Judgment

43

After she left Hersh’s office, she called the phone number he’d given her and got voice mail. It was a company called Boston Digital Forensics. The voice on the message was male and didn’t sound very professional. He had a strong foreign accent, presumably Ukrainian.

Next she called Martie Connolly and told her she’d be coming “home,” to Martie’s apartment, on the late side. Tonight was parents’ night at Jake’s school. She and Duncan would arrive separately.

Her phone trilled. She recognized the number as the one she’d called from the Post-it. “Hello?”

“Yeah, I’m looking for — Rosalind?”

“This is Rosalind. Is this Sasha?” She wasn’t going to use her real name with the guy if she didn’t have to.

“Yes.”

“I got your name from Philip Hersh. I need some computer assistance.”

“Uh-huh.”

“Where’s your office? I’m not comfortable talking about this on the phone.”

Sasha gave her an address on Newbury Street in the Back Bay.

She didn’t have a lot of time — she had to be at Jake’s school at seven — but if she hustled, she’d be able to do this. She found a resident parking space on Comm. Ave., where she’d get a ticket if the parking police nabbed her, but she didn’t have time to look for a legal one.

The office was in a building whose street-level floor was occupied by a coffee shop. She took a small elevator to the fifth floor and walked down a narrow corridor lined with small offices, past a massage therapist’s studio, an accountant, and a financial adviser. The office of Boston Digital Forensics was at the end of the hallway. She knocked on the door and pulled it open.

A small man in his thirties — black hair, beard, hunched shoulders, thick glasses — was sitting at a receptionist’s desk right by the entrance, a cup of coffee in his hand. He stood up, shook her hand limply.

“I’m Sasha.”

“Rosalind.” She felt odd using her mother’s name.

He pointed to a couple of couches perpendicular to each other against the walls of the reception area. He waited for her to sit, and then he sat on the other couch and opened a small laptop computer. She could smell the man’s sweat and whatever Indian food he’d just eaten. His fingers were poised over the keys.

“So—”

“Can I get name?”

Hersh had told her to give as little as possible. She’d already told him her first name was Rosalind. She used her mother’s maiden name. Rosalind Winter. Sasha typed.

“What is it you want?”

“I need access to someone’s e-mail.”

He nodded as if she’d asked him for an insurance quote.

“Name?”

“Noah Miller. He’s at a boutique firm called Miller and Payson.” She spelled Miller’s name.

More typing. “Law firm.”

“Right.”

“Should not be a problem.” His fingers flew over the keyboard. He worked in silence for a minute, then peered closely at the screen. “Actually, is a problem.”

“What kind of problem?”

“The IP address doesn’t trace back to the law firm. It traces back to G Suite. Google. Gmail for business.”

“What does that mean?”

“Means someone is smart. They take precautions. They don’t use exchange server. The system is stovepiped.”

That was gobbledygook to her. “Why is that a problem?”

“Usually you can send phishing e-mail to anyone on company’s network, and you’re in everywhere. But the way the Miller and Payson network is set up, every employee has separate e-mail container. Hosted internally at company. No internal exchange server.”

“Does that mean you can’t do it?”

He shook his head. “It means if you want to get into this man’s e-mail, you have to send him something directly. Not anyone else. Just him. Every e-mail account is in its own silo. So it becomes social engineering problem. If you want this Noah’s e-mail, you have to send him e-mail that he will open. Some people are very suspicious and they don’t click on anything unless it’s from someone they know.”

“He knows me.”

“Ah. Maybe this is possible, then. But is not cheap.”

“How much are we talking about?”

He told her. It was actually less than she was expecting. Hersh had said it wasn’t complicated, that all the software could be downloaded, prefab.

“Okay,” she said.

“You can send him an e-mail and he will open?”

“I’m sure he will.”

“He has to download PDF. You think he will do this?”

“I’m not sure.”

“Will he click on link you send him?”

“I don’t know. He’s more likely to open a PDF, but I may need to prepare the ground first. I have an idea for that.”

“Okay. You write e-mail with attached PDF. This is payload.”

“The payload.”

“Keystroke logger. Credential harvester. It comes preloaded with the Kali Linux social engineering tool kit.”

Juliana wasn’t totally ignorant about computer stuff, even though her son probably knew a thousand times more than she did. She wanted to understand what was about to happen. “A ‘credential harvester’ records everything he types?”

“Right. It creates its own internal mail server on his computer and sends keystrokes in file to location we specify. Passwords and everything.”

“What do you need from me?”

“An e-mail and the document you’re going to send as an attachment. I’ll embed the payload in the PDF.”

“I can get you something tomorrow.” She looked at her watch. She had to get going. “But can you assure me that this will be undetectable?”

“Yes.”

“Absolutely?”

“Yes,” Sasha said. “One more thing. I need payment in cash.”