Last Breath (31 page)

Finally she found a seam and attacked it in a flurry of hammer blows.

Behind her, a burst of light. Something small and tubular rolled on the gravel in the center of the crawl space, sputtering brightly.

A flare, one of those roadside emergency things. Adam must have taken it out of the BMW’s trunk. He’d heard the pounding and wanted to see what was going on.

The flare came to rest a few yards away. Its light barely reached her. She didn’t think Adam could see her yet.

She kept on swinging the hammer. Wood splinters rained on her face.

More light. A second flare.

This one rolled nearer. It stopped just out of her reach, close enough to cast its light on her. Its glare reflected off the interwoven plumbing pipes at her back and threw crazy shadows on the subfloor, illuminating plastic strips of vapor barrier stapled to the joists.

Her hammer swung again, and this time it punched through the wood and was momentarily imbedded in the gap until she wrenched it free.

She’d made a hole. Only a couple of inches in diameter, but it could be widened.

She attacked the hole with the hammer’s claw, peeling off chips of wood. Six inches wide now.

Gunshot.

It thundered in the crawl space, the blast of a pistol.

Adam had fired at her.

And missed. He was still outside, far away, and she was dimly illuminated and half-hidden by the plumbing.

Still, he might not miss again.

She gave up using the claw and pounded the edges of the hole, breaking off chunks of plywood that pattered on the gravel where she lay.

Twelve inches wide now.

Adam fired again. She heard the pistol’s report and the bullet’s ricochet in the same instant.

The shot had struck the plumbing pipes behind her.

She was pushing her luck. Needed to get out of here right now.

Another swing of the hammer, and something snapped.

The hammer. Its head had broken off.

And the hole was still too narrow.

A third shot. Gravel sprayed her face. The round had landed close.

And the fumes were reaching her now. She started coughing again. Her eyes watered.

“You’re not getting out, C.J.!” Adam screamed.

She wanted to tell him to fuck himself, but she didn’t have any air in her lungs, only sawdust and toxins.

Had to widen the hole, or she was dead. No hammer. Okay, improvise.

She braced herself against the copper pipes, then pistoned her legs upward, slamming her sneakers into the subfloor.

Loose wood at the rim of the hole broke away. She kicked again. More debris.

The hole was wide enough now. She twisted into a crouch and grabbed the edges of the hole, ignoring the bite of splinters in her palms. She pulled herself up.

Gunshots behind her. She didn’t think she’d been hit. Couldn’t be sure. Veteran cops had told her that sometimes you took a bullet and didn’t feel it till you saw the blood, touched the wound.

She hoisted herself all the way out, into a corner room with two windows letting in the moonlight.

Knelt for a moment, wheezing, fighting for air until her lungs were clear and she could raise her head and see where she was.

It was a kitchen. A break room, more accurately, for the benefit of the office workers who would inhabit this building. Sink, dishwasher, counter space. The floor was parquet, lustrous in the moonlight, a small touch of elegance that explained the plywood subfloor. Parquet flooring on a concrete base would absorb moisture from the stone, then buckle and fail. Another thing the building inspector had told her.

She struggled to her feet, unlocked a window and raised it. An alarm went off. Every building in the complex must be wired. It was okay. Adam already knew she was inside.

She glanced again at the floor—so shiny—then at two cans with hinged metal handles resting in a corner. She sniffed them both, then picked up the second one and hauled it through the window as she climbed out.

Adam was coming. She could see the brightening glow of the BMW’s headlights.

She ran, lugging the can. It was heavy, gallon-sized, and it slowed her down, but she would not abandon it.

It might be just what she needed to turn this battle in her favor—and give her ex-husband a very nasty surprise.

“So how do we get in?” Brand asked, pacing the office while a cold wind howled and bleated outside. “We don’t have time for a low-and-slow, and if we bombard them, they’ll get their guard up right away.”

“I know,” Rawls said, staring at the homepage of the cellular phone company whose server he had to break into.

