5 ms·

Palin Hacker Caught - Son of Democratic TN State Rep.

42 points by pmorici 18y ago

iamdave 18y ago
He forced a password reset by answering questions about Palin’s birthdate, zip code and where she met her spouse, Wasilla High School. By this admission, the media needs to drop the word "HACK" right now because that's not hacking. That's social engineering.
- tlrobinson 18y ago
  And of course their intent with the word "hack" isn't even close to the original ("Hacker News") sense of the word.
- alaskamiller 18y ago
  There is no difference to MSM.
- sant0sk1 18y ago
  Social engineering is people hacking. He didn't hack any people. He subverted a poorly designed password retrieval mechanism. Just because he didn't use a personally crafted 0-day exploit doesn't mean he wasn't hacking (or cracking, if you're in to semantic debate).
  - iamdave 18y ago
    He subverted a poorly designed password retrieval mechanism. Even better way of putting it, thank you. By all legal definitions this kid should get off scot free but he wont.
    - hugh 18y ago
      I'm pretty sure that "the lock was poorly designed" has never successfully been used as a legal defence by a burglar, and that "but they were so easy to fool" has never successfully been used as a legal defence by a conman, so I'd be surprised if a poorly-designed password retrieval mechanism could be used as a defence in this case. If nothing else, the kid committed some kind of fraud by telling the system he was Sarah Palin when in fact he wasn't.
      - iamdave 18y ago
        If nothing else, the kid committed some kind of fraud by telling the system he was Sarah Palin when in fact he wasn't I've also never heard of a case where someone told a computer they were someone they weren't and prosecuted on that alone or any sort of 'fraud' in a circumstance like this (though if you want to split hairs, Identity Theft that leads to punitive damages such as credit, or finances is another thing, but still doesn't fit the mold of this particular circumstance) It's a perfectly fine defense, all things said. He retrieved the information he needed, he used the system the way it was built to be used and the system did what it was supposed to do. There is NOTHING illegal about lying to a computer system in this situation. The burglar analogy only makes even a bit of sense if the burglar illegally obtained a key, made a copy of it and THEN gained access to the home. For the intents of this discussion, that's all this rubico person did. He obtained a key to the home, used the key to it's intended purpose and gained access.
        mynameishere 18y ago
        Drop it. He could be legitimately prosecuted for everything from identity theft to electoral fraud.
        ars 18y ago
        Simply having a key does not give you the right to use it.
        mseebach 18y ago
        > he used the system the way it was built to be used and the system did what it was supposed to do. So, if I go to the mailbox outside your home (assuming the classic unlocked US design) after the mailman leave, pick up your mail, open the envelopes and post what I find on /b/, you're just gonna shrug and blame yourself for using such a badly designed security mechanism? You know, when I open your letters, the envelope does exactly what it's supposed to do, so I'm not committing a crime, right?
- mattmaroon 18y ago
  Not even that. Social engineering would be if he tricked Palin into divulging the information. It's really just being able to use Google.
- deleted 18y ago
  [deleted]
- deleted 18y ago
  [deleted]
hugh 18y ago
Well, this settles the question, posted in an earlier thread, about whether the culprit was very very smart or very very stupid. (Unless, of course, this guy is innocent, in which case the real culprit was very very smart.) In other news, I sure hope everyone who feels compelled to express an opinion about what should happen to this kid now will stop for a moment and consider whether their opinion would be the same if he were the son of a Republican senator and got caught doing the same thing to a Democratic candidate, and to make absolutely sure that their opinion would be the same either way.
- davidw 18y ago
  > I sure hope everyone who feels compelled to express an opinion... ... will do so elsewhere?
  - hugh 18y ago
    Oh I don't know, I think that "suitable punishments for computer criminals" is perfectly on-topic, as long as it's not too infected by boring politics.
    - qqq 18y ago
      And you think that your view that politics is boring is on-topic?
      - hugh 18y ago
        Perhaps it's more meta-ontopic.
        qqq 18y ago
        Do you think the view that politics is not boring is on topic (or meta-on-topic)?
- DanielBMarkham 18y ago
