Showing posts with label digital detective. Show all posts
Showing posts with label digital detective. Show all posts

13 December 2020

The Skating Mistress Affair, Part II


bank vault

Part I provided the background of a unique bank fraud investigation.

No one had any notion of the unreal turn negotiations would take.


Monster energy drink slash logo

Centuries from now, post-civilization archeologists will discover deep, mystifying gouges in the concrete walls of a skating rink in Greensboro, North Carolina. Those ragged furrows came about this way…

The Queen Unseen

Previously I’d uncovered an unusual fraud perpetrated upon a Virginia bank. The bankshares officials sent me to Greensboro to negotiate with the unlikely scammer.

I was willing to bet the miserly VP had booked the motel. It smelled like cheap motels everywhere, a musty mix of stale food, sex, and disinfectant. It featured two beds, a TV remote control bolted to the nightstand, and lots of cardboard stand-ups advertising the dining room, deals for my next visit, Dillard’s Rent-a-Car, and dial 6 for room service. The cardboard junk I swept into a drawer so I could open up my suitcase. Tomorrow, the maid would redecorate the room with new cardboard stand-ups.

I hung shirts on stupid hangers that featured nubbins instead of hooks. Someone had left two wire coat hangers behind. Thanks to cable television, frequent travelers no longer needed to use one as a TV antenna, but having one to keep the toilet from running helped in the middle of the night.

I sat on the bed and dialed Sandman’s number. Another cardboard stand-up informed me local calls cost 75¢. That would bring a frown to the face of Data Corp’s very tight vice president.

“Yo, this is Dan Sandman. We’re ready. Be there in fifteen minutes. Oh, I forgot– I’m bringing my girlfriend, Justine.”

Before my speaking with Sandman, Chase had filled me in about Justine, and Sandman revealed more in our conversation not long ago. Some years older than Danny, his girlfriend was married to an oblivious husband.

She certainly annoyed the hell out of Chase and not because of morals. Chase intimated she involved herself as more than a mistress. She interfered with the business he and Sandman put together. She interjected herself in the middle of discussions. Chase also thought she was a little too flirtatious.

Another hypothesis was developing.

A knock rapped on the door.

Sandman stood nearly a foot shorter than me with an average build, neither athletic nor chubby, barely a slight pudginess around the edges from Moon Pies. His sandy hair was short, but he kept brushing an invisible lock away from his eyes. He bore a pale complexion not from sun screens, but computer screens.

His girlfriend constituted another matter altogether, a dishwater blonde with blonder streaks, slender, pneumatic push-up cleavage, and skirt by Saran-wrap. In heels, she stood a couple of inches taller than Sandman. A lupine awareness hovered about her, a feral aura of a Jerry Springer guest loose on the veldt. She looked pretty in a tough, Tonya Harding way.

I found it difficult to picture her with a didactic like Sandman, a guy who listened to Shostakovich and read whenever he wasn’t writing. Well, maybe not so difficult to figure out– she insistently molded bulging parts against him.

From under her lashes she locked her gaze on me. My hypothesis was becoming a theory. They’d brought a shopping bag heavy enough that Sandman carried it in his arms rather than by its handles.

He said, “We were supposed to go out to dinner, but maybe we could order in pizza. Eat it here and talk.”

“Sure. What do you like on yours?”

We ordered a large artery-clogger with extra cholesterol, bound to be tasty. Recalling Sandman’s preference, I added two litres of Pepsi.

I got down to business. “The bank authorized me to verify the source code– no more tricks– and pay you a final fee.”

“I brought a listing.” He patted the shopping bag like a baby’s tummy. “Let me show you the program.” From the bag, he reverently pulled a binder of old-school perforated green-bar, 14×11, six inches thick. Definitely large enough.

Sandman held it in his lap for a moment longer, a young mother not wanting to put her baby in someone else’s hands. He said, “Let me show you the code now, so we don’t pizza smear it later.”

Involved with his own self-centered agenda, Chase had come off insensitive to this guy’s inner needs, missing the essential clues.

Danny opened the listing on the motel coffee table and gently smoothed a page with evident pride. Few people could appreciate his accomplishment and he desperately needed a professional and, better yet, a cognoscente to validate his work.

I scanned it. Titles, section headings, comments, labels now made sense. It stopped short of my persnickety standard of documentation, but the code was excellent, even brilliant. I told him so.

He hovered over me, pointing out snippets he was particularly proud of. Perhaps a hundred people in the world could appreciate his creation and he was not wasting this opportunity. A willing audience, I effusively praised his masterpiece.

Justine hovered by his side, watchful. Like hearing foreigners speak, she followed the buzz if not the intricacies. Throughout, she kept some part of her body touching his, not so much affectionate as proprietary. When her eyes turned on me, they gave the feeling of being x-rayed.

Tap on the door. Pizza man. Sandman carefully closed the listing and, with unconscious veneration, placed it back in the shopping bag. I noticed external drives, mag tapes, and a second, thin listing. “My encryption program,” he said.

The pizza was a social convention, a bonding device for minds and ribs. When Sandman and Justine turned to their shared enthusiasm for roller skating, she grew animated. “I love skating,” she said. “It’s where we met. My, ah, husband doesn’t skate. Do you like skating?”

“I like the Dire Straits song.”

“Have you ever tried it?” Danny asked.

“Me? Never. I’m a klutz and a menace. Klutzes that value their skin and bones don’t skate.”

Oh hush! Anyway, it has 4 feet.
© Inside Edition

“You never learned?”

“I suffered a deprived childhood. It happens when you’re raised by wolves.”

She sniggered. “Competition we like best, skate dancing. You’d have fun chasing a girl in a very short skirt, wouldn’t you?”

“I’d need to master the art of standing up.”

Sandman finished his pizza. He dabbed his mouth with a paper serviette. His eyes flicked to the shopping bag with the goodies.

He said, “About the fee, you know we want serious money.”

We. He kept using plural pronouns.

I said, “Don’t get too ambitious. The company isn’t in a mood to be trifled with.”

“You know the software is worth at least a couple hundred thousand, probably two-fifty, maybe more. They could make millions off this.”

“What I know is that they feel hijacked, Dan. You put their investors and customers at risk. They’re upset. You have their attention, but don’t overplay your hand.”

“The obfuscation was just a joke on Chase,” he said petulantly. “Why else would I sell it so cheap?”

“Their contract doesn’t have the word ‘joke’ in it. They’re not laughing. Chase was acting for the bank. Sending me here is an expediency. They figure you owe them, but they’re willing to pay a ransom if they can put this mess behind them.”

I owe them?

“Dan, you miscalculated. Sure, Chase might lose his job, but involving bank investors, you lost hearts and minds. You viewed it as getting a bonus $5000 to screw Chase, but you put Data Corp at risk with bank  customers. At worst, they perceive Chase as naïve, trusting a deceiver, a fraudster who lies, cheats, and steals.”

He turned paler. “Jesus, I never looked at it that way.”

“They don’t like negotiating with a gun to their head, but they’ll ransom the package if they can.”

“How much?”

“How much are you asking?”

Sandman glanced at Justine. Some silent communication transpired.

“Listen,” he said, “let’s go our own way this evening. We’ll reconvene tomorrow. We want to invite you skating. Let’s get to know each other better and then we’ll talk. OK? It’ll be fun. OK?”

It wasn’t okay, but options were limited. I nodded. “Sure.”

Sandman put his hand on the shopping bag. “We’ll, ah…” He seemed strangely uncertain. “We’ll take the program with us for now.”

I looked at them– Sandman timid, she suddenly tense. I realized each person in that room thought the same thing. I was considerably taller, broader, with more muscle mass. I could physically seize the listings and tapes from them, heave their asses out the door and leave them nothing.

For a moment they feared they’d misjudged, but the instance passed. They got me right the first time. Not an enforcer, never a bully, that’s not my style. I wouldn’t thump someone over computer code no matter how justified it might be. Doing the wrong thing wouldn’t accomplish the right thing. He’d placed himself and others in a precarious legal and ethical situation, but he nevertheless deserved compensation for his product.

Relieved, clutching their package, they backed out of the room, waving and saying, “Tomorrow, lunch time, we’ll pick you up.”

