Chasing Pennies

I've written about exploits in banking and brokerage fraud with further articles to follow. Bad banking practices don’t feature well in my write-ups. Institutions change only when they’re forced to.

Recently my fraud expertise touched upon the personal. A good friend fell victim to gaping holes in one of New York’s largest financial institutions, J.P. Morgan Chase & Co.

Lily is smart, pretty, and unattached. Two out of three is pretty good, but she means to win the trifecta. She doesn’t advertise, but merely hopes to attract the right kind of guy. She appears on social media: Facebook, Pinterist, and a singles’ site that’s been around some thirteen years, MeetMe.com, where she met an interesting fellow.

Telling the good from the bad isn’t always easy. By the time our malefactor (male factor or dirtbag are also suitable) stepped into the light, he already knew critical pieces of information about Lily: her real name (thanks to odious Facebook requirements), where she’s lived, family relationships, and importantly– her birthday.

For a few weeks, ‘Antonio Sanchez’ from ‘New Jersey’ wooed our lass on MeetMe. He didn’t do anything crass like ask her bank account number or credit card information; thanks to Chase’s security ‘features’, he didn’t need to.

As Thanksgiving approached, Lily traveled across the country, stopping to visit relatives in Greenfield, Indiana, home of another Lilly, the famed pharmaceuticals company. Our heroine happened to check her bank account and found it unexpectedly fourteen hundred fifty dollars richer.

Lily, not only smart but honest, sought clarification at the Greenfield branch of Chase. Greenfield couldn’t fathom the problem.

check 1 of 6 #808869

“You put money into your account in the early hours of the morning. Looks like you needed it. What’s the problem?”

“I didn’t deposit anything.”

“But you did.” Greenfield regarded her suspiciously. “You’re saying you didn’t?”

“Exactly. I didn’t do any such thing.”

“Well, lucky you. Someone likes you well enough to put coins in your account.”

*click* Instantly Lily knew who’d made the deposit.

A couple of hours later, the situation reached me. By then, other deposits had appeared. Curiously, monies were rapidly shifting among Lily’s three accounts. My fraud alert alarms clanged.

“If you make a withdrawal,” I advised, “calculate only what you own to the penny and not a cent more.”

“What’s the problem?” friends asked. “A handsome guy sending Lily money? Does he have any brothers?”

I spoke adamantly. “There is no money, no boyfriend in New Jersey, no gold at the end of the rainbow.” When I explained the con, Lily agreed to join me for a visit to the Indiana State Police.

The man manning the reception desk told us all detectives were out of the office and wouldn’t return until the next day. Lily asked if she could file a report.

The grizzled trooper brought forms out to us in the lobby. He stood by as Lily tried to explain the situation.

He interrupted her. “A guy giving you money is no crime. No crime, you can’t file a report.”

I said, “There is no money. It’s a con…”

The trooper threw up his palm in a ‘Talk to the hand’ gesture. Cops are trained to seize and maintain control, even when counterproductive. He went on to lecture Lily, not so much accusing her of wasting police time, but of being silly.

“May I explain?” I said as levelly as I could. “There is no money, only fake deposits. He will use that false balance to pay himself.”

The cop paused, considering. “Wouldn’t work,” he said. “If I deposit a check, I have to wait a few days to withdraw funds.”

“That’s why he’s moving money around her accounts. Some banks, perhaps including Chase, lose track of new deposits as they’re moved around. The technique is called seasoning, losing the new deposit tag and making the money look like it’s aged on account.”

“I’m a road warrior,” said the trooper. “I’m not up on these things. Yeah, I’ll have a detective phone you.”

Virtually next door to State Police Headquarters, we’d noticed a Chase branch. Lily made the wisest decision of the day, visiting the bank for an update.

The young woman listened attentively. She quickly grasped the situation. “Oh my God,” she said. “I received a notice exactly like yours of a deposit early in the morning. I need to check my own account before I go home today.”

Together, the three of us discovered additional deposits and further shifting around of money. By then, funds had been used to buy the first Western Union money order made out to an unknown and very foreign name.

“Let me guess,” I said. “The money’s sent to Nigeria?”

“If Lily didn’t give this jerk her personal information,” the young lady said, “how did he get into her account?”

I explained one hypothesis. I’m a vocal critic of the so-called security questions routinely forced upon on-line customers. “What city were you born in?” “What was the name of your first pet?” “What’s your favorite team?” “What’s your favorite color?”

With the slightest information, bad guys find it ludicrously easy to guess the answers. The favorite color question often includes a helpful drop-down menu of eight colors. No one chooses black or white, so a malefactor can guess the answer in six tries or less.

The young branch manager rang the fraud department. She posed the same question to them, who replied “There are so many ways to breach an account…”

check 2 of 6 #808870

The bank gave us copies of the checks. One peculiarity came to light. Chase said it appeared the Nigerian repeatedly deposited the same two checks over and over, fooling Chase and highlighting another flaw in their security, a defective filter for detecting duplicate deposits.

Chase froze Lily’s accounts, leaving her stranded without travel money in the midst of a cross-country trip. But wait, we’re not done.

Lily awoke the next morning, finding her accounts unlocked and a half dozen or so deposits burgeoning her balances.

Lily phoned Chase to let them know further monkey business was afoot in her reactivated accounts. They quickly closed the window and her accounts, again cutting off her funds.

---

Big banks and little people, comes now the pathetic part. Instead of expressing gratitude for Lily’s quick action of notifying them of fraud, Chase blames Lily for the leaking of money from the bank. Their stance is that Lily either worked with the malfeasant Nigerian to defraud Chase, or at the very least handed over her account information to the bad guy. As you now know, that doesn’t have to happen. All it takes is sloppy banking.

Besides seizing Lily’s bank balance, Chase now demands another $600 in compensation for their losses. Good move, Chase: encourage honest citizens to rush in to report fraud made possible by your own shortcomings.

It’s a great day for banking. Have you had similar experiences?

The Digital Detective, Banking part 3

This continues a series of articles about computer fraud. Originally I practiced a career of systems software design and computer consulting, but I sometimes came upon a more shadowy world, that of computer crime. I seldom sought out fraud but I sometimes stumbled upon it, picking up undetected clues others missed.

This episode doesn’t deal with crime, per se, but it includes a con, minor as it is. The scheme required a little ‘social engineering’ and, though the word might be Yiddish, no one can schmooze like Southerners.

The story came to my attention while consulting for banks, this one deep in Virginia’s Shenandoah Valley. My landlord for part of the stay was an eccentric but colorful codger. He talked about a neighbor who leased farm land from him but failed to pay his rent. Outsiders might expect he pulled on a jug of rye whiskey as he talked, but all he did was lean back in his recliner, sip beer, and twirl a never-lit cigarette while a cheerful woman less than half his age clattered in the kitchen. I jotted down his story long before I became a writer, so kindly forgive error and stylistic issues as I strove to capture his dialogue.

1950s era corn picker

Damn Ernie. I hounded that man all summer long for the rent. Finally last fall, I hooked up my corn picker and started up the corn rows. Now a corn picker ain’t a quiet machine, and lo and behold, neighbor Ernie come dashin’ out of his farmhouse yellin’ and cursin’ that I’m stealing his corn.

