Alan joined in. “Yeah, this has to be someone familiar with the way Flexbase operates. But that could be anyone. Flexbase staff, the tenants, ex-tenants, visitors and so on. That’s an awful lot of people.”
“Especially when you consider that Flexbase runs over forty office buildings like this all over the country,” added Fiona, “each sharing a central booking system.”
Jenny asked Alan, “Did you track down the receptionist who was on duty on Friday afternoon?”
“Yes.” Alan pulled out his pocket notebook. “Leyla Seidov. She remembered Anna mainly because of the cello case. Apparently, she struggled lugging it through revolving doors and tripped over, falling flat on her face in the middle of the reception area.” He looked up from his notes. “Miss Seidov thought it was an amusing story until I pointed out the girl was now dead.”
Alan gazed about as if expecting a follow-up comment. None came.
“Was Anna picked up from reception?” Jenny asked, trying to keep the momentum flowing.
“About half an hour before Anna arrived, Miss Seidov received a call from the meeting room on the eighteenth floor. It was a man’s voice. Identified himself as William Webber. She doesn’t recall any particular accent, but she is from Azerbaijan after all.”
“What did the man say?”
“Only that he was expecting a visitor at 5:30 p.m. He asked for the receptionist to phone him directly in the meeting room rather than the WMA offices.”
“Which presumably she did . . .”
“Yes, and when she phoned through, Webber asked the receptionist to send her straight up to the eighteenth floor, where he said he would meet her at the lifts.”
“Was there no security? Surely, that was an unusual request, Alan?” asked DS Harry O’Reilly, the MIT’s computer specialist, from the back of the room.
“Apparently not in that building. There’s no security barriers or anything. Just the reception. The receptionist said she worked in other higher security Flexbase buildings where guests need to be escorted, but not this one.”
“What about CCTV?” asked one of the PCs that Jenny didn’t know. “Surely the killer must have arrived earlier that day?”
“Only in reception. But it’s all controlled centrally from the Flexbase HQ in Docklands. We need to get someone over there to start going through the footage. Fiona . . .” Alan nodded at Fiona who took the hint and added the action to the list.
“This is a priority line of enquiry,” contributed Da Silva. “The perpetrator could be recorded going in or leaving afterwards. And I cannot believe, DI Price, that we have no one chasing this down already.”
Jenny immediately felt her shackles rising. The cheek of the man. That was why the team got together like this, so that they could collate all lines of enquiry and prioritise them. Which would be done at the end of the session. She was about to say this when Alan spoke.
“I’ll head off down there now, Jenny. I think I’m all done here anyway.”
“Thank you, DS Coombs,” said Da Silva.
“Yes, thanks Alan,” said Jenny.
Alan stood up and made his way through the throng to the exit at the back of the room. Da Silva folded his arms.
“DS O’Reilly, what have you learned about how the meeting room was booked?”
“I’ve been on the phone to yer man from their help desk for hours already.” Harry had the soft lilt of an Irish accent. “Those beggars know nothing at all. Best I could get out of them was that yer man booked it through the Flexbase public website.”
“Can they trace where the booking was made from?” Fiona asked, more comfortable with IT than Jenny would ever be.
“Not the eejits I was talking to. The admin app they’re using doesn’t display source IP addresses from whoever booked. Now that doesn’t mean it’s not stored in the database itself, just that they’ve no idea how to check. I’ve got the name of the vendor who wrote the booking system. I’ll follow up after this.”
“Is it true the email address used to make the booking was fake?” Jenny asked, recalling Lawrence MacDonald’s outburst at the Flexbase building manager earlier.
“Completely made up. It’s just an open text field to be filled in on the web page. No logic built in to verify if it’s even in a valid email format, never mind a check to see it’s real. The confirmation email that the booking system sends out just bounced and no one ever checks the logs. Bad design if you ask me.”
“The meeting room booking was made the Monday before?”
“Yes, at 3:14 p.m. And he booked out all four rooms on the eighteenth floor with the same fake email address.”
“Which is one of the reasons we know this murder was pre-meditated,” said Karim.
Jenny summarised for the group. She made sure that Fiona captured all the actions. In fact, she rather enjoyed having someone else do the writing. Perhaps Da Silva had a point. Her handwriting was pretty illegible, especially compared to Fiona Jones’ neat block capitals.
“Now the most interesting part,” Jenny stated. “The lure.”
The murder itself felt secondary for solving this case. The rape and murder were key components of the killer’s ritual, but that was as far as it went. Criminal psychologists might disagree, but understanding the killer’s physical actions wouldn’t necessarily help Jenny make a break through. And anyway, HOLMES would have thrown up a similar case if the modus operandi had been recorded already. And it hadn’t.
To Jenny, the use of the meeting room for the location was unusual and would certainly help to narrow down suspects, but all the techno-gabble around vendors, booking systems and IP addresses confused her.
She was convinced that victim selection was key, especially so far in advance. This was no stranger. It had to be someone close to Anna. Someone who knew enough to exploit her private dreams of playing in the Royal Opera House Orchestra. It was the smart use of the Royal Opera House that had overruled any reservations Anna should have had when confronted with a strange, corporate office block in Paddington for her audition.