Reporting 1

I phoned the vice president at home and filled him in. He was a man of rectitude. He didn’t approve of a Sunday spent in a roller rink negotiating a shady deal with, in his view, a whoring shyster, but he understood the necessity.

“What’s your take on the situation?” he asked.

“Not positive. This girlfriend of his, she’s the wild card, the real problem. What do you know about her?”

“Almost nothing. Just that she’s, ah, a married woman of doubtful moral character. Why?”

“I think she’s running him. Behind the scenes, she calls the shots.”

“Like he’s the mistress? How do you make that out?”

“My theory, she fancies he’s Bill Gates and she’s Melinda without that pesky desire to rescue starving people on the other side of the world. Maybe it’s the skating thing, but I keep thinking Tonya Harding. Together, they’re a salad of Bud and Lou.”

“So?”

“It wasn’t strictly Sandman’s idea to scam us. She figured they could wring out more money this way. If Sandman has ceded the decision-making to her, I doubt we can reach a deal.”

“Much as it goes against my grain, this one time we’re offering him a chance to do right.”

“She thinks everyone is unscrupulous like she is. Her idea of business conduct entails screwing the other guy first. Given a path of crooked or straight, her twisted instincts choose crooked. Then after driving the bus off a cliff, she blames others. Sandman realizes they screwed up. She doesn’t.”

“I’m not sure I follow.”

“They assume their goals are the same, but I don’t think she cares all that much about him, just the money he represents. Sandman lashed out at Chase, but he’d prefer to settle this with minimal fuss. The woman seeks to screw as much money as possible out of the bank, and that’s still her goal. Making more money playing it straight wouldn’t occur to her.”

“If they’d been truly smart, he would have negotiated an optimum price, not a token amount. Then charged us again for continued maintenance and development, which we probably would have agreed to do.”

I said, “Instead of giving value and getting rewarded for it, petty spite and greed guides them.”

“Hmmm. Ever skated before?”

“No. The thought of me skating represents a danger to society.”

He surprised me by chuckling.

“Good luck. The person most agile remains standing at the end of the day.”

The Great Roller Skating Caper

They dropped in at noon on the dot. Her skating skirt covered most of both cheeks. She twitched her bottom against him as we walked to their car. On the ride over, she tucked a hand high inside his thigh.

The front third of the skating complex sported a store and rental shop, plus a snack bar on the left. The rest of the building encompassed a low-walled oval– the rink. Rock music and kiddie shrieks and squeals echoed off the concrete walls.

Sandman helped me pick out skates. Justine knelt to lace them on me, her breasts nearly tumbling out of her top. She momentarily rested my socked foot against her bare thigh before giving my sole a covert caress and slipping it into the boot. Truly a woman of subtlety and international distinction.

One at each of my elbows, they led me like a doomed gladiator into the arena. If given roller skates, many more Romans would have fallen on their swords.

They left me standing and backed away, leaving me on my own. Standing was the key word, because I didn’t know how to move. I shuffled my feet. Zoop. Zoop. Nothing, nothing happened.

I moved one foot, then the other, only to find I was still standing in the same place. Wait. I’d studied physics, mechanics, the science of momentum. I should be able to figure this out. Balance on one wobbly leg and cautiously push away with the side of my other skate.

Oops.

Twelve-year-olds hoisted me off the floor. They knew naught about physics, but they’d cultivated a sense of their bodies on wheels that had escaped my edification.

Jurassic Park III logo

Clinging to the low wall, I tugged myself along by my fingernails. The waist-high barrier circled only half way around. The rest of the rink was enclosed by the building’s cinder block walls, walls I hugged with intimacy.

I clawed my way around the perimeter. I dared not venture more than two feet from the wall so I could pull myself up. My fingers left gouges in concrete blocks still embedded today. A thousand years hence, archeologists will conclude the scarred oval housed a circus of unmanicured Jurassic Park III raptors.

For some reason, girls helped me to my feet but not guys. Possibly it was a center of gravity thing, or maybe if guys stopped to help, they couldn’t get going again. Or perhaps I’d proved an embarrassment to the male population.

Meanwhile, Sandman and Justine whirled and twirled, skating away to the music. Legs outstretched, his fingertips lightly on her waist, hands clasped, they gazed blissfully toward the stars. On skates, he appeared a whole lot taller. Not taller than her, just taller than me struggling to rise from the floor.

Every time I face planted, this toddler on skates and sucking a knuckle stared eye-level at me. Why was a munchkin two Lego bricks tall judging me? I had a lot farther to fall than he.

A charming skater, the kind that prompts males to upshift mass from their abdomen to their chest, hovered over me. With gorgeous padding in all the right places, she offered advice. “Lean forward and stick your bottom out.” Easy for her to say, she was beautifully counterbalanced.

I made one and a half circuits to my hosts’ twenty-three thousand or so, when I realized I needed to visit the restroom. “Behind the food court,” the charming advice chick said.

roller skating rink
Typical roller rink after too many tumbles. Note slight incline of floor. © Huffington Post

I worked my way to the gate and pulled myself hand-over-hand along the rail toward the snack bar. There I encountered an insurmountable problem. The floor suffered a sight incline, imperceptible to anyone but a novice on skates. To me, it sloped 160° uphill, and I didn’t have ropes and pitons to master it. I churned skates, but stayed right where I was.

Spotting the problem, two teenage girls took pity on me. Still on skates themselves, they towed me upslope to the restroom door. O sweet rescuing girls; had they been older, I might have proposed out of sheer gratitude.

The men’s room was laid out with ‘the facilities’ on one side, sinks on the other. I clomped over to the porcelain and discovered another problem. Curse the contractor, the floor’s slope continued in the loo. I found myself rolling away from the urinals. Damn. For a meticulous guy, this wouldn’t do; no one was going to mop up after me.

I angled the skates and locked my heels together, but the muscle tension discouraged kidney participation. Finally, I did the obvious and grabbed the pipe like a carousel horse and held on. That allowed me to ‘complete my business’ as my grandmother might have said. Someone more sensible would have simply entered the toilet stall.

I turned my attention to the sinks. There I encountered the opposite problem where the floor sloped toward the basins. Angling toes trying as I might, I kept rolling into them. I’d soap my hands, push off, lather, push off, rinse, push off… at least in theory. The front of my pants looked like the accident I was trying to avoid.

For once those warm air hand dryers proved useful. I aimed their nozzles at the front of my jeans and held the buttons on. A couple of locals wandered in, eyed the disheveled madman, the blow dryers, and the saturated floor, shot each other looks and backed out again.

Outside, the two girls smiled at me, waving me over. “How did you make out?”

“Trust me, you don’t want to know. I looked like a poster child for poster children.”

That brought more giggles. They steered me toward a food court plastic chair where I collapsed.

Sandman and his woman had just finished their final pirouette et pad-á-deux of the entire Swan Lake ballet. They glided out of the enclosure and up to my table. Unlike me, they barely broke a sweat.

He affectionately brushed a strand of hair out of her eyes. She glanced sharply around. “Not here,” she hissed, but she covered her rebuke by surreptitiously squeezing his thigh.

Sandman pulled out a chair for her and she sank gracefully into it. I was envious of their ease on wheels, but if my awkwardness charmed teenage girls, maybe there was still hope for me.

Sandman laughed. “We’ll say one thing for you. You’ve got guts.”

We sipped coffee and Cokes for a few minutes.

“Tell me,” Sandman said, “what the numbers are.”

“Pardon?”

“The numbers… how much they’re offering. A quarter million?”

I had a horrible feeling the bank radically underestimated these two. Or overestimated, depending on how one looked at it. No number was going to satisfy them.

“They authorized much, much less. I’m talking what you can walk away with this weekend, no questions asked. Name high numbers like that, I have to call in and they debate whether or not to accept. Good chance you could get half your quarter mil, perhaps a little more if you’re willing to wait through the week, but odds drop if you try to wring out much more.”

Justine’s face clouded. Sandman flicked a glance at her but all he said was, “Let’s drive back and change. We’ll pick you up for dinner.”


I looked forward to famed North Carolina slaw and barbecue, but their palates weren’t adventurous. Instead, we visited a family restaurant. Sandman and I chatted technical trivia, operating system internals, stuff of interest only to computer geeks. Were the circumstances different, I might have hired him to work for me.