  I'd like to second that. I'm for punishing the kid just the same as if he had stolen checks and started writing checks against somebody's account. My concern is that this will be a special case -- either giving the kid more punishment than normal or less punishment. Just guessing, I'm thinking a white-collar crime that involved no use of violence? 6 months to 2 years maybe? Now is there an additional crime for political espionage in the course of trying to throw an election? I believe so, or at least that there should be. I think if you commit a felony in the process of trying to sway political opinion that should pump up the punishment some. As an example I use the Watergate burglars, who were anything but run-of-the-mill crooks (and got punished more than first time burglars as well, if I remember correctly) Crime with deliberate political implications, whether violent or not, should be treated more harshly. Perhaps this kid didn't break into Palin's account to sway public opinion. I don't know enough about the case to determine that.
Prrometheus 18y ago
One proxy is never enough. You need more. Like seven.
- qqq 18y ago
  Over 9000.
- lallysingh 18y ago
  Like tor?
  - eru 18y ago
    Tor uses three at a time.
vaksel 18y ago
does anyone here really think that a "l33t hax0r" was dumb enough to post a screen with the proxy url visible?
- newt0311 18y ago
  Then again, you don't have to be very l33t to do what he did.
froo 18y ago
You can pretty much call the election right there gentleman. I don't have any political preference in the matter (I'm an Aussie), but I predict that Republican extremists are going to take this and run with it as far as possible. Not only are people going to see the Palin/McCain team as the underdog, because everyone loves an underdog, but they'll also be portrayed as the victim of evil attacks by the democrats (even though it was his son, and I'm sure his son has little political preferences yet) That just sucks and frankly it scares the living shit out of me that someone like Palin could potentially end up being the "leader of the free world" when she has shown some incredibly odd positions over time. EDIT - just adding this in as a clarification incase anyone wants to call this anti-right propaganda (as I saw myself downmodded earlier, if anything I'm anti-noob) I've got no problem whatsoever with McCain being President if his age wasn't a factor. He's earned his right. It's just that there is a growing anti-American sentiment in the rest of the world (I see it all the time in Aus) and it would be a step backwards to have someone like Palin being literally a heartbeat away from the top spot, especially with the absolute mess that it appears Bush has made. You guys need a leader, not a pretty face.
- anamax 18y ago
  > It's just that there is a growing anti-American sentiment in the rest of the world Of course there is - you feel safe. When that changes, you'll be pro-American again. Yes, we've noticed that when something bad happens, it's always "When will the Americans get here to help?" and (annoyingly often) "Why didn't the US stop {whatever} from happening to us?" Feel free to rely on the Euros instead. Heck, maybe the Chinese or Russians will come through. BTW - Your assumption that Americans should care about how "the world" feels is probably wrong. Yes, I know that you think that we should, but ....
  - froo 18y ago
    Wow.. just wow, there is so much I can say about your comment that I'm curious if you're just trolling. I'll answer you anyway. At what point have I ever said (or implied) I was anti-American on this site, or any other site (I use a similar handle on every site, so it can be verified) or for that matter EVER. The answer? Never, because I am simply not anti-American. Your kind of insular attitude proves exactly what I'm saying. EDIT - For the record: I thought the Americans and the Aussies were allies? Why else were the British and the Aussies the first 2 countries to sign up for the coalition on the willing and along with the American and British the only countries that provided significant military presence in the gulf (http://news.bbc.co.uk/2/hi/americas/2862343.stm http://news.bbc.co.uk/2/hi/americas/2862343.stm) Didn't we also send troops to Afghanistan? Both of these military actions were unpopular in Australia from day zero and both of which hurt trade agreements in the middle east for us (depending on who you talk too, some have suggested it has increased our chances for retaliatory terrorist acts, I simply don't know though), but we went anyway. Also, moving away from military alliances, we only had a change of Government last year so things have changed since but for a while, both the Americans and the Australians were the only 2 countries to have not signed the Kyoto Protocol. This was mostly due to Howard wanting to not have the Americans as the only country as not having signed (he was very pro-american). Within a week of a change of government, Rudd had signed and it was well received by the public.
