The unknown devil, p.5
The Unknown Devil, page 5
“How old is this guy?”
“Twenty-four, I think.”
“He has to be more plugged in than you think. You talked about his code thingies. Don’t people talk about stuff like that anywhere?”
Of course they did. And I hadn’t looked there. I smiled. “I didn’t check yet,” I said. “Thanks.”
Gloria smiled, too. “I hope that helped.”
“Me, too. You seem way more interested than usual in my case.”
“You do good work,” she said. “For a while, I kept waiting for you to ditch the job, but that’s not you. You’re good at this, and you’re helping people. That’s important.”
“Have you seen Invasion of the Body Snatchers?” I said.
Gloria chuckled. “I’m not a pod person.”
“I don’t know,” I said. “Might require some close inspection later.”
“Closer inspection than the shower?” she asked.
“Water makes a proper inspection impossible.”
“Is that a fact?”
“It is.”
“Well,” she said, “right now, this pod person is hungry. I don’t think I could be inspected on an empty stomach.”
“We’ll have to eat, then,” I said.
The contents of my refrigerator and pantry would not combine into an adequate dinner, so we went out. Gloria had a jones for Italian. I ate it for lunch but didn’t mind having it again. I didn’t need a repeat of seeing Tony, however, so we chose one of his competitors in Little Italy: Della Notte. Even though I had been there with Joey, I didn’t mind going back. Because Gloria’s ghost would haunt me if she were seen dead in the Caprice, she drove her Mercedes coupe. The valet accepted it with a wide smile. It wasn’t often a college kid got to drive a car shaped and colored like a rocket.
We got a table and perused the menu. Gloria ordered a bottle of wine I sampled once and found decent but not great. I ordered a Caesar salad appetizer and salmon linguine for dinner; Gloria opted for veal parmesan. “You’re going to have to play a lot of tennis to work it off,” I said when the waiter left with our menus.
She grinned. “I figure we’ll work off some of the calories later.”
“Maybe I’ll order dessert, then.”
“Maybe I’ll help you eat it,” Gloria said.
The waiter dropped off my salad. Like a proper Caesar should, it came with anchovies. Gloria picked up her fork and eyed my salad, then frowned when she saw one of the tiny fish. “It’s authentic,” I said.
“It’s gross,” she countered.
I found anchovies on pizza gross—one anchovy was sufficient to ruin an entire pie—but in a Caesar salad, they were quite good. I drank mostly water with the greens, wishing I had a better wine to wash it down with. Gloria showed a greater interest in my work. Maybe we could improve her wine label snobbery next. Of course, like me, she enjoyed several kinds of snobbery. It must have helped us get along so well: on some level, we understood each other.
“You’re going to look for this guy online?” said Gloria as the waiter cleared my small plate and freshened our waters.
I nodded. “I got a good suggestion.”
It made Gloria smile. “I’m glad I could help.”
If she’d said those words a couple months ago, I would have chalked it up as a trite remark. Today, I believed her. “I’ll start tonight,” I said.
“Tonight?” Gloria said. Her eyes shone, and the corner of her mouth turned up.
“Schedule permitting,” I said. “There’s always the morning.”
“You think you’ll be able to find him?”
“I hope so. I’m sure he has a large presence. When I did a lot of coding at his age, I was all over the Internet.” I kicked myself again for not thinking of this. Because I identified with Brian Sellers, I overlooked the fact Chris Sellers and I had quite a bit in common. He might even be as good a coder as I.
“Will all of that help you find him?” Gloria said.
“Someone has to know something about him.”
“And they’ll talk to you?”
“I might have to show off my coding bona fides,” I said. “If they think I’m one of them, they’ll talk to me.”
The waiter returned with our dinners. Steam rose from both plates. I took a deep breath and inhaled the wonderful aromas of salmon, pasta, tomato sauce, garlic, and spices. Gloria and I scrapped conversation and ate. We drank some more wine—it proved to be a decent pairing with my meal, at least—and scarfed down our dinners.