Justine crushed her breast against his arm while shooting me feral looks. Her leg brushed mine twice, hard to say if it signified more than accidental contact. My instinct suggested it did.

“One twenty?” said Sandman.

“Yes, can do.”

“One twenty-five?”

“Quite likely.”

“It’s worth more than that.”

“It was worth more than that, but they’re wounded, embarrassed, made fools of. Your shot across the bow at Chase injured them and damaged your credibility. You placed their bank and reputation at risk.”

Justine placed her lips against his ear and whispered something.

“So they should be willing to pay more, shouldn’t they?”

“They’re willing to pay less. Don’t get greedy, Dan. Pigs go to slaughter. I can’t impress upon you enough you’re not dealing from a position of strength. Mess around further and you’ll blow the deal. Be timely about it. I can’t advise you any more seriously.”

“You have his interests at heart?” Justine asked me, but the message was for him.

I said, “I have our interests at heart. The company has a limit how much they’re willing to deal, how much they’re willing to risk, and how much they’re willing to tolerate before cutting their losses.”

“That would leave the product up in the air.”

“No, that would leave the product dead and buried. You sold it to them; they own it.”

Wheels turned, though I couldn’t track where they headed. These two lived in a land of make-believe with no notion how the business world operated.

As I left the tip, they ambled out with their heads together. In the car, they pointed out features of Greensboro as he drove toward the motel. They stayed in the vehicle as I walked around to his window.

“Dan, what do I tell the executives in the morning?”

He waited an uncomfortable half minute before answering. “Tell them we’re in no hurry to accept.”

Did my not-to-tarry warning trigger a contrary response? Trying to keep exasperation out of my voice, I said, “What does that imply? How close or far apart are we?”

“It means… It means go home and think about it and we’ll go home and think about it. Then perhaps we’ll talk again. Perhaps not.”

“Don’t try their patience, Dan. They’re already put out.”

He shrugged, smiled, and offered his hand. I shook it. Pressed tightly against him, she reached out and shook mine too. I turned and strolled back to my room.

Report 2

Despite the late hour, back in Virginia folks waited to hear from me. The vice president asked if I thought I could resolve this impasse in the next day or so. I had to say no.

“Go home, man. We’ll be in touch. Thank for trying.”


Over the next two and a half weeks, I spoke with Chase every few days. He’d ask clarification of some detail; I enquired about the situation’s progress. Twice I casually reached out to Sandman. He enjoyed talking tech, but steered away from closing a deal.

The notice came unexpectedly, a call from the bankshares president himself. He instructed me to fly once again to Greensboro. No one expected we would witness an entirely different battle of wits in Part III.

06 December 2020

The Skating Mistress Affair, Part I


bank vault

Some people don’t seek trouble, but it finds them. That’s how I viewed fraud cases that came my way. Hired to hunt down computer anomalies, I didn’t enter a contract thinking criminal intent, but occasionally I stumbled upon crimes. This episode outlines my most challenging case, a battle of wits with a very smart adversary.

It started with a phone call.

In a cultured, south-of-Mason-Dixon accent, the man said, “Call me Chase; my daddy’s Mr. Franz. I’m marketing director of a software venture owned by a major Virginia bankshares concern. We own a product, a big one. We need a specialist to figure it out and support it.”

“A banking program?” Visions of Cobol or badly written C++ sprang to mind. “Sorry, I work with operating systems, not applications.”

“No, no, we’re talking systems software, not an app. The bank’s investment division floated the venture capital internally.”

“What’s the name of this product?”

“I can’t reveal that.”

“What does the software do?”

“I can’t tell you that either, not until we have your signature.”

“That’s all you can say? Why the secrecy?”

“Take a bank’s perspective of confidentiality, marketing paranoia, and a technical product we need to get a handle on, you get secrecy.”

“Who developed it? In fact, where is the developer in all this?”

“Well, that’s part of the problem. It was developed by a low-profile dude in North Carolina, really eccentric. He’s difficult to work with and we can’t seem to get his full attention. After selling us the package, he doesn’t want to be bothered with it.”

Only a few dozen independent software designers populated the top of the pyramid and we all knew each other, at least by name and reputation. I didn’t recall anyone in the Carolinas.

“You must not be paying much.”

“We bought the program dirt cheap, figuring he’d gouge us with ongoing support fees, but he’s not done that. He shows no interest in the product.”

“Your startup software group purchases an untried product from an unnamed author? How do you know the product is viable and isn’t trash?”

“Our bank’s systems run this software and no one, not even our lead systems programmer, can comprehend the program– it’s way too advanced. We sold copies to multiple Fortune 1000 companies, companies that use it and like it. But we found bugs. We desperately need enhancements and alterations as systems grow and evolve. We’ve got no one capable of maintaining it.”

“And your bank’s worried someone will wise up and expose your exposure.”

“That’s a huge concern. Spending venture capital is one thing, but discovering critical vulnerabilities implies liability. A number of jobs hang in the balance, mine included.”

“Written in C or what?”

“Assembler. 50,000 lines of machine code for the nucleus. With support utilities maybe hundred thousand lines for the old OS version and double that for the new, plus somewhat more for add-ons and extensions.”

“You’re saying a quarter million lines of code?”

“Uh, not exactly. The old and new versions cover a lot of duplication, so figure maybe one fifty to two hundred thousand unique lines.”

“That no one understands?”

“It’s costing us already. We need to put this right.”

The Plot Thickens

Locally, nothing exciting was happening with current clients. Steady income was nice, but I liked challenges.

Their tech division was named Data Corp. We exchanged non-disclosure agreements, eventually reaching an accord and a paranoia contract that required my cutting ties with other parties.

From Boston Logan, I flew a geriatric jet into Charlotte, Virginia, where I hired a car for a drive deep into the Shenandoah Valley. I passed beautiful horse farms and Mennonites in their buggies before I came to markers of American civilization – McDonald's, KFC, and WalMart.

The bank’s data center dominated a charming downtown in Harrisonburg, Virginia. I gave the receptionist my name and glanced around.

To the left of the lobby extended the glass room where the main computers lived, MICR check readers, networking and transmission units, 6000 square feet, perhaps 550 square metres, nicely laid out. It looked outwardly secure short of a terrorist attack.

From stairs at the right of the lobby descended a man about 5’5 of economical build. My salesman alert Early Warning System sounded. Scientists and engineers regard salesmen barely a step removed from slithering politicians. The two aren’t so much cats and dogs as cobras and mongooses. That mutual distaste would play a key part in the drama about to unfold.

Even so, Chase seemed a decent sort. He cultivated a brooding mien like a mantle of poetic melancholy, the kind that tenderizes feminine hearts and moistens girls’ eyes. Sporting a black, closely trimmed beard, he might have portrayed a weekend Civil War reenactor captain or river boat gambler.

He toured me around the complex, introducing me to bank presidents and vice presidents, those who plump out the top of the pyramid in financial institutions. He chatted up a half dozen girls who seemed in various stages of thrall. His magnetism short-circuited the female EWS.

“The product,” I said. “Let’s take a look.”

Chase offered me a seat in his office. He busied himself sipping coffee, winding his Swiss chronograph, twiddling a pen. I waited. Finally he said, “What we have here is a print spooling subsystem. A good one. Cool, huh!”

I understood why they wanted me. Not only did I work on operating systems, I had contributed code to two competing packages, a key operating system component in the evolution of computers.

Like a priest revealing the Dead Sea Scrolls, Chase reverently set a six-inch thick binder before me. He opened it. “This is our baby.”

My response came out less than reverential. It could be summed up as “WTF?”

No titles. No headings. No comments. No register notation. No meaningful labels. No reference points.

“I told you, Sandman, the developer, doesn’t need all that. He’s an amazing genius. He doesn’t document his work because his eidetic memory remembers everything.”

“Except for those who come after,” I said.

The lack of labels troubled me most of all. Normally programmers use real world identifiers such as Minutes, Seconds, Distance, Height, Weight, Brightness, etc. This had gobbledegook.

“Who does this?” I said.

“I told you, he’s a genius. They mean something to him, but he’s way above our level.”

“This is attempting ancient Egyptian without a Rosetta stone. This is insane,” I said.

