Authors: Mark Russinovich
The pressure of Carnaval and the expanded Casas de Férias was bringing his fears and suppressed aspirations to the surface in ways he’d never experienced before. He had friends who had no idea who he was. That was one reason why he’d insisted in locating the company in Rio, away from his father’s interests. He’d also insisted the company be legitimate from all appearances, that it conduct itself exactly as a legal operation did. He liked being accepted for who he really was, not treated with respect by those wanting favor with his father. He’d had too much of that in his life.
And he needed to leave soon he’d decided, which meant Carnaval was an opportunity. The longer he stayed, the more deeply he’d be pulled into his father’s world.
Pedro turned to his screen as he heard the familiar Skype sound. Ramos wanted to talk. Pedro sighed, pressing back in his mind the one nagging thought he’d had since lunch the previous day.
Would his father let him go?
23
ENFORCEMENT DIVISION
SECURITIES AND EXCHANGE COMMISSION
NEW YORK REGIONAL OFFICE
200 VESSEY STREET
NEW YORK CITY
4:01
P.M.
Robert Alshon, senior SEC investigator, picked up the telephone. “Susan? Could you come by my office at once? Thank you.”
Alshon was busy with the printed sheets in front of him when Susan Flores knocked lightly at his office door. She came in and sat down in an armed chair in front of his desk. She was not yet thirty years old, single, of average size with long jet black hair. She was part of Alshon’s team but was more than a little intimidated by him. His expectations were always difficult. She raised an eyebrow.
“We’ve got a hot one from the SSG at the Exchange.” SSG was the Server Systems Group of the Infrastructure Management Department of the New York Stock Exchange. They were the digital cops responsible for detecting irregularities within the code, but especially potential criminal conduct. Alshon met her eyes with that same intensity he always showed at the beginning of a chase. Forty years old, formerly with the Federal Bureau of Investigation before joining the SEC, he handled “big ticket” cases of insider or fraudulent trading. He was broad shouldered, with short clipped graying hair and a trim black mustache. He was known as a bulldog for his relentless investigations and attention to detail. Arrogant and on occasion nasty he was the best and Flores considered herself lucky to be part of his investigation team.
“They’re still at it, so we’ve got a chance to catch them red-handed,” Alshon continued with obvious pleasure.
“How big?” she asked. When it came to securities, she’d once told a girlfriend, size was everything.
“I can’t say at this point. That’s one reason I want you on this. The scope is extensive. A rough guess would be in the neighborhood of eight to twelve million dollars, though if it was twice that, I wouldn’t be surprised.”
“How long?”
“They don’t know; likely only a few weeks. It’s a pretty clever operation but then they’re exploiting a position of trust. That always makes access easy.”
“What do we know?”
Alshon leaned back in his chair. “Some weeks ago, Stenton’s team spotted a random bot on their system. It was one of those auto-spreading robot things that never should have got by their defenses. They were due for a penetration test so decided to bring in an outside team, someone new for a fresh approach. They hired some genius out of D.C.”
“I read about the bot on the way in this morning. Who’d they hire?”
Alshon looked back at the report. “Jeffrey Aiken, Red Zoya. Know it?”
“Not the company but the name sounds familiar. It will come to me.”
“I’m talking to Gene when we finish and will have him get me all the info on this Aiken guy and his company.” Gene Livingston was the team’s primary researcher. “Anyway, it seems they’ve had some success and a few days ago penetrated the New Jersey engines.”
“Wow. They tell me that isn’t possible. How long did it take?”
Alshon grimaced. “Something like two weeks.”
“That’s impressive.”
“Maybe not. They may have been working on this for a while.”
“If that’s true, it’s quite a coincidence them getting hired for the penetration test.”
“Good point.” Alshon leaned forward and wrote a quick note to himself. “Maybe there’s more here than meets the eye. Bill Stenton hired them. I’ll have Gene look for a connection.”
“Bill’s clean I’m sure.”
