Authors: Mark Russinovich
“Clever but I don’t see how software like that can get into our system without our knowing.”
“Someone on the inside is doing it. That someone realized Jeff and Frank were getting close and set them up. Framing them was done very crudely. They opened a brokerage account in Jeff’s name, put trading malware into the engine that was sure to attract interest, then sent the money straight to his account. You know the rest.”
“Interesting. You have any idea who?”
Daryl hesitated. He might be cute, but she had no idea who he really was. “No. That’s what I’m doing on-site. I’m looking for the mole. Are you going to let me work on this? Or turn me in?”
Iyers said nothing for several long moments. “What you say makes a lot more sense than what the SEC was insinuating. From how you describe it this frame job was pretty sloppy. We should be able to trace it back to your mole.”
“‘We’?”
“Sure. After you finish your coffee, let’s go back to the office. You can show me what you’ve got. No one knows the system better than I do. I can help.”
“Why would you do that?”
“Well, besides the fact that your explanation makes a lot more sense to me than the one the SEC is putting out there, I’d like to see this alleged rootkit for myself. I really can’t believe it exists. And anyway, I’d like to get the bastard just as badly as you do. It’ll be a feather in my cap.” He smiled again. “Ready to go?”
* * *
On their way back to Wall Street, Daryl quickly ran through her mind the wisdom of this. The smart thing might be to just keep going, to say good-bye now and return to her hotel. Richard didn’t know her real name.
Part of her was telling her to be cautious, not to trust this stranger, while another reminded her of just how effective she could be with a key infrastructure specialist working with her. She couldn’t be the only one who thought how Jeff and Frank had been framed was too obvious. Richard would see it for himself soon enough. And if that didn’t convince him, surely the rootkit would.
But what if this was a trap? What if he was just luring her back so she could be arrested?
That made no sense at all. He’d known from the first moment he’d heard her name that she was lying and had done nothing. Maybe he was working with the SEC, but that made even less sense. For the time being everyone at the Trading Platforms IT was to one degree or another under suspicion.
No, she’d take her chance.
* * *
A plum didn’t fall into Iyers’s hands very often, and he was still dazed by events. As he was going home the previous night, his thoughts returned repeatedly to the dazzling beauty he’d spoken to briefly. This morning, he’d made an effort to hunt her down. When she’d told him her name, it was all he could do to quell his excitement. She didn’t know it yet, but he owned her, lock, stock, and barrel.
In his view, he’d had no alternative but to pretend he believed her, to offer to help. He needed to know what she knew, whom she suspected, and just as important, whom she’d told. They were down to the final twenty-four hours—less, actually. Tomorrow was going to be the biggest day of Iyers’s life, and he planned to stick to whoever this woman was as if they were joined at the hip.
66
EDIFÍCIO REPÚBLICA
RUA SÃO BENTO
SÃO PAULO, BRAZIL
12:49
A.M.
Victor Bandeira replaced the telephone in its cradle and stared out the window without pleasure. Carlos Almeida was in a near state of collapse. His anxiety over his coming windfall was becoming too much for Almeida to bear. He’d been complaining for months about what Bandeira considered to be the modest income stream of Casas de Férias. Now with Carnaval coming online the task of handling the increased volume was proving too much for him. Bandeira was tired of holding the man’s hand. When this was finished, it was time to kick him upstairs and move someone with real ability into power. He shuddered to think that there’d been a time when he’d actually confided in the man.
Bandeira had been amused at the suggestion he court Sonia. Amused, then intrigued. The Almeidas were one of the most respected families in Brazil. It would introduce Bandeira into a social class that currently only tolerated him. To be married to such a willful child would in itself be no problem. He would do as he wished, just as he had always done. And as her husband there would be no question of his right to discipline her. He was intrigued but not convinced. The child could prove more trouble than she was worth to him.
But Bandeira had no time for such thoughts now. Time enough after Carnaval. He told his assistant to send in César who was waiting outside. Once the slender security chief was standing before his desk, he said, “Tell me about last night.”
