Originally published by Chief Monkey on the A Day in the Life of an Information Security Investigator blog (the “Security Monkey” blog) at it.toolbox.com. Mirrored here from the Internet Archive. All rights remain with the original author. See the section intro for full attribution and takedown contact.
Part I 路 Jun 13, 2006
“Dude, I am SO BORED.” popped up in my iChat window on my trusty Powerbook.
It was a message from Scrap, who was sitting next to me at a newly created network security conference. Neither one of us had been impressed with the content of the conference, and were busily surfing away on the conference’s free wi-fi internet connectivity.
“This presentation is almost over. We can skip the resort lunch and grab a pizza and some beer around 11:30.” I messaged back. Why we were instant messaging each other and not simply quietly whispering amongst ourselves is a puzzle left to the reader.
BZZZZZZZZZZZ
I nearly jumped out of my chair. I was receiving a telephone call on my trusty Treo and had the ringer set to ‘vibrate’. I made a note to myself to contact Palm and inquire whether they also made high-voltage cow prodding poles and possibly electrocution chairs.
I quietly closed the lid of my Powerbook, slipped it into its carrying case, and crept towards the meeting room door.
“Chief.” I said quietly into my silver squawk box.
“Oh, you are there! Chief! Hi! It’s Reese!” came a perky female voice on the other end of the conversation.
A smile crept over my face. Reese never calls just to say ‘hi’.
“Reese? It’s been a while. When was the last time I bumped into you, Vegas?” I asked, remembering The Case Of The Audacious Attacker.
“Oh my, what a memory you have. Yep. I have since left SouthWestern Silverware Technologies and went to Buhlchet Silicon, Inc. as Chief Marketing Officer!” she squeaked.
“Impressive.” I replied. “Congratulations are in order. I’m guessing you didn’t call to catch up.”
Reese paused for a second and I could make out the faint sound of a door closing on her end of the connection.
“You know me too well. I have a discreet matter that I think you can help me, well, ‘us’ with.” Reese said quietly.
“‘Us’? Do you have a mouse in your pocket?” I joked.
“The Director of Financial Operations, Louis, brought something to my attention a few weeks ago. It’s big. I mean, it’s REALLY BIG. If this gets out to a certain batch of our shareholders or the media, I’m pretty sure the entire company is going to tank. We want to investigate, silently remove the guilty parties, and then discuss the matter on our terms at an emergency shareholders meeting.” Reese whispered.
“Good grief, woman! Spill it! You’re killing me!” I begged.
Reese opened her office door briefly, closed it, and took a deep breath.
“Our three top executive officers are about to steal some money from our shareholders.”
I furled my brow. “Like that doesn’t happen every day.”
“Chief, we’re talking several million dollars.” said Reese.
I nearly dropped my phone.
漏 2006 All Rights Reserved.
Source: archived original
Part II 路 Jun 15, 2006
“Do you see dead people?” Scrap said as he waved his monkey arms in front of my face. The class had ended and the participants were spilling into the hallway that I was standing in the middle of.
“After eating your cooking? Hell yes.” I snapped back as I placed my Treo back into its carrying case and stepped to the side of the hallway. “You aren’t going to believe who just called me.”
Scrap thought for a moment, and then his eyes lit up. “Jessica Alba? SWEET!”
“Yeah. Uh, no. Reese called me, and she’s a suit over at Buhlchet Silicon now. A couple of larger suits are allegedly planning on stealing some serious cash from the company.” I said.
“No shi…?” Scrap said after I described the amount of money involved.
“I’m not kidding. I’m going to need a new sidekick for this job.” I said as I pulled my Treo out of its case and started scrolling down through my contacts list.
“WHAT? I’m not going?” Scrap whined.
“No, I need you to go to Seattle and start the job that we were planning on starting tomorrow. This works out fine, because I’m going to need somebody with some serious accounting and business skills.” I said as I found the name I was looking for.
“Awww, mannnnnn.” Scrap moaned.
I held the Treo to my ear and let the melodic ringing sound tickle my eardrum.
“Inez speaking.”
“Inez? Chief here. How are you?” I asked.
“Wow, a voice from the past. I haven’t seen you in years. What can I do for you?” Inez queried.
“Are you still doing the forensic accounting thing?” I asked as I crossed my fingers.
“Sure. I actually just returned from a gig in Hawaii. Have something in mind?” Inez inquired with a hint of hope in her voice.
“As a matter of fact, I do. I need you to meet me at Buhlchet Silicon headquarters in three days.” I said.
“Buhlchet? Oh my, my ears are perked now. Lay it on me.” Inez said so cheerfully that I could hear her smile on the other end of the phone.
“Their director of finops came across some stock option paperwork that was stuck in a laser printer. Apparently the CEO was planning on cashing in some stock options.” I said.
“Nothing wrong with that, Chief. Stock options are typically a large portion of any executive compensation package.” Inez replied.
“Correct. However, this director had been with Buhlchet from the very beginning and was very familiar with the stock grants that the executive team had received. Something on the paper didn’t jive.” I explained.
“Really? Chief, you have me intrigued. So are they adding extra zeros to their grant amounts, or what?” Inez joked.
“Wait, you haven’t heard the best part. The director takes the printout to his office and looks through the official employee files of the entire executive team. The CEO, COO and CFO all had stock grants in their files, and they all looked similarly weird.” I blathered on.
“Oh, oh, I know! They changed their share price, right? Made it one dollar!” Inez said.
“Try backdated executive stock options.” I said.