There were two obvious methods of testing a company’s perimeter defenses. Low-and-slow port scanning was one way. Data packets, small enough to be missed by most intrusion-detection software, were sent to the corporate network over a period of days. Entry was accomplished by flying under the radar and taking a long time—low and slow. Eventually all open ports would be identified, and a skilled hacker could map the network.

The alternative was to bombard the target with data packets—an NMap FIN scan, in hacker argot. There was nothing slow about this approach, but unfortunately it wasn’t clandestine either. An all-out scanning attack would trigger an immediate security alert.

Rawls needed to get in fast but surreptitiously. Tall order, but there was always a way.

His fingers moved across his keyboard and pulled up a program that allowed him to launch a null session—a NetBIOS connection established with a blank user name and password. A null session could get him into any vulnerable server and allow him to read some of its contents.

“You can’t get to Nolan’s account that way,” Brand said, watching over his shoulder.

“I’m aware of that, Ned.” Rawls heard testiness in his own voice. Well, it was after 2:00 A.M. He had a right to be testy.

The null session got him into the corporate server and gave him read-only access to the registry. “They’re running NT 4.0,” he said, “service pack five, option pack four.”

“Outdated,” Brand observed.

“That’s what I was hoping for. You remember the problem with this build of NT?”

“There were lots of problems.”

“The big one.”

“You mean the i-i-s-hack thing?”

“You got it.”

“There’s been a patch for that since last year.”

“But if the sysadmin hasn’t upgraded his OS, he may not have kept current on the patches either.” Rawls was already searching his hard drive for a file named “ncx.exe.” He uploaded it to the Baltimore field office’s Web site, then typed a telnet command, sending a 500-byte file—a small program called “iis-hack”—to port 80 of the cell-phone company’s Web server. The port was open, as it had to be in order to receive Internet traffic. The question was: Would it run the program, or had the server been upgraded with a security patch that would reject the file?

“No way they didn’t patch it,” Brand said.

“There are hundreds of holes in NT,” Rawls countered. “No one can patch them all.”

“Don’t even need a patch, really. Sysadmin just has to disable script mapping for .HTR files.”

“Well, let’s hope he didn’t.”

They waited. The “iishack” program would instruct the server to find the “ncx.exe” file at the Baltimore field office’s URL. It would take a couple of minutes for the file to be downloaded and run. Or the request might already have been denied.

When two and a half minutes had passed according to Rawls’s wristwatch, he entered a new telnet command and reconnected with port 80 of the victim server.

“Moment of truth,” Brand said, leaning closer to the screen.

The corporate homepage vanished, replaced by a black screen with the copyright notice for Windows NT. Below it flashed a DOS prompt.

“We’re in,” Rawls breathed. The flickering C:\ looked beautiful to him.

He was past the firewall. He had access to the corporate server.

Quickly he scrolled through the directory, then went to accounts, entering the Read command followed by Adam Nolan’s account number, which was probably the filename.

A request for log-on identification came up.

“Shit.” Brand sighed. “I guess their security’s not as lame as I thought.”

“We can crack it.” Rawls returned to the directory and located a list of user names. No passwords were shown, but he didn’t think he’d need one. He scanned the list until he found the user name
backup
. He tapped it with his fingertip. “Sounds like a back door.”

Brand agreed. “Give it a shot.”

Back doors were simple means of access left in place by maintenance and diagnostic personnel who didn’t want to be bothered with memorizing complicated user IDs and passwords. Often they left the manufacturer’s default settings intact. Even when they modified the settings, the changes were usually easy to guess.

Rawls went back into Accounts and typed the user name
backup
. A password request came up. He retyped
backup
. He knew how a lazy person’s mind worked. It was easier to remember one word than two.

A moment later the screen filled with lines of text. Adam Nolan’s account in detail.

“Man, you are on a roll,” Brand exulted.

The most recent cell-phone activity came at the end of the list. Nolan’s last call began at 19:54 Pacific Standard Time and continued for three minutes twenty-three seconds. The terminal cell site was given as a string of figures—the cell tower’s latitude and longitude.

