She closed her eyes. Oh, My Lord, please help me.
“Mrs. Thompson?”
Snapping back to reality, Adele blinked and saw Natasha walking up to her in the bank lobby with a large, ambling man in tow behind her. He was well built, with thinning blond hair and a black, short-sleeved polo shirt that said Ace Business Systems.
“Oh, great. It’s about time you got here,” Adele told the man. She looked at him again. His shirt seemed like it was too small for his build, and his features were particularly sharp, making him look almost bird-like. A predatory bird, perhaps, given his size. “Where’s Mr. Gary? He’s usually the one who does service calls for us.”
The large man smiled, revealing a gap in between his front two teeth. “Gary called in sick,” he replied with an odd accent. “So they sent me.”
“And you are...?”
“Johan.”
“Well, Mr. Johan, you’re late. My computer has been down for two full business days now, and it’s impacting my customers. If I’m going to pay your company to support our equipment, I expect you to actually support the equipment.”
The smile slid off the man’s face and he gave a conciliatory nod. “Of course, ma’am. I apologize for the delay.”
He seemed genuine, so Adele accepted the apology. “Thank you. I need this thing fixed.”
“I’ll get right on it now, of course. Can you take me to the machine in question?”
Adele turned to Natasha. “Would you take over helping train Mr. Benjamin?”
Natasha’s slender shoulders fell, and her dark eyes delivered an unmistakable, imploring message: please, no. Adele pursed her lips and jerked her head over her shoulder toward where the young man was busily trying to decide where his latest counting error had been, or even if he had an error. Natasha’s head fell, and she skulked over to the desk.
“Follow me, please.”
The pair was a study in contrast. Adele was a small, brown islander, with tight, curly black hair that she kept cropped close to her scalp. Johan was a burly man who looked like he could have been manning a Viking longboat. They proceeded over to Adele’s office, a corner room with a large glass window that looked out into the main room on the second floor of the BBC building. She walked around to her side of the desk, sat down, and logged into her PC.
“Do you see this?” asked Adele.
Johan looked at an inert Windows desktop on the screen.
“See what?”
“Exactly, Mr. Johan. Look. I click here on my Unibank icon. It doesn’t load. Do you know how difficult it is to use an application when you can’t start the application?”
The burly man’s forehead furrowed in consternation.
“That’s right, it is very difficult. I can’t do my job running around to everyone else’s workstation to use Unibank. I need it to work on my computer. And before you ask, I’ve already done all the rebooting and all of that jazz and it hasn’t fixed it.”
Johan took a deep sigh. “Okay, then. I’ll get right to work.”
“Yes, you get right to work. Mr. Gary would have been right to work yesterday, only he isn’t here, is he? So it’s going to come down to you now, who came late, to see if we put all of our customers out of business.”
“Yes, ma’am.”
Adele looked Mr. Johan up and down one last time. She was being hard on him—it was just frustration, really, at having to work late three nights in a row—but the man looked earnest, and she felt assured that when the technician was done, things would be back to normal. It was difficult enough to be a single parent raising two young children, never mind when work hours extended uninvited into what had always been Adele’s jealously-guarded family time. But year-end reviews would be coming up soon and she didn’t want any gaps in what she hoped would prove to be a sterling performance as the site manager. Their earnings were up, thanks to a couple large clients who were growing like crazy. And all the good things meant extra hours as a matter of course. Adele didn’t need more work on top of that because her PC was broken.
A moan of frustration carried into her office from the main bank floor. Adele looked up and saw Natasha snatching a stack of bills out of Mr. Benjamin’s hands so that she could count them herself.
And then there was that.
She looked over at Mr. Johan, who had sat down and familiarized himself with how her computer was set up—the monitor on the top of the desk, right behind the keyboard and mouse; the main CPU on the floor underneath; her own personal printer on the credenza set up at a right angle to her desk and topped with photographs of her children. Johan had placed his little tool bag on the floor and was typing busily onto her computer. Things looked under control here. With a brisk pivot on her heel, Adele Thompson went back onto the bank floor to rescue her employees.
Johan watched the woman leave. Keeping his eyes on the door, he reached into his shirt pocket and pulled out a tiny, one-inch-long plastic rectangle with a USB connector on each end, one male, one female. He ducked under the desk and unplugged the keyboard connection. Then, working quickly, he plugged the keyboard connector into one end of the device, and then the device back into the PC.
He sat back up and looked out the door. The bank manager looked like she was in the middle of a deep and unpleasant conversation with two of her employees, a young man and woman. She was quite distracted. Johan reached into his tool bag and pulled out his smartphone. With a tap of his finger he launched the app that Krystian had designed. It took a moment for it to load, and then there was a simple notepad screen. It was time to test.
Johan typed an X on the keyboard, even though there wasn’t any program open. The keylogger he had installed wirelessly transmitted an X to the screen on his phone.
He typed in a random string of characters. The same string appeared on his phone a moment later.
