Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

FBI Arrests NYPD Detective On Hacking Charges

Detective accused of hiring hackers to obtain webmail access credentials for 30 targets, accessing federal crime-information database without authorization.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
The Department of Justice Tuesday announced the arrest of New York City Police Department (NYPD) detective Edwin Vargas, 42, on computer hacking charges.

Vargas, a 20-year veteran of the police force, has been accused of ordering hacks of at least 43 personal email accounts belonging to at least 30 people, 19 of whom are current NYPD employees, including fellow detectives. He's also accused of paying the service to provide credentials for accessing a target's cellphone records.

According to a complaint unsealed Tuesday in federal court, from April 2010 to October 2012, "Vargas paid certain email hacking services to hack into numerous email accounts which did not belong to him, in order to obtain the login credentials for those accounts."

The primary target of Vargas' alleged surveillance operation was reportedly his former girlfriend, who's also an NYPD employee. Police officials told The New York Times that the couple had a child together, but had broken up.

[ If a full-on cyberwar breaks out, what should you do? Should CIOs Hire Cyber Pinkertons? ]

The investigation was conducted by the FBI, together with the NYPD's internal affairs bureau. Law enforcement officials told the Times that during the course of an investigation into a pay-for-hacking operation being run from Los Angeles, investigators discovered evidence that some NYPD employees' email accounts had been hacked, which lead them back to Vargas.

FBI investigators said that a digital forensic review of Vargas' hard drive revealed that he'd accessed online cellphone records for July to September 2012, for at least one of his targets. He allegedly also accessed records that listed the phone numbers of everyone to whom the account holder had sent text messages.

According to the complaint, in November 2011, Vargas also accessed the National Crime Information Center (NCIC), which is a centralized database used by U.S. law enforcement agencies to track crime-related information, and obtained information on at least two of the NYPD officers for whom he'd already obtained online email access credentials.

According to the complaint, which was filed Monday by FBI special agent Samad Shahrani, who's part of the bureau's Cyber Criminal Intrusion Squad, email hacking services such as the one Vargas allegedly employed typically accept an email-account hacking order, then provide the client with a screenshot of the targeted account's homepage and message saying that the requested account credentials have been obtained and used successfully. At that time, they demand payment, typically by credit card, PayPal or another online payment processor. Shahrani said that after reviewing Vargas' bank and PayPal records, he identified about $4,050 that had been paid to email hacking services, at a rate of $50 to $250 per hacked account.

Vargas has been charged with conspiracy to commit computer hacking and unauthorized access to a law enforcement database.

"Of all places, the police department is not a workplace where one should have to be concerned about an unscrupulous fellow employee," said George Venizelos, who heads the FBI's New York office, in a statement. "Unlike the email accounts, the defendant didn't need to pay anyone to gain access to the NCIC database. But access is not authorization, and he had no authorization."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
6/27/2013 | 4:39:15 PM
re: FBI Arrests NYPD Detective On Hacking Charges
This is not only a corrupt police officer
seriously abusing the power has, in addition his personal insecurities are at
the cost of the American people. Good job Samad
Shahrani for catching the abuse in action. There should be a test for these law
enforcement officials who are that high up to test for traits in the area of
power of abuse and if their personalities are going to able to accept the responsibility
and power without abusing it.

Paul Sprague

InformationWeek Contributor
alifaizan
50%
50%
alifaizan,
User Rank: Apprentice
5/23/2013 | 10:11:09 AM
re: FBI Arrests NYPD Detective On Hacking Charges
If the law enforcement officers are breaking the law then how can you expect a normal individual to behave within the ethical boundaries?
there should be strict action who opposes the law even if its the cyber law. there has been huge increase in the rate of cyber crimes not just locally but internationally as well. America is under constant attack by the Chinese army of hackers, they are dealing with enough problems from outside the border and if these things escalate internally then America will have to retaliate and its good hear that they already have (source: http://goo.gl/c20Mm)
Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
Google Adds More Security Features Via Chronicle Division
Robert Lemos, Contributing Writer,  2/25/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9431
PUBLISHED: 2020-02-27
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.
CVE-2020-9432
PUBLISHED: 2020-02-27
openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2020-9433
PUBLISHED: 2020-02-27
openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2020-9434
PUBLISHED: 2020-02-27
openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2020-6383
PUBLISHED: 2020-02-27
Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.