Hacker breaches T-Mobile systems, reads US Secret Service email

[petron]

http://www.theregister.co.uk/2005/01/12/hacker_penetrates_t-mobile/

By Kevin Poulsen, SecurityFocus
Published Wednesday 12th January 2005 09:47ÊGMT


A sophisticated computer hacker had access to servers at wireless giant T-Mobile for at least a year, which he used to monitor US Secret Service email, obtain customers' passwords and Social Security numbers, and download candid photos taken by Sidekick users, including Hollywood celebrities, SecurityFocus has learned.

Twenty-one year-old Nicolas Jacobsen was quietly charged with the intrusions last October, after a Secret Service informant helped investigators link him to sensitive agency documents that were circulating in underground IRC chat rooms. The informant also produced evidence that Jacobsen was behind an offer to provide T-Mobile customers' personal information to identity thieves through an Internet bulletin board, according to court records.

Jacobsen could access information on any of the Bellevue, Washington-based company's 16.3 million customers, including many customers' Social Security numbers and dates of birth, according to government filings in the case. He could also obtain voicemail PINs, and the passwords providing customers with web access to their T-Mobile email accounts. He did not have access to credit card numbers.

The case arose as part of the Secret Service's "Operation Firewall" crackdown on internet fraud rings last October, in which 19 men were indicted for trafficking in stolen identity information and documents, and stolen credit and debit card numbers. But Jacobsen was not charged with the others. Instead he faces two felony counts of computer intrusion and unauthorized impairment of a protected computer in a separate, unheralded federal case in Los Angeles, currently set for a 14 February status conference.

<snip>

Oh great, that's just what I need some hacker selling my data to some jackass Identity Thief. Goddamnit!

[Name removed]

1. Deleted message

Message removed by moderator. Click here to review the message board rules.

[DELUSIONAL]

2. Or will he be offered a job with the GOP --

to hack future elections?

Convict him and then transfer him to an undisclosed location.

[NYC]

3. Perhaps he is not the only person with

such capabilities.

Security?

[proud2BlibKansan]

12. I am thinking

that if the Secret Service's secret info is so easy to hack into, what is the level of security for other less 'secret' govt agencies?

I am also glad I don't have a TMobile phone. :)

[DS1]

19. Obviously we need to privatize the Secret Service

:eyes:

[TexasLawyer]

4. This is SO far-fetched! (sarcasm alert)

For one thing, hacking into secret government business is illegal.

For another, there's no proven market for selling Social Security numbers to identity thieves. Look at any newspaper ads, read through the yellow pages, and listen to all the commercials on TV and radio. You'll see that those things are just not being bought and sold.

Also, the Secret Service would never make itself vulnerable like this. HOW could a 21 year old kid, even a "highly sophisticated" one, hack them undetected for an entire year? How could it be that they didn't know it was even happening until they realized their secret info was floating around the web? No, this is crazy-talk. It never could happen and it never did happen.

And that whole identity theft scenario sounds like a wild conspiracy theory. Everyone knows that is just laughable. And was this guy doing it for kicks or for money? These web-spinners can't even make their own conspiracy theory internally consistent.

Geez, how can people believe this stuff?

Besides, I think for the good of the country, people should just forget about this story. If we can't rely on our Secret Service then it will undermine our war on terror.

Please, people, abandon this thread. Otherwise, you're going to Gitmo for treason.

[htuttle]

6. Well, if Agent Mike is reading this...

...perhaps he could post the case file for 'Boot Trax', one of the Wisconsin '414's who got busted for CC fraud in the 80's (IIRC, Agent Mike please correct me if I'm wrong).

Specifically post the part about what 'Boot Trax' did to the Milwaukee Secret Service office telephones after he hacked into COSMOS while out on bail...

Not only could it happen -- this sort of thing has been happening for about 25 years...some years before the 'internets', actually.

[Der Blaue Engel]

9. Ha! Brilliant!

:)

[proud2BlibKansan]

13. So this source

is not credible? It's not The Onion or The National Enquirer.

As an identity theft victim, I disagree that there is no proven market for SS #'s. I happen to know for a fact that there is indeed such a market. Both my bank and my local police dept told me this is one the most common crimes they deal with. My bank has a large fraud division in place to deal with what they told me is "a huge problem nationwide".

So it's very easy to understand how people can actually believe this stuff - it does indeed happen.

Your comment about going to Gitmo for treason makes no sense whatosever. Me thinks you have been spending way too much time at free republic.

[TexasLawyer]

15. Not making sense was my point...

I was just giving this article the right-wing once-over that it would get if it was a perfectly well-documented story alleging election fraud.

I agree that the "treason" charge is way, way over the top and complete nonsense-- but it just shows ta go ya how crazy it is for the Rovian ones to argue that questioning the integrity of the vote in Ohio and elsewhere is equivalent to undermining democracy at a time of war. And of course that is treason.

[proud2BlibKansan]

18. Okay gotcha

sorry I jumped on you.

[TexasLawyer]

16. Oh, and I meant to say...

sorry that you were the victim of identity theft. I've seen TV shows about it, and it looks like an absolute nightmare. I hope that you've gotten it resolved.

