Attacks/Breaches
5/22/2013
10:36 AM
Connect Directly
RSS
E-Mail
50%
50%

FBI Arrests NYPD Detective On Hacking Charges

Detective accused of hiring hackers to obtain webmail access credentials for 30 targets, accessing federal crime-information database without authorization.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The Department of Justice Tuesday announced the arrest of New York City Police Department (NYPD) detective Edwin Vargas, 42, on computer hacking charges.

Vargas, a 20-year veteran of the police force, has been accused of ordering hacks of at least 43 personal email accounts belonging to at least 30 people, 19 of whom are current NYPD employees, including fellow detectives. He's also accused of paying the service to provide credentials for accessing a target's cellphone records.

According to a complaint unsealed Tuesday in federal court, from April 2010 to October 2012, "Vargas paid certain email hacking services to hack into numerous email accounts which did not belong to him, in order to obtain the login credentials for those accounts."

The primary target of Vargas' alleged surveillance operation was reportedly his former girlfriend, who's also an NYPD employee. Police officials told The New York Times that the couple had a child together, but had broken up.

[ If a full-on cyberwar breaks out, what should you do? Should CIOs Hire Cyber Pinkertons? ]

The investigation was conducted by the FBI, together with the NYPD's internal affairs bureau. Law enforcement officials told the Times that during the course of an investigation into a pay-for-hacking operation being run from Los Angeles, investigators discovered evidence that some NYPD employees' email accounts had been hacked, which lead them back to Vargas.

FBI investigators said that a digital forensic review of Vargas' hard drive revealed that he'd accessed online cellphone records for July to September 2012, for at least one of his targets. He allegedly also accessed records that listed the phone numbers of everyone to whom the account holder had sent text messages.

According to the complaint, in November 2011, Vargas also accessed the National Crime Information Center (NCIC), which is a centralized database used by U.S. law enforcement agencies to track crime-related information, and obtained information on at least two of the NYPD officers for whom he'd already obtained online email access credentials.

According to the complaint, which was filed Monday by FBI special agent Samad Shahrani, who's part of the bureau's Cyber Criminal Intrusion Squad, email hacking services such as the one Vargas allegedly employed typically accept an email-account hacking order, then provide the client with a screenshot of the targeted account's homepage and message saying that the requested account credentials have been obtained and used successfully. At that time, they demand payment, typically by credit card, PayPal or another online payment processor. Shahrani said that after reviewing Vargas' bank and PayPal records, he identified about $4,050 that had been paid to email hacking services, at a rate of $50 to $250 per hacked account.

Vargas has been charged with conspiracy to commit computer hacking and unauthorized access to a law enforcement database.

"Of all places, the police department is not a workplace where one should have to be concerned about an unscrupulous fellow employee," said George Venizelos, who heads the FBI's New York office, in a statement. "Unlike the email accounts, the defendant didn't need to pay anyone to gain access to the NCIC database. But access is not authorization, and he had no authorization."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
6/27/2013 | 4:39:15 PM
re: FBI Arrests NYPD Detective On Hacking Charges
This is not only a corrupt police officer
seriously abusing the power has, in addition his personal insecurities are at
the cost of the American people. Good job Samad
Shahrani for catching the abuse in action. There should be a test for these law
enforcement officials who are that high up to test for traits in the area of
power of abuse and if their personalities are going to able to accept the responsibility
and power without abusing it.

Paul Sprague

InformationWeek Contributor
alifaizan
50%
50%
alifaizan,
User Rank: Apprentice
5/23/2013 | 10:11:09 AM
re: FBI Arrests NYPD Detective On Hacking Charges
If the law enforcement officers are breaking the law then how can you expect a normal individual to behave within the ethical boundaries?
there should be strict action who opposes the law even if its the cyber law. there has been huge increase in the rate of cyber crimes not just locally but internationally as well. America is under constant attack by the Chinese army of hackers, they are dealing with enough problems from outside the border and if these things escalate internally then America will have to retaliate and its good hear that they already have (source: http://goo.gl/c20Mm)
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio