Social Engineer (4 page)

Jacobsen stopped himself, but his fists remained clenched around his Montblanc pen as if to crush it.

“LinkedIn and Facebook again, I presume?” asked Wilson.

“Actually, no. I would have used them if there’d been enough R&D personnel listed on LinkedIn, but they don’t seem to bother too much with it. I got creative.” Brody found it hard to keep the pride from his voice. He pulled up another audio file and pressed play.

“HTL help desk. Can I help you?”

“This is John from the CEO’s office.” Brody’s voice again, but in a confidential manner. “Listen, I need you to keep this to yourself. Mr Musgrave, our CEO, is launching some new employee morale-boosting initiatives. The first one is a chance to win two weeks’ hire of an Aston Martin DB9.”

“No way!”

“Yes, really. But keep it to yourself. Anyway, to have high impact, we’re looking to schedule an all-staff meeting some time over the next week or two. And Mr Musgrave will draw the winner from a hat, live. The car will be presented to the winner there and then, assuming they’re on site. And he wants everyone to see it in the car park every day for two weeks!”

“That sounds fantastic.”

“Yeah, I know. But here’s the problem. We want to make sure that anyone who’s on holiday at the time doesn’t get drawn. I know it’s unfair for them, but it would lose the impact Mr Musgrave wants to have by handing over the keys personally.”

“Uh, right?”

“Would you be able to do a search and let me know all employees who’ve booked annual leave during the next two weeks?”

“Uh, sure.”

“You’re not on holiday are you? It’d be a shame for you to miss out now you know about it.”

Brody stopped the playback. On the other side of the oak table, the executives’ jaws had dropped open and they were shaking their heads.

Brody said, “Like I said before, help desks like to help. That’s their flaw.”

“But he didn’t even ask for your employee ID, raise a help desk ticket or anything,” stated Hall, the exasperation clear in his voice.

“It’s basic psychology. As far as he was concerned I was representing your CEO. And I let him into a secret. He’s drawn in and motivated to help.”

“Why didn’t you just use Colin Renshaw’s pass to get through reception?” asked Wilson.

“Good point. It’s because receptionists are the people most likely to check the badge of someone they don’t recognise. And I look nothing like Colin Renshaw and no amount of make up is going to fix that. You’ll see later that no one really checks my badge once I’m through the secure doors. They rely on that having already been done.”

Brody brought the video back up. It showed him enter a large atrium open to all three floors. A bank of four glass lift doors lay immediately in front. To the left, a glass staircase offered an alternative to the glass pods that silently glided up and down linking suspended walkways. HTL staff quietly went about their business. A group of three were engaged in conversation on the walkway immediately above. Two women exited a lift and walked towards him. As they approached, they stared directly at the camera.

“They’re checking out the Cisco logo on the cap rather than Colin Renshaw’s identification pass pinned to my fleece,” Brody commented.

On video, Brody made his way up the staircase to the top floor. At the double doors controlling access to the north wing, his yellow pass obligingly turned the light green. He pushed open the doors and strolled along the corridors, passing staff going the other way. No one took any notice of him.

The onscreen Brody made it through another security barrier successfully. Brody remembered thinking at the time that it had almost been too easy.

At another set of security doors, the video showed Brody’s hand wave the yellow pass at the sensor. But this time the light above the sensor flashed red. Abruptly, he stepped back from the doors and retraced his steps, the camera pointed at the floor rather than straight ahead.

Five Weeks Ago

“Brody?”

Brody immediately recognised her voice with its beautiful French accent. Fuck. He couldn’t believe his bad luck. What the hell was Mel doing here, of all places?

He turned around slowly, forcing a wide grin across his face. She was sitting in the reception area of the law firm head office he had just been about to social engineer his way into; his latest pentest assignment. Dressed in a navy jumpsuit with a Domino’s pizza logo he’d had embroidered onto the chest, he had completed the imposture by carrying in four large flat cardboard boxes containing pizzas. It was a sure-fire way to blag it past any security-conscious receptionist.

He pivoted away from the reception desk — he couldn’t continue now — and walked over to the waiting area where Mel was sitting, pulling the boxes up to cover the Domino’s logo.