Jenny summarised this line of thinking for the room. There was general agreement all round.
“O’Reilly, have you retrieved the killer’s email from Anna’s laptop yet?”
“Technically, it’s on a mail-server in . . . ah, sure never mind. Here’s a printout.” He handed her a sheet of paper.
Jenny scanned it and then read it aloud to the group.
Dear Ms Parker,
I have been given your details by Jake Symmonds, one of your music lecturers at Trinity Laban. He has done this off-the-record as he and I are old colleagues. I work for WMA Associates, an independent agency that identifies up-and-coming talent for professional orchestras around the world. I am currently carrying out a confidential search for a cellist on behalf of the Royal Opera House Orchestra. Initially, this would be a temporary position, filling in for someone going on maternity leave. But it could lead to greater things.
Jenny paused and then commented, “Can you believe this shit?”
“Sadly, Anna Parker did,” said Da Silva.
“Yes, she did.” Jenny knew she deserved the gentle rebuke. She continued reading.
Jake has given you a strong personal reference and so I would like to invite you to audition for this exciting opportunity. Due to urgent time pressures, the only slot I have remaining is on Friday 20th April at 17:30. The address for the audition is at the WMA Associates offices, which are located at Tower 2, Paddington Basin, London, W1 9OL.
Please be prepared to play two solo pieces of your choice.
I would very much appreciate it if you could keep this under wraps at this stage, given the publicity surrounding my client. I look forward to meeting you in person on Friday afternoon.
Kind regards,
William Webber.
The room pondered the note silently.
Jenny offered her thoughts, “Okay, this gives us at least three strands. Who was he to know so much about her? Does this lectu
rer Jake really have any involvement in this? And the email itself – can it be tracked?”
Fiona added further actions to the whiteboard.
“I’m after looking into the email,” said Harry. “It’s from a spoofed email account. It’s the same fake address as yer man used when booking the meeting room. Now then, underneath the display headers, it’s a completely different email address. It’s one of those disposable ones that you can get without registering any personal details. The only line of enquiry left is to trace the IP address via the email service provider, from when it was initially registered and when this email was sent. The only problem is that could take a fierce long time and depends if they are forthcoming or not.”
“So, does that mean we’re dealing with someone really IT savvy?” asked Jenny.
“Not necessarily. If you google ‘fake email address’ there’s a feckload of sites that explain step-by-step how to do it without being traced.”
“Okay, so we’re back to the list of people who would have known enough about Anna to compose something like this, playing on her dreams so well. What about Facebook?”
“I’ve already checked,” said Fiona, standing beside Jenny. “She’s got over five hundred friends listed. We’ll need to eliminate all of them. And we’re checking Facebook and Twitter to see if anyone has been cyber-stalking her.”
“Who has five hundred friends?” asked Verity, one of the civilian indexers, a rotund middle-aged woman.
“Come on, Verity,” said her colleague, an older gentleman whom Jenny recognised from around the station but didn’t know, “You know what the kids are like these days with their friends. Quantity over quality, not like in our day, eh!”
Jenny agreed with the sentiment. Online connections were no substitute for the proper intimacy that real face-to-face friendship offered.
“What about cross-referencing everyone on her Facebook and Twitter accounts with every name we end up getting from Flexbase?” suggested Fiona. “If someone shows up on the list of people who know something about Flexbase and also on the list of Anna’s friends, then we’d have a strong suspect.”
“Great idea, DC Jones,” said Da Silva.
Jenny agreed; it really was a good idea. She’d never have thought of it herself. But that was why they were a team.
“Can you set that up, Harry?” Fiona asked.
“I can,” he replied. “It’ll only take a minute. Just get me the names from Flexbase, ideally with email addresses, and I’ll be after organising it.”
“This is good,” said Jenny. “What about this lecturer? Jake?”
“Yup, I’m on that,” said Fiona, capturing the action anyway.
“Anything else?” Jenny asked the room.
Karim put up his hand and said, “What about checking with the Royal Opera House? Just in case they really were auditioning?”
Fiona wrote down the action.
“Okay. Last strand. Other witnesses and suspects. You know, the basic legwork we’re all so good at. Let’s trace Anna’s steps from leaving her house to arriving at Flexbase. Did she go anywhere else first? Meet anyone else? Let’s talk to her family and friends. Anyone who had something against her? There’s a list of one-night stands over the last six months we need to talk to. Perhaps there’s something there.”
Karim added, “Yeah, and we’ve yet to confirm alibis for the other flatmates. And then there’s Kim Chang’s boyfriend. There’s something not right there.”
“What do you mean, Karim?” asked one of the other DCs, with a smirk.
“Karim’s just jealous,” said another to the room. “He mentioned it earlier. He can’t understand how come a looker like this Kim Chang would lower her standards so much. I think Karim’s hoping he’s in with a shot if we nick the boyfriend.”
Laughter erupted around the room. The light relief at Karim’s expense eased the tension of the workload they all knew was going to be immense over the next few days.