So far, Gloria knew I was looking for a missing fellow with a younger brother. She didn’t know about Alberto Esposito and his interest in Chris Sellers. I debated telling her as the waiter took our plates away and promised to return with a dessert menu. While Gloria and I had grown closer, we still didn’t have a traditional relationship. The evening we spent together involved a meal, conversation, and sex. During a recent case, however, I needed to stay at Gloria’s house for a few nights. I think the occasion made us closer. We hadn’t talked about it, however. Maybe one of these days, we would.
I ordered two cannoli for dessert. Gloria looked at me over her wineglass. “There’s a complicating factor in the case,” I said.
She put her glass down. “What’s that?”
“Someone else seems to have an interest in the missing brother.”
Gloria frowned. “Who?”
I lowered my voice and gave her an abbreviated version of the Alberto Esposito story. “I don’t know how he fits in,” I said, “but I know he’s involved, and I’m sure I’ll see him again.”
“Be careful,” Gloria said. She grabbed my hand. I didn’t resist. When she looked down and saw what she had done, however, Gloria pulled her hand back and hurried it into her lap. The waiter spared us any further awkwardness by bringing out our cannoli. The shell was light and flaky, with fresh, sweet ricotta inside, and a sprinkling of chocolate chips on top. I ate mine in a few bites. Gloria nursed hers. I didn’t know if she wanted to savor it or if the recent tenor of our conversation made her concerned.
Even after she finished her cannoli, Gloria remained quiet. I spooked her by mentioning Esposito. She downed her remaining wine in a single swig and added the last couple ounces from the bottle to her glass. I paid the check. When we got outside, Gloria handed me her keys. “I drank more wine than you did,” she said. I loved the pickup and sportiness of her car but didn’t care for the smallish driver’s seat. If I wanted to drive something shaped like a rocket, I would have been an astronaut.
I tipped the valet and adjusted the seat and steering wheel. Before I could take off, Gloria grabbed my face and kissed me hard. “Drive fast,” she said.
The Benz complied.
Chapter 6
Back at my house, I intended to work on the case. Gloria, however, had other plans. I no sooner closed and locked the front door when she shoved me against it and kissed me. “So aggressive,” I said when I got a chance.
“You mind?” she said in a breathless tone.
“Nope.”
I tried steering Gloria toward the stairs, just inside the front door. She had other ideas again, instead steering me into the living room. She shoved me onto the couch and slid on top of me. I didn’t resist.
Later, Gloria padded upstairs while I tossed some clothes back on and went to work in the office. In my college days, both undergrad and grad, I availed myself of forums where coders of all skill levels would come together, talk about their programs, solicit help, and sometimes carry on about life. One of the people I met there ended up as a colleague in Hong Kong. I hoped Chris Sellers made at least one such e-friend, and I hoped I could find him or her—I knew a lot of girls who were great coders—and get the person to talk to me. If I got lucky, I might even find Chris himself.
I looked up the most popular online hangouts for coders. To my non-surprise, they’d changed since the days I posted my Python ramblings for the world to see. None featured an easy way to search for a member without knowing the user name. I signed up for the most popular three and looked for Chris Sellers under any handles he might use. I found him on all three.
Did I reach out to him directly? What if his accounts were inactive? I checked his profile on one of the sites.
He logged in three days ago.
He was alive then.
I had to contact him. His profile on codingchat.com showed him to be an active user with more posts and more recent activity than on the other sites. I opened a new message. Now I only needed to figure out what to say. Other than this blip of online presence, Chris Sellers disappeared. He had to have a reason for doing so. I couldn’t come on too strong, or he’d blow me off. While I’m often a fan of lying, I didn’t want Chris to see through a lie and blow me off there. I settled on a version of the truth.
Chris,
Your brother is worried about you. You don’t know me, but I’m helping him find you. He’s safe but worried. Reply to this message or to my cell, 410-555-7274.