Johan opened Internet Explorer and typed the name of a porn site into the URL pane. The web address appeared in his phone.
Satisfied that the device was working and transmitting properly, Johan closed the browser and the application on his phone. Now he pulled out a small sheet of paper on which Krystian had written additional notes on what to do next. He opened a command prompt and typed in a series of commands that were meaningless to him, but obviously had very important and distinct purpose both in syntax and in the order he was to type them. Krystian had explained to Johan that Mrs. Thompson was apparently an avid Facebook user, and that it had not been difficult to get her to click on a hyperlink to download a virus piggybacking onto a YouTube video clip. That virus, written by Krystian’s little circle of geeks, made it impossible to launch any applications on a Windows machine other than Internet Explorer. The sequence of commands that Johan now typed in were what was needed to disable and delete the virus, and magically “fix” the functionality of her computer.
It was done.
Johan packed up his things into his tool bag and stood up. The bank manager was coincidentally walking back into the office and seemed surprised that he was finished so quickly.
“You’re finished?”
“Yes, ma’am. Your computer had a virus. I ran a scanning program and it cleaned it up right away. Everything should be working now.”
Incredulous, the manager walked briskly around her desk and commandeered the keyboard and mouse. Several clicks and keystrokes confirmed that her computer was indeed acting the way one would expect. She stiffened for a moment, then crossed her arms across her chest.
“Yes. Well, it does seem to be working now,” she said finally.
“Yes, ma’am.” Johan zipped his bag shut.
“How much is the service call, then?”
Johan smiled. “This one’s on the house, ma’am.”
The bank manager seemed flustered at the charitable goodwill. “I’m sorry you had to come over here for such a simple repair, Mr. Johan.”
“Not a problem,” Johan said. “But I would recommend allowing me to do a quick check of your other systems as well
, while I’m here. It should only take a few minutes to see if they are infected. After that, I do need to be going in order to get to the next service call. That way I can still bill my time without charging you.”
“Thank you,” the manager said, extending her hand. Johan shook it, gave her a nod, and followed her out into the lobby to examine some of the other bank branch’s computers.
40
Austin, Texas.
It was mid-morning on a Wednesday. Lucy was late for her meeting with Roger and walked quickly through the maze of cubicles. Roger had buzzed her office and told her to meet him right away. She hoped it was good news.
She arrived at the executive conference room that overlooked a panoramic view of the greenbelt. Roger was there and so was Marty, their QA lead. They looked odd standing next to each other. Roger was small and thin, well groomed and wearing business casual clothes. Marty was tall, unshaven, overweight, and his black jeans and T-shirt barely covered his belly.
“Hi guys,” Lucy said brightly as she set her tablet down on the conference table.
“You seem pretty chipper today,” said Roger, closing the door.
“Am I?”
Roger lowered his voice. “You know... Derek seems a lot happier lately, too. You wouldn’t know anything about that, would you?”
Lucy arched her eyebrow. “Maybe he’s found some purpose to life?”
Maybe, if that purpose was sex, she thought. She suppressed a smirk. The amount of time over the past month they had spent naked together was insane. No one was more surprised than she was. Ever since that night at the pub she had seen Derek in an entirely new light. He was the proverbial tragic hero, noble but flawed, and Lucy couldn’t keep her hands off of him. She wanted him to understand that he didn’t have to carry his burdens by himself anymore.
Roger gave her a little, knowing nod and walked back to the conference table. Marty was fiddling with the hookups to the overhead projector and trying to undo a broad, pink coloring that had taken over the display.
“Marty, are you ready?” asked Roger.
“Um... yeah, I guess I can be. This is kind of hard to see in here, though.”
Lucy went over to the wall and hit the window shade switch. Instantly the view of the exterior greenbelt was gone, replaced instead by an opaque white frost induced onto the LCD-coated windows. She tapped the switch two more times and the frost got successively darker. The light in the room dimmed enough so that even the pink hue on the screen still made for easy viewing.
“Just amazing,” Roger said, staring at the projection screen. “A state of the art conference room, furnished with the fucking shittiest AV equipment possible.”
“It’s just a loose pin,” Marty observed. He was still playing with the connector.
“So,” said Lucy, sitting down. “Why are we here, guys?”
Roger leaned against the edge of the conference table and looked at Marty. “Do you want to share the news, there, big guy?”
“What news?”
Roger smiled.
Lucy caught her breath. “Wait... you figured out how the money disappeared?”
At that, Marty stopped trying to make the pink go away. He looked at her and smiled. “Better.”
“Better?”
“We found the actual money.”
Lucy waited, transfixed.
“Well? Where is it?” she demanded finally.
Seemingly enjoying the drama, Marty leaned back in his chair and looked up at the overhead screen. “They used our Beta servers.”
“What?”