I said to him I couldn’t possibly be stealing corn off my own land, unrented land at that. He steamed and stormed and said the seed and planting labor had been his, and anyway he was just a little late with the rent, three or four months, maybe four or five, weren’t nuthin.

I told him that I was just going to keep picking corn for myself until someone showed up with rent money. He dashed off like banshees themselves chased him. Pretty soon he comes back waving his checkbook.

I said, “Ernie, are you sure there’s money in that account?” Oh yes. He told me twice there was, so I said there’d better be, and he said he wanted the corn I’d picked. I told him to consider the already picked corn interest and collection fees. Fact is, I finished the rest of that row, which he just hated.

So the skinflint S.O.B. hustled off to hitch up his combine and wagon, and I find myself a few bushels better off than I was before. I cleaned up and headed in town to the bank, right past Ernie who’s racing his machinery through the fields.

At the bank, I always get in Molly’s line. She’s a sweet, buxom lass, and I’d been thinking about asking her out.^†

Anyway, I get up to her teller window and she said the account’s a bit short to cover the check. I asked her exactly how short, and she said she wasn’t allowed to tell me that.

So darlin’, I cajoled, is this check completely worthless, or did Ernie at least come close? Looking at her computer, she said he was purty close.

Well, I says to her kind of reflectively, I want to tell my neighbor Ernie how much he needs to cover my check. Like would he have to deposit only $10? No, she said, ten dollars wouldn’t cover it.

Well, says I, would $20 or $30 do? No, she smiled at me, it’s not quite enough.

Hmm, says I, I wonder if $40 or $50 would suffice? Um, she said to me, that first amount ought to cover it.

Thank you, I says, I’ll tell that rascal he needs to put $40 in the bank. By the way, sweet thing, can I have a deposit slip? And you think maybe I can call you up? For, uh, you know, maybe dinner Saturday?

So I walked out of there with a bounce in my step, a deposit slip and her phone number. I was feelin’ purty good. What I did was get in my car and circle around through the bank’s drive-thru. I already had Ernie’s account number on the check, so I just filled out the slip and shot it through the air tube with two $20 bills. Sure enough, the receipt came back showing $1002.39. Good on Molly.

But wait, I say, I almost forgot to cash a check. I send over Ernie’s $1000 check and this time I got back a thousand dollars.

Fair enough. I probably had $40 in shelled corn and a lesson I ain’t gonna rent to Ernie no more.

Ernie got stupid, though, and instead of being grateful I didn’t bounce his worthless ass along with his worthless check and turn both over to the sheriff for collection, he raised holy hell at the bank yelling someone manipulated his account.

I took Molly to the horse show that Saturday. Now I tell you personal like, you want to get a lady in a receptive mood, bein’ around horses will do it. Something about women and horseflesh– just a word to the wise.

Anyway, Molly, she confided the bank said it was apparent someone had taken liberties, but they couldn’t blame the girl who took the deposit and they couldn’t blame the teller that cashed the check. They just gave everybody a stern reminder warning.

Ernie wanted to call the authorities, but the branch manager explained Ernie’d be the one in trouble for writing bad checks. He didn’t mention Molly could have gotten in trouble if they’d figured out her role.

Molly said she knew I’d manipulated her and wanted to know if I’d asked her out from obligation or guilt. I said I didn’t want to sully a relationship thinking I used her. She needed a lot of reassurance about that, and so Friday nights and Saturday nights we just get romantic and I give her plenty of reassuring. Been about a year now. Figure we can go on with this for a long, long time.

And he winked at the cheerful lass in the kitchen doorway.

---

† Commonly in Virginia’s Shenandoah Valley, ‘out’ sounds are pronounced like a Scottish ‘oot’. Thus he really said, “I’d been thinking aboot asking her oot.”

Yet Another Computer Scam

 WARNING A scam involving Google and clever programming sleight-of-hand has hit the scene. It’s not entirely new– a prototype showed up in 2014– but it fools many professionals. Apologies in advance for the technical parts below.

A new month, a new scam, this one brought to our attention by a reader. Although widely reported, this scam hasn’t shown up in the ACM Risks Digest yet. Surprise– the scheme starts with your GMail where a note from a friend or colleague contains a link to another page or document. You click and receive a message you must log in again. Happens every so often, annoying but sign in again for security.

A Google log-in page shows up– the URL field (web page address) contains google.com. Enter your name, enter your password. Click. The document your compatriot sent now appears.

You may not know it, but you just lost exclusive control of your Google account. Your pal didn’t send that email and the link was plucked out of your emails.

Let’s look at the sign-on dialogue boxes again. Which one is counterfeit? Hover your mouse over them for the answer, but the fact is, they’re indistinguishable.


The insidious part is that email web sites– Yahoo and AOL included– train us by periodically forcing us to relog in. Hold on… didn’t the URL box contain google.com?

Yes. Over the years we’ve seen clever fraudsters incorporate target domain names similar to this:

http://w5.to/google.com

The trick here is that the real domain, web address of the bad guys, is w5.to. The google.com is only a web page set up to fool you. Other examples might look like the following:

http://citibank.net.w5.to/index.html

This is a variation of the bad guy’s domain, w5.to, above.

http://citybank.net

Here the bad guys registered a variation of the real name made a little easier by CitiBank using a non-standard spelling. These three examples are reasonably clever and some scammers don’t take that much trouble. However, this new one can catch even professionals by surprise:

data:text/html,https://accounts.google.com/ServiceLogin

The clue something is very wrong lies in the first three words, data:text/html – you shouldn't see that at all. The opening letters of an URL don’t have to be http – they can be file, data, help, about, chrome, gopher or possibly another protocol, but ‘data’ is the only hint the page is abnormal.

Browsers have become more sophisticated over the years, so web pages might include additional capabilities such as setting preferences. The ‘data’ keyword allows HTML to be embedded in the URL field, but more insidiously, it allows JavaScript, and that’s how this particular exploit fools us. Following the ServiceLogin part of the URL are dozens upon dozens of spaces so you can’t see what comes next. Far beyond the right side of that URL field is where the real sorcery begins with <script…>. This malware program throws up a fake Google sign-in page to capture your ID and password.

Expect Google to quickly mount an update, but beware, look ever more critically at URLs when you’re asked to type in your credentials. It might save your on-line life.

RansomWare 3,Recovery

 WARNING  In part 1, we discussed a nasty type of malware (malicious software) called ransomware and in part 2, we recommended preventive steps. In this final article, we explore options in the event your computer is attacked.

Don’t Pay

That’s the advice of most professionals. Besides filling criminal coffers, a better reason leaps out. FireEye Security and technical advisor Alain Marchant estimate only 60% of payees get their computer back intact. BitDefender estimates even dimmer odds, as few as half of those who pay see their files returned. Symantec hasn’t published figures but they’re also not optimistic about the odds of success.

The poor odds of successfully retrieving files has drastically impacted the ‘business’ of extorting stolen files. TeslaCrypt perps have taken two unusual steps.

