Come, we’ll to sleep. My strange and self-abuse
Is the initiate fear that wants hard use:
We are yet but young in deed.
—Macbeth III.iv
Monday morning I walked into the office at CCS feeling even more naked than my shaved face. For the first time I could remember in recent years, I wasn’t carrying a computer with me. The police still had my office under lock and key, much to the surprise of the people who shared the rest of the house. I’d received a call from Daniel’s counselor, Janna, before I even got to CCS both thanking me for the work I’d done and asking to be briefed on anything I could provide that didn’t breach a confidence but that she could use in counseling him. She was almost speechless when I told her what I’d discovered and why my office was taped off.
“I can’t believe it. I wish I’d sent him to you so much sooner. I just can’t believe that it was a stalker and not just a bully—not that that wouldn’t have been bad enough.”
“It wasn’t your fault,” I calmed her. “Besides, it’s likely that if it had come to my attention earlier, I’d have missed the solution. It just happened that another project I was working on gave me a lead on where to pursue this one.”
“Nonetheless, I won’t hesitate to send cases your direction. Anything I can do for you, I’ll be happy to.” That struck a chord with me.
“Say, now that you mention it, there is something I’d like to ask you,” I said. “I don’t suppose you give any classes in dealing with teenagers, do you?”
“It would take longer to teach that kind of class than for the kid to grow out of his teens. Do you have something specific?”
“I’m concerned about a friend—well, the daughter of a friend—actually the daughter’s friend.” I explained casually as I could. That certainly wasn’t a great start. It sounded like I was covertly asking about myself. “I’m wondering if certain behaviors that we’ve observed might be indicators of something more significant or if it’s just part of growing up.” Janna encouraged me to tell her what was on my mind, so I plunged ahead. I explained some of what Cali told me about Mel and my own observations. This technically wasn’t part of my contract with Cali and I was not using any names, so I felt secure in the idea of not betraying a confidence. The counselor then gave me some pointed advice.
“What you’ve described could simply be a part of growing up. Kids act out all the time. But you’ve described a couple of things that I’d explore if I were counseling the kid. Ultrastrict parents aren’t necessarily a sign that a kid is under duress. We see lots of Asian kids that handle the pressure of strict parents without much trouble. Their problems are more likely to be in socialization. But sometimes, when combined with other things we’d revise that opinion. Your teen sounds like she’s an over-achiever. Several sports, straight As, and a party attitude. Her vulgarity could just be a response to pressure to cut loose. But the idea that she has ‘many freaky on-line friends’ as you said, makes me think she could be treading on dangerous ground. Sometimes a kid that aces everything and is fully self-assured will expose herself to more risks than normal simply because she figures she can handle it. It’s definitely worth looking into, especially since she might be leading a friend down the same path.”
I thanked her profusely and said I’d check a few things. If I needed further advice, I’d be sure to give her a call.
***
When I walked into the office at CCS, I was still thinking about the conversation with the youth counselor. I was going to need to look through Mel’s social accounts. But today, I was going to have to do something about my search for a fraud inside a credit card company that I’d already grown to dislike. And I was going to have to do it without my own computer and tools.
I started thinking about something Lars taught me back in the Navy. He set up a drill in training in which we were to track down an intruder and neutralize the suspect. We—a team of six intelligence trainees—were locked in a room with our backs to each other and told to use the resources at hand to track down the culprit. We were scanning all available files on our network, looking for a breach. We quickly divided up the tasks among us and started our search. It was frantic. Lars hadn’t given us an exact deadline for finding the problem, but alluded to the fact that if we didn’t find the security breach soon, the damage would be irreparable. It was a typical war games scenario and we occasionally tossed information back and forth among us to help the search with others. We were nearly an hour into the search having found pointers, but not being able to locate the problem.
I suddenly became aware that the room was quieter than it had been before. I glanced to my left and right to see four of my team slumped over their computers. I spun around to see a silenced sidearm pointing in my direction. The last of my teammates was behind the gun smiling at me. The door to our room opened and Lars walked in. The other four team members sat up at their computers.
“You all failed to achieve your mission objective,” Lars stated. “All except Ensign Cooper. Why did you fail?”
