Slashdot Log In
Palin Email Hacker Found
Posted by
Soulskill
on Sun Sep 21, 2008 01:01 PM
from the do-not-pass-go dept.
from the do-not-pass-go dept.
mortonda writes to tell us that the person responsible for breaching Sarah Palin's private email account has been found. We discussed the breach last Wednesday, shortly before the hacker, a University of Tennessee-Knoxville student, posted a message detailing his methods. Wired has a story examining the potential legal consequences for the hacker.
Related Stories
[+]
"Anonymous" Hacks Palin's Private Email 1733 comments
netbuzz writes "'Anonymous,' best known for its jousts with Scientology, has apparently hacked Sarah Palin's private Yahoo email account. Contents, including sample emails, an index, and family photos, have been posted by Wikileaks, which calls them evidence that the GOP vice presidential candidate has improperly used private email to shield government business from public scrutiny." Note that there is no easy way to tell if the material on Wikileaks is genuine or a hoax. Update by J : Genuine.
[+]
Court Rules That Palin Must Save Yahoo Emails 33 comments
quarterbuck writes "An Anchorage judge has ruled that Governor Sarah Palin must save her emails, as they were apparently used for state business. Last week a Tennessee man was arrested over hacking one of her Yahoo email accounts. The Washington Post also reports that Sarah Palin, her husband, and officials had set up email accounts known only to each other."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
This Just In (Score:5, Insightful)
Cracker is an idiot. Ever hear of Tor [wikipedia.org]? Or better yet, post the information on something like Freenet [wikipedia.org] and just advertise it on Freenet somehow and let other people get the information out to the main web.
Of course, the fact that he posted his nick on /b/ when it's usually forced-anon anyway means he basically confessed. Not to mention that he said which proxy service he used -- note to criminals: if you want to get away with something, don't brag about how you did it!
Re:This Just In (Score:5, Funny)
Unless someone just compromised that forum account and framed him.
Parent
Re:This Just In (Score:5, Informative)
Parent
Re:This Just In (Score:5, Informative)
He put a name he uses elsewhere in the name field. That name was then connected to an email account.
Parent
Re:This Just In (Score:5, Insightful)
Let's say it like this: He or she is no hacker or cracker. It is just a usual internet user who did not obtain great skill.
Lessons:
* government users should not take yahoo (who ever came to that idea?)
* Anonymous communication matters
* Activities of governments should be transparent.
* It may help a person to become vice president who appears to be a nightmare and encourage anti-hacking regulations. Fortunately S. Palin has close affiliations with witch hunters. [youtube.com]
Parent
Re:This Just In (Score:5, Insightful)
The whole reason Palin is using Yahoo instead of government sponsored email is that any email sent through those channels is archived for a Very Long Time as a matter of public record. Wondering what the clerk at the DMV is REALLY emailing about? Put in a freedom of information act request and it's all yours.
By Palin using yahoo, it's not closely watched and she can conduct official business off the record. It's very poor form to do so and is the real story here.
Parent
Re:This Just In (Score:5, Insightful)
I have trouble understanding why we put people with such obvious contempt for the law in positions that are in charge of it.
Parent
Re:This Just In (Score:5, Insightful)
I have trouble understanding why we put people with such obvious contempt for the law in positions that are in charge of it.
Brilliant marketing, and the general public's desire to believe what they're told in hopes that it will come true. If the general public were half as smart as we give them credit for the world would have never seen Napoleian, Cesar (well actually the Romans solved that problem on their own), Castro, Hugo Chavez and more. But as the protestants like to point out, people are like sheep and will head in whatever direction the man who speaks softly but carries a big stick says.
Parent
Re:This Just In (Score:5, Informative)
Email is a lot easier to record? There's always been a divide between the written and spoken word, from business deals (oral contract is only binding up to $500 in Florida), to courtroom hearings (hearsay, your word vs. mine, etc). You can request copies of government memos; email is electronic mail; it stands to reason that any official written communication should be kept. Lots of meetings are held behind closed doors because there's no written record for public consumption.
There's lots of other cases where emails are available for public consumption; for instance emails back to 1996 for the Seattle metro service are all available for review. On the flip side you have a matter of public record, historical records for data mining, and more. Imagine how boring history would have been if we didn't have access to Benjamin Franklin, George Washington, Abraham Lincoln's personal letters today?
Governors aren't required to record their telephone conversations, although I know Nixon was a fan of doing so - which is partially what got him in trouble in the first place. I'm not sure what the outcome was in court about whether those are considered personal or not. I know in most states both parties have to be aware of the conversation being recorded. In Virginia(?) only one party is required to know that the conversation is being recorded.
Parent
Because Yahoo is not for gov business. (Score:5, Insightful)
http://voices.washingtonpost.com/the-trail/2008/09/17/palins_yahoo_account_hacked.html [washingtonpost.com]
Among the e-mails released as part of the records request in June were several from Frye asking a state official whether private e-mail accounts and messages sent to BlackBerry devices are immune to subpoena, then reporting the answer to the governor and her husband, Todd, who also uses a Yahoo! mail address.
Asking if Yahoo accounts are subject to subpoena and relaying the answer to the governor suggests to me that the accounts were not simple private email accounts.
Parent
Re:Why can't a government employee use Yahoo? (Score:5, Informative)
Most of the newsbits explicitly mention that "Governor Palin has come under media criticism in the past week for using private email accounts to avoid Alaskan freedom of information laws." Neither of you seem to have even read the original story?!
Parent
Re:This Just In (Score:5, Insightful)
She wasn't using the account for gov business, at least not based on what was posted on wikileaks, or according to the purported "Hacker". It was personal e-mail, in some cases about how she and others were being treated personally in the political arena, but not anything related to official government business.
As Officer Bar Brady says "Nothin to see here, move along now".