1. They set up a secretive TOR ‘dark web’ message center to facilitate payment.
2. To prove they can actually decrypt files, they offer to decrypt a small (very small) file of the user’s choice.

Yet, as they try to extract payment, their pages hint at the myriad failures and pitfalls: «If step 2 goes wrong, then attempt this and if that goes wrong then try that and maybe try again in 10-12 hours… which may exceed the allotted time… blah, blah.»

Then consider the matter of who reaps the stunning profits from ransomware. It’s tempting to blame ordinary criminals but in fact, ransomware funds terrorist groups like Daesh/ISIS and al-Qaeda. State-sponsored extortionists include the obvious suspects, China, North Korea, and Russia. Technical authors Gregory Fell and Mike Barlow further accuse Iran and Israel of sponsoring attacks at the expense of the rest of us.

Ransomware is an international problem. The Russian security firm Kapersky Lab was reportedly hit with ransomware and thus turned their attention to addressing the problem. French security consultant Alain Marchant, who goes by the name xépée and cheerfully admits Marchant may not be his real name, has developed a client base of victims ranging from individuals to major companies. Here at home, developers of anti-virus products have trained their sights to the problem.

The Costs

Worldwide, malware sucks more than a half-trillion dollars out of the annual economy. Some target individual countries like Japan (TorLocker) and Russia (Kryptovor), but others are indiscriminate. The US alone loses $100-billion annually.

Cyber crime is lucrative and safe. While one or two man operations bring in as little as $1100-5500 daily, Symantec traced one revenue stream that amounted to $35 000 a day, a number consistent with a study by FireEye Security. At the upper end of the scale, Cisco’s Talos Group calculated the Angler exploit (CryptoWall, TeslaCrypt) each day targets more than 90 000 users, pulling in $100 000… every day.

Losing family photos is one thing, but businesses have lost their files, charities their revenue, hospitals their patient records, government agencies their data, and– in at least three cases– people their lives.^[1],[2]

Practicalities

Acquaintances of ‘Mark’, a victim mentioned in last week’s article, casually recommended caving to demands and paying off, ignoring the odds and consequences. Those acquaintances may be well-heeled and untouched by ordinary concerns like money and terrorist funding, suggesting if one can afford it, why not? Fortunately, Mark had a friend to help see him through the worst of a bad situation.

If you are a victim, only you understand your circumstances or desperation, but treat pay-offs only as an absolute last resort. Be prepared for the worst– your payment may go for naught.

Easy Pickings

Chances are you’ve seen web pages or pop-up windows that claimed your computer has been damaged or compromised and to call ‘Windows’ or ‘MacOS’ where ‘professionals’ for a fee will help you stamp out this insidious nuisance, one they created, although they don’t tell you that.

These are usually simple browser attacks– JavaScript on a web page seizes control of your Edge browser, or Internet Explorer, Safari, Chrome, FireFox, etc. The good news is they’re relatively easy to defeat, although getting out of the situation can puzzle an average user.

In these cases, don’t panic and don’t call the toll-free number the bad guys so thoughtfully provided. You may want to call a friend for technical assistance, but you may be able to solve it yourself.

The key to recovery is killing the script, the little program abusing your browser. You may be able to simply close the page, and if so, job well done.

Another approach is to open the browser Preferences or Options and disable JavaScript. Once JavaScript if paused, you can close the web page at your leisure, alt-ƒ4 or the more nuanced ctl-w for Windows, cmd-w (⌘-w) for the Mac. Unfortunately, FireFox made the decision to remove the option to disable JavaScript, but add-ons like QuickJS, NoScript and Ghostery give users that option. For the Mac, typing command-comma (⌘,) normally brings up preferences, but the malicious script may thwart that move.

What happens if you can’t close the web page and can’t disable JavaScript? You have no choice but to kill the browser and restart with a goal of stamping out the offending window. Use the Macintosh Force Quit (⌘-opt-pwr) or the venerable Windows Task Manager (win-shft-esc). You may be able to right-click on the program icon to close it. When restarting Safari and Edge, use finger dexterity to close the offending window– you may have to force-quit and restart a couple of times to succeed. FireFox is helpful here: They provide a dialogue box asking which pages you want to reopen (or not).

Note that you may have to smack down more than one browser window. At least one exploit deploys two pages using one to reopen the other if it’s closed. Both pages need to be killed.

Trust Issues

As with other ‘exploits’ (short for exploitations in professional parlance), you can (and should) take the preventive measure of downloading an alternative browser to your computer, say Opera, FireFox or Chrome. If a bad script has nailed your Safari or Edge browser, you can fall back on an alternative until you can get help.

The other key step is not to download anything you don’t trust. Don’t fall for messages claiming your Java or Flash or SilverLight player needs to be updated. Be extremely shy of web mail that offers to upgrade Windows 10. The safe way to update is not to click on the helpful button, but to locate the official web sites and manually download any updates yourself. Make certain the URL says java.com, adobe.com, or microsoft.com (with or without the www.) and no variation like javaupdate.com.

In the past, professionals have disdained automatic updates and that’s fine for them. Let them micromanage if they will, but for the average user, I break with my colleagues and suggest automatic updates might prove safer. The reason is that if you already trust a program, then its updates are reasonably safe as well. At worst, you may get a message saying that FireFox must be restarted, although if you don’t restart immediately, the updates will kick in after you quit your current session.

Apple and Microsoft occasionally check for updates. While I approve of the automatic mode, I suggest running the update check one time manually so you know what to look for.

RansomWare

Thus far we’ve discussed the simplest form of ransomware that merely subverts your browser. At present, you’re more likely to encounter web exploits than the really nasty kind that takes over your computer by encrypting files and user programs.

True ransomware programs demand payments ranging from $200 to over $2300 ($475 appears average) in untraceable digital payments, up to tens of thousands of dollars when targeting hospitals, corporations, and crippled city and county governments. There is no single flavor of ransomware. At least half a dozen strains are extant plus offshoots and variants. Each makes up its own rules and demands. Early models sought cash transfers via Western Union and later Ukash, MoneyPak, and PayPal My Cash, but nearly all now demand payment in anonymous digital money– BitCoin.

The other characteristic found in most ransomware is the imposition of a deadline, after which the bad guys state they’ll refuse to restore your files altogether and at least one variant claims it will permanently ruin your hard drives, not merely beyond recovery but beyond formatting (a highly dubious claim).

The time limit serves one primary purpose, to apply pressure and rattle the victim, to preclude the user from thinking his way out of the dilemma. A time limit makes it difficult to gather information, tools, and help. The target may not have sufficient opportunity to order recovery tools or a second drive to work from or a create a bootable disc.

Besides your backup, you will need a reinstallation disc. These days, few computers come with installation DVDs. Some computers feature a bootable partition that contain tools and recovery programs. In other cases, you must download a so-called ISO file from the internet to burn to an optical drive (Blu-Ray DVD, etc)– but you can’t safely do that from your compromised system– you either need to boot from a trusted drive or ask someone to download a recovery ‘disc image’ for you.

As far as the threat to permanently wreck a hard drive, it’s hypothetically possible but unlikely. Black hats may alter your boot tracks or drivers, but those can be repaired with a disc formatting program. In the unlikely case that bad guys were to zap your drive’s firmware, they’d have to strike after the time limit they imposed. Long before then, an aware user should have powered down his computer.

