Rogue Code

by Mark Russinovich

  “Like I told you over the telephone, we can use help in figuring out what exactly they are up to, but especially in backtracking to them. We have to hope they’ve left a clue somewhere. If they are inside the Exchange, that narrows the field of suspects considerably. If they are outsiders, that would tend to get us off the hook.” He paused, then continued, “Since you’re here, it occurs to me that it’s useful to have a fresh face on the scene. You can go places we can’t. We need to stay out of sight.”

  “Where are you two staying?”

  “It’s better if you don’t know.”

  Daryl nodded. “Okay. I can see that.” Neither spoke for a long minute. “Does he know you asked for me?”

  “Yes, I told him.”

  “And?”

  “He appreciates your help.”

  She looked Frank in the eye. “And?” she repeated.

  “No ‘and.’ He appreciates your help. He knows how good you are.”

  “Okay, then. Tell him … tell him I’ll do everything I can.”

  Frank touched her forearm. “He knows that.”

  Daryl blinked as she fought back tears.

  35

  ENFORCEMENT DIVISION

  SECURITIES AND EXCHANGE COMMISSION

  NEW YORK REGIONAL OFFICE

  200 VESSEY STREET

  NEW YORK CITY

  2:51 P.M.

  It was Saturday, but during a big case, weekends meant little in Robert Alshon’s office. He had checked in with Flores and her team just after lunch. They were hard at the forensic examination of the computers seized from Red Zoya in D.C. When he’d caught her eye, she’d shrugged and shook her head.

  He returned to his office. Maybe this guy was more clever than most, he thought. And he kept his dirt out of his office. If that was the case, Aiken would have a laptop with him from which he’d done everything. Alshon alerted his people and any federal officer who might arrest Aiken to acquire every computing device within reach.

  Gene Livingston rapped lightly on his open office door. He was an understated man, both in size and demeanor, but Alshon had come to rely on him to perform the essential legwork outside Flores’s province. He waved the man in and gestured at the chair.

  “What do you have?” he asked pointedly.

  “Just preliminaries at this point, boss, but there’s some firm data here.” Livingston lifted a legal tablet in front of him slightly. Approaching fifty years of age, with little hair remaining and out of date glasses, Livingston looked every bit the bookworm his job description made him out to be. He’d never married and had rented the same one-bedroom apartment for over twenty years. He brought his lunch to work and ate at his desk. Alshon once commented to a colleague that he wished he had ten more like him.

  “I can find no connection between William Stenton and Jeffrey Aiken or Aiken’s company. I’ve checked Stenton’s finances, and there has been no significant movement in two years, nothing at all in the last three months. All indications are they’d never met before Stenton hired him and Frank Renkin. I’ve requested a digital and telephone screen and expect results back Monday or Tuesday, but I think we can expect it will confirm my preliminary analysis.”

  “I plan to meet with Stenton on Monday. I have a number of questions, and it will be better if I don’t have to tell him he’s a target. So do what you can to speed that along. What else?”

  “Red Zoya is clean. Aiken owns it without partners. It pays its taxes, its corporation filings are up-to-date. It has a good credit rating. Basically, it’s just an extension of Aiken for tax and liability purposes.”

  “And what about the man?”

  Livingston smiled. “This is where it gets really interesting. He’s a Ph.D., taught at Carnegie Mellon. You mentioned he once worked for the CIA.” He looked up and Alshon nodded. “He was head of the Counter Cyberterrorism Unit, a four-man team in existence before 9/11. I can’t find anything official but as I understand it he claimed to have uncovered the attack before it happened and later said no one listened.”

  “I’ve heard that story a few times.”

  “Anyway, he left after that and started his own company. It’s got a good reputation, and he does too.” He looked down. “There’s more, but nothing official.” Alshon raised his eyebrows. “Aiken also reportedly discovered a cyberterrorist attack against the West a few years ago. He flew to Moscow and Paris, engaged in a firefight, killed the brothers responsible.”