I think it was Inez’s turn to drop her phone.
21002-060615-127159-91 Rate content: https://web.archive.org/web/20140910142244/http://numly.com/numly/verify.asp?id=2100206061512715991&rate=yeshttps://web.archive.org/web/20140910142244/http://numly.com/numly/verify.asp?id=2100206061512715991&rate=no
漏 2006 All Rights Reserved.
Source: archived original
Part III 路 Jun 21, 2006
“It’s raining like crazy up here!” Scrap yelled into his cell phone. “I’m still waiting on a cab and some hot coffee.”
Three days had passed and Scrap was checking in from the airport in Seattle. The client had decided to start a few days later than originally planned, which worked out just fine for us considering our new case load.
“Are you and Inez going over to Buhlchet today?” Scrap asked as he blew a large quantity of smoke into the phone.
“Affirmative. I’m on my way to pick her up at the airport down here as we speak.” I said into my cell phone’s hands-free headset. “Check in with me again after your initial meeting with the client up there and let me know how things are going.”
“Roger that. Oh, a cab! Gotta go!” Scrap mumbled as he hung up.
Scrap was never much on goodbyes.
I maneuvered my vehicle to the arrivals curbside check-in and found Inez waiting patiently with her bags placed neatly on the ground in front of her.
“Hola, stranger!” Inez yelled as she threw her bags into the back seat. “You’d think as much as I fly that I wouldn’t hate it so much.”
“I know what you mean.” I replied with a grin. “Let’s grab some lunch before we meet with Reese.”
Moments later we were seated in a nice mexican restaurant being waited on by a girl named Rosa. After ordering some drinks and lunch, we got down to business.
“So fill me in on the details. What’s our mission?” Inez asked as she bit into a tortilla chip topped with salsa.
“I don’t have a whole lot more to tell you at this point aside from the details that I shared on the phone, but I’ll recap.” I said as I perused my notes on the notepad next to me.
“Buhlchet compensates executives with stock option grants. Buhlchet’s stock has been all over the board during the past few years because of increased competition and delayed product launches. According to Louis, the director of financial operations, the grants in question were to the top three executives almost a year ago when the stock was at $60. Buhlchet’s stock is currently at $70. The grant paperwork that Louis recovered from the office printer listed the grants at $40 a share with a date of two years ago. The executives have grants for a combined total of 200,000 shares.” I said.
“Wow. That’s blatant.” Inez said with a grin. “There’s a big difference between $6M and $2M.”
“Exactly.” I replied.
“Judging from what you told me a few days ago, the company’s board is clueless?” Inez asked.
“That’s the fear. Reese told me that the company is sitting on $200M in cash too. That’s a big cookie jar.” I joked.
Inez was lost in thought for a moment and closed her eyes before she began to speak.
“Unless there are additional details, we have to find proof that the documents were forged and that the shareholders never knowingly approved these grants. This is going to be fun.”
She had no idea.
漏 2006 All Rights Reserved.
Source: archived original
Part IV 路 Jun 27, 2006
“Looking sharp, Chief!” Reese commented as Inez and I were escorted into her plush office at Buhlchet Silicon. “I almost didn’t recognize you.”
I grinned. “Hey, I figured I’d polish up a bit to meet with a CMO. Reese, this is an associate of mine, Inez.”
Reese and Inez shook hands and exchanged business cards in a most robotic fashion.
“Inez is a forensic accountant. She has substantial experience in researching accounting fraud and explaining things in plain English. I felt that her experience would be a huge plus to our investigation.” I explained.
“Oh, I agree! This is fantastic. While we are doing introductions, I see the rest of our party has arrived.” Reese said. Her attention was clearly focused on something behind me.
Three gentlemen walked through Reese’s door. The first was a fifty-ish gentleman identified as Louis, the director of financial operations. The other two gentlemen appeared to be in their mid-forties and were introduced as Charles and Fred, both members of Buhlchet’s board of directors and some type of acquaintances of Louis.
“Fred and I are grateful to Louis and Reese for bringing this to our attention.” Charles said with a smile. “We’ve both been on the board for a long time, and neither of us have any love for the three top executives of this firm. This latest discovery has us very concerned. If other members of the board discover this inquiry, or if the shareholders catch wind of this, we’re going to be hung from the flagpole by our ankles. We need to get this matter resolved quickly and discreetly.”
“Discretely? That’s my middle name.” I thought to myself with a laugh. The odds of discretion were much higher without my overly flirtatious sidekick along for the ride.
I placed my notebook on the corner of Reese’s desk and addressed the group.
“You look like you want to say something, Chief.” said Reese.
I clasped my hands together and took a deep breath.
“Do we have copies of the original grant letters?” I asked.
Louis shuffled around in his chair, shifting his weight from one cheek to the other.
“We’re not sure.” Louis replied.
Inez shot me a concerned look as she scribbled notes in her notebook.
“Has anyone confronted the executives yet? Louis found the printout on the printer and the supposedly modified agreements in the executives’ employment folders. Has anyone verified that what we suspect has happened has really happened?” I said as the voice of reason in the room.
Glances were exchanged around the room.
“I don’t believe anyone has said anything to the executives yet, Chief.” Louis responded.
“Our first order of business will be to locate the original copies of the grant letters, and authenticate them. We’ll then need to compare those letters with the documents in the employee files, and possibly recover digital evidence from computers that could have been used to modify the documents here in the office.” I said. “Louis, Inez and I are going to need access to your paper and electronic records.”
