Authors: Mark Russinovich
A serious problem Daryl now faced was that the link from their C2 servers to the Exchange and possibly the jump server and their code in the trading engine had been disrupted. Her first order of business was to check to see if she could reestablish a path.
From her purse Daryl removed a USB key to boot one of Jeff’s tools. This enabled her to change the local administrator password on the operating system. Once done she rebooted the computer normally and logged on. Now that she was in, she ran a tool to leverage the passwords Jeff had collected to give her access as if she were the users to whom they belonged. Using that access, she connected to one of the Payment Dynamo backdoor servers via the IT side of the Exchange network. Holding her breath, she scanned the list of processes running for their backdoor. There it was, still active. She exhaled. She could connect to the backdoor from the system she was using and regain access to the jump server. This allowed her to monitor the software uploads through the jump server and if she positioned herself correctly, she hoped she could prevent them from passing through.
With her ability to monitor and interfere with the rogue code restored, Daryl turned to following up on the Brazilian connection. Jeff and Frank needed all the help they could get and while Frank suspected the lure was intentional she was sure of it. She was convinced that things would go very badly for them no matter how confident Frank seemed.
She navigated to the internal employee directory Web site and set about scanning it slowly searching for Portuguese names or variations in the event they’d been Anglicized. As a prodigy Daryl had discovered a natural aptitude for languages very early in her life. Before she was a teenager she already spoke Spanish, Portuguese, and Italian fluently. In her teens, she’d added both Latin and French. Her parents thought she’d become a linguist, but Daryl had also been drawn to mathematics and computers. At age fifteen, she was spending most of her time with pimple-faced geeks. It had been the combination of languages and computing skills that had led to her recruitment by the National Security Agency.
The problem in searching for a Portuguese surname was that they were Latin and so many were identical to Italian and Spanish family names, and immigrants often dropped the specific distinctions to simplify assimilation. After an hour, she had a working list of thirteen possible names: Alvaro, Braga, Camacho, Campos, D’Souza, Esteves, Fernandes, Gonsalez, Mateos, Nunes, Parra, Rodriguez, Silva.
Braga, D’Souza, and Nunes were almost certainly Portuguese in origin. The others might or might not be. She next went through the thirteen names in turn to determine what access to the trading engines each had and from that produced three who were in an easier position to insert malware. Braga, Campos, and Esteves. Of course, she knew any on the list could have used their position of privileged access to hack into the system but these three were in the best position, and she had to start somewhere.
Daryl memorized the names, titles, and office numbers. She recalled that she’d seen the name Esteves on one of the manager offices on this floor. She drew a deep breath, stood up, and went back into the hallway. Esteves’s office was unoccupied. The two others were on the fifteenth floor.
She stepped off the elevator and resumed her movement around the next floor. It seemed identical to the other. Employees walked by her, intent on their own concerns. As she’d noticed on the other floor, there was a sense of restlessness in the air, not exactly one of urgency but rather of unfocused frenzy. The cubicles had no names for occupants. Apparently you were expected to know who worked at the station. Braga and Campos were not managers. What to do?
“Excuse me,” she said to a chubby young woman standing in the hallway talking to someone in a cubicle. “I’m looking for Marc Campos. I don’t know him by sight.”
“Marc?” The woman repeated the name as if she’d never heard it before. “Marc,” she said again, looking down. “This lady wants to talk to you.” With that she said good-bye, glancing at Daryl from the side as she moved away.
“Marc Campos?” Daryl asked as she moved to the cubicle opening.
“Yes.” Though he was sitting down, she could tell Campos was tall. He was in his early thirties, with olive skin, an average face, though with slightly bulging eyes. She knew that he was on the core trading platform team at the heart of the trade matching engines. He looked very tired. “What can I do for you?”
There was just the slightest trace of an accent and for reasons Daryl could not explain she knew this was her man. “I’m Kelly,” she said. “I’m with SSG. Do you have a minute to talk?”
“Sure,” Campos said, gesturing to a chair in the corner. “You have a card?”