bbb 18y ago
Hypothetically, it is really easy get away with something like this: 1) Go to a well-trafficked coffee shop that you've never been to before. Pay with cash. 2) Use a bootable Linux CD or a virtual machine for the actual "attack." (Xen, VMWare, anything.) 3) Spoof your wireless MAC address. (if you are paranoid) 4) Perform your "special investigation." Post your info to wikileaks. 5) Reboot without the Linux CD or securely delete the virtual machine when you are done. 6) Don't brag about it. See, you don't even need a proxy. It's not that hard. How can anyone be so stupid to get caught anyway?
- ryanwaggoner 18y ago
  1.5) ensure the coffee shop has no security cameras
  - bbb 18y ago
    Good point. But if there are a lot of laptop-using customers even a security camera shouldn't be too much of a problem. After all, just being there is not a crime in itself. And wiping your system will delete all evidence that could link you to any log files.
  - tlrobinson 18y ago
    Or devise some system that can autonomously sniff from inside a laptop. Even better, use a tiny embedded Linux device like gumstix (http://www.gumstix.com/ http://www.gumstix.com/). You could even hide it somewhere and leave, let it do it's thing, and either pick it up later, or have it transmit it's findings to you over the net (through some anonymous proxy, of course) And this is why SSL is important.
  - mattmaroon 18y ago
    Just don't go inside the coffee shop. Do it from a car or the restaurant next door, just to be safe. Or better yet, drive down the road looking for a resident with an unprotected WiFi connection.
- Alex3917 18y ago
  If you are going to go into town anyway, why not just go to the library and use their computers?
KevBurnsJr 18y ago
zip archive on wikileaks http://wikileaks.org/wiki/Sarah_Palin_Yahoo_inbox_2008 http://wikileaks.org/wiki/Sarah_Palin_Yahoo_inbox_2008
rsheridan6 18y ago
AFAICT, what we know at this point is that Palin's email was hacked and somebody claiming that Kernell's email address was theirs claimed to have done it on 4chan. I think it's a little irresponsible to have a headline that shouts "Palin Hacker Caught" when he hasn't admitted to it, been convicted of it, or even been charged yet. I'm not saying he didn't do it, but internet trolls have been known to attribute their actions to others before.
- pmorici 18y ago
  That's a good point, the person in question could also have had their computer compromised and are being framed...
- BrandonM 18y ago
  Agreed. I flagged the submission for having a sensationalist, unfounded, unnecessarily-political headline.
ajkirwin 18y ago
I'm not so sure that he should be prosecuted at all. The equivalence to this is breaking into someone's house.. by asking their two year old if they can go inside and for the key. It's an equivalent level of security.
- ars 18y ago
  If you asked a two year old if you can come in and did, you would/could be prosecuted. For trespassing amongst other crimes. Two year olds do not have legal capacity to consent. Technically you could be prosecuted if a 15 year old let you in - although you probably wouldn't be. It depends on the parents. And it depends on what you did - specifically did you commit an additional crime while there. Reading someones private email is a crime, as is posting it, as is trying to mess with an election. If you told the kid a lie in order to get in you could also be prosecuted for fraud. Just because you can, does not mean you should.
noahlt 18y ago
So it wasn't Anonymous, since he was posting as 'Rubico'.
nihilocrat 18y ago
This guy (I mean whoever did it, not necessarily who the article purports did it) is ultimately pretty dumb; it's one thing to point out "it is easy to break into a public figure's Yahoo email because the security questions rely entirely on security-through-obscurity" but it's another thing to actually do it. Like others have said, the defense provided sounds pretty feasible; I'm no legal expert, so it's very plausible he has done nothing really wrong, and it might be the case where prosecution will lead to a dangerous interpretation of laws that would make "truly" innocent people guilty. As usual, the end result will probably be less about law and more about the candidate involved making sure the situation turns out how she wants it to, the justice system is eager to put people in jail so I figure punishment will be likely. Everyone hates college students, lazy hippies! Also, he should have probably just used TOR. I'm not really that good of a cracker, preferring to instead program useful things and then getting paid for it, so would this have covered his tracks pretty well? Either way, it's pretty amazingly funny to see a /b/tard easily get access to a public figure's email and let 4chan get a hold of it, and then see the news media act like it's some sinister hacker network that did it. Well played.

