Brody stepped in. “A penetration test is a simulated attack on your organisation’s security defences to identify weaknesses. It’s done through computer hacking or social engineering or, as I’ve done, with a combination of both.”
“Social engineering?” prompted Lamont.
“The art of manipulating people into performing actions or divulging confidential information to give me the access I need. And, as you can clearly see, I’ve successfully broken through your security defences and have been sitting in on your board meeting for the last hour. But fortunately for you, the last part of a pentest is to report back the findings. And that’s what I’m here to do.”
Lamont turned on the CIO. “Did you agree to this, Chu?”
In Sydney, Chu visibly squirmed in his chair. “No. Mr Taylor was supposed to meet with me next week to present his findings. From there, I would block any holes he found and make sure we’re completely secure from a real cyber attack.”
Lamont turned back to Brody. “Okay, Mr Taylor, you’ve proved your point. Thank you for what you’ve done. Why don’t you leave us to our board meeting and report back to Chu as planned.”
“Hold on a second,” said Fielding. “Did you get him to sign a confidentiality agreement, Chu? He’s just heard all about our recent performance and future plans!”
“Yes, of course I did,” said Chu.
Brody nodded in agreement. Rising from his seat, he paused halfway and asked. “Before I go, do you mind if I ask you one question, Mr Chu?”
Lamont splayed his hands in exasperation and shook his head in disbelief.
“Why did you hire me for a pentest right now?”
“What do you mean?” asked Chu.
“Why now? Why not a year ago? Or in three months from now?”
“It’s part of our security improvement programme. We do this kind of thing all the time in IT.”
“From the vulnerabilities I’ve exposed, I very much doubt that, Mr Chu.” Brody looked at Lamont. “Mr Lamont, why don’t you ask Mr Chu the same question? Maybe you’ll get a straight answer.”
Lamont’s intent expression showed that he knew there was more going on here than was immediately apparent. “Chu?”
Chu shrugged. “I was talking with Welland about the plans for launching the new restaurant concept. He was worried that one of our competitors might break in and steal our ideas. As I’ve explained previously, IT doesn’t have anywhere near the budget necessary to put in place a comprehensive threat protection programme. So Welland offered to pay for a pentest to at least determine how exposed we are. Who am I to turn down a gift horse like that?”
“That makes sense, doesn’t it?” asked Brody. “No more to it.”
Tim Welland, the man who’d waxed lyrical about his new restaurant concept a few minutes before, was strangely silent. He clasped his hands together.
“Welland, what’s going on?”
“It’s as Chu said.”
“It’s called corporate espionage, Mr Lamont.” Brody said, sitting back down. “And your company is guilty of it right now. The last time I heard about a case like this was in the hotel industry. Hilton settled out of court with Starwood for $85 million.”
Lamont blew his top, spittle flying everywhere. “What the fuck is going on here?”
All the executives silently studied their hands.
“The funny thing about the presentation you’ve just heard from Mr Welland is that I’ve already read about an exceptionally similar concept for a grille-based barbecue restaurant chain. But in the documents I read there was one significant difference. Your number one competitor’s logo was all over them. Would you like to know where I found these documents, Mr Lamont?”
“Go on . . .” said Lamont tightly.
“As I’ve already mentioned, your security defences are so weak I was able to give myself access to each of your email accounts and —”
“You’ve read our private email?” shrieked Fielding.
“Well, yes. Fascinating reading. But the most interesting were the documents I found in Mr Welland’s account.”
“I can explain . . .” pleaded Welland.
