Malware Policy Discipline Ch. 01

This story is based upon real people, not real events. Names have been changed to protect the innocent and the devious. I hope this is merely the first of at least a few chapters in this saga.

-----------------------------------------------

Some things you fantasize about over and over. Winning a lottery. Becoming a celebrity. Banging a hot celebrity. Banging a hot anything. All of them require events to fall into place just so. Like catching lightning in a bottle.

One of Kevin Schmitz' more endearing (and enduring) fantasies had been brought to life 6 months ago when Kirsten Dale got malware on her work pc while surfing the internet. He had hoped then that with a little patience and a little luck, he could be banging that hot piece of ass eventually.

Kevin Schmitz worked in IT at Willigs, a small- to mid-size company in Madison. Willigs employed about 275 people in their main office in Madison. They had some smaller satellite locations in the upper Midwest but Madison was the home office.

Kevin had grown cynical in his job. Willigs was once a smaller environment, more family-like. Decisions were made by a small group of upper management who had the best interests of Willigs in mind; just like it is supposed to be. But after 20 years at Willigs -- 10 of them in the IT department -- Kevin had seen a deterioration of commonsense management. Departments had become business entities unto themselves. Each department developed their own turf and rarely did Kevin see decisions made based upon what was good for the bottom line.

Web security was something Kevin had come to specialize in over the last few years. Willigs accepted credit card payments and thus was in the middle of becoming PCI compliant. Kevin was all onboard with that effort. Willigs had seen an increase in malware incidents the last few year since a third-party firm was hired to monitor network traffic. Kevin was usually the IT guy assigned the task of cleaning up a pc that got a trojan or other piece of messy malware.

Willigs' upper management had become increasingly tired of the amount of malware its employees were getting on their pc's. Everyone knew that if the wrong kind of malware got on the wrong pc and went undetected long enough, it could mean unprecedented disaster for Willigs. A key-logging trojan that leaked out customer credit card numbers was their worst fear. Therefore, the level of paranoia about pc users getting malware was on the rise.

Right or wrong, upper management felt that users were solely responsible for malware getting into their work pc's. There was talk of disciplinary sanctions against employees who got malware. There was a widespread rumor that upper management was looking to make an example out of somebody. Kevin, being deeply involved in Willigs' policies regarding internet usage, knew that no such effort was underway. The one thing any company with 10 or more employees was good at was spreading stupid rumors.

But Kirsten Dale didn't know that. And Kevin Schmitz counted on that.

Kirsten Dale was hot. Just plain hot. She stood about 5'-10", long legs, slim, blonde, pretty face. Not a porn star size chest but what she had looked good on her 25-year old body. Since Kevin had dealt with her one other time -- the first time she got malware about 6 months ago -- he knew she wasn't real smart. A simple clerk in the merchandising department. She chased paperwork and, if another rumor was to be believed, she didn't even do it well.

Whenever Kevin got a work order for a hot chic, there was always the 7^th-grade-kid-in-study-hall part of him that wanted to tell the chic that he'd move her up to his top priority for a blow job. Alas, Kevin never tried that one. Something about not wanting a sexual harassment complaint in his file kept him from actually saying it.

So on July 13, 2010, at 3:10pm when the work order came in saying that DefenderPlus had flagged her pc for the Zeus trojan, he wondered if he had just caught that lightning in a bottle.

"Well, maybe not quite lightning in a bottle," Kevin thought to himself. But surely, opportunity and circumstance had met nicely. "But I'm gonna fuck her brains out for this one. Well, I'm gonna try."

He almost picked up the phone and called her right away. Then he put the phone down, got up from his desk and went outside for a brief walk. He had to think this through.

"Should I?"

"How would I carry this off?"

"What if it failed?"

"What if she's not so dumb and doesn't fall for it?"

"What should I do first?"

He thought it best not to do anything right away. He'd think on it over night and come in tomorrow with some sort of a plan.

The next day, Thursday, started off shitty. He had a voice mail from the corporate lawyer: "Kevin, this is Jack. My laptop's doing something funny since you rebuilt it yesterday. I can't have it like this. I need it for just about everything I do. Please call me right away."

"Fuck," Kevin muttered to himself. "There goes my day. Probably the next 2 days if I have to rebuild that fucking thing again."