  Alshon looked at Livingston in disbelief. “Are you certain?”

  “I am that it happened. It’s pretty common knowledge in some circles. I just don’t know the details. Two years ago, he’s the one that found that virus that changes documents in a computer. He was involved in some incident in Turkey in which a plane crashed.”

  “Gene, this sounds like fantasy land.”

  “I understand your skepticism. I’ll see if I can’t nail down some facts.”

  “What about his finances?”

  “He’s done well, but he’s not much of an investor. Basically, his money piles up in a savings account. Every few months, he transfers some into an indexed Schwab account. The rest he rolls into CDs. Of course, there’s the recent activity. I’ll get to that later.”

  “Not very imaginative.”

  “I guess not. He did pay off his town house in Georgetown last year. In general he works a lot and doesn’t do much else.”

  “What about Renkin?”

  “Renkin is former CIA as well. He left some months ago to go to work for Aiken. He was Deputy Director of Counter Cyber Research at the time. His finances are even more boring than Aiken’s. Still has a mortgage, married, three children. Nothing stands out and no recent action.”

  Alshon grimaced. “You say there’s nothing?” Livingston shook his head. “These guys are too clean. That’s always a red flag. They’re hiding something. What about recent weeks, since they came to New York?”

  “Nothing on Renkin.” Livingston consulted his tablet. “Aiken opened a brokerage account, and it’s received just over three million dollars in the last few days.”

  “That’s more like it.” Livingston was pursing his lips. “What?”

  “It doesn’t smell right. He set the thing up in his own name. No attempt to hide anything. Then he’s transferred market money straight into the account. It’s almost like there’s a spotlight on it.”

  “What was he supposed to do?”

  “I don’t know, something. Set up an LLC in Nevada and use it. That would have slowed a search down a couple of days to get back to him. Use any name but his own. Go offshore. Something. It’s almost like he wanted to get caught.”

  Alshon swiveled in his chair and gazed out his window. “These are both Company men, Gene,” he said after a bit. “They’ve been schooled in the craft. They think it through. My guess is he expected to erase his trail before anyone caught on to him. What we’re seeing is a bitter man whose career was going nowhere, who has the chance of a lifetime to get back at everyone and set himself up for life. He figured he’d get away with it and laugh all the way to the bank. These guys like Aiken and Renkin, they think they’re above the law.” He turned back to his desk. “Keep digging. My guess is there’s more.”

  “I do have more. Aiken was struck by a car Thursday night. He was hospitalized.”

  “What happened?”

  “He was jogging near the reservoir and was attacked. He ran into a busy street to escape and was hit by a car. He was nearly killed.”

  “What do the police think?”

  “They think a homeless guy went berserk.”

  “Nothing more?”

  “Just that Aiken left the hospital without being released.”

  “I’d expect that. He’s on the run now. All right, see what else you can find and keep digging. Send Susan in, please.”

  Flores arrived a few minutes later, looking very tired as she took a seat.

  “What have you got?” Alshon asked.

  “Not a thing.
Zip. Nada.”

  “Details.”

  “It’s all encrypted. I’d need the NSA to break it, and even then, it would take weeks, assuming it can be done.”

  Alshon thought about that, then asked, “How about his finances?” He often had Flores and Livingston cover the same ground just to be sure. They were aware of it and worked that much harder.

  “That was actually pretty easy. Nothing out of the ordinary, just a Schwab account and some CDs. He pays his bills on time, owns his house.” She looked up and in a rare moment of humor said, “In most regards he’s a good catch.”

  Alshon snorted. “You’ll be visiting him in prison.”

  “Not for me. For some women.”

  “Tell me what you found on the Exchange.”

  “It didn’t take long to locate the tools Aiken used or his malware. He was employing it stupidly, though. Instead of blending in with traffic, he had it programmed to just keep working around the clock. The automated security scans would have picked it up but the way the malware was set up made getting caught even more certain. It was pretty carelessly done. And it leads straight to his brokerage account.”

