Ivy and Chrome PbP Forums

“Sir,” Dane says, turning to Mosley, “I can’t do what you need from this terminal. It’s locked to the CJIS interface and doesn’t expose the underlying system.” He gestures to the screen. “I need authorized access to the physical server room before I can run proper diagnostics or recovery.”

OOC: Is it easy to tell that Dane's RF Scan/Broadcast device does more than just scanning for RF signals? I wouldn't want to pull it out and have him arrested for having a black market RF repeater.

“Sir,” Dane says, turning to Mosley, “I can’t do what you need from this terminal. It’s locked to the CJIS interface and doesn’t expose the underlying system.” He gestures to the screen. “I need authorized access to the physical server room before I can run proper diagnostics or recovery.”

"Right," Mosley nods and holds up a finger, "Be right back."

"So, you onto something?" Asks the sheriff.

Before Dane can answer, Mosley hustles back into the room, clutching a sheet of paper and an access badge with a key attached. “Got it! As soon as I said we needed in, he approved it.” He spreads the paper on the desk. “All four of us just need to sign along this line; date and time too.”

Once everyone scribbles their signatures, Mosley leads them down the hall. He unlocks the server room door with the key, then swipes the badge. The red light above the frame clicks to green.

Inside, the room is small but well‑ventilated, which is barely large enough for a small child to crawl through the access space, but perfectly sized to keep the equipment cool and dry. Two routers sit beside several 24‑port switches, their cables neatly routed into trays and wire baskets that disappear into the station’s walls. In the far corner, a keyboard, mouse, and large monitor connect to a rack-mounted server. Above it sits the camera‑backup server; below, another unit serving as a secondary backup.

Mosley points to the lower machine. “That’s the backup. Whoever broke in wiped the last six months clean. We can restore everything except that window. Once you finish your analysis, I can start the restore.”

Dane steps behind the rack and immediately spots a small, thumb‑sized plastic device blinking faintly. Based on its size and the frequency range it uses, whoever planted it could’ve stood outside in the alley and accessed the server remotely.

OOC: Is it easy to tell that Dane's RF Scan/Broadcast device does more than just scanning for RF signals? I wouldn't want to pull it out and have him arrested for having a black market RF repeater.

OOC2: He could use it. It's not a common device that cops would look at and go, "Holy shit! Hang him!" It's just a box with an antennae that you could attach to your tablet or computer and it will load up software to spectrographically monitor different Wi-Fi signals. The SSID that Dane's looking for is cleverly called, "Patrol connection."

“Sheriff, sir,” Dane says, poking his head out from behind the rack without touching anything. “Are you supposed to be running wireless access off this machine? There’s a Wi-Fi device plugged into the back of the server. If that’s not authorized, don’t remove it yet. I need to check a few things first.”

He reaches into his satchel, pulls out his RF scanner, and switches it to passive scan mode.

“Sheriff, sir,” Dane says, poking his head out from behind the rack without touching anything. “Are you supposed to be running wireless access off this machine? There’s a Wi-Fi device plugged into the back of the server. If that’s not authorized, don’t remove it yet. I need to check a few things first.” He reaches into his satchel, pulls out his RF scanner, and switches it to passive scan mode.

Joe nods to Mosley, "Don't ask me, not my police department."

Mosley gasps, "No!" and he scurries over and peeks at the back of the server, seeing the attached antennae. "What the hell? How?" He watches as Dane connects the RF scanner to his tablet and examines the data and spectrograph. The SSID, "Patrol Connection," populates with statistical data. His suspicion is correct. The signal will reach the alleyway, otherwise someone inside the station would have had to access the Wi-Fi. As he examines the WPA4-E encryption, he instinctively knows that the password is, "Tolkeen4Eva!", and server logs show that the connection terminated at 00:32:58 this morning.

"What's that thing?" Mosley inquires.

George and Joe glance suspiciously at each other then continue watching, completely lost as to what they're talking about. Joe finally asks, "What's Wi-Fi?" as George averts his gaze, obviously knowing what it is.

“This,” Dane says, gesturing toward the dongle sticking out of the server, “allows wireless bi-directional communication. It broadcasts in high-band RF, kind of like a CB radio, just at a much higher frequency.” He keeps working as he talks. “With a transmitter this small at that frequency, range is limited. The attacker was probably in the alley behind the building.” His eyes flick across the log output. “Connection terminated just after twelve thirty this morning.”

Still scanning through network records, he digs for insertion and initialization events. “Somebody had to be physically in this room to plug it in. I’m trying to determine when that happened so you can check the access logs and camera footage.” He pauses just long enough to look around the room as the weight of that statement hits him. Whoever planted it likely had access. If they realize he is close, that could become a problem fast. Mosley seemed genuinely surprised, which lowers the threat slightly, but Dane keeps an eye on him anyway.