Louis nodded cooperatively.
Charles and Fred stood up at practically the same time and offered me a handshake.
“It sounds like we’re on the right track. Fred and I will be in contact.” Charles said as they exited the room with Louis.
“Chief, I’ll run you two down to Finance.” Reese said as she stood up from her desk chair.
“Nice.” Inez whispered in my ear. “This isn’t an investigation, it’s a lynching.”
漏 2006 All Rights Reserved.
Source: archived original
Part V 路 Jul 4, 2006
“Anybody need a coffee?” Reese asked as she showed us to an empty cubicle in the finance department.
“Like you need to ask.” I said, trying to hold back my laughter.
“Nothing for me, thanks.” Inez replied.
“Got it. The main doors of each area are badge controlled. Your badges should give you access to most departments. I have identified you as private auditors to the staff, so they should be cooperative and not too curious. Chief, I’ll be back with an extra-large coffee for you.” Reese said as she made her way out of the department.
“What is it with you and the coffee?” Inez asked with a flirty smile.
“If you have to ask, you wouldn’t understand if I told you.” I replied back. Love of the bean can be hard to explain to a non-believer.
“Right. Okay, I’m off to find the finance supervisor and start pulling files. What’s your plan?” Inez queried.
“I’m going to make my way down to the IT department. Reese slipped me a name of somebody that I suspect will be able to help in this investigation. Well, I’ll head down there after I get my coffee, of course.” I replied. A monkey has to have his priorities straight.
Ten minutes later and coffee in hand, I made my way down the elevator to the IT department. I badged myself through the primary door and started to look at nameplates on office doors.
“Three doors down from the machine room window…” I mumbled to myself, trying to remember Reese’s directions.
There it was!
The nameplate read “Dogson, Brian. Manager, Information Technology”
Impressive.
I politely knocked on the door and took a step into the office.
“Come in.” rang a familiar voice.
“Brian?” I asked, having only talked to Brian on the phone before while in Vegas with Reese.
“Are you Chief?” Brian asked as he got up from his desk. “This is a pleasure. Reese thinks the world of you. We haven’t talked since that whole ‘weed’ issue while you and Reese were in Vegas, right?”
“Correct.” I replied. “You and Reese seem to have done quite well after coming to Buhlchet.”
Brian sat down and rubbed his hand across his mahogany desk. “You could say that. What’s going on? Reese told me to take care of you.”
“My associate Inez and I are investigating a pretty sensitive matter for the company. This goes all the way to the top. In order to do so, we’re going to do a little digging around in financial matters and IT resources.” I replied.
“Okay, my interest is piqued. How can I help?” Brian asked with a grin.
I handed Brian a piece of notebook paper.
Brian glanced at the paper and raised his other eyebrow.
“This is a date range.” Brian said. “I’m not sure I understand.”
I shuffled through the pages in my notebook, ripped out another page, and handed it to Brian.
Brian examined the second sheet closely and ran out of eyebrows to raise.
“Are you serious?” Brian exclaimed.
“Absolutely.” I replied.
漏 2006 All Rights Reserved.
Source: archived original
Part VI 路 Jul 7, 2006
“Dios Mio!” Inez exclaimed as she laid her head on the pile of papers on her desk, her silky dark hair spilling over the desk and into my coffee cup.
“Uh, Inez I think you got your…” I started.
“This would be so much easier if we just walked upstairs and asked the alleged conspirators if they were guilty.” Inez whined as she pulled her hair out of my coffee cup. “Every time I think I’m done searching this rabbit hole I find another rabbit hole.”
“Rabbit hole?” I queried as I started to take another drink of my coffee, only to change my mind after spying a single hair dangling from the lip of my cup.
“Si. This place gives out stock options to every… what is the saying? Every ‘Dick & Harry’?” Inez asked as she paused to remember her English vocabulary. “The initial grant numbers don’t match everywhere. I’ve looked at the grant papers in the file, the copies filed by the Board of Directors, the grant tracking spreadsheets that are used by the finance department, and nothing matches what is on the grant papers.”
“Fascinating.” I said as I scratched my chin with a paw. “Show me one of these grant papers.” Inez dug through the pile of papers on her desk and retrieved several sheets of paper.
“Here, this is the grant paper that was in the CEO’s folder. Mira!” Inez said as she shook a paper in my direction.
_ NOTICE OF GRANT OF STOCK OPTION
Notice is hereby given of the following option grant (the “Option”) to purchase shares of the Common Stock of Buhlchet Silicon, Inc. (the “Corporation”):
Optionee: John Johnson
Grant Date: January 6, 1999
Vesting Commencement Date: January 6, 1999
Exercise Price: $ 40.00 per share*
Number of Option Shares: 100,000 shares*
Expiration Date: January 5, 2009
Type of Option: Non-Statutory Stock Option
Exercise Schedule: The Option shall become exercisable for one-hundred percent (100%) of the Option Shares upon Optionee’s completion of two (2) years of Service measured from the Vesting Commencement Date and shall become exercisable upon Optionee’s completion of the first day after two (2) years of Service measured from the Vesting Commencement Date.
In no event shall the Option become exercisable for any additional Option Shares after Optionee’s cessation of Service._
“What a sweet, sweet deal.” I said as I shook my head. “These guys get to cash in all of their playing cards? NICE! Inez, let me see the other two option grants.”
Inez pawed off two more sets of papers at me. Both grants read the exact same way, however they had different numbers of shares for each executive.