  “So just as IT told us?”

  “Pretty much.” She tapped her teeth with her pen. “There’s a rootkit in there. He’d been paying a lot of attention to it.”

  “Rootkit? That’s some kind of cloaking device, right?”

  “Right, it conceals a file’s presence in a computer. He’d been working on this one.”

  “Maybe it’s his.”

  “No. He’s investigating it.”

  “What did you find out about it?”

  “Nothing except that it’s pretty sophisticated.”

  “It was just part of his job; good to go through the motions.”

  “I suppose, but a rootkit’s got no business in the heart of the New York Stock Exchange’s trading platform.”

  Just then, the telephone rang. “Yes?” Alshon listened intently, then hung up. “Take another look at his office data just to confirm we can’t access it, then get back on the Exchange and see what else you can learn. Maybe he’s one of those people who kept things separated, but not many do. Encrypting the files can only have one explanation.”

  “Maybe he works for sensitive clients and wants to protect his work product. That will be the explanation.”

  Alshon snorted. “He’s hiding something. We need to find out what that is. I’m off to search his office over at the Exchange. The team will have more computers for you.”

  “Okay.”

  “With a great deal of luck they’ll show up. I’ve got two arrest warrants.” As he grabbed his jacket he gave her a very unpleasant grin.

  36

  WEST 109TH STREET

  MANHATTAN VALLEY

  NEW YORK CITY

  3:26 P.M.

  Frank let himself into the small hotel room quietly, not sure if Jeff was sleeping. Instead, he found Jeff hunched over his laptop at the room’s desk, deep in thought. Frank set his paper sack down and sat in the room’s only chair.

  “Any luck?” he asked.

  “I’ve made some progress I think. What’s in the bag?”

  “Bourbon. I couldn’t remember if you were a Scotch man or not, but I drink Bourbon so you can either share or get your own.”

  “Bourbon’s fine.”

  Frank retrieved two glasses from the bathroom, unwrapped them from their plastic cover, then filled them halfway with amber liquid. “Here you go.” They both took a sip. “So what have you got?”

  “I think I’ve locked in what the malware does. It’s pretty sophisticated. You’re the expert on Wall Street, since unlike me, you’ve actually read a book so maybe it will make more sense to you. It looks like a trading algorithm programmed to hunt down certain traders and specific situations. When it finds them with a transaction matching the algo’s parameters taking place, it rides it in, bypasses the Exchange’s safeguards, and inserts itself at the head of the trading queue. It’s a high-frequency trader that can always beat everyone to the front of the line.”

  “Like cutting in at the movies huh.”

  “Exactly. Only in this case, there are only so many tickets available at a preferred price. The algos suck that up. In effect, they drive up the price by taking the ready action, then dump, and repeat. They’ve held some of these trades hostage in the Exchange’s computers for minutes while they pump and dump.”

  “How much?”

  “Well, in terms of percentages, it’s taking up to five percent of a trade, though usually less. Depending on the size it’s a lot of money. I have found instances where it appears to have taken substantially more. I haven’t figured out why those are treated differently.”

  “And the Exchange’s IT department doesn’t know about it?”

  “Not from what I can see. They’ve done nothing to stop it.”

  “So the code is undetected and in operation.”

  “Yes, and hidden within the rootkit.”

  “That suggests to me someone with intimate knowledge of the Exchange’s code.” Jeff nodded agreement. Frank took a sip, then lowered his glass. “When did it start?”

  “There’s no way to tell so far. A few months, a year, perhaps more.”

  “Even if it’s just a few months, that’s a long time to operate in the heart of the New York Stock Exchange without being spotted.”

  “It is.”

  “Is it really that clever or are they just not very good at what they do?”

  “It’s clever, obviously. As for the rest … complacent is likely the word for it.” He paused. “It’s possible whoever is responsible for the type of security that would usually detect the malware is in on the action.”

