You would imagine in this advanced era of nationalist hackers and skilled internet conmen that the candidates for president and vice president would have beefed up security on their email accounts, and perhaps would not use the standard version of online services. That logic proved incorrect with the recent revelation that Republican vice presidential candidate Sarah Palin's email was hacked by a protest group.
The group 'anonymous', famous for its successful protests against scientology, and attacks on scientology's online presence due to its censorship tactics, claimed responsibility for this hack. However, Gov. Palin's email account shows signs of in-fighting amongst the group.
Governor Palin had been using two yahoo accounts -- gov.palin@yahoo.com and her unrelated gov.sarah@yahoo.com -- both of which have since been deleted. Hackers gained access to the first account on Tuesday, September 16. The hackers, according to the whistle-blowing site WikiLeaks, were "loosely affiliated" with 'anonymous' and passed information to WikiLeaks following the hack.
Hackers gained access to the account by tricking Yahoo's password recovery system, by using information such as Gov. Palin's zip code and birth date, which were widely available online or easily determined. With the password in hand they accessed her account. All their activities were done using the CTunnel proxy service.
The FBI is investigating the breach and is demanding CTunnel turn over its records. CTunnel has thus far refused. It appears that the hackers may have left the original web address used by the proxy in one of their screenshots, which the FBI is also hoping to use to track the perpetrators. If so, this would be a huge hacking gaff. However, there is a very real possibility that the address may be a ruse as well.
It appears that there is also infighting among the group 'anonymous' over the attack. An individual identifying himself as the 'good anonymous' sent an email to the account which may have first revealed the attack. He states, "You don't know me, but I am part of an internet group. We call ourselves anonymous. This email was hacked by anonymous, but I took no part in that. I simply got the password back, and changed it so no further damage could be done."
Yahoo said of the incident, "Yahoo treats issues of security and privacy very seriously. To protect the privacy of our users, we are not able to comment on the details of a specific user account. Generally, if Yahoo! receives reports that an account has been compromised, we investigate for suspicious activity and take appropriate action."