Chase beamed. “You confirm what I’ve been saying. Sandman is genius above other geniuses; he’s beyond brilliant, absolutely off the scale. Our own people say his high-level abstract symbolism is far beyond their comprehension.”

“Even Einstein used standard identifiers, e = energy, m = mass. This has, for example, ‘rtgq233x.’”

“Sandman isn’t a merely an Einstein. Your challenge is, are you someone who can come to understand this or are you giving up?”

“Like hell.” Candidly, I wasn’t sure which part of the question I should answer.

Mystification

As a digital detective, I first confirmed the original assembly language matched the binary machine code in the executable module. I looked at a hundred different values scattered throughout the programs. They matched.

I profiled the program, I ran traces. I floated one other idea to Chase.

“Does Sandman speak Arabic or some language that omits vowels? Or Welsh? Polish? Russian? A language with unusual combinations of letters?”

“I imagine not,” said Chase. “He’s short, sandy hair, fair complexion. I doubt he’s visited out of the country. He’s barely travels outside of North Carolina. He’s so fearful of flying, he always takes a train.”

I had seen computer programs written in French and German. The mix of English and other languages looked a little unusual, but they ultimately made sense.

“Perhaps foreign abbreviations…”

“Look, stop going on about labels. Maybe they are in Klingon or Tolkien Elvish. Maybe they’re random or perhaps they’re nothing at all. With an impenetrable genius mind like Sandman’s, the labels themselves appear opaque to us and we simply don’t know.”

I didn’t accept that for a moment, but there was one other avenue to understanding the code– weeks of immersion in it. I packed the programs in my bag and headed back to Boston.


Over the next two weeks, I pored over 150,000 lines of assembly code. Some days I dissected routines line-by-line, noting, studying, analyzing. Other days I propped my feet up on the sofa and absorbed the gestalt.

Reading a program offers a unique peek into the author’s thought process. This mind meld can provide a strangely disquieting experience. A virtual voyeur can determine a precise mind opposed to a sloppy one, bold versus fearful, brilliant versus not so much, and lucid v losing it. This code contained all these elements and more. Although tightly written, it radiated a surreal aura and umbra, a sense of someone hiding in the shadows.

The Rosetta Stone

“The name of the song is called ’Haddocks’ Eyes.’”

“Oh, that’s the name of the song, is it?” Alice said, trying to feel interested.

“No, you don’t understand,” the Knight said, looking a little vexed. “That’s what the name is called. The name really isThe Aged Aged Man.’”

“Then I ought to have said ‘That’s what the song is called?’” Alice corrected herself.

“No, you oughtn’t: that’s quite another thing! The song is called ’Ways And Means’, but that’s only what it’s called, you know!”

“Well, what is the song, then?” said Alice, who was by this time completely bewildered.

“I was coming to that,” the Knight said. “The song really isA-sitting On A Gate’, and the tune’s my own invention.”

Through the Looking-Glass (1871) chapter VIII, Lewis Carroll

I kept coming back to the labels. They held significance, I felt certain. I could sense a pattern as if glimpsing a phantasm from the corner of my eye. Sometimes, I almost grasped a meaning, only to lose it as I shifted to focus on it.

While analyzing the program line by line, I stumbled across the name of a known operating system routine declared in a constant. The name of the routine was $$BEOJ, which stood for ‘Broker End of Job’. Unnecessarily, the program invoked this routine directly. The author had allowed himself a moment of ego. Instead of the standard, run-of-the-mill method available to any programmer, the coder had showed off his knowledge of operating system internals and triggered this segment explicitly.

I understood the inner workings, but the label of the constant, $$XYAU, grabbed my attention. Could this, perhaps, be the name of the name? Could XYAU someway represent BEOJ?

I poked around, trying the David Edgerley Gates’ Sunday Jumble and Crypto-Quote letter swaps on other labels. Sometimes it seemed to work, more often it didn’t. I combed the program in earnest, searching for obvious constants that might zero me in.

The hunt suffered from a paucity of information, but slowly clues accumulated as I harvested two more paired constants and labels, four, and then six out of three thousand six hundred. Patterns, it was all about patterns. I glimpsed the edges of a picture. No label contained more than eight characters, and something peculiar happened to the letters in each label.

Oddly, B often meant X but it also appeared to be F at times. In rare cases, it didn’t seem to be either. I ripped another sheet off a legal pad and tried again.

I phoned and left a message for Chase. He hadn’t called in days. I sensed his dismay.

I sat up that night, the next two nights, devouring Chinese food for nourishment and Coca-Cola caffeine to feed my notorious ADD. I clocked six hours sleep out of seventy-two. My hair matted, my smelly T-shirt could startle bad-tempered water buffalo.

Everything changed. Like a submerged enemy submarine hiding in deep waters, computerdom’s trickiest puzzle broke the surface. I faced the most fascinating computer game of my career.

On the fourth day, I messaged Chase a couple of times in the morning. I made a few more notes, then toppled over and slept until mid-afternoon.

Demystification

“What?” I barked into the phone a bit too sharply. My eyes seemed glued shut.

“Hey, it’s me, Chase. I got your messages. Whatcha got?”

“How much did you pay for this program?”

“Well…” He hesitated.

“You either paid way too much or way too little. Either way, you got screwed.”

Defiance mixed with defensiveness, he mentioned a figure barely larger than a month’s salary, paid for a program that took someone a year or two of 60-90 hour weeks pouring out one’s soul.

“Why do you ask?”

“Like I said, you got screwed. Sabotaged. Someone has encrypted the labels and stripped the meaningful information out of this program.”

“Bullshit. I don’t believe it.”

“Embrace it. You think it’s a coincidence comments are missing? There’s no register notation? Not a single artifact of meaningful evidence?”

“My people asked him about that. He’s one of those super smart guys who never comments his code.”

I grimaced. For that alone, the program should never have been accepted. I no longer believed the legend.

“Look,” I said. “Labels have been encrypted. I’ve got examples of equates in which one is assigned to 5 and five is assigned to 10.”

“It’s his genius level of abstraction. And what do you mean encrypted?”

“’His genius level of abstraction nonsense’ is getting old. I mean encrypted like the cryptogram puzzles in the newspaper, A equals S and B equals M and so on. A substitution cipher they call it, like Sherlock Holmes’ Dancing Men, only a factor far, far more complex. I’m still working it out, extrapolating clue by clue; it appears the bastard’s used at least two translation tables I'm sure of plus a couple of other frills, kind of a mental oubliette.”

“I don’t believe it. Look, we better rethink this contract. This can go one of two ways. Option one, we terminate our relationship. Option two, other than these conspiracy theory labels you go on about, the positive side is you now know more about the software than anyone other than the author. Come on down here, show us what you’ve got, and we’ll move forward.”

Enter Sandman

From DC, again I boarded another deafening jet into Charlotte. Where did USAir salvage these museum pieces? Maybe they explained why Sandman refused to fly.

The girls at the banking complex greeted my return engagement warmly, speculatively. The town librarian had mentioned the region suffered a serious shortage of males.

Chase, a bit aloof, escorted me into his office.

“I phoned Sandman,” he said coolly.

“And?”

“Says your theory– your accusation– is nonsense. Says he never ever uses comments, can’t afford time for them. Says those equates you mentioned, one equates to 5 and so on, just a coding convenience when in a hurry. Told me if we want to make insinuations, his lawyer can tell us to get stuffed. We can’t afford to get on his bad side.”

I snorted. “Coding convenience? How did you approach him? Did you ask if he sabotaged the code?”

“Of course I asked him. What was I supposed to say?”

“When you asked rather than told, he knew he’d bluffed you. I know he sabotaged the code, so I don’t need to ask.”

“He denies your allegations. Look, you’re a guy I hardly know. You make unbelievable accusations about a fellow I’ve known for years who says your notion is ludicrous. You tell me; how am I supposed to believe you?”

“I’ll show you proof.”

At the end of an hour, I’d further confused Chase rather than convinced him. He still believed Sandman. My stacks of tables and colored diagrams decorated with fine-tipped arrows left him unmoved. He couldn’t entertain the slightest possibility he’d been fooled or the other guy committed malfeasance.

I said, “I want to talk to Sandman myself, geek to geek.”

“That’s unwise. If he breaks off contact, we’re done for. He might even sue our asses.”

