By Kevin Poulsen ,SecurityFocus
A sophisticated computer hacker had access to servers at wireless
giant T-Mobile for at least a year, which he used to monitor U.S.
Secret Service e-mail, obtain customers' passwords and Social Security
numbers, and download candid photos taken by Sidekick users, including
Hollywood celebrities, SecurityFocus has learned.
Twenty-one year-old Nicolas Jacobsen was quietly charged with the
intrusions last October, after a Secret Service informant helped
investigators link him to sensitive agency documents that were
circulating in underground IRC chat rooms. The informant also produced
evidence that Jacobsen was behind an offer to provide T-Mobile
customers' personal information to identity thieves through an
Internet bulletin board, according to court records.
Jacobsen could access information on any of the Bellevue,
Washington-based company's 16.3 million customers, including many
customers' Social Security numbers and dates of birth, according to
government filings in the case. He could also obtain voicemail PINs,
and the passwords providing customers with Web access to their
T-Mobile e-mail accounts. He did not have access to credit card
numbers.
...
Cavicchia was the agent who last year spearheaded the investigation of
Jason Smathers, a former AOL employee accused of stealing 92 million
customer e-mail addresses from the company to sell to a spammer. The
agent was also an adopter of mobile technology, and he did a lot of
work through his T-Mobile Sidekick -- an all-in-one cellphone, camera,
digital organizer and e-mail terminal. The Sidekick uses T-Mobile
servers for e-mail and file storage, and the stolen documents had all
been lifted from Cavicchia's T-Mobile account, according to the
affidavit.
http://www.securityfocus.com/news/10271
Monty Solomon (monty@roscom.com)