by David Caris
She folded her arms. ‘Well, you sure picked a hell of a time to throw in the towel.’
‘Think of me more as an investigator – with a few bonus skills. Sub-contracted, a temporary arrangement only. And no killing. You agree to all that, fine, I work for you.’
‘On the hack and the bombing?’
Kovac saw it was time to relent. ‘If I get ID, cash and weapons, yes. And remember, I can walk away whenever I want.’ When Megan didn’t argue this point, he said: ‘The photo suggests some kind of extortion. Do we have a ransom demand yet?’
‘No.’
‘Well, it’s coming.’
‘I agree.’
Megan put her laptop into a desk drawer. She locked it and grabbed a nearby tote bag. She dropped keys into the bag along with a scrap of paper that had been sitting off near a docking station. ‘If you’re done haggling,’ she said. ‘I’ve got someone you need to meet.’
Chapter 14
Megan told Kovac what she knew as they walked from Curzon’s London office, through Soho towards her apartment. ‘An employee came to me with five names,’ she said, swerving around wooden tables filled with outdoor patrons.
‘And?’
‘She thinks one of them is the cause.’
‘Of the hack?’
‘She said it only hit us, Curzon. So the vulnerability that allowed it has to be in software only we use. And the only software we have that is truly exclusive to Curzon is our accounting software.’
‘You’ve verified that?’
‘As best I can under the circumstances, yeah.’
It was now going on 9:30 p.m., but the street was full of electric lights. It was shut off to traffic, tables set up on the blacktop. Its treble came from countless alcohol-infused conversations, its base from speakers located deep in brick pubs. No doubt about it, Kovac thought. This section of the city was hopping. He envied the patrons their relaxed freedom. He watched them sipping at beers, laughing and checking their phones, while he went on scanning for trouble. Most of the men were in simple work shirts or T-shirts, a few with sunglasses hanging from their collars. A majority of the women were already into skirts and heels, dressed up for a night out. No one was behaving erratically or even suspiciously, there were no police, and it was like the bombing at the soccer stadium had never happened.
Kovac kept monitoring his surroundings, but there was no sign of Bishop. So far Bishop was honoring his agreement and leaving Kovac to work with Megan directly.
‘And no one’s contacted you beyond that one childhood photo?’ Kovac asked, as they reached the end of the street and came face to face with a building covered in scaffolding. They turned right, into a street with just as many pubs but no outdoor dining and fewer people. More of a nightclub feel.
‘I shut everything down, so maybe someone’s tried to contact me. But if so, I’m not sure how I’m meant to find out.’
‘How many staff did you say worked on the accounting software?’
‘Five, I think.’
‘You think? We’re how many hours into this, Megan, and all you have is “I think”?’
Her face tightened at his tone, like she was working to hide distaste. ‘That’s what Juliette’s for. She’s meeting us at my apartment. She’s prepared a full report on what we’re facing. At least, I hope she has, because if she can’t no one can.’
‘Who’s Juliette?’
‘Juliette Kraus. IT consultant. Well, more security really, but she has “consultant” on her business card.’
‘How did you arrange the meeting with her?’
‘Bishop made some changes on my phone and said I could trust it.’ Megan took it from her tote bag and showed him. ‘He gave me the pattern code. Then I set it up the same way I’d arrange any meeting. Why?’
‘You sure you can trust this woman?’
‘Right now, I need to trust someone, Kovac, and I’m choosing Bishop.’
‘And Juliette.’
‘To an extent, yes. I can’t lock myself in a Faraday cage and pray everything will just magically fix itself. I’m trusting you, too, remember.’
‘Fair point.’
They pressed on, past a few convenience stores and groups of people walking with beers in plastic glasses. Normally, Kovac studied up on areas before navigating them, but he hadn’t expected to come here tonight. At first, the bars were more like nightclubs – more neon than brick with security at the door. But then they hit pubs and outdoor tables again, which meant patrons and waiters in black and brown aprons.
‘How much further?’ he asked, tired of scanning for threats.
‘Not far.’