Alshon smirked. “Trust me. You never know. Anyway, IT says they’ve been inside a few days but—now, get this—they’ve not reported the penetration. And they’ve been doing some very funny things in there too.”
“You know the timing is interesting.”
“How’s that?”
“There’ve been reports for months now from brokers about unexpected losses.”
“They’re always complaining, looking for someone to blame.”
“I know, but I understand Bill has received a series of complaints about trades coming in well under projection. He’s been looking into it. Maybe that was the real reason for the test.”
“How much are brokers reporting?”
Flores shook her head. “I don’t have figures but I understand it’s in the tens of millions, more than a million per incident in some cases.”
Alshon made another note. “I’ll have Stenton prepare a report for me of these incidents once we clear him and tell him what we’re up to.”
“What do you want me to do?”
“I’m forwarding the IT report to you. You’ve got access. I want you to go in there and take a look at what they’re up to, confirm suspicions. I don’t like trusting an outside party. Be sure they don’t see you in there. In the meantime I’ll turn Gene loose. I’m going to move fast on this one. My gut tells me we don’t have a lot of time. It’ll be good to catch them in the act. We’ll talk next morning. You’ve got a long night ahead of you.”
“All right. When is this penetration test supposed to wrap up?”
“They don’t know. It should already be finished, but like I say, they’re still in there, doing God knows what.”
“All right.” Flores stood up and moved toward the door, then stopped and looked back. “You know, sir, there could be a good reason why they haven’t reported penetration yet. That by itself isn’t suspicious.”
“Read the report,” Alshon said with an edge. “There’s two of them on the team. They’re a nasty piece of work. They’re both ex-Company men. I’ve had experience with this kind before.” He glanced at his wristwatch. “Stay on this and keep me updated. I’m catching the shuttle to D.C.”
24
HOLIDAY DAY INN EXPRESS
WATER STREET
NEW YORK CITY
5:06
P.M.
“I’m having a beer. Want one?” Frank asked as he went to the minibar in his room.
Jeff shook his head as he sat. Frank passed him a bottle of water. “Let me tell you where I am. I still don’t know what those numbers in the hidden file mean, but I’m filling in the holes around them. I’ve been focusing on what the code does. It looks like it interacts with another component on the trading servers. It seems to search for particular conditions within defined trades, then takes part.”
“And it’s malware.”
“Absolutely.”
“So whatever it’s doing is bad. Sounds like it’s taking money. What else would malware be doing within the Exchange’s trading engines?”
“Almost certainly, one way or another. I suspect that it’s found a way to get into legitimate trades and take a piece of the action. I can’t be sure, but I think that’s it. Everything fits.”
“If it did that, the Exchange’s security would catch it.”
“I think it’s more sophisticated than that.”
“Those numbers might be accounts. Maybe those it accesses or where it sends the trades.”
“That’s what I’m thinking, but they could be anything. I’m hoping to puzzle it out tomorrow. I know we need to close this engagement out but I really want to understand what is taking place.”
“The report’s about finished, except for what you’re doing. Do you have a meeting set?”
“I called to schedule it,” Jeff said.
“When?”
“His secretary’s supposed to get back to me.”
“Is Stenton out of town?”
“I don’t know.”
“You’d think he’d want to hear what we have to say. Did you read the
Times
today?” Frank gestured at the copy he’d picked up earlier. Jeff shook his head. “The bot that got us this gig is in the news, in the financial section. According to the article, a former Exchange employee revealed all the details, and there’s a fracas since the New York Stock Exchange security is supposed to be the best in the world.”
“The bot was harmless.”
“Not according to the article. The ex-employee is claiming all kinds of damage has been done and the Exchange, in particular Stenton, is covering it up. The article suggests that the extent of the malware is vast.”
“Wow.”
“And the stock market tanked today, down something like ten percent, a record of some kind.”
“Think about what would happen if they knew what we’d found.”
