/poisoning” of Sven’s workstation. I directed all traffic to and from Sven’s workstation to our monitoring machine. At the monitoring machine, I dropped all P2P traffic in transit and let the rest of the traffic through. This procedure made the P2P client think that it couldn’t achieve a connection, which served the purpose of closing the breach. We used this approach because we did not want to directly involve Treesoft networking staff in the technical portion of our investigation.”

A quiet murmur began between a few members of the executive management team, their eyes fixated on our presentation.

I moved to the next slide.

“My associate was able to pinpoint which P2P clients on the internet had downloaded the confidential documents. As you can see on this slide, all of the documents were downloaded by a single IP address that is owned by Gamersbeatches.” I said with a wave of my paw.

John was holding his head in his hand, shaking it from side to side in disbelief. Dave had started typing on his blackberry. Ed, being the astute legal begal, was writing pages and pages of notes.

Peter appeared to be pretty annoyed and spoke up.

“Chief, let me make sure I have this straight. You’re telling us that an employee unintentionally shared confidential documents to the outside world through a P2P client, and a gaming web site just happened to find these documents?”

I flipped to the next slide and addressed Peter.

“Yes and no. We suspected that the sharing properties of Sven’s limewire application were being manipulated without his knowledge. While Sven was in the office, his limewire application appeared to only share music and video files. Somehow, these properties were being changed after hours. Our next step was to set up surveillance on Sven’s workstation to see if the changes were being made physically at the workstation, or possibly through some type of remote control software.”

With a few clicks and several adjustments to the display projector, I queued up a video clip.

“This video was taken last night. We have examined the video very thoroughly, and believe we now know who is making changes to Sven’s application while he is gone.” I said as I clicked the ‘play’ icon on the video clip.

The clip showed the inside of Sven’s work area. The camera inside the Scrapbag was positioned perfectly. A few moments into the clip, a figure appeared.

Eric looked confused.

He was standing in front of Sven’s workstation, manipulating the mouse and clicking through multiple windows on the screen. First, he brought up Limewire from the minimized icon. He then clicked through multiple levels of configuration screens, and added several key directories to the shared resources. However, things weren’t working the way he wanted.

The clock next to Sven’s monitor read 08:02 PM. After several minutes of attempted connection troubleshooting, Eric returned the desktop and windows to their normal configuration and left the office.

I stopped the video and turned my attention to the stunned members of Treesoft management seated at the conference room table. Within seconds, everyone started talking at once in loud, passionate voices.

“Gentlemen, gentlemen … PLEASE!” I begged. “Let me finish my presentation.”

The room gradually quieted down.

“It is highly probable that Eric has been changing these application settings every night since a few days before the ‘six documents’ appeared on the internet. According to the door reports, Eric and the cleaning crew are typically the only people here after 6PM. In the video, Eric is confused because limewire is no longer able to connect out to the internet. He gives up and leaves the area. We were unable to find evidence of any other tampering of Sven’s workstation.” I said with another change of the slides.

John interrupted me with a loud grunting noise. “Let’s not gloss over this whole ‘Gamersbeatches’ thing. If I’m hearing you correctly, you’re saying that we have one employee trying to frame another employee, or just get that employee fired?”

I leaned over the conference room table and placed my paws on either side of my notebook.

“John, there are a lot more employees involved than Sven and Eric.”

John appeared to have stopped breathing.

Coming Up Next: The Conclusion!!! Who else was involved at Treesoft? And why?

Chief

65096-060320-568092-35 Rate content: https://web.archive.org/web/20140910114019/http://esbn.org/esbn/verify.asp?id=6509606032056809235&rate=yeshttps://web.archive.org/web/20140910114019/http://esbn.org/esbn/verify.asp?id=6509606032056809235&rate=no

Source: archived original

Conclusion · Mar 22, 2006

“I knew I picked the wrong week to quit drinking coffee.” lamented John as he sat back in his chair. I hoped that he was kidding about the coffee.

I changed to the next slide in my presentation, a series of emails from Eric.“My associate conducted a thorough search of email accounts for specific keywords that are listed in the handouts you received. As you can see on this slide, Eric had numerous email conversations with a ‘bblack’. Unfortunately for Eric, bblack screwed up and replied to him from the wrong email address. If you’ll flip to the next page in your handouts, you’ll see excerpts from these emails.” I said as I brought up the emails on a slide.

**To: [email protected] From: [email protected] Subj: ok i still dont see them and my limewire proggie is working just fine

To: [email protected] From: [email protected] Subj: re: ok OK - try now. The peer servers take forever to update or somthing [sic].