“Well, this is a pleasant coincidence,” he said, as amiably as he could make it. She stood as he neared. Leaning forward to give her a kiss, he awkwardly clutched the pizza boxes to his chest. She hesitated, looking him up and down suspiciously, but stood on tiptoes and accepted the peck on her lips.

They had been together for three weeks now and Brody was utterly smitten. Whenever they were apart, his thoughts frequently drifted to her; either reminiscing over their last date or anticipating the next. They saw each other every few days; working around her care home shifts and the weekends she usually spent protesting for animal rights with her activist friends. Occasionally, she stayed over at Brody’s apartment and so he had been forced to introduce her to Leroy and his boyfriend Danny. His friends were pleased to see Brody so obviously happy, and particularly delighted that the cause of his happiness was because of someone in the real world rather than the virtual.

Leroy’s favourite rant involved Brody’s proclivity to prioritise relationships built electronically rather than through interaction with real humans. Brody didn’t see the problem, citing Leroy as the exception that disproved the rule. Online, Brody went by the moniker Fingal and had forged friendships and acquaintances with fellow computer hackers from all over the world. He was very active in the hacker forums, always aiming to strengthen his elite hacker status by sharing code, blogging or exposing unknown Advanced Persistent Threats that he’d identified during his pentesting assignments. APTs were crafted by nefarious ‘black hat’ hackers, often members of mafia-funded cyber-gangs, whose aim was to surreptitiously install them on corporate networks, where they ran undetected, replicating themselves and sending back intellectual property which the hackers could then sell on or ransom. One Russian mafia-backed cyber-gang had even put up a large bounty for any information that led to the unmasking of Fingal in the real world and, for that reason, Brody took extensive efforts to conceal his trail online. Over the years, Brody had worked hard to maintain Fingal’s infamy; always ensuring a clear line of delineation between his online and offline worlds.

Spurred on by Mel having met Leroy in his offline world, she had then set up a night out with Joyce, her closest friend in London, and her fiancé Neil. By weekday, Joyce was a lawyer and Neil an accountant. By weekend, both were fellow activists, Mel having first met Joyce three years before at a rally in London. Despite his dismay at being stuck with three activists for the evening, Brody had cheered up the moment Mel had casually introduced him as her boyfriend. It was the first reference to them as an official couple and his mood brightened completely, even outlasting the inevitable boring conversations about drug companies and their immoral use of animals in research.

The only downer was that as their relationship started to become serious, Brody felt ever more guilty about his dishonesty to Mel regarding his online and offline lives. He was stuck in the lie with no obvious way out, reinforcing it that evening whenever Joyce or Neil led the conversation towards him and his background.

“What are you doing ’ere?” Mel asked, suspicion still lining her face. “I thought you were in Brussels, scouting locations.”

He thought quickly. “We finished a day earlier than planned. I just got back in on the Eurostar a couple of hours ago. I was going to surprise you later, but obviously that’s ruined now.” He gave her a sad look and then asked, “What are you doing here?”

 “I’m waiting for Joyce to come down. As it is one of my days off, we decided to — how you say —
do
lunch.”

“Joyce works here?” Brody couldn’t believe the coincidence. Mel had introduced her friend as a lawyer, but it had never occurred to Brody that she would be on the payroll of the exact same law firm on which he was being paid to carry out a pentest.

Mel furrowed her brow. “But what are you doing ’ere, Brody? And what is with the pizzas?”

Brody continued improvising. “I was just getting provisions for the second unit location team. We’re in the middle of some long negotiations between our lawyers and the lawyers who represent the owners of Tower Bridge. We want to film an action scene with some boat stunts under the bridge, but they’re concerned about potential damage to it from any explosions. I think it’s going to be a long day.” He shrugged. “Didn’t realise our lawyers were from the same firm that Joyce worked for.”

Mel studied him, dubiously. “Brody, why are you meeting with lawyers wearing a jumpsuit?”

Yes, that was a good question. Why was he wearing a jumpsuit? The truth was that he was dressed to look like a pizza deliveryman. But he could hardly say that.