“Dad,” he says, voice lower now, “whoever plugged this in may still be in the building, and if they know what we’re doing...” He lets the sentence hang.

“This,” Dane says, gesturing toward the dongle sticking out of the server, “allows wireless bi-directional communication. It broadcasts in high-band RF, kind of like a CB radio, just at a much higher frequency.” He keeps working as he talks. “With a transmitter this small at that frequency, range is limited. The attacker was probably in the alley behind the building.” His eyes flick across the log output. “Connection terminated just after twelve thirty this morning.”

"Well that doesn't sound very good," Joe comments, still ignorant to any of the techno lingo.

Still scanning through network records, Dane digs for insertion and initialization events. “Somebody had to be physically in this room to plug it in. I’m trying to determine when that happened so you can check the access logs and camera footage.” He pauses just long enough to look around the room as the weight of that statement hits him. Whoever planted it likely had access. If they realize he is close, that could become a problem fast. Mosley seemed genuinely surprised, which lowers the threat slightly, but Dane keeps an eye on him anyway.

"They didn't erase the camera footage." Mosley seems excited as he sits at the desk, accesses the cameras and security, then pulls up footage logs and backups. He points at a graph on a time range, "There! That's around twelve thirty this morning. We have fourteen cameras to choose from." He then checks through the server room access logs, "Last person who came in here was our other tech, Burger. That was over a month ago. He moved away just three weeks ago," and then frowns as the dots begin to connect for him. "That's probably not a coincidence..."

“Dad,” he says, voice lower now, “whoever plugged this in may still be in the building, and if they know what we’re doing...” He lets the sentence hang.

"Well son," George whispers, "If it was this Cheese Burger fella, then I have a feeling that he's long gone."

The sheriff overhears, blankly staring at George's awful joke, "Then, if he left weeks ago, who pulled off the hack?"

Dane keeps scanning for any logs that might show when the Wi-Fi card was first installed. “Let me keep digging and see if I can confirm the timeline for when this card was plugged in.” Since querying the wireless interface is not giving him what he needs, he decides to go to the source. He sets his personal devices aside, moves to the server terminal, and begins a careful review, once again watching for signs of malware or trigger scripts. He focuses first on identifying who connected the device and who used it during the breach, before moving on to data recovery.

Dane keeps scanning for any logs that might show when the Wi-Fi card was first installed. “Let me keep digging and see if I can confirm the timeline for when this card was plugged in.” Since querying the wireless interface is not giving him what he needs, he decides to go to the source. He sets his personal devices aside, moves to the server terminal, and begins a careful review, once again watching for signs of malware or trigger scripts. He focuses first on identifying who connected the device and who used it during the breach, before moving on to data recovery. Yet, as Mosley had stated, the prior six months of logs were wiped out prior to the Wi-Fi connection terminating from user, "ReconH." What Dane finds interesting is that the final action logs; deleting logs, wiping out pcap logs and their own user data and the disconnect all happened in less than 500 milliseconds. The closing session logs show that the connection lasted roughly ten minutes, covering several Gb of data, which would be about the right amount of time to exfiltrate it all. This means it was an automated attack, but from who, how and why?

As soon as Dane is satisfied it is safe to remove the Wi-Fi card, he gives Mosley the okay to pull it. “I don’t know if you can get prints off it or anything, but I’ve gotten what I can from it. Does ReconH ring any bells? That’s the login name the infiltrator was using. They were in and out fast. Fast enough that the attack was probably automated.” .oO Time to dig in and see if I can recover anything. Oo.

He bypasses the normal UI layers and gets deeper into the operating system, starting a low-level sector scan to see whether the data is still on the drive, even if the operating system can’t see it anymore.

Dane gives Mosley the okay to pull it the Wi-Fi card, “I don’t know if you can get prints off it or anything, but I’ve gotten what I can from it. Does ReconH ring any bells? That’s the login name the infiltrator was using. They were in and out fast. Fast enough that the attack was probably automated.” .oO Time to dig in and see if I can recover anything. Oo.

"No, it doesn't. Sounds obvious what they were doing by the name though." Mosley comments as he leaves the server room, access badge and keys in hand. George and Joe decide to sit down and relax, waiting on Dane to proceed.

Dane moves back to his forensics as he bypasses the normal UI layers and gets deeper into the operating system via command line, starting a low-level sector scan to see whether the data is still on the drive, even if the operating system can’t see it anymore. He manages to find bits of the erased data that hasn't be allocated to clear, more of a magnetic residue. He works quickly to try and reconstruct the data, only to come up with a file name with only some of the data available. It seems to be a wellness check on a vagrant walking around the city, scaring people. Not much more can be pulled other than the name Dustin. Huh...

What felt like minutes for Dane must have been longer as the sheriff is snoring as George seems to be playing video games on a small device, trying to keep entertained. Mosley rushes back into the room, "There were prints! We got a hit! They're Burger's!"