To: [email protected] From: [email protected] Subj: re: re: ok damn there are like ahundred[sic] files! ok i see gloom_gfx5.txt and stuff like that. cool. **

John was shaking his head from side to side, clearly not happy with what the evidence suggested. Ed raised his eyebrows at me, and I returned with a quick nod that nobody noticed. Ed quickly excused himself and left the room.

“Speaking of mail …” I continued, “my associate noticed some irregularities with your mail server.”

Scrap piped up. “While recording some standard information about the mail server, I noticed that it had recently gone down hard due to a system crash. The mail server was a linux server running postfix mail services and used ‘.mailbox’ format mail boxes. Upon examining /var/log/wtmp, I saw that a system crash occurred while we were on site investigating these matters. I queried Kurt, your systems administrator, about the crash. Kurt advised me that the server developed a problem with its RAID controller and needed replacement. Kurt then proceeded to tell me that after replacing the RAID controller and examining his homemade performance logs, the linux server was at an extremely high load when the server failed.”

The members of the management team were relatively technical (especially John) and seemed to follow the flow of the conversation.

“In Kurt’s logs, he recorded a ‘ps aux’ snapshot seconds before the server crashed. Examining this snapshot showed that a user was creating a large load on the server through an imap mail session. I investigated the imap application’s logs and found that the same user was initiating a large delete of the contents of their ’trash’ folder. When I inspected the user’s home directory and looked at the contents of their mail trash folder, I found that the server had not deleted all of the emails in the folder due to the crash. It was in these emails that several artifact discoveries were made.” Scrap reported as the conference room door opened.

Ed entered the room followed by Rosa, the human resources director, and three uniformed private security guards. All of them stood against the wall.

“What’s going on here?” Peter asked.

Scrap cleared his throat, clearly trying to get everyone’s attention back on his presentation.

I nodded at Ed & Rosa.

Ed decided to take control of the situation.

“The mail folder belonged to Dave. Inside Dave’s trash folder were several email exchanges between Dave and you, Peter.” Ed said as he removed hard copies of the emails and slid them towards Peter.

“You and Dave have worked together to over-inflate the value of Treesoft for a year. And perhaps the most damning thing about the contents of the emails? Your private negotiation attempts with Majorcorp to buy John out cheap, sell the intellectual property, and take your money to the bank.” Ed said.

Rosa approached Ed with a letter in her hand. Ed unfolded the letter and slipped his glasses back on to his face.

“Peter Warginoff. Dave McEww. You are hereby notified that you are relieved of your duties with Treesoft, Inc. and are ordered to vacate the premises immediately. Signed today by the Treesoft board of directors and agreed to by a majority vote conducted this morning.” Ed read in a very Perry Mason-ish tone.

I glanced at John. He appeared to be watching a car accident of sorts, and in shock.

Peter and Dave rose from their seats without saying a word, and were escorted out of the building by the uniformed security guards under Ed’s watchful eye.

“My company. My company!” John moaned as he held his face in his hands. “I trusted those guys with my life’s work. This is all unbelievable.”

I grimaced.

“Look at it this way John. Today is the first day of a rebuilding of sorts for Treesoft.” I said with a large monkey grin.

“John, I have something that you should read.” said Rosa as she passed a folded piece of white paper to John. Either Rosa was a lady in the know, or she had origami as a hobby.

**John, You are hereby appointed as acting President and Chief Executive Officer of Treesoft. Please join us during an emergency board meeting today at Noon.

• Treesoft Board Of Directors ** “I guess congratulations are in order, man!” Scrap bellowed with a flash of monkey teeth.

The conference room door opened slowly. Kurt entered the room, cracking his knuckles as he walked.

“What a morning. First, I see Manditt escorted out to his car by Rosa. A few minutes later I see Svenson getting yelled at by Rosa, and he disappears back behind his desk with his tail between his legs. Then, to top it all off, I see the CEO and CFO of my company escorted out by uniformed security guards. I think I’m going home early today!” Kurt exclaimed as he sat down in a conference room chair.

Ed was right behind Kurt and approached John.

“John, I have our outside legal counsel preparing cease and desist orders for the websites that are publishing those documents. I made a few phone calls to gamerbeatches’ counsel, and they are all over this on their side. We won’t be the only ones terminating employees today. This was quite a double-punch, and some damn good detective work by our consultants.” Ed said with a satisfied grin on his face. “So John, what now?”

John sat up straight in his chair and looked Ed right in the eyes.

“I could really use a cup of coffee.”

Music to my ears.

98605-060322-903191-69 Rate content: https://web.archive.org/web/20140910144406/http://esbn.org/esbn/verify.asp?id=9860506032290319169&rate=yeshttps://web.archive.org/web/20140910144406/http://esbn.org/esbn/verify.asp?id=9860506032290319169&rate=no

Source: archived original