Slashdot Log In
Hacker Penetrates T-Mobile Systems
Posted by
timothy
on Wed Jan 12, 2005 08:40 AM
from the sounds-like-a-movie-plot dept.
from the sounds-like-a-movie-plot dept.
An anonymous reader writes "SecurityFocus.com reports 'a sophisticated computer hacker had access to servers at wireless giant T-Mobile for at least a year, which he used to monitor U.S. Secret Service e-mail, obtain customers' passwords and Social Security numbers, and download candid photos taken by Sidekick users, including Hollywood celebrities.' Demi Moore and Paris Hilton are involved."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
At first ... (Score:2, Funny)
linkie? and recruitment (Score:5, Insightful)
Okay, all my Karma points for a link.
The same source also offers an explanation for the secrecy surrounding the case: the Secret Service, the source says, has offered to put the hacker to work, pleading him out to a single felony, then enlisting him to catch other computer criminals in the same manner in which he himself was caught. The source says that Jacobson, facing the prospect of prison time, is favorably considering the offer.
As much as we make fun of the computer knowledge of our governments, they finally seem to be on the right track. You must have some of these guys in your pocket to really have a chance. Can you trust them? Probably not completely... but if they bring you some knowledge, skills, and some of the most damaging players, then it's worth it.
Re:linkie? and recruitment (Score:3, Insightful)
Re:linkie? and recruitment (Score:4, Funny)
Parent
Yep, the guy was stupid (Score:5, Interesting)
The guy crossed the line when he went to sell personal information to identity theives. Looking at famous people's candid photos is pretty harmless (as long as he's not selling them to some tabloid or spreading them around). Reading the SS's email is the ultimate in poetic justice; they should be more aware of just how insecure email is than just about anyone. It's inexcuable for the frelling SS to have been sending sensitive documents around in unencrypted emails.
In the end, it sounds like the guy got caught because of his own hubris. Which, when you think about it, is typical... criminals get busted not because the cops are spectacuarly competant, but because they run their mouths off.
Parent
Re:Yep, the guy was stupid (Score:3, Funny)
The SS? Don't these guys use Enigma? [codesandciphers.org.uk]
uh, blackmail? (Score:3, Interesting)
Um...you do realize they're blackmailing him, right?
Honestly, I can't decide if being blackmailed is better or worse than him rotting in jail. We don't let people off th
Re:linkie? and recruitment (Score:3, Insightful)
Re:linkie? and recruitment (Score:3, Informative)
I hate to break it to you, but that's a movie. It is, however, based on a true story. You might want to see how the real Frank Abagnale has been doing lately, though:
http://www.abagnale.com/index2.asp [abagnale.com]
Re:linkie? and recruitment (Score:3, Insightful)
See the case of the chinese woman who had a 20 year affair with a FBI agent. She was spying on the Chinese, for the FBI, and they paid her 1.7 million. Then the FBI got an interesting notion that she might be spying for the chinese, so they dragged her in court. Of course, the prosecution screwed up and the judge dismissed the case for infringement of her constitutional right. (that was in the paper a couple days ago).
All this to show that the US government is no
Get Moore !?! (Score:5, Interesting)
Q: If I were a customer and I found out that my identity has been stolen, could I sue T-Mobile for any damages since they knew of the problem, or perhaps for just having breakable security?
BTW, the Black Hat's email address (and online identity) is ethics@netzero.net [mailto] and at one point was looking for work as a security administrator. Not a big surprise that he was interested in the field, but 'Ethics'!
Re:Get Moore !?! (Score:4, Informative)
Parent
Re:Get Moore !?! (Score:5, Informative)
RTFA:
It appears that if you sue, you won't win.
Parent
Re:Get Moore !?! (Score:5, Interesting)
As I read even more of the FA:
It appears the feds knew about this months ago.
Parent
Sophisticated Hackers (Score:5, Funny)
Demi Moore and Paris Hilton are involved. (Score:4, Funny)
Re:Demi Moore and Paris Hilton are involved. (Score:4, Insightful)
Wealthy
Thin to the point of being unhealthy
High Libido
Slutty
Blond
Dumb as a post.
As a result, the media HAS to go nuts about her, because toothpicks like her are the kind of trash they've been throwing at us for ages.
Parent
Re:Demi Moore and Paris Hilton are involved. (Score:3, Insightful)
Mind you, I don't for a moment think this is the result of any kind of organized conspiracy. This is the logical consequence of about a century and a half of advertising campaigns telling us ways we're "not go
The Register has an article too ... (Score:2, Informative)
His Resume is posted online ! (Score:5, Informative)
Re:His Resume is posted online ! (Score:5, Informative)
Clicky... AC, so no karma whoring for me. :-)
Parent
Re:His Resume is posted online ! (Score:3, Funny)
Wow, Ubbercracker!