Now I could only wait. I had to hope Chris would see the message, not be freaked out, and get back to me. My cell number gave him an easy way to figure out who I was. It would have to be enough. I wanted to look into his posting history on these forums, but it grew late, and I was tired.
I went upstairs. Gloria woke up when I entered the bedroom. She propped herself on one elbow. Her chestnut hair flowed down her shoulders and touched the white sheet of my bed. The lingerie she wore fit like someone made it just for her, and knowing Gloria, it was a possibility. I found myself staring. Gloria grinned.
Well, I wasn’t too tired.
In the morning, I left the sleeping Gloria upstairs as I went down into the kitchen. One of these months, I would need to get my grocery shopping done. I made a cup of coffee and pondered my limited options. Some cracked wheat sourdough still looked good enough to combine with turkey sausage and a few eggs. A pretty basic menu, but it would do. I got two skillets going with a little olive oil and put the eggs and sausage on. The aromas of the food must have woken Gloria. She came into the kitchen and beelined for the Keurig.
“No kiss for the chef?” I said.
Gloria waited until her coffee brewed. She added sugar and creamer, took a long drink of it, and then kissed me. It tasted like spearmint and dark roast. “Priorities,” she said, taking a seat at the table.
“I understand.” I flipped the eggs and sausage patties and maxed out the toaster at four pieces. A few minutes later, I carried to the table two plates, each with two fried eggs, three sausage patties, and two pieces of sourdough toast. I sat opposite Gloria and buttered my toast.
“You always seem to know just what to make for breakfast,” Gloria said after a few bites of her eggs and sausage.
“Years of morning-after practice,” I said with a wink.
Gloria smiled and shook her head. “I might believe you.”
“I might be telling the truth.”
“Did you get any work done last night?” she said.
“You mean between bouts of being ravaged by a beautiful woman?”
“Yes,” Gloria said, color rushing to her cheeks.
“I did some research, the kind you suggested. I found a few places Chris visited recently.”
“Did you reach out to anyone who knew him?”
“Not yet,” I said. “I didn’t have much time. I found he logged in three days ago on one site, though, so I sent him a message.”
“Any response?”
I shook my head. “I’ll check after breakfast.”
“You think it’ll work?”
I buttered and added apricot preserves to my second piece of toast. My first cup of coffee was getting low. “No idea. If he hasn’t responded by tonight, I’ll try to find some people who knew him on those sites.”
By the time I needed a second cup of coffee, Gloria did, too. I carried both back to the table. We finished, and I nearly fainted when Gloria volunteered to put the dishes in the sink. If she washed them, I would have dropped where I stood. While I went down the hall to work, Gloria climbed the stairs to get a shower. She didn’t try to coax me into joining her; I must have looked serious about getting on task. I would have joined her had she asked.
While Gloria showered, I looked into Chris Sellers’ activity on Coding Chat. He made over three hundred replies but only started three of his own threads. The pattern pegged him as a solid contributor. If I needed to track him down via other people, there should be no shortage of fellow coders he helped along the way. I focused first on the threads Chris replied to most often.
They all concerned malware reverse engineering. I studied it in college and worked at it on occasion since. Chris Sellers was probably more proficient than I at the moment, much as it pained me to admit. He offered a few pieces of general advice to the original poster. Then the person posted the code in question, and Chris provided a bunch of comments. I wanted to see how insightful they were.
I downloaded the code onto a flash drive. The exact functions of this malware had yet to be established. I would find out on a VM. I got out my laptop, fired it up, and logged into a fresh virtual machine. I copied over the malware code, compiled it, and ran it. I didn’t notice a visible effect. My desktop looked the same. I searched for open processes and found nothing unusual. Maybe this malware didn’t allow itself to be evaluated on a VM. On a lark, I opened a terminal window and examined the file list.
Then I saw it.
