“Oh.”
“Have you ever received a message returned back to you because it could not find the email address you typed in?”
She bobbed her head.
“The message came from mailer-daemon at companyname dot com, company name being whatever company you were sending it to.”
“It has a log?”
“Sometimes, yes.”
“Ours does,” Carl chimed in. “May I?” he asked Cooper, his arm stretched out, indicating the chair behind her desk.
Cooper stood and rounded the desk. It was just her, Carl, and Cooper in the office now. David had gone back to his man cave in Research and Development to place calls to some of the irate distributors. He could have made the calls from her office, but Jane figured he felt guilty enough for bringing Cooper into the mix and was afraid of reprisals.
Not that she would or could hold anything against David. He did what he thought best. She just wished he had consulted her first. Now another person knew her identity and that was too many.
“It shows the email came from our SMTP server.”
“SMTP?”
“Simple Mail Transfer Protocol. SMTP servers route the messages throughout the Internet and to a mail server.”
“What’s it mean if it came from our server?” she asked as she stood, stretched her back and legs.
“Normally, when someone hi-jacks your email address it is through some type of spam and then malware that searches out email addresses. Once it finds email, it proceeds to send messages to recipients according to the programmer’s instructions. In this case, you can usually track down the IP address of the originating server.”
“In our case?”
“It means someone was on your network and you won’t be able to track where they came from because it appears they were here.”
“You’re implying someone within my company did this? That’s impossible.” She crossed her arms over her chest and glared at him.
“That’s not what I’m implying, but it is feasible and should be checked out.”
“I’ll do it, but if you don’t mind, I’d like to return to my office to do the work, see what I can find.”
“Of course. Thanks, Carl.”
“I’ll let you know what I find.”
Carl was looking at Cooper when he made the statement then left her office.
“What are you implying?” she asked, not placated by his evasive response.
“That someone got on your network. Someone inadvertently, or on purpose, gave a password away, either verbally or through an email and that mistake cost you.”
Jane shook her head. She couldn’t take it all in. “How would someone inadvertently give a password away?”
“Social engineering.”
“Social what?” She wrinkled her nose.
“Engineering. Social engineering is when someone manipulates another person into divulging information, usually confidential information. It’s similar to fraud. Someone pretends they are something they really are not in order to get you to perform some action that will allow them access to your personal or proprietary information.”
“How do they do that?”
“There are many different ways,” he answered and Jane could have sworn she saw something akin to pain cross his face. It was fleeting but she saw it.
“You have security at your office, right?”
He knew she did. Why did he ask? “You came through the lobby. You know we do.”
“How secure is it?”
“The office is secure,” she insisted.
“What measures of security do you have?” Cooper bent and picked up his pen and paper from the end table. His pen was poised for the answer.
“W-we have a badge entrance via revolving door, which you saw.” She swallowed, shutting her eyelids for a moment and continued. “Only one person can pass thru at a time.”
“Tell me about the badges. Are they photo ID badges? Do people wear them all day attached to their hips with a fob?”
Jane lifted one shoulder and dropped it. She brushed at her skirt, a nervous habit. “Yes, everyone’s photo is on their badge.”
He lifted one knowing brow.
“What?” Her voice quavered and she cleared her throat. “What’s wrong with that? That way whichever security guard is at the front desk knows he or she belongs.”
Cooper gave a slow shake of his head. “Do the people who work here go out for lunch?”
“A lot of them do, yes,” Jane answered, her eyebrows drawing inward.
“Most people who wear ID badges forget to take them off when they leave either for lunch, an outside meeting, or even to go home.”
“I’ve done that. So?” she asked.
“Picture yourself standing on the street corner waiting for a bus or the light to change and you have your work id hanging off your pants. Or maybe you’re sitting in a restaurant and the badge is dangling from your purse. While you are waiting for that bus or waiting for the waiter to drop off your check, someone else is watching you, looking at your badge, and taking notes. They now know your name, the company you work for, and in some instances which department you work in.”
“What good does that do?” she questioned, his arms crossing in front of his.
“There are all kinds of things you can do with that small amount of information. For example, someone could easily swipe the badge hanging off a purse, take the thing and have their image placed on top of or replace the previous image. The person may be a career criminal and take it a step farther by getting a new badge made but using the information gained from the exposed one.”
“But the sensor wouldn’t work.”
Cooper grinned. “This is where the social engineering skills kick into high gear. The would-be employee can’t get into the building because the swipe sensor doesn’t work, but he or she has a badge that looks like everyone else’s so guess what will happen.”
“Someone will let them in because the badge says they belong,” Jane murmured.
“Ding, ding! Right the first time. People are almost too friendly nowadays. No one questions them because their hands are full and can’t get to their badge. Instead, someone opens the door and invites trouble in. Once in the building, almost all facilities have open doors. It’s just a matter of determining where you want to go and getting there. Even if you have secure interior doors, it’s just a matter of using that charm and those social engineering skills that worked at the front door.”
