📸 Photo

OPERATION FIREWALL

to gain Anonyman’s trust, and the hacker finally revealed himself as Ethics, a vendor whom Cumba already knew on Shadowcrew.

The leak was starting to make sense. In March, the Secret Service had noticed Ethics was selling access to the database of a major wireless carrier, T-Mobile. "I am offering reverse lookup of information for a T-Mobile cell phone, by phone number," he wrote in a post. "At the very least, you get name, SSN, and DOB. At the upper end of the information returned, you get Web username/password, voicemail password, secret question/answer."

T-Mobile had failed to patch a critical security hole in a commercial server application it had purchased from the San Jose, California, company BEA Systems. The hole, discovered by outside researchers, was painfully simple to exploit: An undocumented function allowed anyone to remotely read or replace any file on a system by feeding it a specially crafted Web request. BEA produced a patch for the bug in March 2003 and issued a public advisory rating it a high-severity vulnerability. In July of that year, the researchers who discovered the hole gave it more attention by presenting it at the Black Hat Briefings convention in Las Vegas, an annual pre-Def Con gathering attended by 1,700 security professionals and corporate executives.

Ethics learned of the BEA hole from the advisory, crafted his own twenty-line exploit in Visual Basic, then began scanning the Internet for potential targets who had failed to patch. By October 2003, he hit pay dirt at T-Mobile. He wrote his own front end to the customer database to which he could return at his convenience.

At first, he used his access to raid the files of Hollywood stars, circulating grainy candid photos of Paris Hilton, Demi Moore, Ashton Kutcher, and Nicole Richie stolen from their Sidekick PDAs. It was evident now that he’d gotten into a Secret Service agent’s Sidekick as well.

A simple Google search on Ethics’s ICQ number turned up his real name on a 2001 résumé seeking computer security work. He was Nicholas Jacobsen, a twenty-one-year-old Oregonian who’d recently relocated