David Kessler - No Way Out

The MAC number had nothing to do with Apple Mac computers. It was an identification number that identified an individual computer.

“And?”

“It came from your laptop Andi.”

“ My laptop!”

This sent a jolt through her. When could it have happened? She had her laptop with her at all times as far as she could remember. The only time when she had left it was when it was in the car when she went into the rape crisis center. Could some one had got into her car, used her laptop — via the WAN of Levine and Webster — and then switched if off and left the car looking untouched all the in the space of a few minutes?

“Is it possible for some one to spoof a MAC number?”

“A few years ago I’d’ve said, yes, but only if it was a very experienced hacker. Now anyone who can do an internet search can download an off-the-shelf MAC spoofing program. You can get an evaluation version free or the standard version for thirty dollars.”

“But how would they have got my MAC address to spoof it? Only the IP address is transmitted with the message header. The Mac address is only transmitted to the initial service provider.”

“Maybe that’s where they got it. From the company WAN.”

“You think some one at Levine and Webster.”

“If the hacker could access the network there then they might be able to get the MAC address from there, if you use the laptop at work. Does anyone else have access to your computer — I don’t mean just now, but generally.”

Andi hesitated. She knew the answer to this. But didn’t want to think about it.

“Gene wouldn’t have the knowledge to do this sort of thing.”

“Gene?” he sounded surprised. She forgot that he didn’t know what she had found out last Wednesday. As far as the rest of the world knew, Gene might have the opportunity, but she wouldn’t have had the motive.

“She has access to my laptop… some of the time. But not recently.”

“And as you say, she wouldn’t have had the knowledge of how to spoof a MAC address… let alone a motive.”

“So what do we do next? asked Andi.

“Well, there’s something you should be thinking about. Let’s take an off-the-wall scenario and consider what if some one did somehow manage to gain temporary access to your laptop. We know that the person downloaded a file from the Bethel Newton rape case.”

“So?”

“That means then they might have left some tell-tale sign on your computer.”

“Holy shit! I almost missed that!”

“Well what I suggest is that you check it out when you get back to the office. Let me know what you find. In fact, if you can connect it up with PC Anywhere, I’d like to do a hard drive image.”

“Okay. Thanks David. Bye.”

She put the phone away and became aware of Alex’s eyes upon her.

“Good news?”

“It could be Alex… it could be.”

Twenty minutes later they were back in the office. Alex had decided not to quiz her about this latest development immediately but to let her calm down first. Her animated conversation with David had perked her up somewhat but when he asked her about the “good news” she had refused to elaborate. He sensed that she didn’t want to jinx it by talking prematurely. She would tell him in her own good time.

So now Andi sat alone in her office, searching through the laptop’s hard disk for any trace of what was downloaded from the DNA database. She was checking deleted files too. If Lannosea had really managed to gain access to the computer to log on to the Ventura LDIS and downloaded anything, then even if she subsequently deleted it, the ghost of the file would probably still be there on the system. Even if she overwrote it completely, there should be a record in the activity log.

She had to find it.

File, by file, deleted file by deleted file, she searched the disk, using a range of software tools and utilities devised for system management. Finally she saw something that made her eyes pop open. There was a file called EliasClaymore.dna and then another called nailmidfngr.dna. As she looked further, she discovered something very interesting. The nailmidfngr.dna file had been created locally on this computer, whereas the EliasClaymore.dna file had simply been downloaded.

But then as she continued to look through the deleted files, she found the shadow of another downloaded file, also called nailmidfngr.dna. This had been downloaded at about the same time as EliasClaymore.dna and then deleted. It was clear that the hacker, had downloaded the EliasClaymore.dna file and then used it to create a false evidence sample file. But why also download the real evidence sample file if they were planning to overwrite it on the DNA server with a fake one?

Maybe it was because they needed to refer to the metadata in the file header, to get it right on the forged version. Or maybe Lannosea had originally planned to create a fake Elias Claymore sample — using the real evidence sample — and then changed her mind and decided to do it the other way round.

Andi decided to compare the forged evidence sample file with what she presumed was the real one.

But what she saw this time made no sense. Because the original evidence sample file that had been downloaded and deleted was the same as the new one that the hacker had created.

Why overwrite a file with another identical copy?

“But that doesn’t make sense,” said Bridget.

She was talking on her cell phone to Victor Alvarez, from her car at San Francisco International airport, having flown in to be available to help Sarah Jensen on this, the most crucial day in the trial of Elias Claymore. It was going to be an uphill struggle winning the case if it continued. And if it didn’t, they’d have a hell of a job persuading Bethel Newton to testify at the retrial.

“That’s exactly what Paul Greenberg said. But he checked and double-checked. The fact is, whoever did it, all they did was delete the genuine evidence file that had been uploaded from a computer at the crime lab and then uploaded an identical copy from the remote computer where they were hacking in from.”

“But why would anyone do that?”

“Maybe the person who did it didn’t know that it was the same profile. Maybe they meant to upload something else and instead uploaded the same file they’d already downloaded.”

Bridget was trying to concentrate on what Dr Alvarez was telling her while at the same time navigating her way out of the airport parking lot. She didn’t relish the prospect of the morning drive across the Bay Bridge in commuter time.

“Do we know who did it?”

“Greenberg said he’d passed on some information to the FBI. I heard on the radio that Andi Phoenix was arrested in connection with it. But the hacker may have hijacked her computer with a Trojan, or spoofed her IP address. At any rate, she was released R-O-R and we’ll have to wait for the evidence hearing.”

“In any case, that still doesn’t help us resolve the question of who is actually guilty.”

“Not in itself,” said Alvarez. “The way things stand now, we’ve got two suspects, neither of whom can be eliminated by the DNA, and in both cases the chances of a random match are 500 to 1.”

“It’s worse than that, Victor. We’ve got one suspect who was identified by the victim and another who matches the age of the perp. We’ve got one who matches the description of the perp and the other who used to match that description when he was younger. We’ve got one suspect who owns a car that matches the one described by the victim and another who was caught driving that car with false number plates. We’ve got one suspect who was a rapist in his youth and another who has no priors for rape but was arrested when he tried to rape a reporter who’s covering the case. ”