“What’s this attached to each grant option?” I asked as I flipped pages.
“That is their standard compensation agreement.” Inez remarked as she pointed to the second page.
_ COMPENSATION AGREEMENT
Agreement dated as of the 6 day of January, 1999 by and between John Johnson (“Optionee”) and Buhlchet Silicon, Inc., a Delaware corporation (the “Corporation”).
W I T N E S S E T H
WHEREAS, Optionee is to provide services to the Corporation, and the Corporation wishes to provide an equity incentive to Optionee to provide such services.
NOW, THEREFORE, in consideration of the above premises, the parties hereto agree as follows:
-
On January 6, 1999 Optionee was granted an option to acquire 100,000 shares of the Corporation’s Common Stock (the “Option”) under the terms and conditions set forth in the Stock Option Agreement, attached hereto as Exhibit A.
-
Corporation and Optionee acknowledge and agree that the Option is granted as compensation for services and not for any capital-raising purposes or in connection with any capital-raising activities.
-
This agreement is intended to constitute a written compensation contract within the meaning of Rule 701 of the Securities Act of 1933, as amended.
-
Nothing herein or in the Stock Option Agreement shall confer upon Optionee any right to continue in the Corporation’s employ or service for any period of specific duration or interfere with or otherwise restrict in any way the rights of the Corporation or Optionee, which rights are hereby expressly reserved by each party, to terminate Optionee’s service at any time for any reason, with or without cause.
-
The Optionee and Corporation agree that in the event that Optionee’s service is terminated prior to the first day after the Vesting Commencement Date, this agreement will become null and void.
IN WITNESS WHEREOF, the parties hereto have executed this agreement as of the date first above written.
OPTIONEE: Buhlchet Silicon, Inc.
John Johnson By: Charles Charleston
Title: Managing Partner
_ “Look pretty airtight, alright.” I said.
“I have one concern so far.” Inez said as she removed the paper guts from a large brown folder in front of her. “You’ve looked at the executives’ paperwork, no? Okay. Here is the paperwork for the Vice Presidents. This stack is for the Directors. This stack is for lower-level managers. Take a look.”
I glanced through stack after stack of agreements.
“I give. I don’t see it.” I said as I rubbed my eyes. I was going to hold Inez’s hair personally responsible for lack of coffee at such a critical juncture in our case!
Inez sighed. “Mira… the executives’ paperwork is signed and approved by Charles Charleston. If you look at any other level of management, they are all signed by…”
“Fred Fredly” I blurted out. “Another ‘managing partner’. So these guys have been around since the beginning of Buhlchet, eh?”
“Yes, it would appear so. I think I know why they are so concerned about this alleged fraudulent activity by the executives.” Inez said as she motioned for me to look at her computer screen.
“What am I looking at?” I asked. “It’s a memo from a committee made up of board members, but its all financial geek speak to me.”
Inez laughed. “Aye, Chief. It’s a disclosure memorandum of some sort. Look at the spreadsheet attached to the memorandum.”
I whacked the ‘page down’ key a few times with a paw.
“Charles and Fred own TWO MILLION shares?”
Inez blinked her eyes at me.
“Si. And they want to buy more.”
**ASIDE:
What’s going on here, monkeys? Let’s get some theories brewing. Is Inez on the right track? What exactly DID I ask Brian to go find? Why is it relevant? **
漏 2006 All Rights Reserved.
Source: archived original
Part VII 路 Jul 13, 2006
“800 megabytes of Brazilian Transvestites!” Scrap exclaimed into his cell phone. “It was buried about 7 layers deep in his ‘My Documents’ folder, but Forensic Toolkit made short work of it.”
Scrap was entertaining me with an early morning phone call, as fresh coffee beans were ground in the coffee maker on my kitchen counter.
“Amazing.” I replied. “So the guy was trying to be sly by using an anonymous proxy in their office, completely unaware that you rigged a network content monitoring box inside their LAN’s Internet gateway?”
“Yep. It was easy to trace at that point, and warranted a confiscation of his laptop. He was not happy.” Scrap said, his voice bustling with pride at his successful case closure.
“How’s your Bullsheat case going?” Scrap asked.
“It’s Buhlchet.”
“Yeah, that.” Scrap replied.
I updated Scrap on yesterday’s activities as I poured the first cup of morning coffee and inhaled its suggestive aroma.
BEEP
“Scrap, I’ll catch up with you later. I have another call.” I said as I hurriedly switched lines on my phone.
“Chief.”
“Good morning, sunshine!” squeaked Reese. “I know it’s early, but I thought you should know that Brian was in this morning before the sun came up and I think he’s in a hurry to talk to you.”
“Really?” I asked.
Looks like my coffee was going to be drunk in the chimp car.
Moments later I was badging myself through door after door on my way to Buhlchet’s network operations department.
“Early bird got the worm?” I asked as I poked my head into Brian’s office.
“I’ll say.” Brian replied. “I knocked a couple of items off of your list, and I have to tell you that it wasn’t easy.”
“Eh?” I asked as I sipped the last of my coffee.
“I grabbed all three executives’ laptops this morning. Good thing for me they never take them home. I followed your instructions, and…” Brian began as he handed me three small anti-static bags sealed with the chain of custody labels I left him.
“Awesome. You made drive copies. What did you use?” I queried as I scanned the labels.
“Ghost. Thanks for the tip on that.” Brian said with a grin.
“Sweet. I’m going to need a work area to do some analysis. Can you set me up?” I asked.