“Jeff, imagine what would happen if they knew what we’ve managed to do in such a short time.” Frank paused, then continued, “Stenton told you this pentest was urgent, and it turns out he was more than right. Just the two of us pulled penetration off, Jeff. Think about it. We might be geniuses, at least that’s what I tell my wife, but there are plenty of bright geeks out there. If we can do it, so can they. How many others have got in there? For all we know the Exchange computers are leaking like a sieve. Stenton needs to hear that, and see how we did it. Just from what we’ve found they’ve got a lot of holes to close and procedures to tighten. That’s especially true with the heat turned up.”
“Yeah.” Jeff shrugged. “I understand but if he’s in no hurry to get our report, that’s fine with me. In my opinion, this malware is more important than the fact we managed the penetration, especially now. I think we need to know what’s going on before we report. Another day should give us some answers. We’ve worked pretty fast so we’ve got the time.”
They sat in silence for a bit; then Frank said, “What? You’ve got that look.”
“Nothing really.”
“Come on.”
“I’m probably just reading something from nothing. But Stenton’s secretary sounded … I don’t know … uneasy. I can’t put my finger on it. I was probably just tired.”
Frank grunted. “Now that you mention it I’ve caught a few looks in the hallway.”
“What do you mean?”
“Nothing that registered at the time, just looks. Is something going on we don’t know about?”
Jeff shrugged. “If we don’t know about it, how would I know?” He grinned. “You sound paranoid.”
Frank sighed. “I just want to get home. I miss everybody.”
“Well, I’m going for a run. We’ll save the world financial system tomorrow, then get back to our lives.”
25
CENTRAL PARK
NEW YORK CITY
6:13
P.M.
Jeff finished his first lap of the Lower Track. He hadn’t run enough since coming to New York. Only now were the kinks easing out of his body. As he reached his start point, he picked up his pace, settling into the mile-eating stride he ran back home.
This project was turning out to be much larger than he’d anticipated. He’d been flattered when Stenton first contacted him. Though Red Zoya had done work for other well-known institutions, most of what it did was behind the scenes, often not even known in the cybersecurity community. An engagement such as this was very high profile. Their successful penetration of the trading platform of the New York Stock Exchange would get out, he had no doubt. Even though there was a standard confidentiality clause in the contract, one he would keep, a number of employees at the Exchange would know what they’d done, they’d chat about it through social media and post their thoughts online. Word would spread and the result would be even more high-profile projects, and though money wasn’t primarily what this was all about, it was an important component. If what he thought was about to happen took place, he’d need to expand.
Which returned his thoughts to Daryl. If he was going to build Red Zoya, there was no one else he wanted to build it with. Even Frank for all his expertise and abilities was at heart a family man and at this point in his career could not be expected to give the time to the company such an expansion would demand. As Jeff thought about how to do this his mind returned again and again to Daryl. Her ability, her contacts, how they worked together were simply perfect.
The other side of all this was the idea that maybe he’d been wrong about them. Everyone who knew the two of them told him he’d made a mistake. Sometimes outsiders see things more clearly than those involved do. Wasn’t that the nature of a pentest after all? You take for granted what you know. It’s someone on the outside who can see the strengths, and weaknesses, clearly. Maybe the fact that he had had no interest in anyone else during the past year was telling him something.
As Jeff finished his second lap, he picked up the pace again. Would Daryl even want to come back? Was there any point in considering it? For a second he thought about presenting it to her as a strictly business proposition. Red Zoya needed her, they worked well together, with their combined experience and contacts the company would thrive.
He almost laughed out loud at the thought. No, if they got together again, it wouldn’t be only as business partners. At the least there was too much history. And there was no denying the strong mutual physical attraction. A purely professional relationship, at least for him, would be out of the question.
So what to do? What if she was seeing someone? Or living with someone? His heart sank at the thought.
The fact that she hadn’t contacted him, even professionally, in the last year had come as a surprise. When he’d last talked to her that night at the town house, he’d never meant they’d have nothing to do with each other in the future. In fact, he’d been sincere when he said they’d remain friends. After all, they’d been colleagues and friends before they were partners and lovers, why couldn’t they return to that? It had seemed reasonable to him.