Black Hat Blues (23 page)

and filled out all the requirements that Toni had sent him for comple-

tion of the pen test.

He pulled down payroll and bank records, employee information

files, telephone and cell phone billing records, and even some internet

browsing histories. He got passwords to every machine in the network

as well. He wrote his report and handed everything over to Toni who

would handle billing with Sun State and sent it over to her. She reported

back the next day with the good news—the clients were pleased but also

dutifully alarmed at what he’d found and had paid the full fee right

away. Toni transferred Ollie’s payment to his account along with a little

10% bonus she said was, “for doing such a bang-up great job.” He told

her how much fun he’d had and when she asked said he’d be happy to

do some more consulting for her anytime.

The two of them continued to e-mail, and after proving his abilities

to her, his own self-confidence grew, and the back and forth got more

and more flirtatious between them. A few weeks later he was bored,

bored, bored after a long boring day at work, and decided to poke

around Sun State again and see if they’d gone ahead and patched any

of the security flaws he’d found. He was annoyed but not actually too

surprised to see that they hadn’t done a thing. As he was just scanning

through, no real intention of snooping, honest, he noticed some e-mail

threads shooting around inside the company about some sort of finan-

cial crisis. Maybe they were too distracted by their bigger problems to

worry about security? Driven by curiosity, he looked a little closer. The

company had been swamped in a chaotic flurry of seemingly unrelated

troubles. Orders not getting placed for raw materials, bills not getting

paid, employee payroll information being leaked.

Oh shit, he thought. Oh shit, oh shit, oh shit. It was starting to dawn

on him then, what had actually happened. He read some more e-mails,

especially from the company owners. There was no mention in any of

them of the penetration testing, but lots of complaints about recent

problems, including computer related ones. He pulled up the com-

pany’s internal directory and got Steven’s direct office and cell phone

numbers. Ollie dialed and hung up three times before he made himself

call Steven’s office. He heard the voice mail message and it didn’t sound

anything like the man he’d talked to. He called the cell phone and

got the real Steven on the phone and confirmed it—this, rough, old,

accented voice did not belong to the person who’d given him the OK to

118

Geek Mafia: Black Hat Blues

run his pen test. He hung up. Not a pen test, but a hack. He’d hacked

the company under false pretenses.

He should have thought his next move through, but he was angry

and even scared. He could lose his job if anyone found out what he’d

done. Hell, he could go to jail. He touch-typed a 60 word per min-

ute angry screed directed at Toni, railing against her for sucking him

into this madness under false pretenses. He demanded explanations

and apologies and assurances. He threatened retribution and hinted at

going to the cops. He fired it off, waited five minutes, and then called

her phone number. It went right to voice mail and he hung up, calling

again every fifteen minutes for the rest of the day. He started running

IP traces on the e-mails she’d sent him, but they were either spoofed or

dead-ended into anonymizers. The mail server for her personal e-mail

account yielded no clues, nor did he get anywhere tracing the phone

numbers. Nothing led anywhere. He couldn’t find her. The only fact he

knew for sure was that he’d hacked the Sun State Construction network

and sent all the proof anyone would need to convict him of that crime

to a strange, seductive woman who called herself Toni.

Ollie called in sick the next two days and suffered through three

sleepless nights waiting for some sort of resolution, some sort of con-

sequences for his action, but none came. He even tried to get the bank

to trace where his payment had come from, but it had simply been a

cash deposit into his bank account from an ATM in Miami. So yeah,

he knew Toni or someone—who had he really talked to on the phone

if not Steven?—had been in Miami a few weeks ago. That did him zero

good. Even when he went back to work, his heart wasn’t in it. He kept

looking over his shoulder, expecting them to fire him or revoke his

security clearance or something. One sleep-deprived Saturday night

he pulled out all his hard drives and drilled holes through them before

driving them out to the dump himself early Monday morning. He put

the money they’d paid him in a separate savings account and let it sit

there in case he ever got a chance to pay it back. Eventually he started to

calm down, but the anger and resentment at being used so poorly never

went away, never even receded very far from the front of his thoughts.

He told himself that this must be what it’s like to be shell-shocked or

have Post Traumatic Stress Disorder, and it sucked.

When he’d seen Toni walking through the Shmoocon lobby it all

came flooding back, but faced with an actual opportunity to take

revenge on his tormentors, he was frozen with fear and doubt. What

if he tried and failed to get his revenge? What could she do to him in

return? Doubts, doubts, doubts. But there were other people here who

Rick Dakan

119

could do something, people in a position of some authority and influ-

ences. Warning them might be enough.

“Can I help you?” asked Heidi, smiling but looking a little wary.

“There’s some sort of emergency?”

It all came out in a torrent, one word tumbling over the next. He

ended up just telling her everything.

Back in her nerd un-chic persona, Chloe headed upstairs and then

caught an elevator back down. She found Bee loitering by the

entrance to the hotel’s fine dining restaurant, pretending to peruse the

menu. Chloe walked on by and headed out the door and down the

sloping driveway to the street below, trusting that Bee was following

her. She turned into a drugstore and started reading greeting cards. Bee

arrived two minutes later and started looking at cards as well.

“Sandee’s been spotted,” Bee said.

“What? By who?”

“That failed recruit ended up showing up here anyway.”

“Oliver. I thought we checked on that.”

“We did, as best we could, but he hasn’t been online in his normal

haunts. He posted that he probably wasn’t coming.”