Jack Reagle was Willigs' lawyer and a fucking prick to boot. No one respected him and a call from him usually meant a huge lack of fun in your day. Suffice to say, the Kirsten Dale plan was just nixed. If he had to deal with Reagle's laptop again, the Kirsten Dale work order would be given to someone else.

"Well, maybe Ted can end up fucking her," he chuckled as he thought of that.

Ted was his IT co-worker. Approaching 60, Ted was a fundamentalist religious zealot who was so right-wing, he'd make Rush Limbaugh look like Hillary Clinton's running mate for 2012.

He called Jack's extension and was greeted with a professional, "Mr. Reagles' office, this is Kate. How can I help you?"

"Hi, Kate. Kevin Schmitz here. Jack left a voice mail to call him."

"Oh, OK," she said, "I'll put you through." Kate was Jack Reagles' ever-faithful paralegal. She was a stuffy, stodgy old woman but Kevin respected her mightily after seeing how Jack treated her like shit.

10 seconds later he was greeted with a rushed, "This is Jack Reagles."

"Hey, Mr. Reagles. Kevin Schmitz returning your call." And with that he was prepared for his day to be ruined. He'd seen it before from this guy. Reagles was a pro at exaggerating his problems and most of the time just didn't know what the hell he was talking about. He treated everybody like shit. Kevin would have to get in a long line if Willigs held a Kick Jack Reagles' Ass Day.

"Oh yeah, Kevin. You know what? Doesn't look like anything's wrong after all. I remember now you telling me this screen would pop up at my first login. I just figured it was a message that meant disaster. I clicked 'OK' on it like you said and everything looks good. The laptop seems to be working much better since you did what you did with it yesterday."

"Ah, well, that's great," Kevin replied, relieved in about 47 different ways.

"OK," Reagles said. "Thanks," and he hung up.

"Fuck," Kevin said aloud. "Talk about dodging a bullet. I feel like I just got excused from a 2-day seminar on How To Keep Your Cubicle Clean. Man what a break."

And then his devious mind wondered if that was a sign...

"I just got out of a potential 2-day task from hell. Those things don't just happen. Let's do this..." and he got a little flush from excitement.

Kevin dialed Kirsten Dale's number and waited.

"Merchandising, this is Kirsten," her voice rising at the end.

"Christ," Kevin thought to himself. "She even sounds like a dumb blonde."

"Hey, Kirsten," Kevin began. "This is Kevin Schmitz from IT. We have a 3^rd party company called DefenderPlus that monitors our network activity. They flagged your pc for malware yesterday afternoon. I should have called you then but I couldn't get away from what I was working on."

"Oh no," she gasped. "What does that mean?"

"Well, did you see anything unusual pop up on your screen yesterday at about 3:00?" he asked her.

"Well yeah, I got the pop up that said my pc was being scanned for malware. I clicked OK to let it do a scan and then went on break."

"Yikes," Kevin said aloud to her. "You went to all of those education sessions last summer about this right?"

"Yeah, I remember those," Kirsten said in her sexy dumb voice.

"Remember how we said not to click on anything on those screens? And certainly not to click 'OK'?"

"Oh, I'm sorry!" she said. "Is this like the thing I got a few months ago where you had to take my pc for a few hours?"

"Well, it's kind of like that but this one is a bit more serious," Kevin said carefully. "In fact, I'm going to have to take your pc right away and scrub it."

"Scrub it?" she asked. "What does scrub mean?"

"Well," Kevin started, "that means your pc gets wiped out and rebuilt."

"How long does that take because I've got quotes to get out from yesterday's presentation."

"You won't have a pc today. It takes a good day to wipe and rebuild a hard drive."

"Oh no," she started. "What am I—"

"You'll have to contact your pc liaison for another pc," Kevin interrupted. "I assume your department has a loaner pc."

"I don't know," she replied sounding blonder and dumber than ever. "I'll have to find out from Chris..."

"Alright, I'll be over in a minute and get it. Can you just close out everything you have open and shut it down?" he asked.

"OK. You're coming over right now?"

"Yep," he said wanting to sound rushed and important. A rare treat.

With that, he hung up and took the 30 second walk to Merchandising.

Her pc was just logging off when he arrived. He gave a little knock on her cubicle wall and she got up from her chair to give him access to her pc.