As Welland attempted to defend himself under constant barrage from his CEO, Head of Legal and most of the other board members, Brody zoned out and read the email that had popped into his inbox earlier. It was from one of the members of CrackerHack entitled, Favour Required - Will Reciprocate. CrackerHack was an online forum used by computer hackers from all over the world to brag about their exploits and swap ideas, tips and techniques. Brody spent much of his spare time on there. The message was from a member called Crooner42, a username that Brody vaguely recognised from some of the discussion threads. Crooner42 had blasted it out to all of the subscribers to a forum entitled ‘Advanced Pentest Techniques’. In it, Crooner42 explained that he had built an experimental live video-feed based Internet site that was likely to attract unwarranted attention from law agencies around the world. He’d hardened it as best he could, but needed someone deeply skilled to pentest it thoroughly, to ensure it couldn’t be broken into or brought down.
Brody wondered what the ‘experimental’ site was for.
Crooner42 requested that members of the forum declare their interest in carrying out the work. He would then choose from one of the respondents. Brody expected that Crooner42 would select someone based on reviewing his historical activity on the site. Brody knew he would be a strong candidate and, with the Atlas Brands job now pretty much finished, was sorely tempted to offer his services. In return, Crooner42 was bartering a week’s worth of his own coding services. That could always come in handy. It wasn’t a bad trade for what would probably amount to just a few hours of work.
“Do you have proof of this allegation, Mr Taylor?”
Brody looked up. Lamont had asked the question.
“Well, yes of course. Give me a second.”
Brody opened a new browser tab and brought up an email he had drafted earlier. He pressed send.
“I’ve just forwarded you all some emails sent to Mr Welland from a Janis Taplow. I believe she’s a relatively new employee within the marketing organisation. Where did you hire Janis from, Tim?”
Tim Welland replied flatly. He named their number one competitor.
“The email contains the whole launch campaign for their grille restaurant concept, presentations, financial plans, target countries, demographics, everything. And, if you open up the main presentation, you’ll notice that even the concept art is very similar. In fact, the only main difference is the name of the restaurant chain.”
“Got it,” said Lubber, Chu and Fielding in concert, from three different locations around the world.
As they read through the offending material, Brody flipped back to Crooner42’s request. He was tempted by the job, but hesitant to put himself forward until he reviewed the site in question. It was the reference to it receiving unwarranted attention from law agencies that intrigued him.
Incredulity rang in the voices from the screen as they absorbed the material Brody had just emailed them.
He checked Crooner42’s profile. He presented himself as more of a coder than a hacker, someone who spent far more time programming than trying to identify exploits in systems. He’d been active on CrackerHack for three years. Satisfied, Brody clicked on the hyperlink to the so-called ‘experimental’ site. It was called www.SecretlyWatchingYou.com. It seemed to be a random collection of network camera and webcam feeds. Brody clicked on one, making sure his computer’s speakers were muted. It showed some people working in an office, layers of desks and desktop computers. Another feed showed some fish swimming around in a fish tank. Not particularly interesting.
The Internet was full of webcam sites, the majority of which were either for viewing public places from afar in real time or for pornographic purposes. But this site claimed to have hacked into private network cameras in peoples’ homes and workplaces. It was certainly unusual. It charged fees for access beyo
nd the free taster webcam feeds on the front page. Brody couldn’t really see why anyone would want to pay or what all the fuss about law agencies was about.
Surely Crooner42 was over-egging the protection the site needed to have? Who would bother to attack it? And publicly requesting help like this on CrackerHack was definitely out of the ordinary. But then Brody remembered that after this meeting, his diary was looking concerningly clear. If Crooner42 selected Brody over other forum members for the job, his elite status in the hacking community would intensify — doubly so if he quickly broke through the website’s security countermeasures.
Ah, what the hell!
He returned to the original email and pressed the link Crooner42 had provided. In the blink of an eye, he had registered his interest in carrying out the pentest on SecretlyWatchingYou. Now it was down to whether Crooner42 chose him over another offer.
Brody returned his attention to the video conference.
“Looks like I’m done here,” said Tim Welland, getting to his feet in Munich.
“That’s the understatement of the day,” commented Chu.
“You’ll have my resignation in your inbox within the hour, Mr Lamont.” They all waited while Welland gathered his belongings and left the room in Germany.