No, Seriously... is my mom a hacker too? She just
Not-so Secret Service (Score:4, Interesting)
Re:Not-so Secret Service (Score:5, Funny)
In other news, The President had to be reminded (again) that the White House Lobby Pay Phone should not be used to call Ariel Sharon.
Parent
Re:Not-so Secret Service (Score:5, Insightful)
A lot of people have crazy delusions that secret agencies live in some far off technical wonderhome, where all communications are encrypted with some super 733t MD67 algorithm never before seen by any other person in the world, all access is controlled by handprint and retinal scan identification and everyone walks around with James Bond gadgets in their pockets. It's just not so. These people live and work in normal offices and normal homes and deal with the same crappy, bug-ridden and insecure hardware and software that the rest of us do. It's probably a bit better than your normal corporate office, but not by much.
Parent
Re:Not-so Secret Service (Score:3, Insightful)
Re:Not-so Secret Service (Score:3, Insightful)
The News (Score:5, Insightful)
Some days I'm proud to be american, but then the drugs wear off.
Secret Service Mail Encryption (Score:3, Interesting)
Re:Secret Service Mail Encryption (Score:5, Interesting)
-
Just because he is reading Secret Service mail doesn't mean it is important. For all we know the mail could read like this: On todays lunch menu we are not going to be having the chicken fajita due to a lack of chicken, we will be having PB & J's. Surely they have secure transmission lines (& methods of encryption) , so why would they send anything of importance over T-Mobiles network?
If you'd RTFA, you'd know that many of things he had access to were important, sensitive and, in an ideal world, should have been encrypted. One good question the article didn't ask is why'd the secret service agent send these things unencrypted over a monitorable network? Personally I'd like to know that he had been disciplined for allowing this security breach to occur.Parent
But how could he NOT get caught? (Score:5, Insightful)
So... let's say that I want to patronize his obviously grossly illegal service. How do you consummate a transaction like this? Cash in a Fedex envelope? Sent to whom? A P.O. box?
Who performs first? Are there criminal escrow services?
And how stupid do you have to be to take out an ad online, in a known criminal hangout, announcing your secret power, and providing contact info?
Is there something I'm missing here?
No, really.
Even Hung Out On UnderNet? (Score:5, Insightful)
Who performs first? Are there criminal escrow services?
This page [securityfocus.com], linked in the posted article, has some explanation about how they traded:
"The 4,000 Shadowcrew members were participants in an underground economy capable of providing a dizzying array of illicit products and services. The most active commodities were "dumps" of credit card account data, fake physical cards to go with the dumps ($50 blank, $70 embossed, in bulk), and expertly forged identification to help pass the plastic at the local consumer electronics store. Credit reports, hacked online bank accounts, and names, birthdates and social security numbers of potential identity theft targets were also for sale in bulk.
Each product had its own specialists, and every vendor had to be reviewed by a trusted site member before they were allowed to sell. Disputes were handled judiciously, "rippers" selling bunk products quickly exposed and banned from the site. In one case a vendor who owed another member money was allowed to continue selling only on the condition that his future illicit earnings would be garnished until his debt was repaid..
Members of the community even traded in tangible items like ATM skimmers, prescription drugs, and cocaine, and services like DDoS for hire and malware customization. One well-reviewed vendor offered a test-taking service that promised to get customers technical certifications within days. He was permitted to vend after earning the reviewer a Microsoft MCP certification under an alias."
And how stupid do you have to be to take out an ad online, in a known criminal hangout, announcing your secret power, and providing contact info?
Um, dude, have you ever hung out on undernet? All sorts of shady shit happens there. I've known friends who knew people from online chatrooms who hijacked business conference call lines and made them available to entire chatrooms as a group conference voicechat line. Warring chatrooms would even appear and try to make the line unusable. I thought it was moronic (they even called from their home and work phones for God's sake!), but I think people aren't used to the internet's topology. The lack of a physical police presence makes people pretty confident and reckless - you're not there, so they can't just arrest you on the spot, which eliminates most of the anxiety in any crime (smoke weed in a public park and your house and compare your reactions). Even worse, because of the nature of the internet, the police don't need a physical presence to monitor any of it, so criminals can't just look over and notice that shady van across the street. The lack of these real-world reminders makes for bad heuristic judgments. You'd think hackers would be the first to notice that their lack of fear is due to this sort of fallacy, but from the article, it's clear that some don't.