“You’re already done for– that’s why you hired me. Anyway, I’m not going to ask him if he encrypted the program, I know he did. That gives me an advantage.”

He reluctantly agreed to my calling with the condition he silently listen in. Like me, Sandman worked nights, so Chase and I grabbed dinner at a great restaurant as we waited for Sandman to come alive in the night.

One lichee duck later, we strolled back to the data center. I sat in his office while Chase lounged outside at the secretary’s desk listening in on her phone. He promised not to interrupt no matter what– I made him swear to stay quiet.

I dialed the Greensboro number he gave me. The call connected. Dan Sandman’s voice at the other end sounded pleasantly curious.

He said, “So you’re the guy they hired to develop the app.”

“Yep, I’m the sucker. Brilliant program, by the way.” I kept my voice light, pleasant.

“Thanks. I’ve heard of you by reputation. Boston, right? So how are you making out?”

I chuckled. “Dan, you left me one tricky puzzle. I’m still working it out, but your encryption scheme is brilliant, harder than hell to break.” I shook my head admiringly, not that he could see it. “Thus far I’ve identified two different translation tables. That’s ingenious.”

No hesitation, no prevarication, he broke into laughter. “Three actually.”

Through the window, Chase blanched, then darkened. I put my finger to my lips in case he felt like an outburst.

Danny continued. “You haven’t been working on it long. I’m astounded you got that far.”

“Three translation tables explain why I still have a thousand or so labels to crack.”

He chortled. “God damn, you smart dog. I used the first character of each label as a selector, picking the cryptographic table based upon which third of the alphabet the first character fell in.”

Outside the office, a purplish Chase was working on a serious case of TMJ.

I complimented Sandman. “I’ve never come across that idea before. Man, figuring out those tables can give one fits.”

“I didn’t want anyone to break it. Can’t believe you’re two-thirds of the way there. How did you figure it out?”

“$$BEOJ.”

“What? Oh, yes. I’d debated making a special case for it, but didn’t imagine anyone would ever get that far. What did you think of my equates?”

“Annoying.”

He laughed. “I trust that’s mildly put.”

“Right you are. There’s the obvious question, of course.”

“You mean why? Why screw up my own program?”

“You weren’t seeking job security.”

“I did it because I can’t stand that salesman, Chase. He’s such a bullshitter, all monies for himself, benefit the investors and screw the inventors. Flying around the country like an exec, trying to hustle the package, spending other people’s money, hogging the biggest slice off the top– I got fed up.”

Chase’s blood vessels looked ready to burst in an apoplectic fit. When he opened his mouth, I frantically waved him to silence. I tried to remember what Chase had told me.

Into the phone, I said, “You worked with him before?”

“Yeah, he found out about my package and begged to sell it. He couldn’t bother working the phones, doing sales fundamentals. Figured he was a Steve Jobs executive, jumping on a plane just to give a demo. I sold more copies than he did and I never left Greensboro, never tried to promote it, only word of mouth. Know what Chase did? He took the salesman cut anyway. He spelled that out in the agreement he wrote. Now ask me again why I’m pissed at him.”

Outside the door, Chase turned magenta. He could barely refrain from screaming into the phone.

Sandman continued. “So anyway, Chase was burning through money when he approached that bank in Virginia. He convinced them he had a hot product and urged them to buy out his contract. Chase wouldn’t change his ways, though. He wasn’t going to pay me what it was worth and I knew I’d never see royalties. My girlfriend, she said screw him. So I got this idea and I did. It wasn’t ransom, it was revenge. Sold it for almost nothing, figured he’d do himself in.”

“How much did he pay?”

“I bet you already know that. And he was gleeful at the fire sale price, ecstatic. The greedy bastard couldn’t believe the advantage he’d seized over his so-called partner. The slime-ball acted right proud of himself.”

“Dan, it’s affected other people. Plus other companies depend on the product.”

Sandman sounded almost regretful. “Yeah, I know. That’s why I agreed to partially support it until they found a replacement for me. I didn’t figure they’d bring in you.”

“Thanks, I think.”

He giggled dryly. “It’s tough maintaining it. I made the source code such an abortion, I find it nearly impossible to debug. They send me a trace or a dump and I spend a couple of days pulling my hair out. I provide just the minimum, which hasn’t been good enough, certainly insufficient to support new equipment coming out.”

The full significance of that statement wouldn’t register until much later: By implication, he’d orphaned this program and was developing a parallel version with enhancements.

“Dan, you know I have to tell the investment bank about this.”

“Figured you had already. Did Chase convince them otherwise? I successfully put him off when he called, but I gathered you were on to me. Yeah, talk to them. Maybe we can work something out, something fair and equitable. I’d like that.”

Witness to the Ascension

If Chase wasn’t pleased, the bankers were apoplectic. The vice president called the president. The president called the chairman. The chairman called the board. The board called the holding company and they called a meeting. In the meantime, the president asked me to stand by. “Don’t leave town,” he said.

Chase departed on a trip. He begged me to stay at his house and care for his dog, one with a bad case of separation anxiety. Shenandoah Valley girls were very hospitable. Over the next few days, I accepted kind invitations to luncheons, dinners, a bluegrass festival, a Mennonite market, and a community fair.

On Monday, the chairman called the president who called the vice president who called me. “Go home for a few days while we sort out what to do.”

I departed almost regretfully.


A few days became two weeks. I spent the time picking at the listings, painstakingly peeling the masks off characters in this exquisite puzzle. That’s what I liked best about programming, me against the machine, taking its rules and making it do what I wished, bending the beast to my will, solving abstract puzzles others couldn’t see. Usually it was me versus the computer; now I faced a clever human adversary.

Sandman called once to ask what the bank decided. My guess was gnashing their teeth, but I confessed I didn’t know.

People found it easy to talk to me, sometimes revealing personal things that seemed surprising later. He opened up.

We ended up chatting about nothing but learning about each other. Topics included girls, cars, his fear of flying and his enthusiasm for roller skating. We discussed fueling software with good Asian food. Our liquid Ritalin was cola, Coke for me, Pepsi and Moon Pies for him. He revealed a passion for Shostakovich. In the wee hours of the morning, he confessed frustration at his girlfriend’s lack of libido. He hesitantly admitted she was married.

On Friday, the VP called from his scratchy speaker phone. “Leigh, I got Chase and the president here. We want you to hop down to Greensboro and negotiate for the source code. Just you and Sandman– you’re the only one he has rapport with, the only one he respects.”

“What are the guidelines of the negotiations?”

“Obviously try to ransom our source, pay as little as practical for it, low five digits if possible.”

“Cap it at one-twenty, maybe twenty-five,” someone in the background said, probably the bank president.

“If things turn too unreasonable,” continued the vice president, “just walk out and we’ll haul his tail into court.”

“D’accord,” I said. “Shoot me a letter defining the limits.”

The VP said, “Do you anticipate a need to involve the police? Should we hire a private detective, perhaps a non-threatening girl his age?”

Chase spoke up in derision. “He just a little squirt, a pussy, a…”

The VP must have waved him to silence. “Okay. Buy it if you can, walk out if you can’t.”

No one had any notion of the unreal turn negotiations would take.


Next week: Part II, Skating Follies

06 January 2019

Chasing Pennies


bank vault
I've written about exploits in banking and brokerage fraud with further articles to follow. Bad banking practices don’t feature well in my write-ups. Institutions change only when they’re forced to.

Recently my fraud expertise touched upon the personal. A good friend fell victim to gaping holes in one of New York’s largest financial institutions, J.P. Morgan Chase & Co.

Lily is smart, pretty, and unattached. Two out of three is pretty good, but she means to win the trifecta. She doesn’t advertise, but merely hopes to attract the right kind of guy. She appears on social media: Facebook, Pinterist, and a singles’ site that’s been around some thirteen years, MeetMe.com, where she met an interesting fellow.

Telling the good from the bad isn’t always easy. By the time our malefactor (male factor or dirtbag are also suitable) stepped into the light, he already knew critical pieces of information about Lily: her real name (thanks to odious Facebook requirements), where she’s lived, family relationships, and importantly– her birthday.

MeetMe.com
For a few weeks, ‘Antonio Sanchez’ from ‘New Jersey’ wooed our lass on MeetMe. He didn’t do anything crass like ask her bank account number or credit card information; thanks to Chase’s security ‘features’, he didn’t need to.