She was looking hot as usual. Since it was July, she was dressed light. Kirsten was known for wearing white pants with real thin material that never left doubt whether Kirsten was -- or wasn't -- wearing undies. He was gone the day last month when she apparently wore similar white pants that showed off her light yellow thong. "I never get to see anything," Kevin said after hearing about it.

Working up the courage, he said in a low voice, "Now, I'm not sure how this new policy will work. I don't know if it's your supervisor who will talk to you or what."

Nervously, Kirsten quietly said, "Talk to me about what?"

"Well," he started while disconnecting her mouse & keyboard from the back of the pc, "this malware you got is a bad one. This is a key-logger that keeps track of everything you type. Passwords, usernames, you name it. And since this is your second time getting malware..."

With a puzzled, worried look, she said, "I don't know what that means."

Lifting up her pc he noticed that her office neighbors were doing their best to listen in. He moved to the entrance of her 8' x 8' cube and let her sit back in her chair. He took a step toward and said, almost in a whisper, "Look, I'll do my best to help you out here but I can only do so much. Rules are rules."

"Rules, I—" she started.

"I'm not sure who will check the logs to see where you were in the internet at the time this malware traffic was flagged. That part wasn't assigned to me. But typically in these cases we check out where the user was in the internet so we know if it was work-related or a personal web surfing. Upper management is taking a tougher stance on personal internet surfing, mainly because of things like what happened here."

"But I was just, they were sites that I always... It couldn't have been..." her voice trailed off looking up at Kevin.

"I know, but it's not up to me," he replied still in a low voice. "Let me do some checking on what's going on here and I'll get back to you, OK? In the meantime, just don't say anything to anyone about what's going on." Then in a louder voice, "We'll check it out but there wasn't anything you could do; wasn't your fault. I'll let you know." And he walked off.

Kevin got back to his cube and went out about his business as usual. He waited for 15 minutes and then called Kirsten.

"Hey, Kirsten. Kevin here," he said keeping his voice low so he couldn't be heard by his office mates. The office he worked out of was small and the cube walls didn't allow much privacy. Kevin's cube was right up against Ted's. Their cubes were set up essentially as though they shared one big cube with a small wall not quite cutting their areas in half. Anything he said in a regular voice could be heard by Ted so he had to be careful. Fortunately, Ted's hearing had deteriorated in the last couple of years.

"Oh, hi," Kirsten said.

"OK, here's the deal," Kevin began. "Everything we do in the internet is logged. Every web site you go to, everything."

"I didn't know that," she replied quietly. Kevin had a feeling that "I didn't know that" was something that came out of poor Kirsten's mouth a lot.

"I brought that up in the web security meeting with your department last year. Anyway, as I told you a bit ago, at some point soon those logs will be checked specifically for your web activity at the time this malware traffic was flagged. I'm guessing you were doing some personal internet browsing at about 3:00pm yesterday when you got that screen pop-up?"

Kirsten gave a flustered whimper. "But everybody does that on the internet!"

"Heck," Kevin replied, "I know that. I do it, too. But what upper management is concerned with is the personal web browsing that leads to malware, and especially key-logging malware. I'm sure you remember what we said last year about what key-logging trojans do and why they're so dangerous."

"I guess, yeah," Kirsten said with all the confidence of a hot chic who most certainly did not remember.

"Well anyway, what's gonna happen is those logs will be checked and somebody -- probably your supervisor -- will talk to you about it." Kevin was doing his best to sound like someone most definitely not in her corner. "From there, I have no idea what will happen. I do know that upper management wants to take a tougher stance on this."

"Oh my god!" she said. "Will they fire me? I just bought a new car!"

"Hey, I don't know about that end of it. I'm just telling you what to expect." Kevin was glad he didn't have to spell things out to her in excruciating detail. She was getting the gist of her problem quite nicely. "Did you have Chris get you a replacement pc yet?"

"Yes, she just finished hooking it up. Will this pc have my files on it?" she asked.

"I assume you mean hard drive files," Kevin said smiling. "I'll save off everything in your My Documents folder and put them in your U: drive user folder. You know where that is, right?"

"I think so, yes," she replied. Kevin knew he'd be getting a phone call later about where those files are.