Demanding Money with Menaces

British use the term “demanding money with menaces” regarding blackmail, extortion, and kidnapping for ransom. The threat of ransomware is clear: If you don’t pay, you lose your files. But if you do pay, you may still lose your files. Damned if you do, damned if you don’t, the track record is not good.

Beyond the substantial risk a victim will never see his files after payment, there are sound reasons for not paying or attempting to communicate in any way. The victimized may inadvertently expose more information than realized such as passwords and bank account information. My colleague Thrush says paying or trying to reach out tells the bad guys “they have a live fish on their line.”

If a victim attempts to reach his bank on-line, an infected computer can forward passwords and account information to the miscreants. Because the bad guys have control of their subject’s computer, they may be able to extract injurious information. A wise solution is to quickly disconnect from the internet to interrupt the outflow of information.

One-Way Communication

Security consultant Alain Marchant says about 12½% of victims opt to pay, but less than ⅗ of those cases see the return of their files even after payment. He suspects the percentage may be considerably worse because of under-reporting.

Marchant’s stats are highly consistent with FireEye reports. He attributes failures to restore hostage files to a number of factors.

• There may be no hidden server that can unlock the files. The victim has only the criminal’s word such a server exists. Maintaining servers exposes the bad guys to risks they may not be willing to take.
  
• Perpetrators may simply not bother. A one-man operation can easily bring in a minimum of thousands of dollars (or euros or pounds) a day, millions a year without lifting a mouse-finger. An extortionist whose biggest problem is hiding money from authorities may feel no obligation to release hostage files.
  
• Hidden servers, if existing at all, may be taken down by its ISP, by government raid, by weather, by a denial-of-service (DoS) attack, by power failure or other outage, or by the bad guys themselves to evade detection. Perpetrators, particularly those on the move, may rely on laptops that are on-line only for brief periods. A perpetrator who can’t connect can’t repair the damage.
  
• Because of a restricted ability to test malware, perpetrators’ programs may be bug-ridden and unable to recover the data. FireEye reports that files encrypted and then decrypted by TeslaCrypt turn out corrupted.
  
• Perpetrators may not have the sharpest grasp of time zones, which may cause a premature trashing. Problems are exacerbated within one time zone of the Greenwich meridian and worldwide during daylight savings time changes. Ransomware does not take into account weekends, holidays, and banking hours.
  
• Perpetrators may not have the sharpest grasp of exchange rates. For example, a ransom page may demand $300, but with worldwide reach, may receive $300 Canadian instead of US dollars and therefore not release the files.
  
• Victims’ machines may be knocked off-line by the same problems above that affect perpetrators’ servers.
  
• Victims’ drives may be so badly damaged, that recovery becomes impossible. Moreover, perpetrators may encrypt the very keys or tokens victims need to communicate with their bank.
  
• Victims usually don’t possess a clear understanding of bitcoins. Some attacks require users to install modified TOR browsers to arrange payments. While these measures help perpetrators hide from authorities, victims lose time and possibly their files while trying to figure out the process.
• Victims’ anti-virus software may belatedly catch and delete the ransomware program making recovery impossible.
• Multiple malware infections may collectively interfere with each other. Victims may inadvertently exacerbate the problem by researching malware on the internet, triggering secondary infections that make recovery impossible.
  
• Victim’s computers may reinfect themselves as drives are brought on-line.

Recovery

Clearly the odds of recovery are better with anti-ransomware programs, assuming data hasn’t been deliberately damaged beyond encryption. If at all possible, create and work from an external drive. You may find better success removing the computer’s hard drive and hooking it up to a clean computer. The idea is to keep the virus dormant while attempting to remove it and correct the damaged files.

At the end of the countdown period (typically 72 or 96 hours), some malware strains sabotage the rest of the hard drive, erasing boot tracks and directories. Marchant suggests it might be possible to turn back the clock in a PC BIOS by several hours to extend the period of analysis and recovery. For this to work, the computer must remain disconnected from the internet.

If there is an extant key, it may not reside in a remote server at all but could be buried in your machine. That can help assist programs in decryption.

Following are a few Mac and Windows resources to help in preventing and recovering from ransomware.

Anvi Defender AVG BitDefender BullGuard Cisco Talos ClamAV•ClamXav

FireEye/Fox-IT HitMan Pro Intego VirusBarrier Kaspersky Lab MacScan Malwarebytes

McAfee Intel Panda Sophos Anti-Virus Symantec / Norton WinPatrol WebRoot AntiVirus

Be safe out there!

RansomWare 2,Vampires and Zombies

 WARNING  Last week, we discussed a particularly vicious type of virus, one that poses a severe risk to your computer’s contents. It’s called RansomWare and it’s coming to a computer or cell phone near you. This week, we offer specific steps to protect yourself.

To infest and infect, one of the givens of vampires is that they must be invited into one’s home. Dracula and his ilk may mesmerize or seduce, but only when a victim throws open the window can the creature waft in.

Viruses– and more typically a variant called Trojan horses– work the same way. A colleague hands the victim a flash drive, or she (or he) clicks a disguised download button or the attachment of an email. Voilà, she’s unknowingly invited the devil into her life.

Sometimes the effects are relatively minor– they may quietly turn the target into a zombie server, a computer that sends out spam, illicit files, and even malware without the owner’s knowledge. The truly bad infections can suck the lifeblood out of the system. Ransomware falls into this latter category.

Recently, Dale Andrews received an apparent email from Velma with an attachment. Strange… she rarely emails and I knew our secretary hadn’t emailed anything since the beginning of the year. Fortunately Dale didn’t open the attached payload. It may have been nothing more than a Nigerian scam letter… or it could have been considerably worse.

Pleadings

My colleague Thrush keeps enough computers to power Bulgaria, nearby Serbia and Romania. He thinks like a pro; he takes security very seriously.

His friend Mark phoned– he’d been hit with ransomeware. Arriving home in the evening, Mark had sat down at his computer, tired and less than alert. One of his emails raised the spectre of a lawsuit; it included attached court documents.

He downloaded them and… innocently unleashed the wolves. Whatever had been attached, they weren’t pleading papers. A screen popped up… his computer had been encrypted by ransomware, demanding a few hundred dollars to return his goods.

The man immediately detached his computer from his local network (LAN), one that included his backup mechanism and his wife’s computer, which fortunately contained their most critical files. His desktop was done for, but quick action saved their most important files.

Defense

The best protection against malware (malicious software) and ransomware in particular is to prepare your fortress now.

I. Backups

Back up, back up often. I previously mentioned it’s critical to back up to drives or discs that can be detached. The reason is that if your backup drive is on-line when malware strikes, you could lose your backup and everything on it.

A simple strategy used in the early days of computing is to make grandfather-father-son backups: You cycle through your discs (or tapes or other media) reusing your oldest backup each time. This includes one vulnerability in that you may back up defective or damaged files without realizing it. For that reason, archive a backup each month or so. Tuck it in a drawer or bank vault and exclude it from the recycling.