  “Any clues?”

  “No. Just something we should keep in mind.”

  “Any luck finding who planted it?”

  “No, I’ve been working to figure it out. The code we’ve got in the engine has detected and copied the code out of our cloud server so whoever is doing this is active. We should be able to follow the files back to where they entered the Exchange and once we have a physical location we can get names.”

  “The other approach, I take it is—”

  “—follow the money,” the men said in unison.

  “That will take a lot of time,” Frank said. “Weeks, at the least.”

  “Yeah, and finding an end deposit is getting tougher every year. Do we have that much time?”

  Frank shook his head. “In theory we do but like I’ve said already, the longer we’re in the crosshairs, the harder it’s going to be to get out. And this Alshon’s going to think any perp we come up with is a fall guy. That’s especially true since we’ll be relying on computer records and trails. They can be made to point most anywhere.”

  Jeff nodded. “What we need is to catch one of the bad guys in the know and get him to talk.”

  “Good luck with that.” Frank set his cup down and refilled it, gesturing to Jeff who held out his own. As he poured, Frank said, “Still, not bad for a guy who was just whacked on the head. We’ve got help in town now too.”

  Jeff took another sip. “How is she?”

  “Daryl looks fantastic, what’d you expect? I can’t believe you let her get away.”

  “I told you about it.”

  “You told me but you didn’t convince me. She’s here, Jeff. When you’ve got some time for your personal life, you should give that serious thought. If she didn’t care, she wouldn’t have flown across the country.”

  Jeff had already thought about that. “Does she believe us?”

  Frank laughed. “What? You’re having doubts? Of course she believes us. In fact, she’s pretty pissed off. She’s staying in midtown. I gave her access to the backdoors, and she’s likely hard at work by now, trying to trace these guys.”

  “That’s going to be the hardest part.”

  “Yep, they will stay as far from it as they can. Even if it turns out they’re on the inside like
we think, they’ll have routed their work in such a way as to not point at them. As for the money, you can bet it’s scattered far and wide. Maybe Daryl should work tracing the dough while you and I work on tracing its operation and finding a perp.”

  “Sounds good.”

  Frank opened his laptop and sent Daryl a message. “Want me to say anything from you?”

  “Just thank her for helping.”

  “Okay, lover boy. That should melt her heart.”

  Jeff turned back to his computer but found he could no longer concentrate. He finished the bourbon, then poured more. Daryl. He was surprised to learn that she’d flown here, mildly irritated at the thought he might see her again. But when the reality set in, not just of his precarious situation, but that she’d cared enough to come, he found he was looking forward to seeing her.

  The more he thought about their breakup, his reasons for it, the shallower they seemed. He wondered if the real problem had been that she wasn’t conforming to what he wanted. She’d stayed the person he’d always known. If he really wanted a lasting relationship with her, he should have waited. Maybe he just had been looking for a reason to end it, to find one more reason to crawl back into his emotional shell. Because once she left, that’s exactly what he did.

  37

  MACATUBA

  SÃO PAULO, BRAZIL

  4:41 P.M.

  Victor Bandeira settled into his patio chair and laid the Cuban Robusto onto its slot on the ashtray. He took a sip of strong black coffee and looked across the expanse of his estate toward the virgin cluster of trees from which the stream emerged. The afternoon sun caught the clear water precisely and the effect was as if diamonds danced on the surface.

  Sonia was still in the bedroom. When he’d finished with her, she lay there unmoving, softly weeping as he took his shower, humming to himself. Once his energy was recovered, he was considering having another go at her.

  He’d found the entire experience depressing, though. She was such a child, and it had all been so easy. He’d known from the first time she’d been with another man, and now had made it clear to her that she was his and his alone. Women thought they were so clever about such things, but he’d always found it to be the opposite. He was sensitive to any change in their attentiveness or heightened passion, as both were signs. Women thought such compensation masked their infidelity, when in fact it only confirmed it.