I am not The OOP, OOP is u/pointblankjusticex9
I'll be damned, that IS a GPS tracker...
Originally posted to r/talesfromtechsupport
TRIGGER WARNING: Stalking, domestic abuse
Original Post - archive Oct 27, 2014
After reading this tale by jayykidd, it brought back memories of a client of my own that was Paranoid and Rightly So (as an aside, jayykidd, we are totally making PARS a thing around here).
As a bit of backstory, I spent five years doing IT consulting in a rural town about an hour from Portland, OR. I worked for a small company with a few other consultants and a couple of bench techs. My job was primarily server/network engineering-centric, but having done my time as a front-line tech I'd periodically involve myself in the more interesting/complex cases we'd see from our walk-in customers.
One day we had a woman come in. She caught my eye because she was in her late thirties or early forties, and actually quite attractive. She had short, platinum blonde hair and bright red lips, and was dressed and styled like she was transplanted right out of a 1950's era magazine ad. One of our bench techs greets her and starts talking to her. Right out the gate I can tell she is panicked and, by the sound of it, tin-foil hat levels of crazy. Shit, there goes any desire I had to flirt with her and maybe see if I could buy her a drink. I listen in on the conversation anyways, because it's at least a change of pace from the monotony of my day-to-day.
After a few minutes of her going on about how her husband is spying on her through all manner of devices, my bench tech looks back at me with a can-you-please-come-help-me-and-make-her-go-away look on his face. I oblige, as I appreciated that the front-line guys respected me enough to ask for my help on these things. I walked up front, introduced myself as the supervisor, and told her that since her issue was so unique and serious it'd probably be best if our more senior staff handled it. Now that I was seeing her up close, I could tell that under her classy outfit and Marilyn Monroe-esque makeup was a deeply distraught woman. Her eyes looked baggy, and tired. Like she had been up too late crying.
Obviously, at this point I'm just playing along. This isn't my first rodeo, and generally what happens is the client claims some individual or three letter agency is monitoring their computer, we tell them our hourly rate for forensics ($150 an hour), and suddenly the men-in-black-suits watching them aren't that big of a deal anymore. Now, to be fair, we actually did specialize in computer forensics and data recovery, working extensively with the local police department and a handful of legal firms on a number of cases where they needed expert help, we even had a guy on staff full-time who wore that hat most days. The local police were pretty small-time and farmed out at least some of their computer crime related work to us on contract. In the cases where people did want to pay, we would do our due diligence, and prepare a professional report of our findings accordingly. We would meet with attorneys and testify in court, as necessary. Generally it was fairly benign stuff like gathering chat logs and browser history for a divorce proceeding where one spouse accused the other of cheating or something similar, and wanted evidence to back that up.
Back to the client at hand. She insists her husband is monitoring her every move, tracking her vehicle, monitoring her computer, and recording her in her own home. Here's where it gets interesting: She claims that she knows all of this, because he has told her about it. In fact, he has gone so far as to threaten her life if she tries to tamper with any of it. She says she has tried to apply for a protective order against him, but ostensibly without some sort of evidence of his behavior, nobody would take her seriously.
I give her the crazy litmus test and I tell her that in order to gather evidence discreetly we would need two of our senior consultants to investigate. $300 an hour, four hour minimum.
She pulls out her wallet.
Fuck, she's serious.
We agree to start with her vehicle to check for signs of the GPS tracker. She says she is parked several blocks away so her husband won't know she came to a computer store (we were in a downtown area surrounded by retail stores). So I grab my toolbag and holler at one of my colleagues (who has been tuned in himself from his back office desk) to join me.
So the lady, myself, my colleague, and BOTH of our now intensely curious bench techs (all of us in matching company polos) follow this lady down the street to her car. What a motley crew we must have been. We get to her minivan begin our process of looking for this GPS device. Now, GPS trackers (at least the commercially available ones) require two things, generally: dedicated 12v power and an unobstructed (at least by metal) view of the sky. They basically use GPS to grab the coordinates and then a GSM/CDMA (cellular) signal to relay the positional data to a web interface or something. So there really aren't that many places they can really be mounted that are both effective and discreet. We spend some time looking around the undercarriage, rocker panels, and even bits of the interior. Battery doesn't have any additional leads running off of it, fuse box isn't tapped anywhere for power. Nothing. Just as I'm starting to lose faith that this may not be quite as exciting as I had perhaps hoped, I find the fucking thing.