Chloe sighed and picked up another card. She wanted to be outraged

and tell someone that she’d told them so, but the truth was she hadn’t.

Just like the others, she assumed that the odds of Oliver both being

there and recognizing Sandee were negligible. She was still smarting

about how badly they’d misread Oliver and the likelihood of recruiting

him into the Crew. “What happened?”

“He came to Heidi Potter and told her the whole story.”

“You’re kidding me. Everything?”

“I think so. I’m getting this second hand through c1sman, which I

guess makes it third hand. Oliver went to Heidi and she listened and

thought he was probably a little nutty, except he’s got an OK rep in the

Rick Dakan

121

community and so she took him seriously enough to want to be safe

rather than sorry. She told Bruce and then they pulled in some of the

other Shmoo Group people and talked to them about it in the NOC,

and c1sman was one of the people that got called in. Well, he was

already in there and they let him stay.”

“And they believe him?”

“It sounds like they don’t believe it all, but they’re curious.”

“Curious is bad,” said Chloe. The last thing they wanted was all these

hackers getting curious about them.

“So they have a description and they’re pretty sure she’s staying in

the hotel. The word is that she’s some sort of black hat recruiter who’s

looking for people to suborn into a life of crime. People are supposed

to keep an eye out for her in the con areas and Heidi asked some of the

Shmoo Group to do some subtle poking around.”

“Well, that’s not the end of the world, I guess. They think Sandee’s a

she, so we can solve that problem easily. And they don’t have any idea

what we’re really up to. But still, we’re going to have to get him out of

the hotel for good.”

“If they get real curious they might go to the security tapes,” Bee said.

“Heidi said she wasn’t going to go to hotel security unless something

actually happened in the part of the hotel Shmoocon was responsible

for, and obviously nothing like that has happened.”

“Except us piggy-backing on their network to hack into Clover’s

network.”

“But c1sman’s in charge of that.”

“Not so in charge that he could keep one of the others from poking

around because they’re curious. And just because Heidi’s not going to

security doesn’t mean one of the other Shmoos won’t go poking around

in the security tapes on their own.”

“You’re saying we have to leave.”

“Oh, there’s no question we have to leave,” said Chloe. “The question

is, do we have to do something else besides just leave.”

“How do we explain c1sman leaving early? And if he leaves then we

lose our person on the inside,” said Bee. Chloe agreed with the point,

but suspected that Bee just didn’t want to leave the con yet or freak out

c1sman too much by doing a full scale emergency bug out. There was

only half a day of convention on Sunday anyway, so c1sman sticking it

out might not be such a bad idea, and keeping Bee on top of him only

made sense. “You and c1s can hole up in his room while the rest of us

skedadle. The only thing is we need to make sure they don’t somehow

connect you two to our room in case they ever connect Sandee to us.”

122

Geek Mafia: Black Hat Blues

“So what’s the plan?”

“I need to talk to Paul and then get to some hardcore misdirecting.”

The key to making this work was to find the right person. She’d man-

aged to get c1sman on a cryptophone while he was in a private place and

debriefed him on exactly which of the curious investigators to focus her

attention on. C1sman was freaked out and scared of all of them, and

wasn’t very helpful at first, but eventually she got what she needed from

him—someone smart (that part was easy, they were all smart) with a

good rep in the community who was willing to take matters into his

own hands to do a little investigating and if he was the type who could

be distracted by a pair of tits, all the better.

He was a big guy, well over six feet, and barrel-chested with a heavy,

solid gut. A formidable presence but a friendly face, and he smiled down

at her and said, “Yes, how can I help you?” when she asked if he was

part of the security for the convention. He twisted and turned his broad

back to her to show the word “SECURITY” stenciled on the back by

way of presenting his credentials.

Chloe gave him an embarrassed, shy smile and said, “Something

weird’s been happening to me and I thought maybe I should tell some-

body about it.”

“I’m definitely somebody. What’s up?”

“Well here’s the deal, and I know it sounds weird or whatever, but

I’ve been talking to this lady who I think might be an undercover fed.”

Although they didn’t formally play the game at Shmoocon, Chloe knew

that at other conventions “Spot the Fed” was a serious contest with

prizes and special t-shirts if you successfully spotted the undercover

federal agent in their midst. She was betting that the security guy’s

curiosity would be roused sufficiently to want to look into it, if only

because he could then share in the bragging rights for having uncovered

the undercover.

“Oh yeah? Interesting, interesting. What makes you think this lady is

a fed?” He looked around to see if the person Chloe was talking about

might be nearby.

“Well, she seemed all cool and whatever at first, you know just kind

of curious. I thought maybe she was a reporter or something. I guess

she could be a reporter, but I don’t really get that kinda vibe off her, you

know? Plus she’s like wicked smart on hacking stuff. Knows things and

technical terms and stuff the way reporters just really don’t, you know?”

Rick Dakan

123

“OK, sure. But you think she’s a fed why?”

“Well I was out last night with some friends from the con at this bar in

Adams Morgan, right, and she was there. A bunch of people were there

from the con. And I had some drinks and whatever and I think maybe

I got all too talky and stuff. Maybe, you know, bragged a little.”

“Gotcha,” he said, nodding and smiling. “Don’t tell me anything I

shouldn’t know, right?”

“Exactly, yeah, sure. Right, but the thing is, I kinda did tell her some

stuff. I didn’t, like, actually admit to anything specific, right? But we

both knew what I was talking about. And she kept asking more ques-

tions and stuff, and buying drinks and I kept talking. Then she starts