It took me a minute. I could have easily missed it. It was, after all, easy to overlook. It was exactly the point. Chris Sellers had been helping someone with a rootkit, a piece of malware able to hide from the user and subvert the operating system to mask itself. An extra file in the expanded listing I preferred provided the only indication, and I doubted most people would have seen it. Users and admins get accustomed to certain things, so much so they expect it. This rootkit took advantage of their tendencies.
I tried to find it in other ways and got stymied at every turn. This one dug its hooks into a lot of processes. I checked Chris’ comments. He advised the original poster how this was a powerful and insidious tool and should not be trifled with. I couldn’t read the original poster’s intent. Chris must not have been able to, either, because he stopped replying after giving a long explanation and suggesting the poster leave well enough alone. This rootkit could do some serious damage in the wild. I wondered if anyone ever used it, and if an enterprising admin ever discovered it.
I heard Gloria come down. While I destroyed my infected VM and created another, I scoured the forums anew. Chris’ replies centered on reverse engineering and esoteric coding challenges. From what I saw in his replies, he was a damned good programmer. In a moment of weakness, I would admit he had a small edge on me due to the recency of his research. No wonder Bobbi Lane held him in such high regard.
Instead of continuing with Chris’ replies, I dug into the threads he started. One dealt with reverse engineering and how to handle a rootkit responsibly. Another solicited opinions on the finer points of Unix shell coding. The third intrigued me: it dealt with research into ransomware. I wondered again if Alberto Esposito found interest in Chris Sellers for the same reason. After some back and forth and solid suggestions, Chris posted his code. I downloaded it to a different flash drive.
My new VM finished building. The code allowed me to manage and deploy the ransomware, so I built another VM to play the victim. Ransomware tends to lock users out of their files. I created a few text files on the second VM so the software could encrypt and hold them for ransom. After verifying any communication medium on the laptop was disabled, I compiled and ran the ransomware.
The management console opened. This was software anyone could use. It gave a choice of how to encrypt the files, how much money to demand to release them, and ways to collect the funds. The hacker could choose what image to display on a victim’s desktop. This was one-stop shopping for criminals. All they would have to do is point and click through a few choices, wait for their malware to infect some unwitting folks, and start making money. I had never seen such customization before. If this got into the wild—especially in the hands of someone like Alberto Esposito—it could cause a metric ton of damage. Not to mention, raise a lot of ill-gotten gains.
“Interesting stuff?” Gloria said from the doorway, making me jump in my seat. She padded into the room. “You were so wrapped up in your work.”
“This is really interesting,” I said.
“Did you find the guy?”
“No, but I discovered he’s really good at writing malware.”
“Is that a good thing?” Gloria said.
I leaned back. “It’s a matter of perspective,” I said. “The coding skills are good to have, though I’d like to see them put to better use. This program could cause a lot of damage.”
“What does it do?” I explained the basics of how ransomware worked. “That’s really shady,” Gloria said.
“It is,” I said. “So far, people who pay have gotten their files back. But there’s no guarantee it’ll keep happening.”
“So people could have to pay over and over?”
“Potentially.”
“What if this targeted specific people?”
“Good grief,” I said, letting out a slow breath. “It would be like spear phishing on steroids.”
“That actually made some sense,” Gloria said.
Was this malware the source of Alberto Esposito’s interest in Chris Sellers? I still needed to know how Esposito got onto Sellers in the first place. Now seemed like as good a time as any to pay Danny Esposito a visit. I looked at my phone; it just turned one o’clock. I had been sitting with this malware for about four hours. Doing anything else sounded better.
I changed into more respectable clothes and drove to Hopkins. Several years went by since I was last on campus. During my senior year of high school, they recruited me hard, both for my academics and for the lacrosse team. I preferred computer science to engineering, opted for Loyola, and ended up not good enough to play varsity lacrosse. Despite the passage of time, I remembered where the admissions office was. I parked in an available spot and walked into the building.