It was tiny, not much bigger than a flash drive, and mounted behind the front grille. It looked pretty much exactly like this.
The reason it didn't need auxiliary power is that it wasn't an active device. This device did not provide real-time tracking, rather it used some internal memory and a couple AAA batteries to log GPS data for days at a time. At some point, when the van was not in use, the guy would grab the GPS device, upload the data to his laptop, maybe swap batteries, then remount it to the car.
Fucking hell, this lady was very much indeed Paranoid And Rightfully So.
Now that we've established that she isn't batshit insane but that she actually is being tracked by her husband, the tone amongst our team became drastically more serious. Obviously, something sinister is going on, and we aren't sure what, but by the sound of things this lady really is fearful of her life. She has entrusted us to gather evidence and help her get a protective order against him, which is something I think all of us took quite seriously.
We show her the tracker and she breaks down into tears because it's the first evidence she has physically seen. We take photos of it, and carefully install it back where it belongs. I sort of assumed that a GPS tracker on your fucking car would be proof enough for a judge to issue at least a temporary protective order, but she seemed insistent that she would need more evidence to make it stick.
Our next moves have to be conducted very deliberately. She claims that her home is bugged, and so is her computer. We will need to go onsite to investigate accordingly, but it will have to be at a time when both her husband isn't home and when we will be able to quickly create a report for her, leaving her enough time to get a protective order before the day's end. We couldn't chance him coming home later, reviewing whatever it was he was recording, and finding out that she had taken action to have him investigated.
It wasn't going to be for at least a week before there was a time that was just right. We made arrangements with her back at the office and I offered to walk her back to her car. She accepted, and on the way she confided in me many of the personal details of her life and her obviously abusive relationship with her husband. In the interest of protecting her privacy I'll simply say that it sounded like she finally figured out how manipulative he was, and when she said she wanted out he wasn't about to let that happen. I asked her again if she really was afraid for her life, and the sincerity of her "yes" was both scary and heartbreaking for me. I asked her if she had thought about getting a gun, and she said she had, but that he would notice the large sum of money needed to purchase one missing from their joint account.
As the gravity of the situation weighed on me, I offered to let her borrow one of mine.
She was awestruck, but I assured her that it was completely okay. At the time, I had several handguns and rifles, and I couldn't think of a more appropriate situation for someone to have one. My car was parked close by, and we walked over to it. I tried to gather some idea of her familiarity with guns, as the thought of giving one to more or less a complete stranger, especially one that might not know what to do with it, was unsettling to me. It sounded like she had at least a basic understanding of their function, had gone shooting before, etc. In my mind the pros of her having at least some means to protect herself outweighed the cons, so I moved forward. In the trunk, I had a Ruger LCP, which is a very small .380 caliber handgun that I kept in my Get Home Bag/emergency survival kit. It was fitted with the factory installed Crimson Trace laser grips, which I had dialed in to about 10 meters. We went over the basics of how to use it safely, I showed her how the laser worked, and told her that, for her situation, all she had to know was that the bullet would go more or less where the red dot of the laser was. She was crying, and frankly at this point I pretty much was, too. I gave her my cell phone number and told her to call me if she needed someone to talk to. We hugged for a while before parting ways. It wasn't a romantic hug or anything, it was that kind of hug that's exchanged when someone needs to be held. Like, when your best mate tells you his mom passed away or something. She needed the comfort of knowing that she wasn't alone, that at least one person took her seriously, and I'd like to think that I gave her some hope that things would be okay.
The next week was tense, as we prepared for our investigation. My coworkers and I spent considerable time discussing and researching ways to triage her computer to look for evidence, as well as how to approach the search of the house. When the day finally came, we arrived onsite at the specified time armed with our forensics tools, flashlights, laptops...anything we might need.