“Shortly before midnight, Zico reported he heard a sound in the alley beside the warehouse. When it didn’t repeat, he reported it was a false alarm. Then a cat attracted his attention. He spotted figures and opened fire. In return fire he was wounded in the arm and shoulder. He’s in the hospital. Didi was shot dead on the roof. Paulinho exchanged gunshots but neither he nor Cafu were wounded.”
“How many did they get?”
César cleared his throat. “I could find no evidence we hit anyone, though that doesn’t mean we didn’t.”
“How many were involved?”
“Based on what I heard and what my men reported, I’d say between three and seven.”
“And where were you during this gunfight?”
“In the office, of course. The engagement might have been staged, designed to lure us away.”
“There was nothing there to steal.”
“No, but they didn’t know that, and if it was staged, I was ready to take out whoever tried the office. I had good men taking care of the street action. They didn’t need me.”
Bandeira gathered his thoughts before proceeding. “I’m confused by this. We lure two computer nerds here and end up with one man dead and no sign we even touched whoever came to the warehouse. It doesn’t make any sense.”
“We don’t know it was them. I’m inclined to think it was not.”
“Then what was it?”
César shrugged. “A burglary gone wrong, perhaps a
quadrilha.
It may be they thought we were storing something valuable there. I think that more likely than it was the two we are waiting for.”
Bandeira opened his mouth to dismiss the idea that a
quadrilha
was responsible, then stopped. Was that possible? Had he underestimated this from the first? “I don’t see how,” he said slowly, “but we should ask around. If these were local men, we’ll hear about it.” If one of the local gangs had been responsible for last night, he needed more time, more information, to consider the implications. And there was too much to do now that required his attention.
“Perhaps we should increase security at Grupo Técnico,” César suggested. “Just to be on the safe side.”
“It’s not necessary. Keep good men at the warehouse. But I need you and Paulinho with me.”
“As you say.”
67
TRADING PLATFORMS IT SECURITY
WALL STREET
NEW YORK CITY
3:21
P.M.
Returning from lunch and her presumed alliance with Richard, Daryl decided to take a different, more direct, approach with her investigation. He went to his workstation while she settled in at her purloined cubicle. Time was running out, and she still didn’t have the evidence she needed to clear Jeff and Frank. First, though, she needed to know who this Richard was. She accessed the administrator account Jeff and Frank set up previously when they compromised the Payment Dynamo server, since that account had access to most of the infrastructure. The account allowed her into the employee account database and human resource systems.
All she had was his given name, Richard, but she needed to know who he was. She was grateful for his offer of help but suspicious as well. It struck her as too easy, too opportune. Still, she’d overheard enough to know that the SEC was not popular here. Their execution of the search warrant and treatment of staff was still a popular topic. Richard could very well be telling her the truth.
She navigated in search of the infrastructure team but found them spread out in several subcategories. On a slip of scratch paper she wrote out, “Richard, Rick, Rich, Dick,” then, looking down from time to time to remind her, she slowly worked through the employee lists. After ten minutes, she had five names, two of them using Richard, only one of which was an infrastructure specialist. Richard Iyers. That must be her man.
Something tickled in the back of her mind. Richard Iyers. Hadn’t she seen that name before? She thought, but nothing came to her. It would in time, she was certain. For now, just to be on the safe side, she connected to Iyers’s computer, which was identified in the network directory, and installed Jeff’s monitoring software. This would allow her to read Richard Iyers’s e-mail and log his keystrokes. She configured it to alert her whenever he sent or received e-mails. Next she copied off his access logs and scanned them visually and with Jeff’s tool, but they showed no accesses to the jump server.
The logs were the key, though. As she continued to work on them she was identifying patterns of suspicious behavior, mapping it all out, dating it. This information established correlations with logs from other systems, fanning out into a complex map of interconnections, the majority of which would be red herrings. These patterns came from a number of different staff, but she was convinced they originated with Campos and whoever else was involved. Eventually she’d have enough of the map to find her way behind those cutouts, following the trail back to the originator. Knowing Campos was a target helped narrow the data, but it was still tedious work.