Consider using Blu-Ray discs with write-once technology. Those discs are not only less expensive than rewritable discs, they’re safer in that they cannot be later altered and their life span could last for decades.

The Macintosh includes a backup program called Time Machine. It can operate in manual mode, which is useful for detachable drives. It also offers a continuous mode in which changed files are backed up every hour to an attached drive, the cloud, or a NAS (network area storage) unit. Continuous backing up is great unless ransomware attacks the backup files.

A method of safe continuous backup is possible for desktop computers using these steps:

1. Ensure files you want backed up are either in your public folder or outside your home folder altogether. In other words, make sure items to be backed up are visible beyond the confines of your user folder.

2. 

   W-D My Passport back-up USB drive

   Establish another user account called Backup. If set up properly, it should be able to see the files and folders you want backed up. Keep things pure. Do not use this account to surf, read email, or shop on-line.
3. Attach a back-up drive, cloud storage, or NAS using a password. Only the Backup account should have the passwords readily available. Don’t access these drives from your main user account(s). (Western Digital external drives not only provide good back-up programs, they also allow the drive to be password protected.)
4. Start the back-up program, providing its security services with passwords if needed. Don’t log off the Backup account when returning to the main user account.

While you’re working, the Backup account will quietly save your data. If you are attacked, malware won’t be able to get at the back-up drive. You need only consider this for continuous automatic back-up programs like Time Machine.

II. Modems, Routers, and Firewalls

The Backup account acts as a sort of firewall to seal off back-up drives from the rest of the machine. Chances are your router as well as your computer contain software firewalls. Because of the variety of manufacturers, I won’t attempt to address specifics other than to suggest learning how or seeking help in using them.

With the router, keep open ports to a minimum. Use long passwords for both your modem and your router. Be careful whom you let into your network. Some wireless routers allow ‘guests’ with imposed limitations. If both your router and your guest’s computer, tablet, or phone features a WPS button, you can permit guests to connect without giving out a password.

III. Computer Settings

Besides judicious sharing and firewall settings, a seemingly minor option offers major potential. By default, both Windows and the Mac don’t display common extensions (.doc, .rtf, .gif, .mp3, .exe, .app, etc.) An invisible extension might look a little prettier, but that extra piece of information might help you save your computer.

Say you get a breezy email purportedly from a friend containing an attachment called FamilyFotos.jpg. You start to open it but, if you’ve activated the showing of extensions, you’ll see the full name is FamilyFotos.jpg.app … uh oh!

Or, say you visit SexyBuns.com, download HunkyGuys.mp4 (yes, I’m talking about you, Jan Barrow Grape of 103 Rodekyl Lane, Armadillo, Tx 78657) and spot that the complete file name is hunkyguys.mp4.exe

These are big clues that those files are not friendly.

Show extensions by visiting Control Panels Files and Folder Options (Windows) or Finder Preferences (Mac) and checking the appropriate box. Now you can have more confidence that LegalPapers.pdf is truly what it claims.

☑ MacOS X show extensions

Use extra caution with .doc and .docx files. Unknown files may contain malicious macros and may even suggest you turn macro support on if it’s not. More recent variants reportedly can leap the divide from MS Word to infecting the rest of your computer.

If you wish to peek at unknown Word files, use WordPad (Windows) or TextEdit (Macintosh) or equivalent text processors that ignore embedded macros. Whenever possible, use .rtf instead of .doc as a far safer alternative.

☒ Windows hide extensions

Email filtering not only keeps annoying mail out of your in-box, but it can also provide a line of defense against malware. Even if you blacklist/whitelist, keep in mind that bad guys may have hijacked a friend’s contacts list and try to spoof their address relying upon your trust.

IV. Too Helpful

Be wary of too-helpful emails and pop-up windows that offer updates to Flash, Silver Light, or Java, and especially shortcut links to your banking web site. If you receive an email supposedly from PayPal, your financial institution, HealthVault, IRS, Social Security, or other site containing personal and financial information, don’t click on any embedded links. Instead, type in the URL address yourself to be assured you’re not accessing a ‘spoof’ site trying to trick personal information from you.

Consider the irony

Notices urging upgrades– usually employing pop-up menus– can serve as fronts for malware. Don’t fall for the false convenience. Be cautious of notices your computers has been infected with a virus. If your browser screen locks up, get help. Don't call the toll-free number on the screen.

Such notices may try to trick you into installing nasty stuff. If you think you might need a newer Flash player or Java component, then hie directly to their web sites and check for download versions.

V. AntiVirus Protection

Obtain a good anti-malware suite, either free (like AVG) or from Kaspersky Lab, Symantec/Norton, BitDefender, Malwarebytes, or WinPatrol. They each take different approaches. BitDefender’s defense works as a sort of vaccine. The free Panda Ransomware Decrypt Tool tries to restore deliberately damaged files.

If at all possible, remove the wounded drive from its computer, or create and boot from an external drive to work on the damaged device. It’s possible the infection has altered the boot sectors of your hard drive. If you’re able to decrypt your damaged files, move them to a safe place and totally reformat the damaged drive.

The Myth of Customer Service

One of the internet ‘memes’ floating around the web speaks of ransomware ‘customer service’. This irresponsible wording is tantamount to insisting a rapist gives good customer service if he doesn’t kill the victim. Even professional developers who should know better use this expression, an indication of naïveté rather than an expert opinion. A paid criminal that restores files only 50-60% of the time does not exhibit good customer service.

More on that next week. In the meantime, avoid zombies, vampires, and malware.

RansomWare 1,The Threat

 WARNING  A particularly vicious type of virus poses a severe risk to your computer’s contents. It’s called RansomWare and it’s coming to a computer or cell phone near you.

Although no longer engaged in software design, I enjoy keeping an eye on technology. RansomWare had risen on my radar as an up-and-coming annoyance, but I hadn’t appreciated the level of threat it’s become.

Virus sophistication has risen from the early cutesy messages to vandalism to zombie-bots… hidden programs that turn your computer into a secret spam server. In the past, viruses were largely preventable and recoverable.

That’s changed. Bad guys have figured out how to monetize infections that can wipe out your photos, movies, letters, tax records, your home and work content. They can obliterate your recorded life.

The viciousness doesn’t stop at the personal level. We know only of attacks made public, but ransomware has assailed small businesses and large, county offices, schools, charities and non-profits.

The criminals behind the scenes have no compunctions. A favorite soft target has been hospitals where lives hang in the balance. Forensic experts believe some of those penetrations were deliberate attacks from the inside. To wit, someone deliberately hand-planted a ransom virus in hospital computers.

Even police agencies have been hit and– to the disgust of many– they paid the ransom. How can criminals be stopped if police dump public money into their coffers? For all anyone knows, the attackers may have been terrorists or state-sponsored Daesh/ISIS or al-Qaeda, China or North Korea, all badly in need of euros and dollars.

Destroying a victim’s computer’s contents can ruin years, even decades of work and study, crucial research and development. RansomWare can devastate careers and ruin lives. It even takes lives, at least three known victims, father-son deaths and a student suicide.

What is RansomWare?