[proud2BlibKansan]

20. Thanks

It has been a friggin nightmare. Every time I think it is behind me, I get a new surprise in the mail. Last week, I got a call from a collector wanting to know when I was going to pay my Master Card bill. And I have never had a Master Card. This man read my ss#, my middle name (not just the initial) and my husband's name to me over the phone.

The thing that really pisses me off is we were planning to refinance our house this year. But I am sure my credit is shot and it will be a waste of time. We have a good mortgage and a reasonable monthly payment but want to do some home improvements and help our son pay for college. Now we have to forget the home improvements and look into financial aid.

The police were also no help. They basically just took the report and are expecting the bank to investigate and solve the crime. (It started with my checkbook being stolen) The detective never even returned my calls. And the kicker is I know who stole the checkbook! 6 months later, the thief has still not been arrested and the total amount of forged checks and credit in my name is over $100,000!!!

BTW, my ss# was not on my checks. Neither was my middle name. Or my husband's name.

[errorbells]

17. I got it!

Husband asked "have you heard of the TexasLiar?"
Then said you probably have
...gosh, I hope you don't work there.

He liked it, btw. TexasLawyer, that is.

[KansDem]

5. Secret Service email, eh?

You don't suppose the hacker found references to times and locations for picking up the twins' shit-faced friends from out of the local drunk tanks?

on edit:
7 The Secret Service - It would appear that the Secret Service have acquired yet another new role under George W. Bush. Along with protecting the president and busting down the doors of junior satirists (see Idiots Week 6), they are also required to pick up underage alcoholics from the local drunk tank. After the recent TCU booze-up, Jenna Bush's "boyfriend" William Ashe Bridges (Nash to his friends) was thrown in jail for public intoxication. Four hours later, Secret Service agents showed up in a black Chevy Suburban, bailed him out, and give him a ride home. Now this may seem an unusual way of spending the public's tax dollars, but think about it - bearing in mind this guy's connections, it's entirely possible that the Secret Service were just protecting our future president! Nash Bridges in 2032!
http://www.democraticunderground.com/top10/01/top10_2001_08.html

[leesa]

8. Or the reason they did not respond to move the Resident on 9-11,

to lessen the danger to all those kids in the classroom?

[KansDem]

10. On a serious note, you have a good point...

Never thought about that, but you may be on to something here...

[Stinky The Clown]

7. I wonder if he found any Kerry votes while he in the gov't's ether ......

[zann725]

29. Possibly...if they intercepted Rove's email and phone records!

n/t

[lovuian]

11. My friends have T Mobile phones Uh OH!!!

:crazy:

[ananda]

14. I have one, too

Uh oh is right. I have T-Mobile cell phone service, too.

I didn't realize...

Sue

[dansolo]

21. Secret service emails from T-Mobile????

Has anyone else's bullshit meter been pegged? Why the hell would sensitive agency documents be available through T-Mobile's servers?

[420inTN]

22. email forwarded to cell phones / PDAs.

My boss and some cow-orkers have their emailed forwarded to their cell phones/PDAs.

[Renew Deal]

23. Well that's great news.

I'm a t-mobile customer.

[Mika]

24. Looks like he did "get more".

;)

[d.l.Green]

25. Sarcasm/TMobile

Great job, TexasLawyer! Reading the reply posts was a little disconcerting, the sarcasm was pretty obvious esp with the last lines. And sure I have TMobile also but really, you think this is the only company with the flaw? Now that this guy's been caught I would imagine that it's all the other phone companies that are even more vulnerable- especially if the SS isn't using them.

Talk about tall tales, the end of the article states:

"The same source also offers an explanation for the secrecy surrounding the case: the Secret Service, the source says, has offered to put the hacker to work, pleading him out to a single felony, then enlisting him to catch other computer criminals in the same manner in which he himself was caught. The source says that Jacobsen, facing the prospect of prison time, is favorably considering the offer."

This "source" has a leaked a "secret" about a "secretive case"... and since when is the SS so noble about their endeavors. That hacker will be put up to no good... but he now has a job! The resume worked!

[nadinbrzezinski]

26. Once again proving... do not store anything sensitive

over your personal rad... err cell phone

Do not have sensitive conversations over that same rad... err Cell Phone.

Many years ago as a medic we used to listen to cell phone traphic on the trusty Scanner... nope it was not that legal, I used that to make a point to a friend who did not believe just how easy they were (and still are) to hack into....

By the way, this was in another country before GMRS and all that happy horse, but they are not that hard to crack.

I'll admit some of those conversations were amusing, for a bunch of bored medics that is. Oh and the tactical freq for the PD was never that entertaining.

[bpilgrim]

27. probably on windows

xss :evilgrin:

peace

[TexasLawyer]

28. Drudge Report

I noticed that this article has been posted on the Drudge Report site. I'm kind of surprised, since this hack job happened under Bush's watch. A 21 year old kid? For a whole year? The story would seem to be quite humiliating for the very people who are supposed to be in charge of protecting the Fatherland. It's the type of story that Bush apologists like Mr. Drudge would tend to ignore.