“Mi casa es su casa!” Brian joked as he pointed to a lab area across the hall.
An hour went by quickly as I dragged Roscoe into the lab and started the drive images. Encase blazed through each drive with little difficulty.
RING
“Chief.” I barked into my phone.
“Where are you?” Inez asked.
“Well good morning to you too. I’m in network operations. And you?” I wondered out loud.
“Back in finance. I picked up where we left off yesterday. I couldn’t stop thinking about our discoveries, so I dug a little deeper.” Inez said, her voice becoming quieter.
“Why are you whispering?” I asked.
“Mijo, I don’t think we’re dealing with a simple theft case here.” Inez whispered.
“Well, that I think we both agree on.” I joked.
“Listen. Several years ago, these same three executives successfully persuaded their shareholders to not accept a buyout from DMA Macro. They successfully argued that the company’s products in the pipeline would be worth more to the company and the shareholders in the long run.” Inez divulged.
“That sounds like reasonable thinking. They were protecting the company they built, the investment by their shareholders, and their jobs.” I surmised.
“Si! Si! But they had to fight off an opposing position in the board of directors…” Inez whispered. “It’s all right here in front of me.”
“Okay, let me guess. Charles and Fred?” I presumed.
“Yes, among others. They have held this grudge for a long time.” Inez responded.
“Alright, keep digging. I’ll join you later.” I said as I hung up.
I returned to my duties in the lab and proceeded to perform several keyword searches on the first drive image with Forensic Toolkit. The drive belonged to the CEO, John Johnson.
Pay dirt!
I found several documents that contained keywords from the printout that was found on the laser printer. One of the documents appeared to be the grant document.
I exported the document out to Roscoe’s file system for a look. The document was password-protected for modifications, but did allow the document to be viewed.
“Well I’ll be a monkey’s uncle.” I mumbled as I viewed the document on Roscoe’s screen and scanned down to the option price.
$60.
Alright monkeys, what’s going on here?
漏 2006 All Rights Reserved.
Source: archived original
Part VIII 路 Jul 18, 2006
My monkey scalp was pretty irritated after the twentieth or so time that I scratched it with my paw.
I had found a copy of each executive’s grant letters on their laptop drives, all password-protected and unchanged. There were no other copies or similar documents on the drives.
“Hmmm.” I thought to myself. “Perhaps they knew the password, changed the document, printed out a few copies and then didn’t save the document? Possibly, but why aren’t there any other artifacts on the drive from the editing and/or printing of the documents? There were no trace elements to be found in the usual places, such as the event logs and temporary file space.”
I had stumped myself. I reached for my cup of almost warm coffee and was nearly jolted out of my chair by a sound coming from behind me.
“Chief! Don’t you know we don’t allow transients in here?” Reese joked as she stepped into the room with a longhaired primate close behind her.
“I see you made it back into town.” I joked as I threw an ink pen at Scrap. “Nice to have you back. Feel like another challenge?”
Scrap took a quick sip off his mountain dew and grinned. “Heck yeah, boss. Whatcha got?”
“I’ll see you boys later.” Reese said as she dodged any possible work assignments from yours truly.
Scrap slammed the rest of his mountain dew and released a rather impressive monkey burp.
“Talk to me about print logs, and wipe that moisture residue off your chin.” I said as I passed Scrap a tissue.
“Print server? What kind of print server? Windows? Unix? Embedded?” Scrap queried.
“HP Jet Direct. I asked Brian to give me a diagram that described the print environment in this place. It appears that the support folks set these workstations and laptops to print directly to the laser printers. Each area has their own laser printer.” I said as I revealed a crudely drawn diagram fresh from Brian’s pencil.
“Yee-haw.” Scrap joked as he stroked his goatee. “We have quite a few places to look.”
“No kidding. Wrap your brain around it. If you were going to trace a print job back to a machine and user on this network, where would you start?” I quizzed.
“Is everything a test with you?” Scrap barked back.
“Yes. Answer the question, Scrappy-san.” I demanded.
“Okay, okay. Well, the printer on this diagram that is circled doesn’t have any local logging of jobs. I guess I’d find the domain admin and find out who had that printer pushed out to them?” Scrap squeaked.
“That would be a good start, and lucky for you he’s right down the hall.” I said with a smile.
Scrap raised his eyebrows. “Hey, how did I get dragged into this? I need to get some sleep man!”
I escorted Scrap to Brian’s office and relayed our questions about the laser printer.
“Are you getting senile there, Chief? That was one of the items on your list!” Brian exclaimed.
“I know. I’m just trying to make Wolfman Scrap feel like he’s contributing.” I joked.
“Well, I almost had that list done. Where did I put it? Ah! Wait, I did have it done. Here you go!” Brian said as he slid another amazing pencil creation into my paw.
“Scrap, we’re going to modify your mission today.” I mumbled while squinting at Brian’s hieroglyphics.
“What? Now what am I doing?” Scrap yelled as he threw his paws into the air.
“I need you to steal a laptop.”
漏 2006 All Rights Reserved.
Source: archived original
Part IX 路 Jul 26, 2006
“One of the reasons that my family left Mexico before I was born was because of so much corruption in business. It nearly drove my father into the casa pobre!” Inez lamented as she waved around a dry erase marker. “It is what drives me in these situations, you know?”
I nodded understandingly. Corruption seemed to be everywhere, like why Starbucks always seems to run out of the exact coffee bean I’m looking for one day before I walk into the store. Some things are not meant to be understood by mere mortals.
