“Wait.” Ian held up his hand. “I’m really trying to follow this. How can you know when someone accessed a file?”
“Every Windows file has three associated time stamps. Creation date, last modified date, and last accessed date. You can access or read a file without modifying it, hence the distinction between last accessed and last modified.”
“Okay, that makes sense,” Ian said. “Did you catch him?”
“I wish. We ramped up our monitoring of the firewalls, but we couldn’t link any of the random attempts to the reading of the files. We looked in all the usual places someone could insert a back door into the Windows operating system, but couldn’t find any evidence of any such back door. We were completely stumped.”
Lily laughed softly. “Arly and I were stumped. Flame suddenly jumped up and yelled, ‘Hardware back door.’ I had no idea what that meant, Ian, if that’s any consolation.”
Flame shrugged. “It was so obvious. We forgot the most obvious advantage Dr. Whitney had over other hackers. These are his computers. He could do anything he wanted with them. Unlike the usual hacker, he doesn’t have to sneak a virus, worm, or Trojan through the firewalls. Unlike software manufacturers, he doesn’t have to sell someone software with a back door in it. No, he has complete control over his own computers. He could literally drill a hole in the side of his computer and run a cable into it creating a private tap. All that time we wasted looking for a software back door when it had to be a hardware back door.”
“Then she went a little crazy,” Lily explained.
“A lot crazy. I just knew I was right, and for once we were going to have the opportunity to the turn the tables on Whitney,” Flame admitted.
“She was crawling around all the computers in the laboratory, picking up wires and following the network of cables from one computer to another. Then she held up the router and started yelling, ‘Look at this, look at this.’ I had no idea what I was supposed to be looking at.”
Flame grinned at her. “It had one too many wires coming out of the box. I knew we had him by the-” She broke off. “I knew we had him. The file protection system on these computers is set up on the local area network, or LAN, to be able to access the files on any other computer-and why not? They’re all the doctor’s computers-it would only be the doctor working on one computer and accessing another. We’d been looking for an intrusion from outside via the Internet. All the firewalls are protecting us from outside intrusions. Dr. Whitney is getting in by masquerading as an insider, as another computer on his own LAN. One of the lines was bogus, and I knew it would take us to the doctor. I traced the line straight to a wall.”
“This is where we get a little technical,” Lily said.
“Not too,” Flame assured Ian. “We discovered the network cable is hooked via a CSU/DSU box into what we realized is a leased T3 line. And before you ask, a CSU/DSU box is a channel service unit/data service unit or digital service unit box, and that’s what identifies the fact that it is a leased line. This is a superfast dedicated connection across the phone lines. The DSU connects to the LAN inside the house and the CSU connects to the lease line.”
Ian frowned and glanced around the room. “I don’t get this. The line goes through the wall and goes to a leased line? He rents a line?”
“A leased line is actually composed of three parts,” Flame explained. “Two local loops and a long haul. The first local loop runs from this house to the nearest POP, which basically is point of presence of the long distance carrier or carriers. There has to be a similar local loop running from wherever the doctor is currently to the POP nearest him. The long distance carriers, one or more, use the normal phone lines to connect the two local loops. The fact that two local loops are completely private, plus special equipment on the hardware/software long haul, guarantees the entire connection is private.”
“So he has to be in the country,” Ian said.
“Not necessarily,” Flame replied.
“There have to be records of who leased the line,” Kadan pointed out.
“Of course. Dahlia broke in and looked for us. It wasn’t very shocking to discover that an import company in Oregon, one owning a private jet by the way, a jet able to land in restricted military space all over the world, leased that line,” Lily said. “Shockingly enough, the man who signed for the purchase of the private jet also signed for the purchase of the one that went down in the Congo. That man doesn’t have a Social Security number or birth certificate that we could find.”
There was a small silence. “It is Dr. Whitney, isn’t it?” Ian asked. “He’s alive then.”
“We don’t know. Certainly if it isn’t him, it’s someone he worked closely with who was privy to all of his experiments,” Ryland said.
Lily cleared her throat. “No matter who my father was working with-or for-he would never have shared all of his information. He has to be alive. In my opinion, he’s alive and he’s continuing with his experiments.” She pressed her hands protectively to her stomach. “He’s out there, and he’s watching us.”
Ryland put his arms around her, leaning to nuzzle the top of her head. “But aren’t we watching him now?”
Flame nodded. “He isn’t going to be able to get to you, Lily. Not you and certainly not the baby.”
There was a murmur of agreement through the room and Lily relaxed visibly.
“How are you watching him?” Ian asked.
“I hoped I could access his computer as easily as he was accessing ours. I actually identified all of our computers and isolated his, so I knew I had the right one, but he had disallowed access.” Flame smiled. “So I changed tactics. I knew he was accessing certain files on a regular basis. He follows all of Lily’s findings and wants to see her updated reports on each of us.” She smirked. “He was particularly interested in my file.”
“What a shocker, cher,” Gator murmured. “I’m interested in it too.” His hand swept down her arm, his fingers tangling with hers.
Flame relaxed, leaning back against Gator. “I created a little surprise of my own for Dr. Whitney. I created a Trojan and embedded it in one of the regularly viewed files. First I had Lily update my file in order to entice him to take a long look at it.”
“What does that do? How’d you do it?” Ian asked.
Flame shrugged. “I assumed he was using Windows XP because all the computers here are XP. So I programmed the Trojan to do one thing. It goes into the controls for Remote Desktop on his computer and adjusts the settings that allow users to connect remotely to this computer across a LAN. Of course, we had to wait for the doctor to read the file embedded with the Trojan so he could unwittingly activate the program for us, but with Lily updating, he took the bait.”