They walked the remainder of the way in silence. Some streets were dark, reeking of stale alcohol. Others were bright and infused with the smell of hot food. The whole area seemed to be one extended pedestrian zone.
Megan’s apartment, when they reached it, wasn’t what Kovac had expected. It was a 1200-square-foot, New York-style loft with rustic red brick interior walls and large warehouse windows. The central living space was vast, with a green sofa, Danish lounge chairs, and a tasteful collection of modern art on the walls. There were layered rugs, a few nice vases, and some indoor plants near a small but elegant kitchen. ‘It’s a mess, I know,’ Megan said. ‘In my spare time in each city, I’ve developed a bad habit of combing vintage markets.’
‘I like it,’ Kovac said. ‘It’s more personal than I was expecting.’
‘Thank you.’ She looked around, as if seeing it with fresh eyes. ‘I used to be into minimalism. Lately though, I’ve kind of fallen in love with clutter. Too many stark hotel rooms.’
‘You have no security here beyond the alarm you deactivated on the way in?’
‘Security personnel, you mean? No. I put up with them at the office. But not here.’
‘Even after Peng?’
‘I don’t like the intrusion on my privacy. And Bishop’s helping me help myself. I have a lot to learn. Or re-learn. I get that. I know it. I do. But I’m not going to become a prisoner to my own fears.’
Kovac frowned. ‘Do you at least have a gun?’
‘No.’
‘A knife?’
‘Only what’s in the kitchen.’ Megan pointed to the kitchen as she said this, then entered it and put on coffee before showing him the downstairs guest bedroom and bathroom. The latter didn’t have walls, just frosted glass. ‘I’m up in the mezzanine level master bedroom,’ she said, ‘which has a similarly open en suite. So… let’s both agree to knock loudly, yeah?’
‘Agreed.’
‘Also, Daniel used this place a few times years ago, before he got fat. He has clothing stored in here that might fit. You’ll find towels and everything else you’ll need in the bathroom.’
Kovac thanked her and she left him to it. He freshened up and dressed in his own jeans again, but added a T-shirt and light summer jacket from Daniel’s walk-in wardrobe. When he made his way back up into the central living room a woman he assumed was Juliette was on the green sofa, unboxing a new Dell XPS laptop.
Juliette was well into her forties, with dull brown hair tied back in a utilitarian ponytail. Her face was gaunt, with a model’s angles and sharp edges, but completely devoid of makeup or color. She was a striking woman, made all the more so by keeping things natural. Her attire was casual: a white shirt under denim overalls with a flannelette shirt tied round her waist, and what looked like a pair of peach Vans.
‘Juliette, this is John Kovac, a security consultant with Curzon.’ Megan handed Kovac his coffee. ‘John, this is Juliette. She’s with DSS.’
‘DSS?’ Kovac asked, as he took his first sip of coffee. It tasted as if it had come from a cafe, which wasn’t surprising given the size of the coffee machine in the kitchen.
‘Digital Security Systems,’ Juliette said, as she stood and plugged a charger into the wall. She returned to the laptop and said to Megan: ‘They only had the 4k screen, so you won’t have great battery. Just something to be aware o
f if you’re on the move. And for obvious reasons, you won’t have anything from your old devices or the cloud. You now have one of these isolated machines at the office and another here.’
‘So what are they for?’ Kovac asked. ‘High-def solitaire?’
‘For now, just about, yeah.’ Juliette tossed the laptop’s extensive packaging aside then stood. She retried the flannel shirt, which was slipping down, and offered her hand. Kovac shook it. ‘You were after an update on the hack?’ she asked.
He nodded.
‘It started with a lot of small things. The environmental footage, problems in the cafeteria, things that systematically climbed up the building to Megan’s office…’
‘That normal?’
‘There is no “normal” with hacking, it’s an evolving, competitive field. But no. That’s not how things like this generally work, so most likely somebody orchestrated that as a sort of show.’
‘Why?’
‘I’m not yet at the point where I can say why.’
‘But if you were to speculate?’ Megan asked.