Then there was the IPO. She had access to the jump server and one advantage for her was that every update had to go through it. What she needed was a way to block any more updates, but most important, to ride into the system and turn off the rogue code.
From time to time her thoughts drifted to Brazil, to the danger Jeff and Frank were in. For security reasons contact was at an absolute minimum. She’d only received a text message after her two messages, thanking her and saying all was well.
But she’d given them the right address, the one in Rio, and she knew they’d be going there. One hard drive from the right computer, one person involved in the operation willing to talk, would bring this all to an end. She’d rather have worked out the answer entirely from computers but understood the logic of what they were up to. She just couldn’t get over the sinking feeling she experienced every time she thought of them.
* * *
Marc Campos was both furious and scared. His fear came from the fact that the code he’d been receiving from Rio was not ready to be implemented. He was exhausted from rewriting and editing, from demanding that Pedro get his team on the ball. The clock was running down.
He was angry because Iyers wasn’t doing his job. Even when Campos had code ready to upload, Iyers often wasn’t available or was slow to respond. Campos had even gone to see him, something he almost never did in the office, only to find him away from his workstation. He searched and been stunned to see him standing in the hallway, leaning into a cubicle, talking to Kelly from SSG of all people.
Campos still didn’t know what to make of her and her questions. At the time, the entire experience had been odd in the extreme, and he’d been sure he was uncovered. Seeing her at a workstation was reassuring to some extent as it suggested she was who she said she was. It was peculiar for someone from SSG to be working on-site, but not without precedent. He’d been afraid to check her out in detail as it would only call attention to himself.
Seeing Iyers talking to her led to only one conclusion, that once again he was distracted by a pretty blonde. It had happened before, though never at such a critical moment. As Campos had turned away he was suddenly seized by an overwhelming anxiety. What if the two were up to something? Here she was asking odd questions, and there was Iyers, the crucial cog in his operation, looking very friendly indeed.
* * *
Back in his office Campos called Iyers on his cell phone. When he answered, Campos said, “Meet me at the coffee shop, right now! Don’t say a word, just do it!”
Ten minutes later, Iyers entered the narrow shop, glancing about as he always did, searching for women. He spotted Campos in the rear booth and joined him. Iyers told the waitress he’d take coffee, then turned to face Campos. “You look like shit,” he said.
“What the hell are you doing with that woman?”
“Who? You mean Kelly?”
“Yes, Kelly. She questioned me yesterday.”
“Questioned? How does she even know about you?”
“She’s from SSG. She said she’s here following up on that bot because of all the heat it’s generated.”
“Yes, but why talk to you?”
“I don’t know. She didn’t tell me. What are you doing talking to her?”
Iyers’s coffee arrived. He sat back as he stirred sugar into it, then poured cream. He took a sip. “She’s not SSG and she’s not Kelly Vogle.”
Campos found he couldn’t breathe. His eyes widened in alarm. His tongue licked across his lips. “What are you saying?”
“I’ve met Kelly Vogle and this isn’t her. I had lunch with this woman earlier and confronted her to try to find out what she’s up to. I thought she might be official, working undercover or something.”
“My God,” Campos said, lowering his face into his hands. “It’s over.”
“Relax, amigo,” Iyers said with a cocky grin planted on his face. “Everything’s fine. We’ll pull through.”
“What … what are you talking about?”
“She’s with Aiken and Renkin. She’s here to try to clear them.”
Bewildered, Campos said, “What do you mean?”
“What I said.”
Campos processed what he’d heard, struggling to compose himself. Finally, he said, “Why did she talk to me? Did she tell you?”
“No. I don’t know why. Aiken and Renkin aren’t just running, they’re trying to figure out who put the finger on them. This woman’s working with them on that. They’ve come up with something that pointed to you.”