As Thanksgiving approached, Lily traveled across the country, stopping to visit relatives in Greenfield, Indiana, home of another Lilly, the famed pharmaceuticals company. Our heroine happened to check her bank account and found it unexpectedly fourteen hundred fifty dollars richer.

Lily, not only smart but honest, sought clarification at the Greenfield branch of Chase. Greenfield couldn’t fathom the problem.

bogus check 1 (808869)
check 1 of 6 #808869
“You put money into your account in the early hours of the morning. Looks like you needed it. What’s the problem?”

“I didn’t deposit anything.”

“But you did.” Greenfield regarded her suspiciously. “You’re saying you didn’t?”

“Exactly. I didn’t do any such thing.”

“Well, lucky you. Someone likes you well enough to put coins in your account.”

*click* Instantly Lily knew who’d made the deposit.

A couple of hours later, the situation reached me. By then, other deposits had appeared. Curiously, monies were rapidly shifting among Lily’s three accounts. My fraud alert alarms clanged.

“If you make a withdrawal,” I advised, “calculate only what you own to the penny and not a cent more.”

“What’s the problem?” friends asked. “A handsome guy sending Lily money? Does he have any brothers?”

I spoke adamantly. “There is no money, no boyfriend in New Jersey, no gold at the end of the rainbow.” When I explained the con, Lily agreed to join me for a visit to the Indiana State Police.

Indiana State Police
The man manning the reception desk told us all detectives were out of the office and wouldn’t return until the next day. Lily asked if she could file a report.

The grizzled trooper brought forms out to us in the lobby. He stood by as Lily tried to explain the situation.

He interrupted her. “A guy giving you money is no crime. No crime, you can’t file a report.”

I said, “There is no money. It’s a con…”

The trooper threw up his palm in a ‘Talk to the hand’ gesture. Cops are trained to seize and maintain control, even when counterproductive. He went on to lecture Lily, not so much accusing her of wasting police time, but of being silly.

“May I explain?” I said as levelly as I could. “There is no money, only fake deposits. He will use that false balance to pay himself.”

The cop paused, considering. “Wouldn’t work,” he said. “If I deposit a check, I have to wait a few days to withdraw funds.”

“That’s why he’s moving money around her accounts. Some banks, perhaps including Chase, lose track of new deposits as they’re moved around. The technique is called seasoning, losing the new deposit tag and making the money look like it’s aged on account.”

“I’m a road warrior,” said the trooper. “I’m not up on these things. Yeah, I’ll have a detective phone you.”

Virtually next door to State Police Headquarters, we’d noticed a Chase branch. Lily made the wisest decision of the day, visiting the bank for an update.

The young woman listened attentively. She quickly grasped the situation. “Oh my God,” she said. “I received a notice exactly like yours of a deposit early in the morning. I need to check my own account before I go home today.”

Together, the three of us discovered additional deposits and further shifting around of money. By then, funds had been used to buy the first Western Union money order made out to an unknown and very foreign name.

“Let me guess,” I said. “The money’s sent to Nigeria?”

“If Lily didn’t give this jerk her personal information,” the young lady said, “how did he get into her account?”

I explained one hypothesis. I’m a vocal critic of the so-called security questions routinely forced upon on-line customers. “What city were you born in?” “What was the name of your first pet?” “What’s your favorite team?” “What’s your favorite color?”

With the slightest information, bad guys find it ludicrously easy to guess the answers. The favorite color question often includes a helpful drop-down menu of eight colors. No one chooses black or white, so a malefactor can guess the answer in six tries or less.

The young branch manager rang the fraud department. She posed the same question to them, who replied “There are so many ways to breach an account…”

bogus check 2 (808870)
check 2 of 6 #808870
The bank gave us copies of the checks. One peculiarity came to light. Chase said it appeared the Nigerian repeatedly deposited the same two checks over and over, fooling Chase and highlighting another flaw in their security, a defective filter for detecting duplicate deposits.

Chase froze Lily’s accounts, leaving her stranded without travel money in the midst of a cross-country trip. But wait, we’re not done.

Lily awoke the next morning, finding her accounts unlocked and a half dozen or so deposits burgeoning her balances.

Lily phoned Chase to let them know further monkey business was afoot in her reactivated accounts. They quickly closed the window and her accounts, again cutting off her funds.



Big banks and little people, comes now the pathetic part. Instead of expressing gratitude for Lily’s quick action of notifying them of fraud, Chase blames Lily for the leaking of money from the bank. Their stance is that Lily either worked with the malfeasant Nigerian to defraud Chase, or at the very least handed over her account information to the bad guy. As you now know, that doesn’t have to happen. All it takes is sloppy banking.

Besides seizing Lily’s bank balance, Chase now demands another $600 in compensation for their losses. Good move, Chase: encourage honest citizens to rush in to report fraud made possible by your own shortcomings.

It’s a great day for banking. Have you had similar experiences?

18 March 2018

The Digital Detective, Banking part 3


bank vault
This continues a series of articles about computer fraud. Originally I practiced a career of systems software design and computer consulting, but I sometimes came upon a more shadowy world, that of computer crime. I seldom sought out fraud but I sometimes stumbled upon it, picking up undetected clues others missed.

This episode doesn’t deal with crime, per se, but it includes a con, minor as it is. The scheme required a little ‘social engineering’ and, though the word might be Yiddish, no one can schmooze like Southerners.

The story came to my attention while consulting for banks, this one deep in Virginia’s Shenandoah Valley. My landlord for part of the stay was an eccentric but colorful codger. He talked about a neighbor who leased farm land from him but failed to pay his rent. Outsiders might expect he pulled on a jug of rye whiskey as he talked, but all he did was lean back in his recliner, sip beer, and twirl a never-lit cigarette while a cheerful woman less than half his age clattered in the kitchen. I jotted down his story long before I became a writer, so kindly forgive error and stylistic issues as I strove to capture his dialogue.
corn picker
1950s era corn picker
Damn Ernie. I hounded that man all summer long for the rent. Finally last fall, I hooked up my corn picker and started up the corn rows. Now a corn picker ain’t a quiet machine, and lo and behold, neighbor Ernie come dashin’ out of his farmhouse yellin’ and cursin’ that I’m stealing his corn.

I said to him I couldn’t possibly be stealing corn off my own land, unrented land at that. He steamed and stormed and said the seed and planting labor had been his, and anyway he was just a little late with the rent, three or four months, maybe four or five, weren’t nuthin.

I told him that I was just going to keep picking corn for myself until someone showed up with rent money. He dashed off like banshees themselves chased him. Pretty soon he comes back waving his checkbook.

I said, “Ernie, are you sure there’s money in that account?” Oh yes. He told me twice there was, so I said there’d better be, and he said he wanted the corn I’d picked. I told him to consider the already picked corn interest and collection fees. Fact is, I finished the rest of that row, which he just hated.

So the skinflint S.O.B. hustled off to hitch up his combine and wagon, and I find myself a few bushels better off than I was before. I cleaned up and headed in town to the bank, right past Ernie who’s racing his machinery through the fields.

At the bank, I always get in Molly’s line. She’s a sweet, buxom lass, and I’d been thinking about asking her out.

Anyway, I get up to her teller window and she said the account’s a bit short to cover the check. I asked her exactly how short, and she said she wasn’t allowed to tell me that.

So darlin’, I cajoled, is this check completely worthless, or did Ernie at least come close? Looking at her computer, she said he was purty close.

Well, I says to her kind of reflectively, I want to tell my neighbor Ernie how much he needs to cover my check. Like would he have to deposit only $10? No, she said, ten dollars wouldn’t cover it.

Well, says I, would $20 or $30 do? No, she smiled at me, it’s not quite enough.

Hmm, says I, I wonder if $40 or $50 would suffice? Um, she said to me, that first amount ought to cover it.

Thank you, I says, I’ll tell that rascal he needs to put $40 in the bank. By the way, sweet thing, can I have a deposit slip? And you think maybe I can call you up? For, uh, you know, maybe dinner Saturday?