“So, I stole this whiteboard out of that supply closet over there and propped it up on the desk in our private cubicle here to map this out for you.” Inez said with a grin.
“You’ll fit right in around here.” I laughed.
Inez started scribbling a flowchart on the whiteboard, and annotating it with a beautiful penmanship that one only finds in books.
“Louis finds a grant letter stuck in a laser printer. He then presents this letter to a trusted few: Fred, Charles, and Reese. We understand Fred and Charles, but why Reese?” Inez asked.
“Hmmm. She’s a C-level executive, she’s new, she made a good impression on the board…” I mumbled.
“She’s new.” Inez agreed. “Fred and Charles make a power play to Reese on how much this is going to screw up the company that she just signed on to. Reese drops your name as someone that can help.”
I scratched my chin to bootstrap my brain’s analysis engine.
“Reese gets us in here and the boys make their case. Nobody has talked to the executives about this at all.” Inez says as she drew another perfect rectangle on the board. “Why not?”
“They want to make sure they have a case before they…” I stuttered.
“Before they go to the rest of the board. They need concrete proof that there was a plan to steal from the company.” Inez reiterated.
“I’m following you. So the monkey brigade shows up and hopefully backs their claims based on a printout that Louis found on a printer and. what?” I asked.
“Exactly. We haven’t found anything else, so all we have is this… hey, wait a minute. Did Louis ever give you the paper that he found on the printer?” Inez asked.
“He gave it to Reese.” I said as I picked up my phone and dialed Reese’s cell phone.
“Reese.”
“Hey, it’s Chief. Can you run down here to finance and bring that grant letter that Louis gave you?” I asked.
“Sure. I’ll be right down.” Reese replied.
Several minutes later, Reese bounded down the hallway and appeared in our cubicle’s doorway with a paper in hand.
“Thank you.” Inez said as she examined the paper.
Inez’s brow furled with great intensity as she wrestled several papers from a nearby file folder and compared them to the Louis’ letter.
“Inez?” I asked.
“What do you think, mijo?” Inez asked as she handed me both pages. One was wrinkled badly as if it had been stuck in a printer with a failing toner cartridge and pulled out with great effort, the other was the grant letter from the CEO’s personnel folder.
“Jeezus Key-righst!” I said as I shook my head in disbelief.
“What? WHAT!” Reese said as she looked over my shoulder. “I don’t see anything.”
Inez leaned in closer to Reese and lowered her voice.
“The fonts are different.”
(Stay tuned for part X… up next!)
Monkeys, this case has more turns than a cheap jack-in-the-box. What does it all mean?
漏 2006 All Rights Reserved.
Source: archived original
Part X 路 Aug 10, 2006
Note: My apologies for taking so long on updating this case file. Between BlackHat, DefCon, and my regular workload, I’ve been one busy monkey! Without further delay, please read on. You may find it necessary to go back to Part One of this case file to refamiliarize yourself with the case.
“Okay, I am SO not seeing this. What do you mean ’the fonts are different’?” Reese asked innocently.
Inez gently folded both papers as to not make a crease in them, and then drew Reese’s attention to the date and dollar amount fields.
“How the hell did you see that?” Reese exclaimed with a smile on her face. “That is amazing.”
Off in the distance a faint whistling noise could be heard.
“Is there a bird loose in here?” Inez asked, glancing at the ceiling.
“No, that’s my cohort in crime looking for me. I’ll be right back.” I said as I wandered down the hall to the elevator.
“Ah, there you are Limp Biscuit. I have a present for you.” Scrap said as he removed a large piece of dark plastic from his messenger bag.
I couldn’t help but smile. Scrap was good.
“Awesome. Take that down to Brian, do a ’tag and bag’ and a couple of images. I’ll be down shortly.” I said as I turned in the direction of Inez and Reese.
“Roger.” Scrap said with an animated salute as he pressed the elevator button.
I double-timed it back to our work cubicle and grabbed my severely worn notepad.
“Reese, I know we’re supposed to update Charles and Fred shortly on the progress of the investigation, but I need you to stall them for a least a day. Can you do that?” I pleaded.
Reese developed a concerned look on her face and shrugged her shoulders.
“I guess so. Heck, I don’t even know what’s going on. What should I tell them?” she asked.
“Tell them that we’re having some technical problems with the electronic portion of the investigation, and we’ll do our best to update them by end of business tomorrow.” I responded.
“Okay. I need to get back to my office anyway. Call me if you need anything else.” Reese said as she bid us goodbye.
I heard Reese call the elevator with a familiar ‘ding’.
“Reese is a fantastic lady, but we need to play this close to the chest right now.” I said as I scrawled some notes onto my notepad. “I need to go down to the IT area for a while. Write your findings up and I’ll call you in a bit.”
“Whatever you say, Chief.” Inez said with Benny Hill-style salute. What was up with people saluting me today?
I made my way down to the IT department and found Scrap and Brian conducting an orchestra of disk imaging.
“Status?” I queried as I took a seat next to Scrap.
Scrap flipped his lab chair around to face me.
“First copy is running. Dogson over there is going to do the second image while I piece this laptop back together and return it to it’s home upstairs.” Scrap said, pointing to Brian.
“Excellent. How much longer is Louis going to be in that finance meeting?” I asked with a concerned look spreading across my face.
Scrap glanced at his watch. “A little less than an hour. We’ll make it. Don’t sweat it.”
Brian leaned back in his chair and grinned at me.
“What?” I asked.