Rawls wrote down the numbers, then stood and pulled out his cell phone. “I’m calling LA. Can you clean up?”

“No prob,” Brand said, settling into Rawls’s seat.

Rawls pressed redial and heard the long-distance call go through. Behind him, Brand went about the business of covering their tracks. He would schedule the deletion of the ncx.exe file from the phone company’s server, and for good measure he would go into the server’s log file and erase all references to the intrusion. He would delete “ncx.exe” from the field office’s Web site, as well. It wouldn’t be a good idea for anyone to find it, since what Rawls and Brand had just done was highly illegal.

“Walsh.” The familiar voice from three thousand miles away.

“We’ve got the cell site.”

“This fast?”

“What can I tell you, Morrie? We’re bona fide federal agents. We’re the best of the best.”

In the farthest corner of the office park, C.J. found the warehouse.

It was a large metal shell of a building with hangar doors and two smaller doors, all padlocked. Cut into the side wall was a casement window four feet square—intended, presumably, for ventilation.

She peered at the window, looking for evidence of security wiring—a magnetic contact sensor or a sound-activated glass-break detector. In the dim light, with the moon hidden behind the roof of the warehouse, she found it hard to be sure.

There.

Strands of wire, barely wider than individual hairs, ran up the sides of the glass and connected to small black nodules.

Pressure sensors.

Break the glass, and the alarm would go off, even before she had a chance to reach inside.

Well, that was all right. Might even be helpful, in fact. The noise of the alarm would add to the confusion and urgency she was counting on.

The window faced an alley that ran between the warehouse and the complex’s perimeter fence. Fig trees grew outside the fence, and their leaves, shed in winter, had blown over the loops of razor wire to lie in dry drifts along the alley. C.J. knelt and touched them, heard them crackle under her fingers.

Perfect.

Elsewhere in the complex, the two alarms—one from each building she had violated—must still be ringing, though she couldn’t hear them from this distance. Couldn’t hear the BMW’s engine either, but she knew the car was out there, circling like a shark, trolling for its prey.

Adam would find her before long.

She kicked the leaves into a thicker pile not far from the window, making a nice firm bed. It was all part of her plan—a dangerous plan, but she would risk it. She was through hiding. She had wriggled into her last crawl space. She had played the victim long enough. Now it was time to go on offense.

Adam thought she was weak. Well, let him find out how weak she was.

She expelled a breath of pure rage and saw it turn to frost in the night air, chillier than before.

He had tried to
fumigate
her, for God’s sake. Like a
cockroach
.

Even now he must think he had her trapped. She couldn’t escape the office park, couldn’t enter any buildings without setting off an alarm, couldn’t hide outside because there was too little cover.

Couldn’t run. Couldn’t hide.

But she could fight. That was the one thing he hadn’t counted on.

She knelt and pried off the lid of the one-gallon can she’d swiped, using a sharp stick for leverage. Slowly she swirled the can’s contents.

“I’m going to win this game, Adam,” she whispered. “And you—you son of a bitch—you’re going down.”

The distance from Brentwood to the Santa Monica Municipal Airport was two miles, a trip that normally took about fifteen minutes in the congested streets. The police convoy made it in five, with Tanner in the lead, flashing the light bar of his squad car and blaring the siren.

He pulled into the airport parking lot just as the big Sikorsky helicopter was setting down on the helipad. The Sikorsky was one of four U.S. Navy SH-3H Sea Kings recently purchased by the Sheriff’s Department, three of which had been adapted for search and rescue operations. Most of the time, this meant carrying paramedics to remote locations, but occasionally it was a Sheriff’s SWAT team that took the ride.

Tonight was one of those times. A SWAT squad led by Deputy Garrett Pardon was already forming up. The Sikorsky, which had flown north from the department’s Aero Bureau station in Long Beach, would head to a county airfield east of downtown LA, which would serve as the rendezvous point.

Tanner wasn’t part of Pardon’s squad, but he figured Pardon wouldn’t object to another man on the job. And if he did, to hell with him. Tanner had come this far, and he wasn’t bugging out now.