Daryl smiled, then dipped her hand into her purse and extracted one of the cards she’d printed earlier. She handed it to him. Campos read it, then set the card down, looking back at her expectantly.
“I’m following up on the bot that’s been in the news.”
Campos laughed. “It’s amazing how those things can get blown out of proportion. I know the former employee who is the source. He’s just disgruntled. Almost everything being reported isn’t true. And the market is rebounding today. It always does.”
“Have there been any others since you came to work here?”
Campos shook his head. “I don’t recall any but then, unless it was in the trading software, it’s not likely I’d have heard about it. And I can’t imagine anything like that getting through the jump server.”
“How long have you been here?”
“Five years,” Campos answered before looking at her card again.
“Campos,” she said. “Is that Spanish?”
“Portuguese,” he said warily.
“Eu falo Português. Onde é que sua família vem?”
“Porto,” Campos said.
“
Porto é muito bonito.
”
“Yes, it is.”
“
Você deve falar Português?”
“Of course.” Campos began to sweat. Daryl arched her eyebrows in expectation. Then he said, “
Sim, é claro que eu falo Português.
”
And there it was. It was all Daryl could do not to yell “gotcha.” He’d tried, even in his short admission that he spoke Portuguese to disguise his accent but there was no hiding it. The region about Porto spoke some of the most traditional Portuguese in existence, while those from Brazil spoke a variation tempered by the climate, the distance from the source of the native language, peppered with African words and idioms unique to their region. Porto Portuguese was like Castilian to Mexican Spanish, Prussian to Bavarian German.
Campos was Brazilian.
Daryl continued speaking to him a bit, almost enjoying his efforts to conceal his accent. Finally, uncomfortable with the exchange, Campos said in English, “If there’s nothing else, I need to get back to work.”
I’ll bet you do, Daryl thought. The Toptical IPO is less than two days away. “Of course. Nice meeting you. It was good to practice my Portuguese. It’s been too long.” She extended her hand.
When she was gone, Campos lifted up her card. Kelly Vogle. He punched the listed SSG number into his phone. It rang three times before an electronic voice said, “You have reached the voice mail of Kelly Vogle. Please leave a message.”
Shit!
What did SSG want with him? They’d found the trail he’d planted leading to Aiken and reported it to the SEC just as he’d wanted. Why would they come snooping around here? Why ask about the bot? The publicity it was causing?
And why talk to him? Why send someone who spoke Portuguese? What were the odds it was a coincidence?
Campos stood up and went into the hallway, his legs unsteady. She was gone. He sat back down and stared ahead, realizing that his hands were trembling.
Merda!
55
ENFORCEMENT DIVISION
SECURITIES AND EXCHANGE COMMISSION
NEW YORK REGIONAL OFFICE
200 VESSEY STREET
NEW YORK CITY
5:11
P.M.
Robert Alshon pulled the drawer out and removed two more pink tablets, chewed, then washed them down with coffee. He looked at his watch. Time was racing away.
He fingered the report he’d received earlier. Uniformed NYPD officers had located a fleabag hotel uptown the previous day where two men matching the descriptions of his target had holed up. The clerk said he had no doubt they were the pair on the flyer but by the time a SWAT team arrived and stormed their room the birds had flown.
Alshon had been furious on receiving word. Whatever happened to cops just doing their job? Why wait on a special tactics team? Just go in and make the arrest. It seemed to him every routine law enforcement procedure was morphing into a big deal. It was, in his view, just one more way to avoid responsibility.
So Aiken and Renkin were gone. Where?
Nowhere close, that much he was sure of. Alshon couldn’t shake off the thought they were long gone. He’d missed his best chance to snag them. By now they could be anywhere. Most likely they’d gone to Canada as it was so close. As Company men they’d know how to go to ground. If they didn’t already have new identities, they could get them there. A Canadian passport was as good as an American one, and they were a lot easier to obtain. You didn’t even have to get a false one. And that assumed they didn’t have one already lined up.
They could have gone south, Mexico. Simple enough by bus or by buying a used car and making the drive. Once below the border, they’d simply vanish and even if they were traveling without new identities those were easily obtained in Mexico City, where false documents were a booming business.