“I knocked another item off of your list. Well, actually it was two items and a bit of a surprise. Take a look.” Brian said as he handed me a small stack of papers.
The first paper was a printout of a spreadsheet of workstation and laptop configurations. A single column on the spreadsheet identified the default (and sometimes the only) printer installed. The rest of the papers were in rather poor condition and looked like they had been stuffed in a college dorm couch.
“Interesting.” I said as I examined the papers closely. All of the papers had a similar ’low toner’ stain on them.
“These came from the destruction bin located near the same printer where Louis found the grant letter?” I asked.
“Well, that’s where the surprise comes in. I didn’t actually recover those documents… Scrap did.” Brian said.
“Huh?” I blurted out. “Scrap, where did you find these things?”
Scrap removed a few file folders from his messenger bag that were held together by a large binder clip.
“They were laying on top of these in Louis’ office when I recovered the laptop.”
I unbound the folders and opened the cover of the first folder. I immediately looked up at Scrap, then at Brian.
“Scrap, are these what I think they are?” I asked.
“Yes.”
漏 2006 All Rights Reserved.
Source: archived original
Part XI 路 Aug 29, 2006
Sorry for taking a few days off from the blog. I’ve been as busy as an office chair supplier around Steve Ballmer. (Don’t get the joke? Read here. Here is the severely late update to our latest case file. Enjoy! ~ Chief
The mystery was a large, ugly tapestry hanging in the men’s room at your local dive bar. It smelled funny, it contained images and colors that didn’t quite make sense, and was covered with a thin coating of dust and the occasional urine stain. It had one wild thread that wasn’t noticeable at first, but when pulled with a minimal amount of effort, caused the entire tapestry to unravel before your eyes.
I secluded myself in Brian’s office with my Apple Powerbook and wrote pages and pages of documentation based on my notes in my notepad.
“Chief.” Brian uttered as he stood in the doorway. “Louis’ laptop image is ready.”
I closed the lid of my Powerbook gently and rubbed my eyes. “Let’s do this.”
Brian led the way into the lab and I placed my monkey butt on the closest lab chair.
Speed was of the essence. With my notes fresh in my mind, I had many questions that needed answered. Roscoe was warmed up and had Louis’ drive image nestled in the folder c:\evidence\buhlchet\images\louis.e01.
I started Encase and FTK and created case files for Louis. After adding the image as an evidence source, I was ready to go.
Minutes ticked away like seconds, and hours blew by as minutes. Brian had brought a coffee pot into the lab and was grinding beans as fast as his chimp fingers could press the button. Scrap was… well, Scrap was asleep on the floor.
There were a lot of artifacts on this laptop drive, and some appeared to be far more interesting than others.
A few keyword searches for the company executive officers’ names revealed a small quantity of hotmail E-mails between Louis, Fred and Charles.
** From: Louis ([email protected]) To: Charles ([email protected]) Cc: Fred ([email protected]) Date: xx/xx/xxxx Subj: re:Continued discussions
No, I think the offer will get serious consideration. Johnson & company will be gone and we can get back down to business. We have to move the company forward no matter what. And yes, I’m sure it’ll work. L
We have concerns that the offer will still not receive consideration or enough acceptance to go through with Johnson and friends pulling strings. We have an opportunity to do this, let’s do this. Fred and I have talked about this and are not convinced that your idea is the best, however we are not at liberty to offer anything else at this time. … **
“Jeezus.” I said under my breath as I bookmarked the snippet and moved on to some other artifacts.
Brian was taking a serious interest in my activities and appeared to be quite wired on the coffee he had spent the past hour brewing.
“What are you looking for now?” Brian queried.
I initiated a few custom searches and peered over at Brian. “I’m looking for smoke.”
Brian rubbed his caffeinated eyes. “Smoke?”
“Yep.” I replied. “The smoke from the gun. And would you look at that…”
“What?” Brian asked.
“I’m looking for spool files. They exist as SHD and SPL file types. Both are created when a print job is initiated in Windows 2000. The files are typically cleaned up by the system, and as luck would have it I couldn’t find a single one. However, our tools have found several that were deleted, and some that are in slack space.” I said as I scrolled through the files.
“Two files types? I don’t understand.” Brian muttered.
“The SHD and SPL files have the same filename, just different extensions. The SHD file tells what print format was used when the SPL was created.” I responded.
“Oh! Wait! I get it. That’s how Windows knows what format to print in, right? EMF or RAW? I have printer spooler errors on some of the older gear here and I have to make manual adjustments to get them to print.” Brian said proudly.
“Exactly. We’ve found a few SPL files that look complete, but unfortunately the SHD file appears to be missing.” I said. “But, looking through the file… right here… we see EMF. Let’s see if Roscoe can display some of these.”
I minimized my tools and started my handy copy of splviewer. I spent a good deal of time recovering every SPL file I could find and viewing them with the viewer.
I stared at several files and didn’t move a muscle.
“Uh, Brian?” I said, not taking my eyes from the screen.
“Yo.” Brian responded
“I’m going to pop this file on a floppy and I want you to print it.” I demanded.
“No problem man.” Brian said as he quickly logged into a networked workstation in the corner of the room. I copied the carved SPL file onto a floppy and handed it to Brian.
“Here we go!” Brian said as he opened a command prompt and typed:
copy evidence.spl \pserver\labprint
A few moments later, the printer in the lab started to warm up and then proceeded to print out a document.
I picked up the warm piece of paper, the smell of fresh toner still lingering in the air.