“I know, I know. I didn’t understand it at first either, but it totally makes sense now. Here’s what happened. We’ve been running all of these reports looking for unusual player activity, right? We didn’t find anything weird. I mean, we found some odd things, sure, but nothing really weird that might suggest someone picked up a million bucks. So Dave got this idea that maybe there was some way a player was hiding the fact that they were carrying all this money. We wrote down all these crazy ideas, like moving small amounts of treasure back and forth between little strongholds as waypoints, or having a bunch of characters act as mules so that no one was individually carrying a huge amount of dough at any one time. We decided we didn’t really know how to run a report to identify behavior like that, so Manmeet told us to create some scenarios and run it in on the Beta site so we could figure out how to write the query. So that’s what we did. Only when we ran our first report against the Beta instance, we found a lot more than the stuff we had set up ourselves. We found the jackpot.”
Roger cleared his throat. “Show her, Marty.”
Marty punched a key on his laptop and the pink overhead screen switched to a large table full of numbers. “This is what we found on the Beta servers.”
Lucy instantly recognized the format as a transitional account report. When the team had run the report before there had been nothing out of the ordinary. But now, there was one row on the table with a huge dollar amount.
It was $1,237,467, to be exact.
Lucy smacked her hand down on the conference table, furious. “What the hell, Marty? Why is there any money flowing back and forth on our goddamn test servers?”
Putting his hand up in a calming gesture, Roger interrupted the discussion. “Yes, it’s a security hole. But just wait. Next slide, Marty.”
The overhead advanced, and Lucy now saw two graphs fill the projector screen, one next to the other.
“We found a number of active accounts on the Beta servers,” said Marty, “The left chart shows the account balances of three players in particular. You can see that they’ve been growing steadily over time. Kind of unusual, wouldn’t you think, since there shouldn’t be any active players in Beta?
Lucy looked at a graph that showed a trio of lines steadily rising up to the right. Then, they all dipped dramatically to the bottom in a sudden, sharp line.
“The right chart,” continued Marty, “shows new player creation on the Beta instance. Each of those bars represents how many new accounts were created in a given week. It’s really, really high. But what’s more interesting is, it’s very steady, and all of the players are very short lived. Each account had cash dropped into it and then the character dies right away. It happens again and again. That money from these short-timers is what’s going into these players’ balances on the left. It’s a huge amount of money. Millions of dollars.”
Pursing her lips, Lucy considered the two graphs together. “Spell it out for me, Marty. What are you saying?”
“Maybe these three guys on the left who are messing around in our test environment, maybe they’re depositing little bits of money into all these baby accounts, and then consolidating it into a couple big players.”
“So... the whole thing is in dev,” Lucy muttered to herself. “From the beginning. Off the grid by design, for the sole purpose of moving money around...”
“Yes.”
“Who’s doing this?” Lucy growled.
“Not yet. There’s more,” said Roger. “Next slide.”
Marty advanced the slides and another chart filled the screen. This one was a table filled with math. It was practically an eye chart.
Marty took pity on Lucy as she squinted at the projection. He stood up and pointed at some summarized figures in the bottom of the table. “After a big build-up, there’s a steady rate of withdrawal from the three big player accounts. See, here?” Marty pointed to the graph. “But the math doesn’t add up. Take what is being deposited from, these, uh, death row characters, subtract what is being withdrawn, and the remainder should be the same as what we’re reporting. But it isn’t. It’s higher.”
“You mean, our three suspects here have more money in their accounts than the total from all those little accounts?”
“That’s right,” Marty confirmed. “There’s extra money coming in.”
There was silence in the room.
“They went adventuring over into the main game environment,
” Lucy said, finishing the thought. Marty was making her work to come to his conclusions.
“Yeah. They can cross over. Don’t know how, but I assume they hacked the system.”
Lucy furrowed her brow and was silent.
“Why would someone set up something like this? It almost sounds like—”
“Money laundering,” Roger finished. “With some added benefits, courtesy of their working capital.”
Marty cleared his throat. “We’ve been finding all kinds of weird little things once we figured out where to look. For example, even though the chart shows three player accounts, there’s really just one game account that holds the money. I think these guys have written new code that lets multiple people level up their characters off the same cash. I’ve already called SecureNet about how that could be and they informed me that we actually only had them contracted to cover the production environment. Not the dev servers. So we might have to clean up some malware floating around.”
Lucy felt sick. This was a huge security gaffe, all on her watch. She felt violated. Dirty.
“Okay.” Lucy realized she was wringing her hands. She took a breath to steady herself. “Let’s say all this money is illegal. There’s a million bucks of it missing. Where is that amount now?”
“That’s the right question,” Roger said. “It turns out that the fact that these players went adventuring is a good thing.”
“Huh?”
“When a vault is robbed, that treasure is transferred to a transition account tied to the vault, right? You have a cluster of three data items—the original vault id, the transition account id, and the player id who stole the money. What Manmeet found is that every time these three guys crossed back and forth between Beta and production, that player id field resets to null. Presumably that’s because the characters themselves don’t exist anymore. In effect, they’ve left the environment.”
Armchair Safari (A Cybercrime Technothriller) Page 38