She shrugged. ‘Maybe to show off. Or maybe to distract us or cover over something. I’d guess they were in our systems before we saw anything or knew anything. They’ve potentially been in our systems for months.’
‘That’s reassuring.’
Megan shot Kovac a look of warning, then said: ‘Juliette’s been helping us this past six months with a pre-emptive redesign of our entire global network. The truth is, like most, Curzon has less than perfect software patching, and we have insufficient network segmentation.’
‘Then today happened.’ Juliette picked up Megan’s laptop and tapped “Accept” to a list of mundane set up terms and conditions without reading a single word. ‘The lack of network segmentation is a vulnerability that potentially allowed this malware to travel right through Curzon’s network. We won’t know details until we get more from your other offices, but I’ve been able to confirm they’re under attack too. It’s company-wide but I’m waiting on data. London’s the only one that shut the power off, so we’re in the dark.’
‘Was that the right move?’ Megan asked.
‘Jury’s out. It depends on what comes next and whether or not you actually preserved anything by doing it. It’s made it harder for me to learn anything, that’s for sure.’
‘But it’s still just Curzon?’ Kovac asked.
‘Maybe.’ Juliette put down the laptop and went for her phone. She refreshed a browser screen with her thumb. ‘I’ve got a few online newspapers open here. From what I’ve seen in the press so far, they’re only talking about Curzon, so… sure. For now it’s just us.’
‘So what’s the fix?’ Kovac asked.
‘Oh shit,’ Juliette muttered, still reading from her phone.
‘What?’ Megan and Kovac asked in unison.
‘This worm moves. I just got data from the Paris office…’
‘If it gets out, what then?’ Kovac asked.
Juliette said nothing for a moment, still reading.
‘If it gets out?’ Kovac repeated.
‘We could be looking at a very rapid spread,’ she said distractedly.
‘You mean globally?’ Megan asked, taking a deep breath.
Kovac thought about his service files, buried somewhere deep in Curzon’s byzantine servers. ‘What does that mean?’ he asked. ‘Curzon would get the blame for a global hack?’
‘For starters.’ Juliette was still looking at the new data she had just received. ‘I’ve never seen anything like this. This thing is… holy shit.’ She looked up. ‘It’s moved through us like we have no defenses at all. Normally with these worms, it’s like cancer. At first, you’re lucky to find it. It spreads, sure, but slow. This…’ She shook her head.
Megan shared a worried look with Kovac. ‘And what, all our files are out in the world now?’
‘Possibly, possibly not.’
‘When will you know?’ Kovac pressed.
‘Soon. I have bots programmed to scrape 4chan and bulletin boards like it. If someone posts a link to Curzon files there, it’ll become the usual game of chicken.’
‘Explain that,’ Kovac said.
Juliette looked frustrated by the questions. She was still trying to read from her phone. ‘Chicken. As in, someone puts the files on anonfiles, and everyone gathers round the link like kids round a snake.’
‘No one wants to be first to pick it up?’ Kovac asked.
‘Right.’ Juliette clicked her phone off. ‘But don’t get the wrong idea. Once it’s there, someone will grab it. They always do.’
Chapter 15
Megan got a glass of water for Juliette, concerned she was a little too under the pump. Juliette sipped at it, but remained focused on Kovac.
‘So what’s the fix?’ Kovac asked.
Juliette said: ‘Most likely, a clean start.’
‘You mean start from scratch?’ Megan asked, horrified.
‘Every computer Curzon has. I’d like to be more optimistic, but you pay me to be realistic and this is a mess. Imagine a few trillion balls of tangled string. And us in gardening gloves. Even if it can be unpicked, it’d take forever.’
‘There isn’t any hope of a kill switch or something like that?’ Kovac asked.
Was this hack already well beyond anything Megan, as one woman, could hope to put right? She was no longer even convinced Juliette was the right woman for the job. Juliette had come with glowing recommendations from all the top names in the business, but she didn’t seem to be sure of anything. ‘There isn’t something built into this malware that deactivates it, reverses it?’