Da Silva stood up. “Thank you DI Price. The only thing missing is the media engagement strategy. We need one, following the impromptu interview I was forced to give this morning in Paddington. I’ll pick that up with DS Schuster, our press officer. He’ll be here later. Okay folks, let’s get this list of actions prioritised, listed on HOLMES and assigned owners. I want to regroup in two hours.”
Jenny thought about Da Silva. She’d never seen a DCI be so hands-off before. And yet, he maintained his authority, made decisions and kept the media to himself, where he would be most visible to his superiors. Perhaps this high-flying, fast-tracked, overly promoted detective had more to him than was initially apparent.
* * *
The problem with creating a tunnel through the Internet is the necessity to dig from both sides. A daemon should be running at the other end, working in tandem to set up the tunnel. Once the tunnel is in place, any kind of protocol, instruction or data can be sent through and the firewall has no idea. All it sees is more traffic on port 80. The daemon at the other end of the tunnel relays these instructions from its privileged location behind the firewall, launching data against any of the servers. In this way a hacker can run far more sophisticated scans for weaknesses and ultimately take control of any of the servers.
But the key was identifying an initial vulnerability through which to set up a remote daemon. Brody had tried and failed dismally for the last two hours. This web server was secure. Incredibly secure. As was the router and the other servers behind the firewall.
He was frustrated. And he had the shakes. The latter he put down to far too much caffeine. He always overdid the coffee during a marathon hacking session. He knew the stereotype Hollywood hacker was a young kid with acne, who drank too much cola. Maybe that was him fifteen years ago, but continued access to a decent income had given him a taste for some of the finer things in life. Good quality coffee was his modern-day cola substitute. The only downside was that the caffeine count was much higher. And decaffeinated coffee was no substitute for the real thing.
Brody wondered if Matt_The_Hatter had some tricks up his sleeve that Brody didn’t know about. Paranoiacally, Brody checked back into the CrackerHack forum pages, dreading a post from Matt_The_Hatter already announcing his success over Brody. But nothing had been published.
Crooner42 had done an impressive job in setting up SWY’s defences. Maybe his naive public approach to requesting a pentest was a smart move after all. If both Fingal and Matt_The_Hatter were seen to fail, then there was no way any police force would ever succeed. And Crooner42’s status in the hacker community would immediately notch up a few levels while theirs would plummet.
Brody’s smartphone beeped twice. He checked it absently. It was his calendar reminding him to head for his daily workout at the gym. That could wait.
But then he noticed another calendar item. It was for his date with Harriet that evening.
Damn, he’d been looking forward to that.
Harriet was a lawyer, aged twenty-nine, five feet four inches, and lived in Bermondsey. She was a brunette with long, curly locks. She’d even spoken with an upper class accent in her pre-recorded video on the dating site. But it had been her dimply smile that had been the clincher.
He looked at his watch. He considered where he was up to in the attack. Nowhere near far enough. He had no choice. He’d have to cancel the date. And their dinner reservation. And the hotel room, which had probably been optimistic anyway.
He thought through a list of excuses and settled on one about delays filming in Morocco . . . only just got back to a place with mobile phone reception . . . first chance he’d had to text her . . . really sorry about the short notice . . . could they reschedule for the weekend?
Brody typed it all in and pressed ‘Send’.
A few minutes later his phoned beeped. Her response was to the point.
No, thanks. Your loss.
He groaned and decided to leave it there. He’d work on Harriet again once he got SWY out of the way.
W
ithout a foothold on the other side of the firewall, Brody’s tunnel attack had failed at the first hurdle. He would have to find an indirect route.
For bricks and mortar companies, the public facing website was just one of the numerous routes into their corporate networks. Companies also needed to provide controlled access for customers, suppliers, business partners and employees. A month ago, Brody had broken into a major retail company’s systems by first breaking into a third-party logistics company used by the retailer for store deliveries. Unlike the retailer, the logistics company had very basic defences and, once hacked in, Brody discovered login credentials back into the retailer’s supply chain system. Once logged in there, he identified a vulnerability ripe for exploitation and quickly gained full administrative access.
The problem with SWY was that there were no obvious indirect routes in. There were no suppliers or business partners. He was already signed up as a paying customer, but that route had already proved barren. And Crooner42 was probably the only employee.
As he mulled the situation over, Brody’s eyes flicked over to the huge television screen displaying the Au Pair Affair video feeds.
Few sites exist in a bubble. Nearly all use widgets and data from external sources. Every time an external source is used, access has to be granted. Surely there must be an external data source?
Following this line of thought, Brody began a thorough review of the website itself, viewing the source HTML on every page. Line by line he searched for external references.
Time passed in a blur.
Leroy resurfaced but found Brody uncommunicative, buried in his computers. He clunked his way around the kitchen for a while making lunch, or maybe dinner, then he showered in the bathroom and then eventually Brody heard the front door slam as Leroy left, saying something about going to the cinema with Danny.
The HTML scan was getting him nowhere. The external widgets were few and far between and he found no vulnerabilities.
Another front door slammed.
“Audri! How many times do I have to tell you that the living room is out of bounds?” A woman’s voice.
Invasion of Privacy: A Deep Web Thriller #1 (Deep Web Thriller Series) Page 11