“Well, Mr Taylor,” said Lamont. “A bit unorthodox, but I’d like to thank you for saving our company from a very embarrassing predicament, not to mention the potential law suits.”
“Just doing my job.”
“I think we should delay the presentation of your findings report until I’m back in the UK, which will be Monday week. I’d also like to personally shake your hand. And if everything is as insecure as you describe, it looks as though Chu will see a lot more budget going his way.”
“Sounds good to me,” said Brody.
“And me,” said Chu, his relief evident.
Ten minutes later, Brody drove out of the Atlas Brands car park in his metallic orange and black, custom-designed Smart Fortwo coupe. It would take a good few hours to get back to London. His phone vibrated. He slowed, looked down and glanced at the message header. It was from Crooner42 and entitled ‘Pentest Outcome . . .’
Brody stopped the car and clicked on the message, fully expecting to see his name in lights.
He couldn’t believe what he read.
* * *
Breathlessly, DI Jenny Price lowered her umbrella and flashed her warrant card at the police constable blocking the entrance to the tall, glass-clad office building. The PC acknowledged her as “Ma’am”, a phrase that always made her feel like an old maid. She pushed the revolving door.
The entrance was imposing, with high ceilings, a large, stone reception desk, and three cream leather suites placed to one side. In the centre of the foyer, a spherical water feature drew the eye momentarily from a large glass block structure standing proudly behind the reception area. Set in a brickwork layout, each rectangular glass tablet had a different company logo etched into it. There were about thirty in total.
Regaining her composure, Jenny recognised DS Alan Coombs leaning on the reception desk, his back to her. He was attempting to interview the receptionist sitting behind, but she was talking to someone on her headset.
Alan turned around and saw Jenny. “Ah Jenny, you’re finally here.” There was no sarcasm, just genuine relief in his voice.
Jenny automatically formed a catalogue of reasons for her lateness in her mind. She could list at least five traffic black spots she’d inched her way through in the journey across London. But she should have accounted for the Monday morning rush hour. Or she could blame the satnav, which had outsmarted her once again, taking her to South Wharf Road instead of North Wharf road. Hence her recent battle with the elements as she’d been forced to negotiate a wet and windy footbridge over Regents Canal. But blaming the satnav was akin to admitting her technophobia.
“I swam all the way,” she offered, shaking out her umbrella.
Alan looked her up and down. “You’re soaking. You’ll catch your death.”
“Al, don’t worry, I’ll dry off quick enough.”
The fifteen years Alan had on Jenny seemed to define the fatherly manner he adopted with her, overriding any seniority she had over him in rank. She found this trait in him endearing when it was just the two of them. But when he exhibited it in front of other coppers, she wanted to scream at him.
“What’s the situation, Al? All I’ve heard from Karim is that a young woman’s body was found here this morning.” She was referring to DC Karim Malik, another member of her team, who’d phoned her earlier.
Alan filled in Jenny with what he knew. The corpse was in a meeting room on the top floor. From her belongings, she had been identified as Anna Parker, a second-year Music student from Trinity Laban Conservatoire in Greenwich. Her throat had been slit with a knife. No weapon found. Initial observations were that she had probably been brutally raped before being killed.
He concluded, “Poor kid.”
Jenny’s barriers had instinctively risen as she listened to Alan's dispassionate recount of events. She’d survived two years as a Detective Inspector in the Camden Borough Murder Investigation Team by projecting an invisible, impenetrable shield that kept the horrors of the job out and the emotions buried inside.
“Any idea when she was killed?”
“That’s what I’ve just been checking at reception. According to this,” he held up a large transparent evidence bag, a visitor’s book inside, “she signed into the building last Friday at 5:20 p.m. The pathologist just arrived a few minutes ago. He should be able to confirm time of death.”
“Does the visitor book show who she was here to see?”
“Yes, a W. Webber of WMA Associates for a 5:30 meeting.”