"OK, give me 10 minutes and they'll be saved there. Did Chris get your email profile set up ok?"

"Let me check," Kirsten said as she fumbled with the phone while she clicked her mouse around. After several seconds she said, "Yes, I can see my emails."

"OK, you're good to go then. I'll let you know when your pc is good to go. Bye," and he hung up.

"Well," Kevin thought to himself, "so far so good."

He knew he'd really have to sell the this-is-really-bad-for-you angle. That she commented about having a new car to pay for meant she was vulnerable. He liked vulnerable. A vulnerable hot chic gave him a woody.

Kevin waited an hour and then sent her an email.

"Everything OK on your replacement pc?"

Her reply came within 15 seconds. That was a good sign. He had her attention. "Yes, thanks. Do you know if my boss was given those log things you talked about? The things that will show what sites I was in when this happened?"

Wondering if he should wait a while before replying, he got up & went to the bathroom. All the way to the restroom Kevin thought about how wonderfully this could play out. It was a bit uncomfortable peeing with a hard-on.

He got back to his desk and fired off a reply: "I'm guessing that's been done. The guy who does this usually does that right away and sends the log file to Human Resources. HR then deals with the employee discipline side of it." He still wanted to lay on the business-as-usual tone. Make her sweat.

Again, her reply was almost immediate. "She must really be sweating over this," he thought to himself, chuckling a bit. "I'm just not very nice."

"HR! OMG! People surf the internet all the time! Why would they pick on me? Will they fire me?"

Kevin replied right away: "Like I said before, I don't deal with that side of it. I can only say that upper management is getting tired of this stuff and really wants to send a signal. I'm sure it's being discussed by somebody right now."

He saw her reply come back right away again. Instead of opening it, he went on with working on scrubbing her pc. It was 9:30 by now. Making her sweat a bit might not hurt his case at all.

At 10:30 he opened her email: "OK, thanks."

He deleted that one and started a new thread.

Kevin's email to Kirsten: "Alright, here's the deal. *I* got assigned the task of checking the logs for your internet activity at the time your pc was flagged for this trojan. I probably don't have to tell you the sites you were in. Is your boss Sheila or Carol?"

At this point he knew her reply would be immediate.

Kirsten: "My boss is Carol. So you will email her the log? And then what?"

Kevin: "The upper management committee on web security will have to be cc'd on the email to Carol so they'll see this log file, too. In addition, I include a summary of the findings because they'll likely not know what the crap in this log file means. Procedure then is that Carol will have to meet with that committee before she meets with you. From there, I don't know exactly. I can only say that you picked a bad time to do this one, Kirsten."

Kirsten: "Well, there goes this job, right? I can't mooch off my fiancé. I don't know what I am going to do."

Kevin pretty much knew he had her but he still had to be careful. The number of fibs he'd told at this point could really get him into hot water. Nothing he'd said to this point alluded to anything sexual but he knew it was time to start with that. He couldn't wait any longer. He got hard just thinking about where this could lead if he played his cards right.

He waited until Ted left for lunch at 11:30 and then called her. He was doubly lucky in that his other 2 office mates were out of the office at the moment.

"Hey, Kirsten, Kevin here," he started, wondering exactly how this would play out. He kept his voice low hoping she would get the hint. He certainly didn't want anyone on her end to hear what was going on. Obviously, from Kevin's perspective, no one could know what was going on.

Immediately, she asked, "Did you send the email?"

"No," Kevin replied simply. "That's what I want to talk to you about. Look, I don't want to see you get fired—"

"Fired!" she shot back in a whisper. "I can't believe—"

"Hang on, hang on!" Kevin interrupted. "Look, do you have people there that can hear you?"

"Well, there are people around here, yes," Kirsten said.

"I don't feel comfortable talking about this where anyone can hear," he said. "Are you going out for lunch? Can you meet?"

"Meet?" she asked. "Meet about what?"

"About the mess you're in!" Kevin said, getting a little perturbed.

"Well, why can't you just tell me now?"

"Like I said, I don't wan to see you get fired. I haven't sent that email yet and I wanted to talk to you about that. But not so that others can hear. Do you want to meet to talk or not?"

"OK," she said. "I can. Where?"

"You know where the parking ramp is by the Kohl's on Holt Avenue?"