Reamde - Страница 16

Wallace looked disgusted. “That’s how you want to deliver it?”

“Is there a problem?”

“I brought a notebook computer. No DVD slot. Rather hoped you’d bring it on a thumb drive.”

Peter considered this. “I think that can be arranged. Hold on a second.”

“THAT GUY JUST tasked your boyfriend,” Richard remarked, shortly after Peter had sat down across from the stranger by the fire.

“Tasked?”

“Gave him a job to do. ‘Get the waiter’s attention. Order me a drink.’ Something of that nature.”

“I don’t follow.”

“It’s a tactic,” Richard said. “When you’ve just met someone and you’re trying to feel them out. Give them a task and see how they react. If they accept the task, you can move on and give them a bigger one later.”

“Is it a tactic you use?”

“No, it’s manipulative. Either someone works for me or they don’t. If they work for me, I can assign them tasks and it’s fine. If they don’t work for me, then I have no business assigning them tasks.”

“So you’re saying that Peter’s friend is manipulating him.”

“Acquaintance.”

“It’s some kind of business contact,” Zula guessed.

“Then why didn’t he just come out and say so?”

“That’s a good question,” Zula said. “He’s probably afraid I’d be mad at him if he interrupted our vacation for a business meeting.”

So he lied to you? Richard thought better of actually saying this. If he pushed too hard, he might get the opposite result from what he wanted.

Besides, Peter was now headed back over to the table.

“Does either of you have a thumb drive I could use?”

The question hung there like an invisible cloud of flatulence.

“I want to transfer some pictures between computers,” he explained.

Richard and Zula and Peter had all been lounging around the place for a while, occasionally checking email or messing around with vacation photos, and so Richard had his laptop bag between his feet. He pulled it up into his lap and groped around in an external pocket. “Here you go,” he said.

“I’ll get it right back to you,” Peter said.

“Don’t bother,” Richard said, peeved, in a completely school-marmish way, by Peter’s failure to use the magic words. “It’s too small. I was going to buy a new one tomorrow. Just erase whatever’s on it, okay?”

PETER RETURNED to the table, pulled out his laptop, and inserted the thumb drive. His computer, a Linux machine, identified it as a Windows file system, which was just what he needed since Wallace’s machine was also a Windows box. Finding several files in it, Peter erased them. Then he popped the DVD out of its case and pushed it into the slot.

“Why don’t you just use the local copy on your machine?” Wallace asked him.

“Ooh, good trick question!” Peter said. “It’s like I told you. There is only one copy. It’s on the DVD. I am not about ripping you off.” The DVD appeared as an icon on his desktop. He opened it up, and it showed but a single file. He dragged that over to the thumb drive’s icon and waited for a few seconds as the files were transferred. “Now, two copies,” he said. He dismounted the thumb drive and removed it. “Voilà,” he said, holding it up. “The goods. As promised.”

“Not until I agree that it is what you have claimed.”

“Go ahead and check it out!”

“Oh, I’ve looked at the sample you sent. They were all legit credit card numbers, just like you said. Names, expiration dates, and all the rest.”

“So what are you getting at?”

“Provenance.”

“Isn’t that a city in Rhode Island?”

“Since you are an autodidact, Peter, and I have a soft spot for autodidacts, I’ll forgive you for not knowing the word. It means, where did the data come from?”

“What does that matter, if it’s good data?”

Wallace sighed, sipped his club soda, and looked around the feast hall. As if willing forth the energy needed to go on with this stupid conversation. “You are misconstruing this, young man. I’m trying to help you.”

“I wasn’t aware I needed any help.”

“This is proactive help. You understand? Retroactive help — the kind you’re thinking of — is throwing a drunk the life preserver after he’s fallen off the pier. Proactive help is grabbing him by the belt and pulling him to safety before he falls.”

“Why should you even give a shit?”

“Because if you end up needing help, boy, owing to a problem with the provenance of these credit card numbers, then I’m going to need it too.”

Peter spent a while working it out. “You’re not in business for yourself.”

Wallace nodded, managing to look both encouraging and sour at the same time.

“You’re just running the errand — acting as an agent, or something — for whoever it is that’s really buying this.”

Wallace made expressive gestures, like an orchestra conductor, nearly knocking over his club soda.

“If something goes wrong, those people will be pissed off, and you’re afraid of what they’ll do,” Peter continued.

Wallace now went still and silent, which seemed to mean that Peter had at last come to the correct conclusion.

“Who are they?”

“You can’t possibly imagine that I’m really going to tell you their names.”

“Of course not.”

“So why do you even ask, Peter?”

“You’re the one who brought this into the conversation.”

“They are Russians.”

“You mean, like … Russian mafia?” Peter was too fascinated, yet, to be scared.

“‘Russian mafia’ is an idiotic term. An oxymoron. Media crap. It is vastly more complicated than that.”

“Well, but obviously…”

“Obviously,” Wallace agreed, “if they are purchasing stolen credit card numbers from hackers, they are by definition engaging in organized criminal activity.”

The two men sat there silently for a minute while Peter thought about it.

“How these people come to engage in organized criminal activity is quite interesting and complicated. You’d find it fascinating to talk to them, if they had even the faintest interest in talking to you. I can assure you it has nothing in common with the Sicilian mafia.”

“But you just got done threatening me. That sounds like…”

“The cruelty and opportunism of the Russians are greatly overstated,” Wallace said, “but they contain a kernel of truth. You, Peter, have chosen to trade in illegal goods. In doing so, you are stepping outside of the structures of ordinary commerce, with its customer service reps, its mediators, its Angie’s List. If the transaction fails, your customers will not have any of the normal forms of recourse. That’s all I’m saying. So even if you’re a complete shite-for-brains with no regard for the safety of yourself or your girlfriend, I’ll ask you to answer my question as to provenance, because I still have a choice as to whether I’ll proceed with this transaction, and I’ll not go into business with a shite-for-brains.”

“Fine,” Peter said. “I’m working with a network security consultancy. You already know that. We got hired by a clothing store chain to do a pen test.”

“What, their pens weren’t writing?”

“Penetration test. Our job was to find ways of penetrating their corporate networks. We found that one part of their website was vulnerable to a SQL injection attack. By exploiting that, we were able to install a rootkit on one of their servers and then use that as a beachhead on their internal network to — to make a long story short — get root on the servers where they stored customer data and then prove that their credit card data was vulnerable.”

“Sounds complicated.”

“It took fifteen minutes.”

“So these data you’re trying to sell me are already compromised!” Wallace said.

“No.”

“You just told me that the client has been tipped off to the vulnerability!”

“That client has been tipped off. Those numbers were compromised. These numbers are not those numbers.”

“What are they, then?”

“The website I’ve been telling you about was set up by a contractor that subsequently went out of business.”

“No wonder!”

“Exactly. I looked through archived web pages and shareholder disclosures to learn the names of some of the other clients who’d hired the same contractor to set up retail websites during the same period of time.”

Wallace thought about it, then nodded. “Reckoning that it was all cookie-cutter.”

“Yeah. All these sites are clones of each other, more or less, and since the contractor went belly-up, they haven’t been keeping up with security patches.”

“Which is probably why you got hired to do the pen testing in the first place.”

“Exactly. So I did find a lot of cookie-cutter sites that shared the same vulnerabilities, including one big one. A department store chain that you have heard of.”

“And you then repeated the same attack.”

“Yeah.”

“Which is now traceable to that consultancy you work for and its computers.”

“No no no,” Peter said. “I worked with some friends of mine in Eastern Europe; we ran the whole thing through other hosts, we anonymized everything — there is absolutely no way that this could be traced to me.”