‘Not that I’ve found.’ Juliette’s tone was apologetic. ‘But having said that, I woke up at 5:00 a.m. this morning expecting a very different day. It was the first morning in as long as I can remember where I didn’t reach across, pick up my phone and check emails as a first point of business. I’m meant to be on holiday. I have two boys who were both packed and ready for a car trip to my parents’ place on the coast.’ She checked her watch, then signaled to her clothing as if it was proof of something. ‘I’m meant to be running a hot bath for myself right now while scooping ice cream. But instead of that, and a late-night walk with my parents and their dog, here we are.’
Kovac said nothing and subtly gestured for Megan to stay quiet too. That was fine with Megan. She was interested to see where Juliette was headed with all this.
‘I’ve spent the day trying to understand this, but I’m nowhere with it. It doesn’t make sense.’ She sighed. ‘So have I covered every angle, am I absolutely certain there isn’t some quick way to turn back time? No. But that said, do I expect to find a magic fix? No again. Whoever did this, they’re good. They know what they’re going after. And something tells me they won’t provide an easy way for me to play superhero and save everyone’s day… Well, everyone’s day except for my own.’
‘Talk me through a company-wide reboot,’ Megan said gloomily.
‘As a starting point, we’d need to issue all senior staff new laptops like this one.’ Juliette waggled Megan’s lightweight 13-inch Dell. ‘We need you all on a new, uninfected network, so you can coordinate a global response. Given the size of this company and the number of senior staff, that’s a challenge in itself. But with the authorizations you’ve given me, I have a team on it and I’m hopeful we can get it done by this time tomorrow.’
‘And after that?’ Kovac asked.
‘After that, we need to rebuild the entire network. That’s 6000 plus servers. The hard part with that is making sure some idiot in an obscure office doesn’t plug in an old flash drive and send us back to step one.’
‘How likely is that?’
‘Very. But let’s factor in some good luck. Let’s assume we get lucky. Once we’re certain the new network is safe, it’s a lot of deleting. 67,000 PCs worth of deleting. We’ll need to erase the contents of every single one, reimage with a clean OS, then reissue back to the appropriate staff member. It
’ll be their machine still, but they’ll find everything they had on it is gone.’
‘And what’s the timeline for something like that?’ Megan asked.
‘If it goes well, weeks. If not, months. Even out to a year to really put this behind us.’ She paused. ‘Of course, when I say we start from nothing, that’s true at a staff level, at an individual level, but not at a company level. We will have backups of our servers and domain controllers, they just won’t be completely up to date. We’ll lose somewhere between three to seven days’ worth of data there.’
Kovac said: ‘In your opinion, is this a state-sponsored attack?’
Juliette fixed him with a quizzical stare. ‘Where did that question come from?’
‘A contact of mine suggested it was. I’m trying to determine what we’re up against.’
‘Maybe.’ Juliette thought for a second. ‘If it’s not internal, not our own staff, and it really has just raced around the company like I think it has, then yeah, maybe.’
Kovac didn’t let up. ‘What do you think about the lead Megan was given?’
‘You mean the accounting software? I think it’s probably nothing, but to be honest I’m yet to spend any real time on it.’ She shot Megan an apologetic look. ‘I’m sorry. I know you wanted me to prioritize it but the employee – I’ve forgotten her name…’
‘Samantha Griffin,’ Megan said.
‘Right. We get this. People come forward. They mean well but –’
‘You think she’s a crackpot?’ Kovac said.
‘She was strange,’ Megan said. ‘She got off track a lot and she was high strung, maybe because she couldn’t sit down or maybe –’
‘Why couldn’t she sit down?’ Kovac asked.
‘Something to do with her back. A herniated disk I think.’
‘Can you run through what she said?’ Kovac asked.
Megan sat down on one of the Danish lounge chairs, brushing hair out of her eye. ‘Ah, okay. She said she worked on Aurelius with five other coders. It’s accounting software, a reimagining of a product called AccountMe, put out by Wilson Software Solutions. I looked into them. They’re a small family-run software company here in London. Griffin claimed it was just us under attack. Just Curzon.’