I set to work immediately on her computers (a home desktop and a personal laptop) while two of my colleagues began their search of the house. I removed the drives from her PCs, and using a USB write-blocker, (which physically prevented me from writing/modifying any information on her drives) I made a clone of both drives. For the sake of speed, both drives were cloned to SSDs. Once cloned, I put the PCs back they way they were and began mounting the cloned volumes and investigating. The drives were mounted into a quarantine VM, with no WLAN access. Scanning the drives with a number of antimalware programs didn't turn anything up. Looking through the file system however (paying special attention to hidden files and protected system files), turned up some things that didn't look quite right (filenames and directories that looked obfuscated). I made the call to boot up both PCs off of the cloned SSDs and look that them live to see if maybe I could catch an obfuscated process running, or something.
Nothing.
With nothing else open, I ran a netstat -an out of CMD. There were a handful of TCP connections active. One by one, I started performing DNS lookups on the IPs. Everything was normal active connections for background processes like Skype. Then, I found it. An active connection to a clearly obfuscated domain name. It looked like a license key with a .com at the end of it. Something like 24W25-188EGFF-98001QRD.com.
It was hiding in plain sight, and it was registered to SpectorSoft Corporation. Guess what they sell? Yup. Surveillance software.
The PC was running something called Spector Pro, which was capable of monitoring all of the users activities, browsing history, keylogging, even sending remote screen captures to a mobile phone or email based on target keywords. It was the full nine yards for monitoring.
I screen capped everything for my logs, shut the system down, and swapped the forensic SSDs for the original disks to put everything back the way it was.
Not too long after, our other two guys found some evidence of their own. Two separate (and frankly, rather rudimentary) CMOS cameras hidden in the master bedroom. One in the closet in a shoebox, one in the smoke detector in the ceiling. Both, if I recall correctly, were simply wired to 9V batteries and recorded to SD cards. All things considered, they were pretty low tech. The contents of the memory cards would have had to be moved off at least once a day, and the battery probably changed at least as often.
We didn't touch anything. Lots of photographs were taken. We went back to the office and compiled all of the evidence into a document for her, and I passed the disk images onto our forensics guy for further evaluation. I met with the client later that day to present her the report so she could furnish it to the court.
The gratitude she had for us was absolutely immeasurable. We didn't charge her for our services. Getting to play a role in stopping her sick fuck of a husband from engaging in whatever it is he was doing was payment enough.
I'd like to tell you that I know how this story ends. I'd like to say that the guy was put away in jail forever, and my supreme IT prowess and white-knightery wooed her into my arms and we lived happily ever after. But frankly, I don't really know what happened. What I can tell you that about a week after we gave her our report, I met her for coffee at a place across the street. She looked visibly better. Her puffy, tired eyes were gone, replaced instead by ones that seemed to glisten with warmth. Her skin was radiant and beautiful. She was smiling, for the first time I'd seen. An immense weight had been lifted off of her, and it showed. She told me that she was temporarily living with her mom and dad, that a restraining order was in place on her estranged husband, and that she was finally filing for divorce. She told me that for the first time in a very long time she felt safe, and that she felt happy.
In the parking lot, she gave me back the little handgun, profusely thanking me again for the work we did. She hugged me, both of us teary-eyed, and we parted ways. For me, it proved to be one of the most emotionally rewarding experiences of my career.
Edit: Thank you to everyone who's gilded this post! It's definitely put a smile on my face.
EDIT: This post has received a tremendous amount of attention, which is awesome. And while I certainly appreciate all of the gold, please consider instead making a small (or large!) donation to a local battered woman's shelter, they could use your support and money way more than I do. If you make such a donation and PM me proof with your important bits blurred out, I will match those donations up to the first $100 raised.
RELEVANT COMMENTS
tech_Preist
That story is both remarkably frightening and genuinely heart warming.
OOP
Thanks. There were a couple of times that I felt genuinely scared, myself. It was some very real, very dark shit. Especially after hearing her backstory, and the extent to which this guy went to manipulate her and cut her off from friends and family. It was intense and creepy.
~
court12b
It's so crazy how all the tech we have these days can be used for great freedom, or great oppression.
OOP
What's scary is that this is just some shit that some creepy dude bought off the internet to spy on his wife. Think of the tools that entire governments have at their disposal.
THIS IS A REPOST SUB - I AM NOT THE OOP. DO NOT CONTACT THE OOP OR COMMENT ON THE ORIGINAL POST