“Well, what is it?” Brian asked.
“It’s a whole lot of smoke.”
漏 2006 All Rights Reserved.
Source: archived original
Conclusion 路 Sep 7, 2006
“I want to cry.” Reese said as she held her hands over her mouth. “I should have expected to hear this I suppose. I am so naive sometimes.”
Reese, Inez, Scrap and I were seated in a finance conference room the following morning. Inez and I were presenting our findings to a very emotional CMO.
“Chief, explain this to me one more time. Explain it to me like I’m Scrap on a nicotine bender.” Reese joked. Even in a crisis, Reese was able to hold it together to make a joke.
I flipped back to the first page of my notepad and glanced at Inez, hinting to her that she should do the same.
“My team and I have performed exhaustive reviews of financial and personnel records, thorough electronic analysis of computing resources, and did not find any evidence that the executive team has done anything wrong as accused, nor have we found evidence of any plans to do the same.” I said as I turned my attention to Inez.
Inez called everyone’s attention to the printed report that she had carefully passed out minutes before.
“The documentation that we were able to find was incomplete in some areas, and very inconsistent. The document that Louis found on the printer did not match any documents on file, or any documents in company safe deposit boxes, or any documents found on the executive team’s laptops. All of the agreements appeared to be legally sound and consistent with compensation agreements approved by the board of directors.” Inez said.
Reese shuffled in her seat and struggled to take more notes with a pen that appeared to be running out of ink.
“So where did this mysterious printout come from that Louis showed me, Fred and Charles? I’m still not clear on this.” Reese said, holding her face with one hand and scribbling with the other.
“This is where it’s going to get confusing.” I lamented. “There were only two people who had computers that were configured to print to the printer that the mysterious printout was found on. One was Louis, the other was a ‘Lance Legstrong’ who has been on FMLA (Family Medical Leave Act) for over a month.”
“But couldn’t someone have printed it on another printer and just left it on that one?” Reese asked.
“Great question.” Scrap interjected. “We thought of that. The printout that Louis found had a distinguishing toner mark on the page. We printed sample pages to every laser printer in the company, and none exhibited the same distinguishing toner mark. There’s a high probability that the document was printed on that printer.”
“We further concluded that the document that Louis found was a clever forgery. The font used on the document was very close to the font used in the original documents, but it wasn’t exact.” Inez explained.
Scrap cleared his throat. “The reason that the fonts were different was because the laptop used to print the document was missing the company standard font. Microsoft Word substituted another font that was pretty close.”
“The laptop. Run the laptop examination by me again?” Reese pleaded.
“We examined all of the laptops that were used by the executives. There was no conclusive evidence that any of the executives had viewed, modified or printed the document in the past month or so.” Scrap replied. “And then we looked at Louis’ laptop.”
Reese took a deep breath.
“Reese, I personally examined Louis’ laptop. His laptop was set to print to the printer that he found the printout on. His laptop is missing the company standard font for whatever reason. I recovered print spooler files of several printouts of modified grant documents that all had the wrong font used.” I said. “However, Scrap made an important find in Louis’ office that I’m not sure you caught the first time we explained this to you.”
“The documents? What were they again?” Reese asked as she slowly blinked her eyes.
“Louis had file folders on his desk that contained the original grant letters that he supposedly couldn’t find before. He also had almost ten ’test’ printouts of the modified grant letters. All had the toner mark and the incorrect font.” Scrap replied.
“And the E-mails?” Reese asked.
I flipped through the documentation that we provided Reese. Several of the pages were transcribed E-mails that were recovered from Louis’ laptop.
“As you can see from the documentation in front of you, Louis has been communicating with Charles and Fred for a long time regarding this issue using personal E-mail accounts. In these E-mails, you’ll see that they conspired find a way to discredit the executive team in the hopes of their removal from the company.” I said.
“My God. The buyout? The DMA buyout? I was told of this shortly after I started working here. This whole thing is a bunch of angry boys throwing spit wads?” Reese said as she angrily shook her head.
“These are some pretty big spit wads.” I commented.
“Si. Reese, these allegations are serious. There are severe penalties for the company and those involved with any type of stock irregularities. If I had to make a suggestion to you right now, I would recommend that you go upstairs and inform your general counsel immediately.” Inez said as she closed her notebook.
“You realize I’m going to need you to give this presentation a few more times? Like maybe in thirty minutes?” Reese said as she searched through her purse for a tissue and wiped her eyes.
“We’re on your dime, big spender.” I joked in an attempt to get a laugh from an obviously upset Reese as she headed towards the door of the conference room.
“I’ll call you in a few moments. I appreciate all the work that you all have put into this.” Reese said in a faint voice as she closed the door.
“What a mess.” Inez said as she took a drink from her water bottle. “How do you guys do this all the time? I’d be an emotional mess!”
“It’s hard at first, but after a while you just get used to it.” Scrap joked.
“Exactly. Sort of like flying.” I said.
“Speak for yourself, gringo!” Inez exclaimed.
[Chief’s Log] My team presented our findings approximately five times over the course of a month. Louis was terminated and personally escorted out of the building by the vice president of human resources. Our findings were presented to the Buhlchet board of directors (minus Charles and Fred), and both perpetrators were summarily removed of their responsibilities. Charles and Fred have filed several lawsuits against Buhlchet, and Buhlchet has returned the favor by counter-suing.
This case was as challenging as trying to get a monkey to clean your bathroom!
漏 2006 All Rights Reserved.
Source: archived original