WWW- A computer hacker who is said to have lifted photos from Paris Hilton’s now famous T-Mobile Sidekick also burgled the T-Mobile account of the very New York Secret Service agent who was tracking him down.
Agent Peter Cavicchia has since left the agency for the private sector. The hacker, 22-year-old Nicolas Jacobsen, pleaded guilty on Feb. 15 to invading 400 T-Mobile accounts, including Cavicchia’s and Hilton’s.
But by then other hackers had followed Jacobsen into the T-Mobile database. The week ended with seemingly the entire contents of Hilton’s Sidekick posted on the Internet. You had to wonder if the hackers were telling the world they were still in business despite the feds’ numerous successes against cybercrime.
One of the feds’ more recent victories can be traced back to March 15 of last year, when the Secret Service came upon a posting by someone with the Internet nickname “Ethics.”
“am offering reverse lookup of information for a t-mobile cell phone … you get name, ssn and DOB … web username/password, voicemail password, secret question/answer … and more.”
The Secret Service took this to be an offer to sell pilfered information. Cavicchia, who had made a name as a kind of “Wired Earp” locking up cybercrooks, contacted T-Mobile on July 28. He was told that a hacker had indeed broken into the company’s database.
That same day, a confidential informant working for the Secret Service was messaged by “Sigep,” said to be a member of “Shadowcrew,” a hacker consortium the feds describe as an “organized criminal group.”
Sigep showed the informant bits he had saved of an online chat with another Shadowcrew member, “Myth.” The chat proved to include an internal Secret Service report along with part of a confidential Mutual Legal Assistance Treaty with the Russian Federation.
“These documents contained highly sensitive information pertaining to ongoing USSS [Secret Service] criminal cases,” the criminal complaint would note.
Later that day, the informant communicated directly with Myth, who indicated he had received the Secret Service documents from another hacker. The other hacker had also revealed several Secret Service requests for subpoenas, as well as correctly reported that Myth’s computer was under surveillance.
The next day, the informant “met” Myth and a hacker who used the nickname “anyoman” in an online room. Anyoman said he had obtained numerous Secret Service documents and pasted several into the chat. He suggested that a computer with the Internet Protocol, or IP, address 209.250.116.88 was “interesting.”
The agents quickly determined that this unique numeric Internet address was registered to a computer in the New York office of the Secret Service.
“Used by USSS Special Agent Peter Cavicchia,” the complaint would state.
Cavicchia proved to have a T-Mobile account that he used to access his work computer. The agents directed the informant to contact Ethics, the hacker who had posted the offer of T-Mobile data in March.
“The CI [confidential informant] asked ‘Ethics’ whether he was the person using the nickname ‘anyoman,'” the complaint would report. “Ethics proceeded to paste text conversation intercepted from SA Cavicchia’s T-Mobile E-mail account.”
Ethics subsequently sent the informant a link that afforded unauthorized access to T-Mobile’s database. The agents used their own databases to identify Ethics as Nicolas Jacobsen of Santa Ana, Calif. He pleaded guilty on Feb. 15 to reduced charges, which suggested he was cooperating with the authorities.
By then, Cavicchia had left the Secret Service. Others Jacobsen hacked reportedly included various celebrities. Fellow hacker William (Illwill) Genovese of Meriden, Conn., has reportedly been saying that Jacobsen sent him photos lifted from camera cell phones, including Paris Hilton’s.
“Everybody had them,” Genovese added yesterday.
Genovese said he was once, but is no longer, associated with www.illmob.org, reportedly the first to post the fuller contents of Hilton’s Sidekick. The Web site carries a posting that insists “the information was simply found on another site and posted here for our fellow visitors.”
And so it goes.