“Does the receptionist recall the victim?”
“No, she only works mornings. Job share. I’ve got the details of Friday afternoon’s receptionist.” Alan handed her the evidence bag. “Here, you take this upstairs. I’ll track down the other receptionist.”
“Thanks, Al, you’re a real gem. Where’s his lord and master?”
“Da Silva’s upstairs pissing off the crime scene team with inane questions.”
Da Silva had been their DCI for the last two weeks. He’d been promoted from a DI in the Kidnap Unit in Scotland Yard to run the Camden MIT. On a murder case, his rank made him the Senior Investigating Officer in name, but not yet in action as far as Jenny and the other members of his MIT were concerned. He seemed inexperienced in how to effectively prioritise the lines of enquiry and balance the limited resources within his team. Jenny was not alone in wondering if he’d been fast-tracked through the ranks too quickly; another minority officer benefiting from the Met’s positive discrimination policies. Although, why a black man from Birmingham had a name like Raul Da Silva, Jenny had yet to find out.
The doors to one of the four lifts slid open. The occupant made a beeline for them. “Not more police?” the man said, tetchily.
“And you are?” asked Jenny.
“Clive Evans. I’m the building manager here.” Evans held his hand out, very business-like. Jenny shook it and introduced herself and Alan.
The building manager’s lanky frame towered over both her and Alan. Jenny assessed that the grey pinstripe suit Evans wore must have been custom made. There was no way you could buy such a long suit in your average high street shop.
“Can you lead the way?” asked Jenny, walking purposely towards the lifts.
He overtook her in three gangly strides. “Uh, ok. This way.”
Jenny followed Evans to the lifts, hoping the squelching in her shoes was less noticeable than it felt. They stood side-by-side.
When the doors slid to a close, Evans asked, “How long will the top floor be cordoned off? The officers upstairs won’t tell me anything. Most of our meeting rooms are located on that floor and they’re all booked out this morning. I can see this is a serious situation but my tenants are already complaining. I need to t
ell them something.”
Jenny watched his reflection in the lift’s mirrored doors as he whined on, but it was the way he looked down his nose at her that wound her up.
“Mr Evans, you do realise that there’s been a murder? A murder. That’s a damn sight more important than a few business meetings being cancelled.”
“I do understand that, Detective Inspector. But what should I tell the tenants?”
“Seems to me that most business meetings take place in Starbucks these days. I believe there’s one just around the corner.”
Evans opened his mouth to respond indignantly and then thought better of it.
They stood in silence as the lift glided upwards. Jenny checked her shoes, half-expecting to see a puddle oozing out from the shiny black patent heels. She noticed that, in her struggle through the downpour, one side of her white blouse had come loose and was showing below the line of her fitted grey jacket, which had also come undone. She tucked the blouse back into the grey skirt and glanced self-consciously at Evans’ reflection, only to discover he was staring straight at her reflected breasts, his lips slightly parted. She was used to it, but most men immediately looked away when they realised they had been caught staring. She looked down and understood. Her blouse had become transparent from the wet and her bra was on full show, leaving little to the imagination.
“Seen enough?” she demanded, buttoning up the jacket. She felt her face redden.
He switched to staring at his feet and mumbled something that might have been an apology.
As the lift slowed, Jenny ran fingers through her wet shoulder-length auburn hair in an attempt to get it back under control and recover some sense of professionalism.
The doors parted on the eighteenth floor, revealing a uniformed PC with white overshoes covering his boots. Immediately he said, “Sorry, this floor is closed . . .”
“It’s okay, Constable,” said Jenny, flashing her warrant card.
“Okay, ma’am. SOCO says you’ll need to wear these.” He handed out paper slippers to them both, which they obediently put on.
“This way,” Evans said, turning left. Jenny followed.
Invasion of Privacy: A Deep Web Thriller #1 (Deep Web Thriller Series) Page 2