I was still at the desk.
Coffee number three going cold beside me. Both monitors blazing.
The Fix It dashboard open on the left screen, a terminal window open on the right, and between them a building's network architecture that was making me question every confident thing I'd ever thought about myself.
You're frowning, the system observed.
"I'm thinking."
You've been thinking for forty minutes. At some point thinking becomes procrastinating.
"Zenith's diagnostic port," I said.
"I found it."
Good.
"It's behind three authentication layers."
Also good. Means their IT team isn't completely incompetent.
"That's good?"
It means when we get through it Mr. Grey will know the test meant something. A pause. Walk me through what you're seeing.
I pulled up the network scan I'd been running a passive sweep, careful not to trigger any detection.
The results were spread across my right monitor in scrolling lines of data.
"First authentication layer is standard credential based. Username password combination tied to a maintenance account." I chewed the inside of my cheek.
"But the account is dormant. Hasn't been accessed in fourteen months."
Which means?
"The credentials are old. Possibly unchanged since installation." I sat forward.
"Default manufacturer credentials. Siemens BuildingOS maintenance accounts ship with a default login that most firms change immediately on installation."
And firms that don't?
"Leave the front door unlocked with a sign on it." I was already running a check against known default credential databases.
"But if they did change it we're done before we start."
The check ran.
Thirty seconds.
A minute.
Brandon.
"I see it."
The default credentials had never been changed.
Fourteen months of a dormant account sitting on a secured network with the manufacturer's original password. One line of negligence buried in forty two floors of corporate confidence.
"We're through the first layer," I said quietly.
Don't celebrate. Look at layer two.
I looked at layer two.
My stomach dropped slightly.
"Biometric confirmation," I said. "The diagnostic port requires a registered fingerprint scan before granting network access."
Silence.
Yes, the system said. It does.
"We don't have a fingerprint."
No.
"We can't fake a fingerprint."
Not directly. A pause. But biometric confirmation at this level doesn't read an actual finger.
It reads an encrypted digital token that the fingerprint generates a unique string stored in the system and matched on entry.
I sat up straighter.
"So if we can find the stored token"
And mirror it yes. The system would see a perfect match. Another pause. The token is stored in the building's security database. Separate from the power management network. Getting to it means crossing into a part of their system we haven't touched yet.
"Which increases our exposure."
Significantly. Every additional access point is another place their detection system can find us. The system's tone was measured. This is where it gets genuinely difficult Brandon. I want you to understand that before we continue.
I looked at the clock in the corner of my screen.
11:04 PM.