Don't get me wrong - I'm not saying that it's easy to catch people committing crimes online. It's extremely difficult. GHB kits thrived online, and I'm sure if you still looked you could find products ostensibly marketed for other reasons that are just clandestine GHB kits on google (that's the only example you get, but you'd all be fucking shocked if you knew just how many drugs are sold online with Visa and paypal). If you take only the most obvious precautions, it's many times harder. Something as simple as using a proxy and encryption from a "borrowed" wireless connection can make criminals almost undetectable. Many of us use one of the three reguarly. How hard is it to combine them?
The police can't monitor everything. Even if they devoted the resources to looking for this sort of thing, how many people know the magic combinations of words and searching techniques that let them
Parent
Re:Even Hung Out On UnderNet? (Score:3, Funny)
Hmm... (Score:5, Insightful)
I mean, it's not like he found a flaw and just experimented with it briefly. He deliberately exploited it over the course of a year and even attempted to profit from it. Doesn't that seem... wrong?
I understand that he would be very useful to the investigators, but what about the victims? Were there actually any? Were they affected? If so, it sure seems like the punishment was rather light. Almost encourages people to try the same thing. Is the message here "crime pays, as long as you work for the government once you're caught"?
On the other hand, how can he work as a mole when so much about his identity is already revealed? If the entire world now knows his name, has access to his resume, etc., isn't he at great risk of being identified?
And it's not just him... with all the information revealed in the news article, how can the SS's original snitch stay hidden? Wouldn't whatever hackers he made contact with obviously know who he is, now?
It's almost like watching a spy movie. Heh, well, what do I know. It all just seemed rather strange to an outsider like me, but I must admit I don't know how these things usually work. Someone wanna explain?
Also, it was interesting that they called ICQ "Microsoft ICQ". Just a mistake or did MS secretly buy AOL?
Re:Hmm... (Score:3, Insightful)
Re:Hmm... (Score:4, Interesting)
If you think the Secret Service won't use his skills in exactly the same way he was offering to the public before he got busted, you are mistaken. That is to say (explicitly), the Feds will use this guy to break into private computer networks and steal information of interest to them. They will keep him at arms length in case he gets caught. This is the way law enforcement (unfortunately) works...
Parent
Are you new here? (Score:5, Insightful)
This is also the same country where we gave a dictator the technology and biological weapons to kill his own people by the tens of thousands, and used that as a reason 15 years later to depose him.
Get used to it.
Parent
Re:Hmm... (Score:3, Insightful)
The government does this all the time in organized crime and drug cases. Look at a guy like Sammy "The Bull" Gravano. He killed god knows how many as a member of the Gambino family not to mention a list of other crimes a mile long but was given a slap on the wrist and a new identi
Re:Hmm... (Score:3, Funny)
Hello fellow criminals. Let's do crime.
Are budget cuts that severe? (Score:5, Insightful)
What's next? The FBI, CIA, etc is compromised while using hotmail, Yahoo, or Google mail?
Are Gov IT cutbacks so severe they have to turn to places like this to send messages?
Funniest quote (Score:4, Funny)
I hope it came with an 18-dollar bill.
Gets ya thinking... (Score:3, Interesting)
I think he let his greed / ego get in the way when trying to offload this information that he obtained.
This really makes you wonder about the guys you never hear about, the ones that don't get caught.
Meet the script kiddie. (Score:3, Informative)
I agree, the most disturbing thing about all of this is the low level of knowledge of the hacker. He was nothing but a script kiddie on his resume and he was caught with obvious mistakes. We can be sure that TMobile and others are still owned by more sophisticated crackers who will not be caught.
The article links to a 2001 resume [securityfocus.com] which never mentions GNU and only once mentions Unix but lots of Windozed
standards board (Score:4, Insightful)
Hacker penetrates Demi Moore and Paris Hilton (Score:3, Funny)
A chain is as strong... (Score:3, Insightful)
(This event could be called "backdoor", couldn't it?)
Re:Argh... (Score:5, Funny)
How do you know he's white?
Parent
Re:Paris Pictures (Score:3, Funny)
Re:Candid and intimate photos of Paris? (Score:3, Funny)
Re:SSH on T-Mobile - Not Secure (Score:3, Informative)
That said, I've used the SSH client myself and even glanced through the source briefly, and nothing struck me as suspicious. As for the hiptop lacking the power to do the encryption, that's why it takes the client a good thirty seconds or so just to perform the initial handshake.