“Uh-uh. No. Our business is secure.”
“Do you have a delivery dock?”
“Yes. I buy plants we can’t grow and supplies is delivered there. We also ship from the back dock. It has a secure card reader just as the front door does.”
Cooper bobbed his head then stopped and lifted his gaze to meet hers. “How long are the bay doors open? Is someone sitting there watching as things are packed or unpacked? Has anyone ever left a rug in the side door that I assume is adjacent to the bay lift door?”
Jane lowered her brown lashes. “Our building is secure. No one would let a stranger in.”
“Let’s say that’s true. But your computer system isn’t.”
She opened her mouth to argue, but she couldn’t. The evidence sat right between them on the coffee table in black and white.
“Most social engineers don’t like to do face-to-face work so they do it via computer or phone. Have you ever received an email from a bank telling you that you need to confirm your information and to click a link in the email so that you can do so right then?”
“Yes, but I’m not clueless. I would not do that.”
“But would one of your employees?”
“It’s not just emails. If someone has enough information about you and or your business they can just as easily run the con over the phone. They call you up acting like they know you, tell you some things that run true, so you automatically assume they are who they say they are and you give away the keys to the kingdom.”
>
She slapped a hand over her mouth. “Holy shit!” Is that what she did? Had she given the information away?
“What?” He asked and moved closer.
“Yesterday. Yesterday I received a phone call from the bank manager asking me to confirm some information, some abnormal activity.”
“Did you? What kind of information? Who did you talk with?”
Her hand slid down to her throat and rested against her chest. “Um, let me think.” Her heart raced against her chest. “Wait. I had Tony call the bank back and verify the bank manager’s name. He was legit.”
“Did you speak with him personally? Confirm he actually placed the call?”
“No. Tony just confirmed his name and that he was indeed the branch manager.”
“Why did you have Tony do that?”
“Because he called me on my cell phone. I never give my cell phone number out and it’s unlisted for obvious reasons. I always use my office number as my contact number.”
“Get the manager on the phone. Now.”
Sweat immediately broke out on Jane’s back, but she reached for the intercom and requested that Tony call the bank and connect her with the manager.
“I have Mr. Heinz on line two.”
“As in the ketchup,” Cooper quipped.
“Shhh,” she scolded as she depressed the button for line two and put the phone on speaker.
“Hello.”
“Yes, Mr. Heinz, this is Jane East.”
“Miss East, how are you?”
“Fine. Thank you for asking. I hate to bother you, but I need to confirm something with you. It will only take a minute. Do you have the time?”
“Of course. What can I do for you?”
This was silly, she thought, and a complete waste of time. It sounded like the same man she had spoken to yesterday.
“Um, did you call me yesterday to confirm some information on my account?”
There was silence on the other end of the phone. One beat, two. “No, ma’am. I wasn’t in the office yesterday. My daughter was home sick so I stayed home with her and took her to the doctor.”
“Oh.” Her heart sank as she looked up into Cooper’s remorseful gaze. It didn’t mean that someone from the bank hadn’t called in Mr. Heinz’s absence. “Perhaps someone else called?”
“And identified himself as me?”
She heard the doubt in his voice. Hell, she doubted it. “Could you just verify it for me?”
“Did something happen, Miss East?”
Cooper cleared his throat. “Mr. Heinz, this is Chief of Police, Cooper Chance.”
“Uh, yes, Chief.”
“Could you check Miss East’s account and confirm everything is as it should be?”
“Yes, sir. I’ll put you on hold while I pull up her accounts. Be right back,” he said right before music came over the line.
Suddenly chilled, she ran her hands up and down her arms for warmth as they waited for Mr. Heinz to get come back on the line.
When his voice cut in a minute later, she jumped.
“It, uh, it appears that there has been a lot of credit card use.”
Jane looked at Cooper and then back at the phone.
“Define a lot,” Cooper requested.
“Miss East, do you wish me to divulge the information?”
Feeling her stomach ready to bottom out, Jane gave her consent and then held onto the back of the chair for support.
“Almost fifty thousand dollars.”
Her vision blurred and for the third time that day, Jane felt her world tilt. Coop grabbed her elbows, held her steady. Fifty thousand.
“Mr. Heinz, please disallow any further transactions and change the password on Jane’s accounts. Is that the only discrepancy?”
They heard a few clicks of keys. “That is all I see. Uh, well, there was one large check made out to a Carolyn…”
“That check is good,” Jane managed to squeak out, cutting off Mr. Heinz.
“Very good, Miss East.”
“Mr. Heinz, can you give me the information on the transaction or transactions for the credit card? Give me the amount, the name of the company it was purchased from, their contact information, and what was purchased if that’s available?”
“Yes, sir.”