A type of virus or infectious malware, ransomware invades a computer, renames and encrypts your files with mathematical, non-reversible encoding. The malicious program then offers to reverse the damage in exchange for a demand ransom ranging from two- or three-hundred in dollars, euros, pounds sterling, or the equivalent in untraceable bitcoin, into thousands. If the black hats recognize a high-value target like a hospital or government agency, they may demand tens of thousands of dollars. Some programs set a three-day deadline after which they promise to wreck the machine beyond repair.

The ransom virus lingers in the target machine long after the damage is done. Worst of all, victims face a substantial probability that even if they pay the ransom, they won’t get their files back.

At present, the worst of ransomware mainly attacks Windows computers, but Macintosh and Unix/Linux users shouldn’t grow complacent. One Mac malware program contains no mechanism to restore files after payment. Black hats have already breached a major Java component (JBoss) and some ƒ-head will figure out how to devise a devastating Unix-based attack. It takes little more than catching a human in a weak or distracted moment.

W-D My Passport back-up USB drive

Now is the time for all good men and women…

Kindly accept today’s article as a heads-up, a wake-up call to take steps now to deal with this eventuality. Writers among us may be able to glean facts for a fine techno-thriller, but safety comes first. We’ll be discussing

• backup, backup, backup
• computer settings
• modems, routers, firewalls
• virus prevention and ransom software
• pop-up and email software ‘updates’

Back-up

Next week I’ll share more detail but consider immediately buying one or more external drives for backing up your important files:

• Western Digital USB Passport series starts about $45 including Mac and Windows back-up programs.
• Flash drives are conveniently small although speed ratings of larger capacity drives can prove excruciatingly slow. These are convenient if you concentrate on backing up your data rather than your operating system or programs, which you can presumably otherwise recover.
• Safest and cheapest of all, you can toast a permanent copy of your data to a Blu-Ray DVD if you limit your back-up to data only. Prices start around $120 for single-layer 25gig drives and increase for dual, triple, and quad-layer models. Single-sided media cost less than a dollar a disc; dual-layered discs run less than three dollars.

The key factor is to backup weekly or as frequently as your willingness to risk your most recent data allows. Then, once you’ve taken a backup, disconnect that drive from your system so it won’t fall victim to a ransomware infection.

Take an extra moment and visit your Control Panels (Windows) or Finder Preferences (Mac). Change the default setting to show all file-name extensions. I’ll explain why next week, but it may help you catch malware masquerading as innocent files.

Stay safe. See you next week with malware vampires and zombies.

The Digital Detective, Wall Street part 2

continued from last week…
The Best of Times…

Systems programmers held a unique niche in the multiple mainframe corporate structure. We didn’t practice ordinary commercial programming but were responsible for keeping the software side running– the operating systems, telecommunications, and utilities. The best of us knew assembly language– the cryptic machine instructions that underpin more or less human-readable languages like C, Cobol, Fortran, and Java. We dealt in bits and bytes, binary and buzzwords, not credits, debits, and balance sheets.

Plane atop 77 Water St

Walston was flush. Shortly after I joined, they moved into their fancy new skyscraper at 77 Water Street, a few steps south of Wall. It featured an artificial stream, a padded soda dispenser shaped like a floppy-eared dog, elevators illuminated like the night sky, and a full-size sculpture of a biplane on the roof. You can see it in the opening fly-over sequence of the disappointing movie The Forgotten; there you can spot the airplane still atop 77 Water.

Walston’s cast of characters included my boss Alex, his boss and vice president Paul, and an assistant vice president, Jim. Brokerage firms contain nearly as many vice presidents as they do brokers. The wrinkle in the relationship was Jim had originally hired Paul who passed him on the corporate ladder. Nearing his 25^th year with the firm, Jim became marginalized, holding down a desk but no responsibility. Upon retirement, he planned to buy a Land Rover, move to South Africa, cultivate a mustache, and live a life of alternating adventure and leisure. As the weeks ticked away, that’s all he talked about.

Wall Street and Financial District

Walston’s third floor contained two sections: the computer room and offices occupied by Arthur Anderson overseen by a Walston executive with the musical name Glenn Miller. As systems programmer, I was the rare programmer allowed in the computer room. That drew the attention of Arthur Anderson.

It wasn’t unusual for large corporations to provide offices for their accounting firm, but it wasn’t kosher for one’s auditors to use provided offices to perform work for other companies. The rules for AA were different. As one of the accounting wonks said, saving office space didn't hurt anyone. It may have been true, but violating rules exemplified the looseness of managerial oversight.

Toad in the Hole

Walston brought in two consultants, guys who would tell a company the same common sense advice at five times the price of listening to their employees. That’s one reason I later became a consultant– companies pay to listen to you.

As far as I was concerned, this was more background noise, but one day my boss Alex called me into his office. There sat the consultants and two Arthur Anderson guys amid palpable tension. They wanted me to perform a task: write a program to scan files and ‘correct’ fields, i.e, numbers within the file.

I pointed out I didn’t do that kind of commercial programming and this was far more suitable a task for one of the Cobol programmers. No matter, they assured me, they wanted me. I should be flattered.

Who’s the analyst who designed this? I asked, not feeling the least flattered. I’ll talk with him. No, said the consultant, only you. The Anderson guys nodded while my boss frowned.

Reasonably, I protested that the Cobol programmers possessed the pension suite’s data structure templates. Without them, I had no idea what the data was. It would be like blindly machining a part while they withheld the blueprints, which could damage the data.

The Arthur Anderson guys exchanged glances. My boss started to fidget. The background noise sounded like a clanging alarm. Practiced deceivers they weren't. Something felt wonky but I didn’t know what. They didn’t quite say I had no need to know, only I needn’t be concerned.

Where did a shift of responsibility end and liability begin? Were they buying blind loyalty or blindness? A light bulb went on. I raised my last objection. What about the lack of an audit trail, I asked. Assembler language would bypass all the record and financial controls.

Of course they knew that. They went into a huddle. Moments later, my boss said coldly, “We’re done here. You’re dismissed.”

I slogged back to my desk feeling dark and dysphoric. With good reason: shortly the VP called me in. He informed me the firm would cut my salary and no longer pay my tuition. Alan, the office political toady, would replace me.

Fire and Ice

Suddenly I didn't feel so brilliant. A thunderstorm had squalled up out of the blue. A kid like me didn’t make or have a lot of money and I desperately needed my classes. It didn’t dawn on me to ask why they didn’t dismiss me. Maybe they feared what they thought I knew or wanted to keep tabs on me, but my ego suggested they kept me because Alan the toady was incompetent and incapable of doing my job. He didn’t know machine language but he knew Cobol… and probably knew where to find the questionable data templates. Meanwhile, they were slamming me for questioning orders.

My boss and his boss cold-shouldered me. They almost fired me when the payroll department screwed up and continued paying my tuition, but as was pointed out, that was their error, not mine. We were at loggerheads, but they needed me as much as I needed the job.

The VP’s secretaries treated me with surprising sympathy and kindness. I don’t know how much they knew, but one took me out to lunch and the other gave me a small gift. In the cold light of Walston, they radiated warmth.