“We weren’t looking for a physical threat,” I answered. “We were looking for an online threat.”
“Which is why you were vulnerable. You let yourselves believe that because you are computer analysts, the threat you were looking for was computer-based,” Lars lectured. “If at any time, any of you had looked around, you would have seen a physical threat manifested in the room. You cannot ever assume that you are safe just because you are inside a sealed room. The dangers in this game are not only digital. They are real and physical.”
I’d become lax.
We live in a digital age. I was hired to find a security leak. I’m a computer geek. It was natural to assume I was looking for something on the network.
As my dad would say, “If all your tools look like hammers, then all your problems will look like nails.”
I stopped in my office and booted up the laptop just to find out if there were any messages from my secret Santa and to check my email. I wasn’t paying much attention to anything that came through unless it was from one of my team or from Arnie. There was nothing on either count, so I put the computer to sleep and left the office.
“Are you done for the day already?” Darlene asked as I passed her desk. “It is only 9:30.”
“Not done, but I’m doing some other investigation that requires a little field work. I’ll be in the building, but might not get back here to the office. Call me if I’m in danger of losing my job.”
“Which job?” she snarked. “Never mind. If Arnie needs you, I’ll call your cell.”
I walked out the security doors past the receptionist and took the elevator to the third floor. The first two floors of this building were occupied by small business and retail. CCS occupied floors 3-26.
There was no receptionist on this floor. The elevators opened into a narrow lobby on either end of which were more security doors. I’d walked the building a few days ago, but I hadn’t tested every set of doors. Third floor contained the company’s server farm. If they got any bigger, they would have to move to offsite storage. There were complexes that covered acres of space in Oregon, Idaho, and Montana, housing some of the thousands of servers that made up what was popularly known as “the cloud.” I wasn’t sure my ID would gain access, but when I passed the card over the reader at the door, I was rewarded with the click that allowed me entrance.
Once inside, however, I wasn’t positive where I was going. I needed to look fairly self-assured, so I clipped my badge to my jacket pocket where it was clearly visible and walked confidently along a row of outside wall offices. These offices were different from those on the upper floors. There were no windows into the hallway. Each office had a solid oak door behind which, I knew, were the dozens of technicians and analysts that kept the servers running and the company network updated. If the offices had windows, as I assumed they did, they would look over an alley or onto the street. No one on this floor would have a sweeping view of Puget Sound and the Olympic Mountains.
The inside wall of the hallway was just a blank wall. There were two doors on each hall, each with its own card reader. I casually passed my card over the reader on the first door I came to. There was no answering click and no green light on the reader. Just as I thought. Either by accident or accidentally on purpose, I was not issued a card that would automatically open every door in the company. I’d suspected as much. I couldn’t imagine Arnie giving me access to executive offices, Human Resources, or the server farm, though my network access had revealed no digital blocks. Technically, I should be able to access any one of the servers here without entering the room. But there were areas in the company that had information I could only access physically. One of those areas was on the 12th floor.
I completed my circuit of the farm and emerged again in the elevator lobby. I went down and out onto the street with my cell phone already dialing the number I’d punched in. Jordan answered on second ring.
“What a can of worms you opened up this time,” Jordan announced without even saying hello. “This is going to take us days just to get a case active and warrants issued. How did your client take the news?”
“He cancelled every on-line account he had, including his ISP and turned off his computer,” I said. “I should say that his father did. I can’t blame them. I didn’t want to go online again after I found that, either. In fact, I still haven’t been online. That’s what I wanted to ask you about.”
“Sorry, friend, but I can’t give you access to your computers yet,” Jordan said. “I don’t know how you managed to accomplish everything you did in as short a time as you were working on it. It’s taking our tech hours to document it.”
“I appreciate that, but I’m wondering if I can get access to the office without the computers. I need to pick up a couple of things that I need on the CCS gig.”
“I don’t see a problem with that. Our impound order only includes the computers currently running and equipment attached to the network. When do you need access?”
“As soon as possible. I could be at the office in half an hour.”
“I’ll meet you there.”
