Palin's email account hacked via social engineering
Published: 19 Sep 2008 15:04 BST
Details describing how someone hacked into the Yahoo Mail account of Republican vice presidential candidate Sarah Palin (pictured) emerged on Thursday.
The hack appears to have been accomplished through little more than social engineering, the process of acquiring personal information through social manipulation. The hackers exploited known weaknesses in Yahoo Mail's password-recovery feature.
The Knoxville News Sentinel reported that a 20-year-old University of Tennessee student has been contacted in connection to the federal investigation of the break-in.
Since Tuesday, anonymous posters using a forum on the 4chan.org website have been circulating password-protected zip files containing the contents of the now-deleted email account once belonging to Palin. Various posts to the /b/ board have also provided insight into how the hack was carried out.
Like most web account services, Yahoo Mail provides an option to reset or recover one's user name and password. What is unclear is how the account recovery was rerouted from the alternative email address chosen by Palin to a secondary email address.
One poster said it took only 15 seconds on Wikipedia to answer Yahoo Mail's prompt for Palin's birthday.
As regards the prompt for a ZIP code, Wasilla, Alaska, has only two ZIP codes.
However, Palin's personal security question — 'Where did you meet your spouse?' — did slow the process down. The poster claimed it took several tries before they eventually hit upon the correct answer: Wasilla High School.
Webmail accounts are not alone in using online security questions.
In May, Acxiom, a Little Rock, Arkansas-based data-warehouse company, announced it was introducing a biographical authentication service that asks users of online banking and e-commerce sites random questions based on their personal lives, such as "How many fireplaces are in your current residence?". The answer can be obtained from any US real-estate website.
Credit: Social engineering cracked Palin's e-mail account from CNET News.com
Did you find this article useful?
33 out of 40 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