In the outside world, Ross Perot had been tacking his way through Wall Street, taking over data processing services, a forerunner of out-sourcing. When the F.I. DuPont scandal hit, Perot stepped in and bought the firm.

I received a cagey call from EDS, the company Perot founded, asking if I’d come to work for them. EDS had a rigid stiff-necked (most said 'tight ass') reputation with a dated, regimented dress code– white shirts, narrow dark ties, grey suits, pants with cuffs, shoes with laces. They subjected potential employees and their spouses to a battery of interviews. Creative thinking was not encouraged. EDS employees liked the money but not one I knew liked the company. I politely declined.

We picked up a programmer from DuPont. Perot had arrived in NYC and put his DuPont troops through sort of a surprise dress parade. As he marched down the line of employees, he came across a girl who wore the fashion of the day– a miniskirt– and fired her on the spot. At Walston, we didn’t mind miniskirts and hired her.

Word on the Street

One day, employees awoke to a lead article by the Wall Street Journal announcing Ross Perot would take over the computing facility of Walston. Vice President Paul turned shockingly white– he hadn't heard even a whisper– but brokerage houses mint vice presidents like they print stock certificates. The company denied the story and things sort of returned to normal.

Except an odd and unsettling thing happened. One month from his 25^th year and retirement, Jim, the marginalized AVP found himself called into the VP’s office. Paul, the vice president, fired him. Full retirement gone, no Land Rover, no African adventure, no life of well-earned leisure.

Another discreet call came in for me. The woman on the other end asked me to identify myself, asked if I could talk privately, then said, “Please hold for Mr. Perot.”

Despite what I've heard before and since, Ross was polite, even gracious, and I was flattered he asked me to work for him. But, as I pointed out, I attended university full-time, I wasn’t as regimented as his usual workers, I enjoyed a bachelor life, and– thinking of Perot’s cozy relationship with Richard Nixon– our politics didn’t mesh. He’d famously said he didn’t like gunslingers and lone wolves– and I was the epitome.

He said, “Son, thank you for being honest,” and wished me well. I wondered why he wanted me.

Take Two

Once again, employees learned the news not from their own company but from the WSJ: For the second time within weeks, employees woke to a Journal article confirming Perot would be taking over Walston’s computing center. Again, our shocked vice president had been left out of the loop.

When Perot dropped in to inspect the troops, he spotted the same girl in her minidress we’d hired from F.I. DuPont and again fired her on the spot. Can’t say Perot wasn't consistent.

Days later, Walston fired Vice President Paul two weeks from his 25^th year– and full retirement. The firm dismissed the consultants and Arthur Anderson's office underwent a shake-up. Programmers found themselves not only locked out of the computer room, but locked out of the computers.

Except for me. A good systems programmer could run the shop without operators, without analysts, without programmers. Perot didn't trust Walston's people, which explained the recruitment calls to me.

A panicked EDS crew asked where certain files could be found. They asked if I could find backups of older versions. They asked if I knew anything about original programs and data alterations. Unsurprisingly, those hotly desired files were the same my bosses asked me to ‘correct.’ The unasked question finally arose: were they corrections or were they coverups?

I dug into the files only to learn what Arthur Anderson already knew. It appeared Walston’s proprietors had embezzled the company’s retirement fund. Now it made sense why they fired the AVP days from his 25^th year. That’s why they fired the VP days from his 25^th year. The money was gone, reflected in the records my bosses and Arthur Anderson (or certain employees within Anderson) desperately wanted 'corrected'. The scheme was so compartmentalized, I doubted how much any one party in my department knew, remembering my boss, Alex, claimed the instructions came from on high. "Just follow orders," he said.

I'd been lucky: What might have happened to the joker who tampered with the data? Alan had been lucky: Unable to find his assets with both hands, he'd botched the changes although he left an audit trail.

Trinity Church framed
by Wall Street

How The Mighty Had Fallen

Perot took over Walston, folding it in with DuPont and again saving Wall Street considerable embarrassment. Two and a half years later, he lost his financial shirt and dismantled a hemorrhaging DuPont Walston. Perot arranged for Congress to give him a special late night $15-million tax break, causing an outcry of socialism for the wealthy when the bill became public knowledge.

Dark forces on Wall Street gleefully watched Perot depart, some accusing him of trickery, some suing him on the way. Whatever the truth of that matter, Walston had been rotting internally before Perot arrived.

Arthur Anderson survived with their reputation barely sullied. Indeed, Anderson and Walston’s Glenn Miller caught more flack for the Four Seasons Nursing Centers scandal than the internal decay within their own firms. It would take the Enron affair to bring down Arthur Anderson.

My services remained in demand and I moved on, still on Wall Street, starting my masters degree before joining forces with two of the earliest software entrepreneurs.

Imagination Noir

In imaginative moments, it’s easy to envision the kernel of a mystery intrigue plot. I picture a John Grisham novel, a storyteller's movie in my mind like The Firm. Had Walston’s board reacted viciously and violently, I might have found myself in a dire plot, on the run for my life with a miniskirted damsel as VPs, AVPs, and Anderson drones dropped dead around me. Excited movie audiences would gasp between mouthfuls of popcorn, women would cry, and children would whisper, “He’s so bwave.”

Maybe a dastardly plot isn't so far-fetched considering the mysterious suicide (or assassination?) of Enron executive Clifford Baxter, about to testify before Congress. But in the world of finance, what’s crooked isn’t always an actionable crime. Commit a fraud of sufficient size and business will hush it up rather than prosecute– not unless something can be gained in the guise of ‘investor confidence’.

Footnote

The case ended with a gentler tone: I commuted to Wall Street on the Staten Island Ferry. One surprisingly sunny afternoon, I spotted Paul, the ex-vice president. He said hello and sat down across from me. Once again open and pleasant, he appeared the man I’d once liked– and could come to like again.

We didn’t talk about Walston. He explained he moved with his aging mother to Keene Valley in upstate New York. Turning his back on Wall Street, this former executive now worked as a carpenter. He spoke of small town pleasures where old men sat in front of the local hardware store whittling and discoursing upon merits of lawnmowers. For the first time in decades, he felt relaxed and at peace.

That pleased me. Paul wasn’t a bad man, merely a figure caught up in the machinating machinery of Wall Street. He offered his hand and we shook warmly.

Looking back, I think his chat was sort of penance, kind of an apology without the words. That was decent, more than many people would have done. And it was enough.

Besides, I’d eventually consult for banks, institutions where further fruits of fraud lay concealed beneath a public veneer.

The Digital Detective, Wall Street part 1

High Finance and Low Crimes
I learned a couple of curious things when I worked at IBM’s Wall Street Data Center. One was that my friend, Curtis Gadsen liked mayo sandwiches and fleecy-legged girls. The other was my friend Ray Parchen could be fooled because he was too good at his job as a mainframe computer operator.

IBM 360 computer room

Like an old-time stoker fed the fires of furnaces and steam engines, an IBM operator stuffed the huge machines with programs and data. Very good operators could act and react instantly without thought, confident in their experience and skills, mounting discs and responding to messages as they'd done ten thousand times before, giving them no more thought than donning their underwear in the morning. The keyword was efficiency.

