“All right.” I announced after a while of contemplating. “I have some things to prepare. See you in a few days.”
I got up and started for the kitchen. Just as I opened the fridge and took two more beers, I heard Aaron call out to me.
“What ... Where are you going!?”
“Covering my ass.” I called back, before leaving the house through the backdoor in the kitchen, leaving a whole living room full of confused people behind.
I got into my Jeep and drove to the house. When I was in my room, I sat in front of my Laptop and started researching the sports bar. I sent them a quick email with a spoofed UTA email address, asking for reservation possibilities. The answer came surprisingly quick, and I discovered in the email header that they were using a long outdated version of Outlook. Then I made sure the exploit I intended to use would work with that version of Outlook. By the time I was done with it, I heard the front door slam closed and, shortly after that, my bedroom door flew open. Almost the entire family rushed into my room. Only Logan and Grandpa were missing.
“You can’t just run off like that without explaining what you’re planning to do, Tim!” Aaron said angrily.
I looked at him for a moment, remembering their collective inability to understand ‘geek stuff’, and decided to use that. If I had to explain how this was really going to work, I wouldn’t get to actually do it until next year, but time was ticking.
“Fine. Here’s my plan. I already found out they’re using an outdated version of Outlook that has long lost its mainstream support to fix the known exploits. So, I’m going to send them a PDF invoice with a little extra payload embedded, that’ll cause a privilege escalation to allow my malware to install itself onto their system. From there it will automatically spread itself to every hard drive and device they connect to the initial machine. I’ll also gain remote access to the infected devices, so I can check their wireless network for any devices that might not be connected physically, or are incompatible with my malware. I already have a C&C-server up and running from a former project, so I don’t have to worry about that. When I’m confident I’m in every device and drive they could have stored the videos on, I’ll brick them all. Clear so far?”
I was met with blank stares; they obviously hadn’t understood half the words I just used.
“Great. So, here’s the part you all actually need to worry about. Since I just sent two of their guys to the hospital and a third one directly to jail, they probably won’t be too happy with Logan and me right now. They might just use the videos to retaliate anyway if they get any more pissed at us. So, I need to work fast! But since your Golden Boy obviously didn’t think of that, he didn’t see the need to speak up, and we just wasted an entire fucking week sitting on our asses, while they got more irritated with each day Logan keeps avoiding them! To work fast, I need to work without interruptions. Is that possible or do you need to make any more angry demands, Aaron?”
They looked at each other, but were obviously concerned about the conclusions I had drawn regarding the time-issue. That part made sense to them. They nodded and started to file out of the room. I called out to stop them.
“Claire! I’ll need eight-thousand dollars in cash. Get it from my bank account, since you probably don’t have that much lying around anymore and obviously think it’s yours anyway. When you’re in the bank, pick up a nice money pouch to transport it. Favorably one that comes with a little window for business cards. And John, do me a favor and call Bill. Make sure he knows I’ll need to borrow one of the armored SUVs for a few hours in about a week.”
Then I got back to work, ignoring their stunned stares.
On the social media pages of the sports bar, I had seen them advertise an event that happened a week before. I prepared an invoice for the date of that event from a liquor distributor in their area, but addressed it to a different bar. The email itself looked completely legit, and simply thanked them for their business without mentioning any names.
The usual M.O. of any accountant, when presented with a legitimate looking invoice they can’t place, is to simply open it to check what the distributor wants to charge them for. When they see the invoice is actually addressed to a completely different company, they will just assume a typo in the recipient address and dismiss the whole thing with a relieved chuckle. They usually won’t even contact the supposed sender to notify them of their mistake, since that would just mean more work for them. But even if they do, they’ll have clicked on my manipulated PDF that embeds a Word document by then, and the damage is already done.
