September 17th, 2008

Sarah Palin's Yahoo account hijacked, e-mails posted online

Posted by Ryan Naraine @ 10:40 am

Categories: Browsers, Data theft, Exploit code, Hackers, Passwords, Patch Watch, Pen testing, Privacy, Symantec, Web 2.0

Tags: e-Mail Account, Yahoo! Inc., Activist, Sarah Palin, E-mail, Online Communications, Ryan Naraine

On the heels of media reports that Republican vice presidential candidate Sarah Palin was using a private Yahoo e-mail account (gov.palin@yahoo.com) to conduct Alaska state business, hackers have broken into the account and posted evidence of the hijack on Wikileaks.

An activist group calling itself ‘anonymous’ claimed responsibility for the compromise and released screenshots, photographs and the e-mail addresses of several people close to Palin, including her husband Todd and assistant Ivy Frye.

Here’s the announcement from Wikileaks:

Circa midnight Tuesday the 16th of September (EST) Wikileaks’ sources loosely affiliated with the activist group ‘anonymous’ gained access to U.S. Republican Party Vice-presidential candidate Sarah Palin’s Yahoo email account gov.palin@yahoo.com. Governor Palin has come under criticism for using private email accounts to avoid government transparency mechanisms. The zip archive made available by Wikileaks contains screen shots of Palin’s inbox, example emails, address book and two family photos. The list of correspondence, together with the account name, appears to re-enforce the criticism.

The list of e-mails include an exchange with Alaskan Lieutenant Governor Sean Parnell about his campaign for Congress and an e-mail from Amy McCorkell, whom Palin appointed to the Governor’s Advisory Board on Alcoholism and Drug Abuse in 2007.

Wired’s Threat Level reports that McMcCorkell confirmed that she did send the e-mail to Palin.

Following the release of this story, both Sarah Palin’s better known account gov.sarah@yahoo.com and the gov.palin@yahoo.com account have been suspended or deleted as revealed by a test email sent to these addresses by Wikileaks. Although the reasons for the deletion of both accounts can not not yet be established, one interpretation is that Palin is trying to destroy her email records.

Wikileaks said it may release additional e-mails should they prove be of political substance.

Here’s one screenshot of an e-mail released by the group.

* Hat tip: Chris Wysopal, Veracode.  Image via CBS News.