So I walked out of there with a bounce in my step, a deposit slip and her phone number. I was feelin’ purty good. What I did was get in my car and circle around through the bank’s drive-thru. I already had Ernie’s account number on the check, so I just filled out the slip and shot it through the air tube with two $20 bills. Sure enough, the receipt came back showing $1002.39. Good on Molly.

But wait, I say, I almost forgot to cash a check. I send over Ernie’s $1000 check and this time I got back a thousand dollars.

Fair enough. I probably had $40 in shelled corn and a lesson I ain’t gonna rent to Ernie no more.

Ernie got stupid, though, and instead of being grateful I didn’t bounce his worthless ass along with his worthless check and turn both over to the sheriff for collection, he raised holy hell at the bank yelling someone manipulated his account.

I took Molly to the horse show that Saturday. Now I tell you personal like, you want to get a lady in a receptive mood, bein’ around horses will do it. Something about women and horseflesh– just a word to the wise.

Anyway, Molly, she confided the bank said it was apparent someone had taken liberties, but they couldn’t blame the girl who took the deposit and they couldn’t blame the teller that cashed the check. They just gave everybody a stern reminder warning.

Ernie wanted to call the authorities, but the branch manager explained Ernie’d be the one in trouble for writing bad checks. He didn’t mention Molly could have gotten in trouble if they’d figured out her role.

Molly said she knew I’d manipulated her and wanted to know if I’d asked her out from obligation or guilt. I said I didn’t want to sully a relationship thinking I used her. She needed a lot of reassurance about that, and so Friday nights and Saturday nights we just get romantic and I give her plenty of reassuring. Been about a year now. Figure we can go on with this for a long, long time.
And he winked at the cheerful lass in the kitchen doorway.



Commonly in Virginia’s Shenandoah Valley, ‘out’ sounds are pronounced like a Scottish ‘oot’. Thus he really said, “I’d been thinking aboot asking her oot.”

22 January 2017

Yet Another Computer Scam


 WARNING A scam involving Google and clever programming sleight-of-hand has hit the scene. It’s not entirely new– a prototype showed up in 2014– but it fools many professionals. Apologies in advance for the technical parts below.

A new month, a new scam, this one brought to our attention by a reader. Although widely reported, this scam hasn’t shown up in the ACM Risks Digest yet. Surprise– the scheme starts with your GMail where a note from a friend or colleague contains a link to another page or document. You click and receive a message you must log in again. Happens every so often, annoying but sign in again for security.

false URL

A Google log-in page shows up– the URL field (web page address) contains google.com. Enter your name, enter your password. Click. The document your compatriot sent now appears.

You may not know it, but you just lost exclusive control of your Google account. Your pal didn’t send that email and the link was plucked out of your emails.

Let’s look at the sign-on dialogue boxes again. Which one is counterfeit? Hover your mouse over them for the answer, but the fact is, they’re indistinguishable.

fake sign-in box
real sign-in box

The insidious part is that email web sites– Yahoo and AOL included– train us by periodically forcing us to relog in. Hold on… didn’t the URL box contain google.com?

Yes. Over the years we’ve seen clever fraudsters incorporate target domain names similar to this:

http://w5.to/google.com

The trick here is that the real domain, web address of the bad guys, is w5.to. The google.com is only a web page set up to fool you. Other examples might look like the following:

http://citibank.net.w5.to/index.html

This is a variation of the bad guy’s domain, w5.to, above.

http://citybank.net

Here the bad guys registered a variation of the real name made a little easier by CitiBank using a non-standard spelling. These three examples are reasonably clever and some scammers don’t take that much trouble. However, this new one can catch even professionals by surprise:

data:text/html,https://accounts.google.com/ServiceLogin

The clue something is very wrong lies in the first three words, data:text/html – you shouldn't see that at all. The opening letters of an URL don’t have to be http – they can be file, data, help, about, chrome, gopher or possibly another protocol, but ‘data’ is the only hint the page is abnormal.

Browsers have become more sophisticated over the years, so web pages might include additional capabilities such as setting preferences. The ‘data’ keyword allows HTML to be embedded in the URL field, but more insidiously, it allows JavaScript, and that’s how this particular exploit fools us. Following the ServiceLogin part of the URL are dozens upon dozens of spaces so you can’t see what comes next. Far beyond the right side of that URL field is where the real sorcery begins with <script…>. This malware program throws up a fake Google sign-in page to capture your ID and password.

Expect Google to quickly mount an update, but beware, look ever more critically at URLs when you’re asked to type in your credentials. It might save your on-line life.

17 April 2016

RansomWare 3,
Recovery


 WARNING  In part 1, we discussed a nasty type of malware (malicious software) called ransomware and in part 2, we recommended preventive steps. In this final article, we explore options in the event your computer is attacked.

Don’t Pay

That’s the advice of most professionals. Besides filling criminal coffers, a better reason leaps out. FireEye Security and technical advisor Alain Marchant estimate only 60% of payees get their computer back intact. BitDefender estimates even dimmer odds, as few as half of those who pay see their files returned. Symantec hasn’t published figures but they’re also not optimistic about the odds of success.

The poor odds of successfully retrieving files has drastically impacted the ‘business’ of extorting stolen files. TeslaCrypt perps have taken two unusual steps.
  1. They set up a secretive TOR ‘dark web’ message center to facilitate payment.
  2. To prove they can actually decrypt files, they offer to decrypt a small (very small) file of the user’s choice.
Yet, as they try to extract payment, their pages hint at the myriad failures and pitfalls: «If step 2 goes wrong, then attempt this and if that goes wrong then try that and maybe try again in 10-12 hours… which may exceed the allotted time… blah, blah.»

Then consider the matter of who reaps the stunning profits from ransomware. It’s tempting to blame ordinary criminals but in fact, ransomware funds terrorist groups like Daesh/ISIS and al-Qaeda. State-sponsored extortionists include the obvious suspects, China, North Korea, and Russia. Technical authors Gregory Fell and Mike Barlow further accuse Iran and Israel of sponsoring attacks at the expense of the rest of us.

Ransomware is an international problem. The Russian security firm Kapersky Lab was reportedly hit with ransomware and thus turned their attention to addressing the problem. French security consultant Alain Marchant, who goes by the name xépée and cheerfully admits Marchant may not be his real name, has developed a client base of victims ranging from individuals to major companies. Here at home, developers of anti-virus products have trained their sights to the problem.

The Costs

Worldwide, malware sucks more than a half-trillion dollars out of the annual economy. Some target individual countries like Japan (TorLocker) and Russia (Kryptovor), but others are indiscriminate. The US alone loses $100-billion annually.

Cyber crime is lucrative and safe. While one or two man operations bring in as little as $1100-5500 daily, Symantec traced one revenue stream that amounted to $35 000 a day, a number consistent with a study by FireEye Security. At the upper end of the scale, Cisco’s Talos Group calculated the Angler exploit (CryptoWall, TeslaCrypt) each day targets more than 90 000 users, pulling in $100 000… every day.

Losing family photos is one thing, but businesses have lost their files, charities their revenue, hospitals their patient records, government agencies their data, and– in at least three cases– people their lives.[1],[2]

Practicalities

Acquaintances of ‘Mark’, a victim mentioned in last week’s article, casually recommended caving to demands and paying off, ignoring the odds and consequences. Those acquaintances may be well-heeled and untouched by ordinary concerns like money and terrorist funding, suggesting if one can afford it, why not? Fortunately, Mark had a friend to help see him through the worst of a bad situation.

If you are a victim, only you understand your circumstances or desperation, but treat pay-offs only as an absolute last resort. Be prepared for the worst– your payment may go for naught.

Easy Pickings

Chances are you’ve seen web pages or pop-up windows that claimed your computer has been damaged or compromised and to call ‘Windows’ or ‘MacOS’ where ‘professionals’ for a fee will help you stamp out this insidious nuisance, one they created, although they don’t tell you that.

These are usually simple browser attacks– JavaScript on a web page seizes control of your Edge browser, or Internet Explorer, Safari, Chrome, FireFox, etc. The good news is they’re relatively easy to defeat, although getting out of the situation can puzzle an average user.

In these cases, don’t panic and don’t call the toll-free number the bad guys so thoughtfully provided. You may want to call a friend for technical assistance, but you may be able to solve it yourself.

The key to recovery is killing the script, the little program abusing your browser. You may be able to simply close the page, and if so, job well done.

