Chapter 4 The Insider

I nodded confidently. "Absolutely."

Then, I pulled up a set of legitimate login records and displayed them alongside the suspicious ones. Both sets showed the same hardware information, but their TTL values differed.

"Whoever spoofed my device's identity forgot one important detail," I explained. "Network traffic leaves its own fingerprints, and those aren't always easy to fake."

Dylan studied the screen, then looked at me. "So, you're saying that the attacker planted a man-in-the-middle server inside our network?"

"Exactly."

Ryan looked confused by the explanation. "But how did they get your device information in the first place?"

I didn't answer him right away. Instead, I opened the company's code repository and searched for the device identification component.

After I scrolled through the recent changes, I found a commit that immediately caught my attention. It had been submitted by Leon on 23rd September at 3:47 p.m., with a description that read, "Monitoring tool upgrade. Fixed memory leak."

The atmosphere in the conference room changed as everyone noticed the name on the screen.

Leon was quick to defend himself. "It's just a software component. There's nothing unusual about bringing in third-party libraries during an upgrade."

"Then, I suppose there's nothing unusual about skipping the security review either?" I asked.

I opened the commit details and showed everyone the unfamiliar module added to the existing monitoring software.

Its description said the module was designed to automatically optimize device identification and reduce redundant authentication checks. It did sound like a routine performance improvement, which was probably why nobody questioned it.

Dylan leaned closer to examine the code. The longer he studied it, the deeper his frown became.

Finally, he said firmly, "I never approved this module."

"The approval's in your email," Leon shot back.

"But you're the one who merged it into production," I reminded him lightly.

He opened his mouth as if to argue, but he fell silent.

I opened a browser and searched for the component's name. There weren't many results, but I found a security report filed six months ago near the bottom of the page.

The report described suspected collection and transmission of device fingerprints to overseas servers. However, the investigators closed the case because they couldn't reproduce the issue.

I displayed the report on the giant screen so everyone could read it.

Ryan went through the information twice before looking up at me.

"So, you're telling me this thing was just sitting there, waiting for us to install an update?" he asked, his voice noticeably tense.

"Pretty much," I replied, leaning against the table. "The hackers hid malicious code inside a component that looked completely legitimate. Then, they waited for companies to install it themselves."

I pointed toward the module on the screen. "Once the software was up and running, it started collecting device information without anyone noticing. The hackers didn't have to break through your security systems because the company had already installed their code for them."

I glanced around the conference room before adding, "Simply put, they didn't have to break down your front door because you handed them the keys."

Dylan turned sharply toward Leon. "Why did you choose this component?"

"I already told you," Leon replied defensively. "It was a mistake."

"A mistake, huh? Then, let's look at something else," I said.

I opened the building's security access records and searched through the entries from 24th September.

One record showed Leon entered the core server room at 2:17 a.m. and stayed for 1 hour and 47 minutes.

Ryan looked up from the screen, clearly surprised. "Leon, didn't you tell us you were home that night?"

Leon's confident mask cracked for the first time since I'd barged into the conference room. "I went in to investigate some network latency," he replied lowly.

"Was there a latency alert?" I pressed.

"Not every internal investigation has to be triggered by an alert," he responded quickly.

Dylan immediately pulled up that night's monitoring records and checked the system performance reports.

"There's nothing here," he said after a moment. "No alerts, no performance issues, and certainly no indication that anything was wrong. Everything was operating normally."

I turned back toward Leon. "So, do you mind telling us just what exactly you were investigating?"

He didn't answer.

I continued scrolling through the activity logs until I found another entry that caught my attention.

At 2:41 a.m. on 24th September, someone had modified the payment gateway configuration, increasing the connection timeout from thirty seconds to thirty-five seconds.

Leon's account was the one behind the change.

Dylan stared at the record, his expression growing darker and darker by the second. "You're the one who added those five seconds?"

"No!" Leon snapped, straightening in his chair. "Someone must have compromised my account."

I almost laughed at how quickly he shifted to a different excuse.

"That's funny because you just told everyone how impossible it was to clone a device's identity five minutes ago." I held his gaze. "But now it's suddenly possible for someone to impersonate you now that your name is showing up in the logs?"

Leon slammed his fist against the table. "These are all coincidences!"

"Then, I've got one more coincidence for you," I replied calmly.

I took out my phone and opened a monitoring app I'd written three years ago. The program had quietly been recording metadata from unusual connections across the company's terminal ever since I installed it.

I filtered the records to show activity around 3 a.m. the previous night.

One connection stood out almost immediately.

Leon's office computer had connected to an overseas server through port 8443 at 3:02 a.m. The destination used a .io domain, and the connection had remained active for 17 seconds.

Ryan stared at the details on my phone before looking at me in confusion. "What the hell is that supposed to mean?"

"It looks like a connection to a command-and-control server," I explained. Then, I enlarged the connection details so everyone could see them more clearly. "That's the kind of server hackers use to communicate with machines they've compromised. They send instructions from one end, and the infected computers carry them out on the other."

Ryan still looked a little confused, so I gave him a simpler example.

"Think of it like a remote control and a toy car. The hacker holds the remote, and the compromised computer follows whatever instructions it receives."

He slowly nodded as the explanation sank in.

Leon, who was seated across the table, fidgeted in his chair. His face had gone pale, and the confidence he'd shown throughout the meeting was thoroughly gone.

For the first time since I'd walked into that conference room, he looked genuinely afraid of what was coming.