Unintimidated by hulking computers the public suspected were semi-sentient, Ray worked quickly and accurately, and for that reason, he held down the first shift position. For him, I wrote a silly little psychological program that worked only with the best.

Amidst weighty programs queued for the giants of Wall Street, I slipped in the prank while a dozen employees gathered outside the computer room’s glass wall, waiting for the small program to do its thing: It made discs chatter, tapes whirr, lights blink, and the data center rumble as if Colossus was taking over the world.

We watched Ray bend over the console, reading the first mundane message:

05483A Press ENTER.

Ray pressed the ENTER key. The machine responded with another message:

05483A Press ENTER hard.

A few of us watched from outside the computer room as Ray hit ENTER again. The machine came back with:

05483A Press ENTER harder.

Ray punched the ENTER key, and a couple of the girls giggled. The computer responded with:

05483A Press ENTER even harder.

Ray smacked the key hard, very hard. The machine responded with one last message;

05483I Did it occur to you I can’t tell how hard you press ENTER?

Ray looked up with a red-faced grin and spotted us chuckling. Afterwards, he joined us for a drink where we argued why the program fooled some and not others.

Of course he knew pressure couldn't be detected, but he hadn't engaged his knowledge hidden behind the wall of his expertise. I would discover this common quirk could be exploited, as Simon Templar might say, “by the ungodly.” As noted in the article about kiting, confidence men take advantage of confidence.

Over the next few days, we tried our little joke on other operators and observed this interesting fact: Only the best fell for the stupid little prank. Novice operators stopped, studied the messages, and tried to look them up.

Ray and the other top operators reacted immediately and without thinking. Self-assured of their abilities, they acted instinctively by rote.

Less experienced operators questioned everything, including themselves. We caught more than one systems engineer trying to look up the bogus message number in the reference manuals and they sometimes called for help. That spoiled the little program.

Lesson: Sometimes it’s easiest to fool the most experienced.

There’s a reason I tell this story. It leads to how I became sort of a detective, a digital Dashiel of a Continental Op.

Over the next few weeks, I'll talk about an accidental career as a investigator in a field yet to be invented, that of computer forensics. I reveled in the chase, but my career often hung in the balance under threat of firing, even blackballing. Often the only reward was termination but hey, that happens to all the best private eyes.

Background Noise

An early case exploded with little of my own involvement, or, perhaps because of my lack of involvement. The players: Walston & Co, the nations third largest brokerage house, and Arthur Anderson, the biggest of the Big Eight accounting firms until participation in the Enron scandal brought about its demise. Anderson had dirtied its manicured fingers long before Enron arrived on the scene.

Wall Street and Financial District

Search the internet for Walston & Co and its Wikipedia entry merely reads "(Walston) was acquired by Ross Perot following pension account fraud and then merged it with Dupont, which had found itself in financial difficulties." Here's the story behind the story.

Despite the Wikipedia gloss-over, the wheels of merger with F.I. DuPont began turning before revelation of Walston’s fraud. Fifteen million in securities had vanished from DuPont’s accounts. The White House grew nervous. Wall Street threw up its collective hands, Oh woe, what to do, what to do?

A Texan rode into town, Ross Perot. He’d bulldozed through the insurance industry (an intriguing inside tale of its own) and encouraged by Felix G. Rohatyn, he made his move on Wall Street. For an initial $30 million, the impossibly old, impossibly young forty-year-old Napoleonic Perot acquired control of one of the Street’s most prestigious houses. (N.B: Regrettably, Time Magazine articles referenced herein require a subscription.)

At the time, that seemed background noise for me, a full-time employee and a full-time student, living paycheck to paycheck and barely sleeping. I couldn't guess how it would alter my career.

Trinity Church framed
by Wall Street

Crime on the Street

In the Financial District, denizens simply call Wall Street 'the Street'. Philosophical sorts read a moral into its long, narrow confines, noting it begins at a church and ends at a river: When times get tough, in depression or desperation, one may choose salvation or suicide.

The Street fosters its own culture. On the one hand, a man’s word is his bond– multimillion dollar transactions hinge on verbal promises. On the other hand, huge regulatory holes allow brokerage houses to commit the sleight-of-hand that brought the economy to its knees ten years ago. We can’t say we weren’t forewarned, but in the heady days of deregulation, greed and giddiness carried the day. We never seem to learn industries cannot police themselves.

One of the first observations of the Street is that the market's moody– it reacts, even overreacts to political news of the day. But I stumbled upon other emotions, which included surprisingly little hanky-panky. A few notes from the era:

Miss Francine Gottfried

• Wall Street can be a mad marketplace when the economy's in a lull. Late one summer, a sweet keypuncher named Francine Gottfried caused a sensation with the mostly male lunch crowd as her 43-23-37 figure bounced down the steps of Chemical Bank & Trust. For a few days, a sort of silly mating season reigned and then, as so often happens, her 15(0) minutes of fame were up.


• Once, as I strolled with my boss down the street, we encountered a beggerman squatting on his flattened cardboard. My boss stopped and chatted with this derelict before moving on. I didn't say anything but he confessed: The homeless man once worked as a broker, what Wall Street called an account executive or AE. When my boss and the man’s wife carried on an affair (and subsequently married), this man– the husband– collapsed in despair. He now lived– literally– on the Street.


• During the 'Hard Hat Riots' (then called the Wall Street Riots), I picked my way through roving construction workers from the rising World Trade Center left by police to run wild, bashing kids protesting the war in Vietnam. On my way to school as police idled, I helped a girl and her boyfriend bloodied by a musclebound thug. It was no contest: the canyon-like Street corralled the teens, leaving them easy pickings by hardhats with pipes and wrenches. That wasn’t one of Wall Street’s prouder moments. Hard-hats went on to attack the city's mayor's office, smashing the face of one of his aides.

The Young and Restless

A precocious if unaware teen, I worked as an IBM shift supervisor in their Wall Street Data Center, Number 11 Broadway. I had the greatest boss, a pretty blonde named Judy Kane. We boys loved her; the girls– not so much.

And I loved software, the machine-level bits and bytes and Boolean stuff. A teenage mad scientist, I found computers a giant puzzle, one I learned to solve and control. It was a battle of wills, me versus machine, immersive therapy for a broken heart (but that's another story). I'd come to know these Daedalus creatures like a mother knows her own children; better even, I'd learned their DNA.

A sales rep, Herb Whiteman, discovered I spent weekends camped in the computer room, teaching myself to program the huge monsters, then catnapping on the couch as the computers blinked and toiled, compiling my routines. Herb asked if I’d be interested in joining a three-man team that would change Wall Street and put video terminals on broker’s desks. Argus Research, the parent company, would double my IBM salary.

The company gave us secretaries and an entire floor of offices, no expense spared. Unfortunately Argus, in the business of prognostication, shortly deduced the economy teetered on the brink of recession and pulled the plug. Not long after Walston & Company hired me as their fancy-pants systems programmer offering tuition reimbursement as part of my hiring package. Me! I was just a kid from nowhere.

Thus began my introduction to low crimes and high finance.

Stay tuned for more next week, Wall Street's big boys and big crimes.