Cooper scribbled on his notepad as the bank manager rattled off the information of about fifteen transactions.
“Thanks, Mr. Heinz. I may call you again if I missed anything.”
“No problem. Is there anything else I can do for you today?”
“No, no thank you, Mr. Heinz. Thank you and I hope your daughter feels better.”
“Thank you, Miss East. I will send those new passwords and codes via mail. You should have them in a day or two.”
“Thank you.”
Cooper disconnected the line after Mr. Heinz hung up. She couldn’t. Her hands were gripping the back of the chair too tightly, afraid she would fall into a heap to the floor if she let go.
“Sit,” he ordered and helped her into a chair. “Breathe.” With firm but gentle hands, he shoved her head between her knees. “Breathe.”
She was hyperventilating. She knew it, but couldn’t stop. Someone had her financial information, her passwords. Staring at the carpet and her shoes, she blinked rapidly, and tried to slow her breathing before her heart jumped out of her chest or her lungs exploded.
“Think, Jane. Did that caller sound like anyone you knew?”
Her elbows resting against her knees, she shook her head. Not a good idea considering she already felt lightheaded and dizzy. She had done this to herself. She had let someone manipulate and scam her.
Blowing out a last deep breath, she sat up. Blinking a few times, she dispelled the fuzzy lights at the edge of her vision and cleared her head. “It’s okay. I know what I have to do. I’ll change all my passwords, all my security codes. On everything.”
“It’s a start, but it’s not enough. You’ve got a security issue and you need to find it and plug it.”
“Yeah. Me.” She stabbed her thumb against her breastbone. “I somehow caused this mess.”
“Jane.” He brushed a hand down her head. “This is not your fault. I need you to think. Think about who could have been on that phone. Who would want to hurt you, your business?”
“I don’t know.”
David picked up his jacket and slipped into it, shoving the notepad and pen into a pocket. “I need you to think. I need you to remember any other event that seemed out of the ordinary.”
“What are you going to do?”
“I’ve got an ongoing investigation that I have to follow up on and I’m going to chase down the vendors that okayed your credit card use, see if I can find out who actually made the purchases.”
She stood to walk him to the door. “Thank you.”
Cooper paused at the door, turned to face her. “You don’t have to thank me. It’s my job.”
THIRTY-ONE
After Cooper left, she spent the rest of the day calling the other distributors who received the scam emails, calmed them down by whatever means necessary. Some of them she appeased easily while others she had to bargain with, promising first option on the next product release or a discount on a particular product. To her, it didn’t matter. She would do whatever it took as long as she didn’t lose her distributors.
Once she dealt with all the merchants, she turned her attention to her security breach. She called every one of her credit card companies, asked them to cancel the card and reissue another. She changed every password on every account including her ATM card, her network access password, and any other password she thought she needed to change. What a pain in the ass. She asked Carl to send out a new policy change so everyone would have to change his or her passwords today. The company’s regular policy would automatically force a user to change their password every thirty days, but right now, better safe than sorry.
For the next few days, she would monitor all her accounts very closely.
Stressed beyond belief, she rubbed the knot at the juncture of her neck and shoulder while she checked off another account password change.
“You want help with that?”
Jane glanced up and saw David’s warm smile greeting her from her office doorway.
“Mad at me?”
“Mad at you? Why would I be mad at you?”
He arched one gray brow and that’s when it hit her.
“Oh. No, I’m not mad at you.” She waved him into the room. “Do me a favor though?”
“Sure.” He eased himself into the chair across from her desk.
“At least warn me the next time you decide to tell my story.”
“I didn’t—”
“It’s okay, David. Cooper told me you hadn’t revealed what he hadn’t already surmised. You just gave him a few extra dots that made it easier for him to connect.”
“I trust him, Jane. He seems to care and he’s not just a police chief, he’s ex-FBI.”
“He said he loved me.”
“What?” David exclaimed, a wide grin splitting his face.
“I think he said it just so I would trust him.”
“Kinda like how a man says that so he can get into a woman’s panties?”
Jane tossed her head back and laughed, shook her head. “Only you would say such a thing.”
“I call a spade a spade.”
“That’s what I love about you. So what are we going to do?” she asked, raking her hair away from her face with her fingers.
“We? I’m not in love with Cooper. Do you love him?”
“What?” She stared back at David. “Not about Cooper, about the issue of someone hacking my email. About the potential that someone wants to hurt our business? Any thoughts?”
“I’ve been wracking my brain and I haven’t come up with any name. We’ve had our share of dealings with people who wanted more than we could deliver or who didn’t want to pay what they agreed to, but we’ve never even had to litigate.”
“We’ve never fired anyone, and the only employees who quit have been people who have moved away, women who went out on maternity leave then decided to be stay at home moms, or left to go to school. All of them to my knowledge were told that if they ever wanted to come back all they had to do was let us know.”
Phish NET Stalkings Page 23