Attacks/Breaches
5/22/2013
10:36 AM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

FBI Arrests NYPD Detective On Hacking Charges

Detective accused of hiring hackers to obtain webmail access credentials for 30 targets, accessing federal crime-information database without authorization.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The Department of Justice Tuesday announced the arrest of New York City Police Department (NYPD) detective Edwin Vargas, 42, on computer hacking charges.

Vargas, a 20-year veteran of the police force, has been accused of ordering hacks of at least 43 personal email accounts belonging to at least 30 people, 19 of whom are current NYPD employees, including fellow detectives. He's also accused of paying the service to provide credentials for accessing a target's cellphone records.

According to a complaint unsealed Tuesday in federal court, from April 2010 to October 2012, "Vargas paid certain email hacking services to hack into numerous email accounts which did not belong to him, in order to obtain the login credentials for those accounts."

The primary target of Vargas' alleged surveillance operation was reportedly his former girlfriend, who's also an NYPD employee. Police officials told The New York Times that the couple had a child together, but had broken up.

[ If a full-on cyberwar breaks out, what should you do? Should CIOs Hire Cyber Pinkertons? ]

The investigation was conducted by the FBI, together with the NYPD's internal affairs bureau. Law enforcement officials told the Times that during the course of an investigation into a pay-for-hacking operation being run from Los Angeles, investigators discovered evidence that some NYPD employees' email accounts had been hacked, which lead them back to Vargas.

FBI investigators said that a digital forensic review of Vargas' hard drive revealed that he'd accessed online cellphone records for July to September 2012, for at least one of his targets. He allegedly also accessed records that listed the phone numbers of everyone to whom the account holder had sent text messages.

According to the complaint, in November 2011, Vargas also accessed the National Crime Information Center (NCIC), which is a centralized database used by U.S. law enforcement agencies to track crime-related information, and obtained information on at least two of the NYPD officers for whom he'd already obtained online email access credentials.

According to the complaint, which was filed Monday by FBI special agent Samad Shahrani, who's part of the bureau's Cyber Criminal Intrusion Squad, email hacking services such as the one Vargas allegedly employed typically accept an email-account hacking order, then provide the client with a screenshot of the targeted account's homepage and message saying that the requested account credentials have been obtained and used successfully. At that time, they demand payment, typically by credit card, PayPal or another online payment processor. Shahrani said that after reviewing Vargas' bank and PayPal records, he identified about $4,050 that had been paid to email hacking services, at a rate of $50 to $250 per hacked account.

Vargas has been charged with conspiracy to commit computer hacking and unauthorized access to a law enforcement database.

"Of all places, the police department is not a workplace where one should have to be concerned about an unscrupulous fellow employee," said George Venizelos, who heads the FBI's New York office, in a statement. "Unlike the email accounts, the defendant didn't need to pay anyone to gain access to the NCIC database. But access is not authorization, and he had no authorization."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Apprentice
6/27/2013 | 4:39:15 PM
re: FBI Arrests NYPD Detective On Hacking Charges
This is not only a corrupt police officer
seriously abusing the power has, in addition his personal insecurities are at
the cost of the American people. Good job Samad
Shahrani for catching the abuse in action. There should be a test for these law
enforcement officials who are that high up to test for traits in the area of
power of abuse and if their personalities are going to able to accept the responsibility
and power without abusing it.

Paul Sprague

InformationWeek Contributor
alifaizan
50%
50%
alifaizan,
User Rank: Apprentice
5/23/2013 | 10:11:09 AM
re: FBI Arrests NYPD Detective On Hacking Charges
If the law enforcement officers are breaking the law then how can you expect a normal individual to behave within the ethical boundaries?
there should be strict action who opposes the law even if its the cyber law. there has been huge increase in the rate of cyber crimes not just locally but internationally as well. America is under constant attack by the Chinese army of hackers, they are dealing with enough problems from outside the border and if these things escalate internally then America will have to retaliate and its good hear that they already have (source: http://goo.gl/c20Mm)
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6212
Published: 2014-04-19
Unspecified vulnerability in HP Database and Middleware Automation 10.0, 10.01, 10.10, and 10.20 before 10.20.100 allows remote authenticated users to obtain sensitive information via unknown vectors.

CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2013-6215
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors, aka ZDI-CAN-1977.

CVE-2013-6218
Published: 2014-04-19
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors.

Best of the Web