***
Jordan accompanied me into my office and I nodded to the tech who was sitting at my computer recording things into a voice-activated microphone. Behind him and to one side, sat a court recorder, watching to see that all he did was read what was available and did not attempt to change anything. As he spoke his notes, she typed them into the steno machine.
One of the first purchases I made when I took this space was a fire-proof locking file cabinet. I looked over the warrant for the computer impound and verified that they were not authorized to touch anything else in my office. Then I unlocked the cabinet, opened the third drawer, and rummaged around a bit. I finally came up with the little tech toy that I wanted and shoved it in my pocket.
I went a little overboard when I started as a private detective. I’ve always been into toys, but as soon as you get your license, you start getting mail of all sorts. Catalogs of high tech surveillance equipment, offers of hacking software, classes and courseware from every conceivable educator and part of the world, and—surprisingly—an incredible number of spam emails from people who just shouldn’t send that stuff to private detectives. They provided a great target for investigation with no apparent benefits to themselves. What I wanted now, however, was a tech toy that I’d picked up at SpyCon in March in Vegas. My first time there was a real eye-opener. After I’d strolled through those aisles, the volume of junk mail and email I received quadrupled.
What I had in my hand was a miniature RFID reader.
The ID card issued to me by CCS was a typical smartcard. In smartcards, there are three active elements. The first is the picture and identification information printed on the card itself—the human-readable part. The second is the gold-colored chip exposed on the back of the card. This exposed circuitry must be in contact with a smartcard reader in order to be activated and is almost impossible to counterfeit. When I slide my card into the reader on my laptop, it sends a randomly generated code to the computer. The computer software compares the code against its table of accepted responses and if all is well and your password matches, you get access to the network. But the third part is invisible. Inside the card is a tiny computer processor. The processor is activated by receiving ambient power from a nearby reader. Upon activation, it sends an encoded message back to the reader via a near-field radio frequency generator. Upon validation that it is a legal code, the requested action is activated. When I wave my ID card at the reader on the security door, it checks my information against the database to see if the card is valid and then unlocks the door. At CCS, the card can be used for much more. I might, for example, deposit funds in an account and when I go to the cafeteria, the account would be charged automatically for my meal. All I need to do is wave the card near the reader.
It had seemed like overkill at the time, but was so attractive that I couldn’t help myself. I’d decided to put an RFID reader on my office and program a card to unlock the door. It was a project I hadn’t got around to yet. Now with the reader and a few blank cards in my hands as well as a programming interface, I could essentially copy the RFID portion of my corporate security card.
Or, anyone else’s.
***
I resumed my walk in the office on the fourth floor, this time carrying a cup of coffee with me. The security cameras would simply record that I had walked the third floor and then went out for coffee. Then I resumed my walk on the fourth floor. I’d done almost the exact same thing on Thursday last week. They might think it strange that I exercised by working my way from the bottom to the top of the company, but I intended to do this every day I was in the office for a while.
When I reached the twelfth floor, I paced myself carefully, pausing at one point to tighten a shoelace. When I noticed the security cameras were all apparently pointing away from my target, I moved quickly to the security door ahead, passed my card over the reader and saw, as I expected, that it did not allow admittance, then pressed the miniature reader against the bottom of the card reader. By the time the security cameras had those doors back in their range, I was casually walking on down the hall. I continued to the 14th floor and on all the way up to the 26th floor. It took nearly two hours altogether.
I returned to my desk at noon and opened the laptop, logged in, and stared at the alert box on my screen. “One predator down. What’s our next job? OK.” The question wasn’t answerable. Not that I didn’t have an answer, but there was no way to answer an alert box that disappeared as soon as I struck any key or mouse click. I knew where I was going to lead my backup next. We’d see how good he or she was at tracking me down.
I checked email again and responded to a message from Ford about the conference using the computer keypad. I’d avoided using this so far, so I decided to let whoever had bugged the keyboard have a go at me. Once I’d sent the email, I opened a new message and addressed it to one of my POP mail accounts that was automatically forwarded to an account I use for gaming. The message said simply, “3.2 billion in missing funds. Where is it? 7 Pacific.”
Now, let the fun begin.
No comments:
Post a Comment