Yeah, the emails with "CONFIDENTIAL" in the subject line from other officials in her administration really screamed "Not official government business" to me, too.
Parent
Re:This Just In (Score:5, Insightful)
Let's say it like this: He or she is no hacker or cracker. It is just a usual internet user who did not obtain great skill.
Lessons:
* government users should not take yahoo (who ever came to that idea?)
* Anonymous communication matters
* Activities of governments should be transparent.
* It may help a person to become vice president who appears to be a nightmare and encourage anti-hacking regulations. Fortunately S. Palin has close affiliations with witch hunters. [youtube.com]
Oh please. Here's the real lessons learned:
1. Don't make your security question anything that can be found online or don't discuss anything about it online (hers was where she and her husband met).
2. Don't enter your real birthdate anywhere online. Again, what places really need this for an online account except "social networking" sites? Even then, anyone you know is probably going to know when your birthday is anyway.
3. Don't use your real zip code.
All of the above would have completely prevented this "hack". It's not difficult to make up a birth date and use that instead. Same goes for a zip code (12345 anyone?).
Parent
step to step guide how not to get caught (Score:5, Funny)
2) Find open wifi network, choose a place far from where you live
3) Connect to TOR and do your dirty deeds
4) Clean finger prints from PC and trash it, far from where you live
OR
1) Goto internet cafe, ensure cafe has no security cameras
2) Pay with cash
3) Connect to TOR and do your dirty deeds
4) Clean finger prints from computer
Profit?
Re:"Hacker" (Score:5, Insightful)
It is usually the easiest way for a lot of systems; that, or just ask the user and they will tell you.
Parent
Re:"Hacker" (Score:5, Informative)
If you have followed the story, he didn't guess the password. He used publicly available information to fool Yahoo's password recovery tool to give it up.
As simple as it may sound, it is a bit more involved than 'guessing' a password.
Parent
Re:"Hacker" (Score:5, Insightful)
If you have followed the story, he didn't guess the password. He used publicly available information to fool Yahoo's password recovery tool to give it up.
And somehow that turned into headlines that say:
Palin Email Hacker Impersonated Her, Stole Password
http://www.google.com/search?q=palin+impersonated [google.com]
Even the Associated Press went down that road.
Parent
Re:"Hacker" (Score:5, Interesting)
Not even password guessing. He apparently took public information about her and reset the password.
If anyone wondered if demanding date of birth, home town, etc. was a BAD way of determining identity, this should resolve that for them.
Parent
Re:"Hacker" (Score:5, Insightful)
First, it wasn't password guessing. He exploited Yahoo's password recovery system to get it to reset her password. He basically used public information to pose as Palin and convince Yahoo's password recovery system that he needed the password reset. Exploiting such a weakness in the system is, by any standards, "hacking".
Second, after he got in, he than went through all of her e-mail. Breaking into a system, even if it had been a password guess, and then going through its contents is again, by any standard standard, hacking.
I loath Palin, but this guy is going to get what he has coming. Even shitty and crazy humans who think the world is a few thousand years old and much to my horror might be president one day, get legal protection. It isn't like the police can go, "Yeah, he hacked in, but Palin kinda sucks, so I think we will let this one slide".
Parent
Re:Important (Score:5, Insightful)
If he's a student, I hope Palin opts not to press charges, or pushes for a slap-on-the-wrist. Some kind of punishment that will sting, but won't be career ending.
No, they are *already* useless for private communication. Email is sent in plaintext across networks, and regardless of prosecution, the attack vector used here is a pretty easy one. If your email is unencrypted, or you're using easily looked-up information as passwords or recovery questions, then it's not private. period.
It would almost be better not to prosecute at all, if it has the effect of making people aware of, and take precautions against, the complete lack of privacy already extant.
Parent
Re:Public Records (Score:5, Informative)
Why is Sarah Palin using a private account when she is Governor?
Because there are laws in place that say what you can and cannot do with government services and equipment. What you do not seem to get is she was abiding by these laws. Thats why she has 2 (or more) email accounts. The hacker ought to be prosecuted, he even said he did it with malicious intent
I really wanted to get something incriminating which I was sure there would be
but guess what? he found squat and diddly.
I read though the emails... ALL OF THEM... before I posted, and what I concluded was anticlimactic, there was nothing there, nothing incriminating, nothing that would derail her campaign as I had hoped, all I saw was personal stuff, some clerical stuff from when she was governor.... And pictures of her family
Parent
You can't conduct state buisness. (Score:5, Insightful)
A number of those emails seem to be very state-businessy looking at who they are all from. And apparently they were using those accounts in order to have the ability to quickly delete any email they wanted rather than be subject to maintaining them for FOIA requests.
Parent
Re:Public Records (Score:5, Informative)
Why is Sarah Palin using a private account when she is Governor?
Because there are laws in place that say what you can and cannot do with government services and equipment. What you do not seem to get is she was abiding by these laws. Thats why she has 2 (or more) email accounts. The hacker ought to be prosecuted, he even said he did it with malicious intent
That's not why she uses personal e-mail accounts for state business. [nytimes.com]
Interviews show that Ms. Palin runs an administration that puts a premium on loyalty and secrecy. The governor and her top officials sometimes use personal e-mail accounts for state business; dozens of e-mail messages obtained by The New York Times show that her staff members studied whether that could allow them to circumvent subpoenas seeking public records.
Parent
Re:Public Records -- The Catch-22 (Score:5, Insightful)
As for the hacker, hopefully the Feds will give him a nice long stay in a real PMITA prison with a guy named Bubba.
Your post was great until you said this. People should be punished according to sentences under the law, not subjected to the arbitrary abuse of other prisoners.
Parent
Re:Equal punishment? (Score:5, Informative)
Parent