There was a knock at his open door. “Come in, Gene,” Alshon said. “Give me some good news. I could use it.”
Gene Livingston entered holding his customary legal tablet and took a seat. He pushed his glasses back onto his nose, then said, “I won’t get the telephone and e-mail information on Stenton, Aiken, and Renkin until tomorrow, so I have nothing new to report there. I did retrace my steps a bit and widened the search, but I still can’t find a connection to Stenton before he hired Red Zoya.” He looked up. “Sorry I couldn’t get this done as soon as I’d expected.”
“It’s good news, though. I prefer to have Stenton on my side in this. So what’s new?”
“I’ve been working on Stenton’s staff since this was an inside job. It occurred to me that these two might have another ally there.”
“Good thinking.”
“What I came up with is Marco Enfante Campos. He works on the trading platform team on one of the modules at the heart of the trade matching engines. That’s as sensitive as it gets. He’s been there for five years. According to his application, he’s from Porto, Portugal. He attended college in the U.S. and worked for New York Life before joining the Exchange. He’s a trusted, reliable employee. He’s moved up steadily in responsibility. He’s single and lives a quiet life from what I can see.”
“What else?”
“He’s working here on a green card. Okay, I got into the New York Life records—don’t ask, you don’t want to know—and while there is a cursory record of his employment, it isn’t fleshed out like that for the other employees.”
“I don’t understand.”
“It looks to me like it was inserted.”
“Inserted?”
“Let’s say you want to establish a work history. You hack a company computer and insert your personal data. When the prospective employer checks, some clerk goes into the records and says ‘Sure, he worked here from such-and-such a date until such-and-such.’ No one gives out any real information anymore because of lawsuits. And that’s all the prospective employer is looking for—confirmation the applicant actually worked there.”
“You’re saying his record looks funny.”
“Right. I checked out the data for employees with similar responsibilities and it is far more extensive. His is really stark.”
“That’s pretty thin.”
“There’s more. I checked with Tufts University, and there’s no record of him ever attending.”
“Maybe the records have it wrong. Maybe he used a different name or took them as special classes.”
“That’s possible. But it was enough for me to really focus on him.”
“And?”
“He’s a creation. I can’t tell you who this Marco Campos is but I’m prepared to guarantee that his real name isn’t Campos, and my bet is he’s not even Portuguese.”
“He looks like their inside man, then?”
“That could be. But when I looked, I couldn’t find any link between Campos, Aiken, and Renkin. Actually, Mr. Alshon, if I were looking at the data fresh, I’d say Campos is your man, not Aiken and Renkin. He’s been there five years, he’s the one who has been in position to set this operation up.”
“We’ve got Aiken red-handed!”
“Maybe,” Livingston said evenly. “But think about it. You’ve been running a long con for five years, you’ve been making money for the last year, then these hotshots from outside come in and stumble on what you’re up to. What would you do? Run?”
Alshon eased back in his chair. Livingston was solid as they come. He needed to listen. “Run makes sense. Why set them up? That in itself is a great risk.”
“Yes, it is. But you’d do it if you wanted to buy time because maybe you’ve got something big coming up.”
* * *
After Livingston left, Alshon summoned Flores and assigned her to personally check out Campos without telling her what he’d already been told. When she left, he gnawed at his lower lip until his cell phone rang.
“Alshon.”
“Mr. Alshon, my names Clive Lifton. I run CyberSys, Inc., out here in San Francisco. We met two years ago in Atlanta. Perhaps you recall. I’m sorry to bother you, but a matter has just come to my attention I need to discuss with you urgently.”
Alshon’s mind raced. Lifton? He had no recollection of meeting the man but that was no surprise. He met a lot of new people in a typical year. CyberSys, Inc. was familiar to him. When he’d been with the Bureau, they adopted one of its security systems.
“What can I do for you, Mr. Lifton.”
“I’ve known Jeff Aiken for a number of years. I’ve tried to recruit him for most of them. I understand you think he’s committed a crime of some kind.”