Another approach is to open the browser Preferences or Options and disable JavaScript. Once JavaScript if paused, you can close the web page at your leisure, alt-ƒ4 or the more nuanced ctl-w for Windows, cmd-w (⌘-w) for the Mac. Unfortunately, FireFox made the decision to remove the option to disable JavaScript, but add-ons like QuickJS, NoScript and Ghostery give users that option. For the Mac, typing command-comma (⌘,) normally brings up preferences, but the malicious script may thwart that move.

What happens if you can’t close the web page and can’t disable JavaScript? You have no choice but to kill the browser and restart with a goal of stamping out the offending window. Use the Macintosh Force Quit (⌘-opt-pwr) or the venerable Windows Task Manager (win-shft-esc). You may be able to right-click on the program icon to close it. When restarting Safari and Edge, use finger dexterity to close the offending window– you may have to force-quit and restart a couple of times to succeed. FireFox is helpful here: They provide a dialogue box asking which pages you want to reopen (or not).

Note that you may have to smack down more than one browser window. At least one exploit deploys two pages using one to reopen the other if it’s closed. Both pages need to be killed.

Trust Issues

As with other ‘exploits’ (short for exploitations in professional parlance), you can (and should) take the preventive measure of downloading an alternative browser to your computer, say Opera, FireFox or Chrome. If a bad script has nailed your Safari or Edge browser, you can fall back on an alternative until you can get help.

The other key step is not to download anything you don’t trust. Don’t fall for messages claiming your Java or Flash or SilverLight player needs to be updated. Be extremely shy of web mail that offers to upgrade Windows 10. The safe way to update is not to click on the helpful button, but to locate the official web sites and manually download any updates yourself. Make certain the URL says java.com, adobe.com, or microsoft.com (with or without the www.) and no variation like javaupdate.com.

In the past, professionals have disdained automatic updates and that’s fine for them. Let them micromanage if they will, but for the average user, I break with my colleagues and suggest automatic updates might prove safer. The reason is that if you already trust a program, then its updates are reasonably safe as well. At worst, you may get a message saying that FireFox must be restarted, although if you don’t restart immediately, the updates will kick in after you quit your current session.

Apple and Microsoft occasionally check for updates. While I approve of the automatic mode, I suggest running the update check one time manually so you know what to look for.

RansomWare

Thus far we’ve discussed the simplest form of ransomware that merely subverts your browser. At present, you’re more likely to encounter web exploits than the really nasty kind that takes over your computer by encrypting files and user programs.

True ransomware programs demand payments ranging from $200 to over $2300 ($475 appears average) in untraceable digital payments, up to tens of thousands of dollars when targeting hospitals, corporations, and crippled city and county governments. There is no single flavor of ransomware. At least half a dozen strains are extant plus offshoots and variants. Each makes up its own rules and demands. Early models sought cash transfers via Western Union and later Ukash, MoneyPak, and PayPal My Cash, but nearly all now demand payment in anonymous digital money– BitCoin.

The other characteristic found in most ransomware is the imposition of a deadline, after which the bad guys state they’ll refuse to restore your files altogether and at least one variant claims it will permanently ruin your hard drives, not merely beyond recovery but beyond formatting (a highly dubious claim).

The time limit serves one primary purpose, to apply pressure and rattle the victim, to preclude the user from thinking his way out of the dilemma. A time limit makes it difficult to gather information, tools, and help. The target may not have sufficient opportunity to order recovery tools or a second drive to work from or a create a bootable disc.

Besides your backup, you will need a reinstallation disc. These days, few computers come with installation DVDs. Some computers feature a bootable partition that contain tools and recovery programs. In other cases, you must download a so-called ISO file from the internet to burn to an optical drive (Blu-Ray DVD, etc)– but you can’t safely do that from your compromised system– you either need to boot from a trusted drive or ask someone to download a recovery ‘disc image’ for you.

As far as the threat to permanently wreck a hard drive, it’s hypothetically possible but unlikely. Black hats may alter your boot tracks or drivers, but those can be repaired with a disc formatting program. In the unlikely case that bad guys were to zap your drive’s firmware, they’d have to strike after the time limit they imposed. Long before then, an aware user should have powered down his computer.

Demanding Money with Menaces

British use the term “demanding money with menaces” regarding blackmail, extortion, and kidnapping for ransom. The threat of ransomware is clear: If you don’t pay, you lose your files. But if you do pay, you may still lose your files. Damned if you do, damned if you don’t, the track record is not good.

Beyond the substantial risk a victim will never see his files after payment, there are sound reasons for not paying or attempting to communicate in any way. The victimized may inadvertently expose more information than realized such as passwords and bank account information. My colleague Thrush says paying or trying to reach out tells the bad guys “they have a live fish on their line.”

If a victim attempts to reach his bank on-line, an infected computer can forward passwords and account information to the miscreants. Because the bad guys have control of their subject’s computer, they may be able to extract injurious information. A wise solution is to quickly disconnect from the internet to interrupt the outflow of information.

One-Way Communication

Security consultant Alain Marchant says about 12½% of victims opt to pay, but less than ⅗ of those cases see the return of their files even after payment. He suspects the percentage may be considerably worse because of under-reporting.

Marchant’s stats are highly consistent with FireEye reports. He attributes failures to restore hostage files to a number of factors.
  • There may be no hidden server that can unlock the files. The victim has only the criminal’s word such a server exists. Maintaining servers exposes the bad guys to risks they may not be willing to take.
  • Perpetrators may simply not bother. A one-man operation can easily bring in a minimum of thousands of dollars (or euros or pounds) a day, millions a year without lifting a mouse-finger. An extortionist whose biggest problem is hiding money from authorities may feel no obligation to release hostage files.
  • Hidden servers, if existing at all, may be taken down by its ISP, by government raid, by weather, by a denial-of-service (DoS) attack, by power failure or other outage, or by the bad guys themselves to evade detection. Perpetrators, particularly those on the move, may rely on laptops that are on-line only for brief periods. A perpetrator who can’t connect can’t repair the damage.
  • Because of a restricted ability to test malware, perpetrators’ programs may be bug-ridden and unable to recover the data. FireEye reports that files encrypted and then decrypted by TeslaCrypt turn out corrupted.
  • Perpetrators may not have the sharpest grasp of time zones, which may cause a premature trashing. Problems are exacerbated within one time zone of the Greenwich meridian and worldwide during daylight savings time changes. Ransomware does not take into account weekends, holidays, and banking hours.
  • Perpetrators may not have the sharpest grasp of exchange rates. For example, a ransom page may demand $300, but with worldwide reach, may receive $300 Canadian instead of US dollars and therefore not release the files.
  • Victims’ machines may be knocked off-line by the same problems above that affect perpetrators’ servers.
  • Victims’ drives may be so badly damaged, that recovery becomes impossible. Moreover, perpetrators may encrypt the very keys or tokens victims need to communicate with their bank.
  • Victims usually don’t possess a clear understanding of bitcoins. Some attacks require users to install modified TOR browsers to arrange payments. While these measures help perpetrators hide from authorities, victims lose time and possibly their files while trying to figure out the process.
  • Victims’ anti-virus software may belatedly catch and delete the ransomware program making recovery impossible.
  • Multiple malware infections may collectively interfere with each other. Victims may inadvertently exacerbate the problem by researching malware on the internet, triggering secondary infections that make recovery impossible.
  • Victim’s computers may reinfect themselves as drives are brought on-line.

Recovery

Clearly the odds of recovery are better with anti-ransomware programs, assuming data hasn’t been deliberately damaged beyond encryption. If at all possible, create and work from an external drive. You may find better success removing the computer’s hard drive and hooking it up to a clean computer. The idea is to keep the virus dormant while attempting to remove it and correct the damaged files.

At the end of the countdown period (typically 72 or 96 hours), some malware strains sabotage the rest of the hard drive, erasing boot tracks and directories. Marchant suggests it might be possible to turn back the clock in a PC BIOS by several hours to extend the period of analysis and recovery. For this to work, the computer must remain disconnected from the internet.

If there is an extant key, it may not reside in a remote server at all but could be buried in your machine. That can help assist programs in decryption.

Following are a few Mac and Windows resources to help in preventing and recovering from ransomware.

Be safe out there!