“I accidentally spilled a load of coffee over my business suit earlier. This was the only clean thing anyone here could find for me — one of the cleaner’s overalls.”

She didn’t look convinced. He wouldn’t have been either. Brody spotted movement in the reflection of the large windows behind Mel. The lift doors were gliding open and Joyce began to walk out. He had to move quickly.

“Damn!” he exclaimed. “I forgot the drinks. Look, I’d better pop back out and get them.” He headed for the glass revolving doors that exited back onto the street. “I’ll call you later. We’ll go out for dinner.”

Today, 9:32am

It was time to explain what had happened next to the HTL executives. “So I’ve reached the limits of Colin Renshaw’s access,” Brody began. “At this point, I’m aware that an alert has gone off in a security control room somewhere. It’s likely they get quite a few each day from real staff inadvertently trying to gain access to the wrong doors. After all, the corridors in this building of yours all look the same to me.”

On the screen, he entered a Gents toilet. The video lowered to near ground level as Brody checked the three cubicles for the presence of feet.

The video cut to show a cleaner’s cupboard.

Brody had edited out the part of the video where he had stared at his reflection in the large mirror above the sinks, exhaling deeply and telling himself aloud to calm down, the adrenalin causing his hands to shake. If anyone had been in the corridor when he had failed to gain access to that last set of doors, it would have made them instantly more vigilant and very likely caused them to properly check his ID, resulting in a security alert. And, now that he had met Jacobsen in the flesh, Brody doubted that he would have survived such an encounter without it becoming physical. After all, he would have been caught red-handed trying to break into HTL’s most secure area. And explaining about a pentest sponsored by Moorcroft would probably have fallen on deaf ears, at least initially.

The cleaner’s cupboard had a mechanical combination lock with two vertical rows of seven buttons, labelled with numbers and letters, above a hexagonal handle. That meant many thousands of potential codes. His hand punched in a six-digit code and the door opened.

The off-screen Brody moved his mouse to pull up another audio file.

“Let me guess,” said Jacobsen. “You phoned the cleaning contract company we use and pretended to be a new cleaner.”

Brody clapped his hands, sardonically. “Well done, you’re getting the hang of this.” He didn’t bother to play the audio file.

The video cut to Brody in front of the mirror. This time he had replaced his Cisco cap with a plain grey one and had donned overalls. He’d located a trolley, carrying a mop and bucket, trays of cleaning materials and a large yellow sack.

He returned to the corridor, pushing the trolley. Slowly, he walked back in the direction of the double doors Colin Renshaw’s security pass had failed to open. The nearer he got, the slower he walked. Every couple of yards, the video panned around to check if anyone was coming the other way. But the corridor remained empty.

From the speakers, Brody’s voice clearly said, “Bugger,” and on the screen, he began to turn the trolley around. At the half-turn mark, the camera moved quickly to show one of the double doors opening. Someone was coming through from the other side. Quickly, he turned the trolley back and rushed the last few yards towards the opening door.

A man in a dark suit was walking through. The camera was pointed downwards, taking in the man’s shiny tan brogues as Brody avoided eye contact. In an Eastern European sounding accent, Brody’s voice said, “Would you mind?”

A second later the shiny shoes stepped back and the camera nodded thanks, briefly revealing the face of the helpful employee.

In the meeting room, Jacobsen leapt to his feet. “You’ve got to be fucking
joking
!” Brody flinched as Jacobsen violently flung his expensive pen down on the table but in Brody’s general direction. It instantly shattered, three pieces bouncing upwards — one heading straight for Brody’s face. Brody reacted quickly and snatched it out of the air. The other two pieces flew either side of him, one just missing Dr Moorcroft.

Onscreen, Jacobsen himself could clearly be seen, obligingly holding the door open. Brody pushed the trolley through. He mumbled an accented “Thank you.”

“You’re welcome,” Jacobsen’s voice said from the speakers.

In the meeting room, Jacobsen slumped back in his chair.

Three Weeks Ago

Brody held the door open, allowing Mel to pass into the small lobby of the residential block of flats. She pressed the button to call the lift, which opened immediately.