42 points by pmorici 18y ago

He forced a password reset by answering questions about Palin’s birthdate, zip code and where she met her spouse, Wasilla High School. By this admission, the media needs to drop the word "HACK" right now because that's not hacking. That's social engineering.

tlrobinson 18y ago
And of course their intent with the word "hack" isn't even close to the original ("Hacker News") sense of the word.
alaskamiller 18y ago
There is no difference to MSM.
sant0sk1 18y ago
Social engineering is people hacking. He didn't hack any people. He subverted a poorly designed password retrieval mechanism. Just because he didn't use a personally crafted 0-day exploit doesn't mean he wasn't hacking (or cracking, if you're in to semantic debate).
- iamdave 18y ago
  He subverted a poorly designed password retrieval mechanism. Even better way of putting it, thank you. By all legal definitions this kid should get off scot free but he wont.
  - hugh 18y ago
    I'm pretty sure that "the lock was poorly designed" has never successfully been used as a legal defence by a burglar, and that "but they were so easy to fool" has never successfully been used as a legal defence by a conman, so I'd be surprised if a poorly-designed password retrieval mechanism could be used as a defence in this case. If nothing else, the kid committed some kind of fraud by telling the system he was Sarah Palin when in fact he wasn't.
    - iamdave 18y ago
      If nothing else, the kid committed some kind of fraud by telling the system he was Sarah Palin when in fact he wasn't I've also never heard of a case where someone told a computer they were someone they weren't and prosecuted on that alone or any sort of 'fraud' in a circumstance like this (though if you want to split hairs, Identity Theft that leads to punitive damages such as credit, or finances is another thing, but still doesn't fit the mold of this particular circumstance) It's a perfectly fine defense, all things said. He retrieved the information he needed, he used the system the way it was built to be used and the system did what it was supposed to do. There is NOTHING illegal about lying to a computer system in this situation. The burglar analogy only makes even a bit of sense if the burglar illegally obtained a key, made a copy of it and THEN gained access to the home. For the intents of this discussion, that's all this rubico person did. He obtained a key to the home, used the key to it's intended purpose and gained access.
      - mynameishere 18y ago
        Drop it. He could be legitimately prosecuted for everything from identity theft to electoral fraud.
      - ars 18y ago
        Simply having a key does not give you the right to use it.
      - mseebach 18y ago
        > he used the system the way it was built to be used and the system did what it was supposed to do. So, if I go to the mailbox outside your home (assuming the classic unlocked US design) after the mailman leave, pick up your mail, open the envelopes and post what I find on /b/, you're just gonna shrug and blame yourself for using such a badly designed security mechanism? You know, when I open your letters, the envelope does exactly what it's supposed to do, so I'm not committing a crime, right?
mattmaroon 18y ago
Not even that. Social engineering would be if he tricked Palin into divulging the information. It's really just being able to use Google.
deleted 18y ago
[deleted]
deleted 18y ago
[deleted]

hugh 18y ago

Well, this settles the question, posted in an earlier thread, about whether the culprit was very very smart or very very stupid. (Unless, of course, this guy is innocent, in which case the real culprit was very very smart.) In other news, I sure hope everyone who feels compelled to express an opinion about what should happen to this kid now will stop for a moment and consider whether their opinion would be the same if he were the son of a Republican senator and got caught doing the same thing to a Democratic candidate, and to make absolutely sure that their opinion would be the same either way.

davidw 18y ago
> I sure hope everyone who feels compelled to express an opinion... ... will do so elsewhere?
- hugh 18y ago
  Oh I don't know, I think that "suitable punishments for computer criminals" is perfectly on-topic, as long as it's not too infected by boring politics.
  - qqq 18y ago
    And you think that your view that politics is boring is on-topic?
    - hugh 18y ago
      Perhaps it's more meta-ontopic.
      - qqq 18y ago
        Do you think the view that politics is not boring is on topic (or meta-on-topic)?
DanielBMarkham 18y ago
I'd like to second that. I'm for punishing the kid just the same as if he had stolen checks and started writing checks against somebody's account. My concern is that this will be a special case -- either giving the kid more punishment than normal or less punishment. Just guessing, I'm thinking a white-collar crime that involved no use of violence? 6 months to 2 years maybe? Now is there an additional crime for political espionage in the course of trying to throw an election? I believe so, or at least that there should be. I think if you commit a felony in the process of trying to sway political opinion that should pump up the punishment some. As an example I use the Watergate burglars, who were anything but run-of-the-mill crooks (and got punished more than first time burglars as well, if I remember correctly) Crime with deliberate political implications, whether violent or not, should be treated more harshly. Perhaps this kid didn't break into Palin's account to sway public opinion. I don't know enough about the case to determine that.

Prrometheus 18y ago

One proxy is never enough. You need more. Like seven.

qqq 18y ago
Over 9000.
lallysingh 18y ago
Like tor?
- eru 18y ago
  Tor uses three at a time.

vaksel 18y ago

does anyone here really think that a "l33t hax0r" was dumb enough to post a screen with the proxy url visible?

newt0311 18y ago
Then again, you don't have to be very l33t to do what he did.

froo 18y ago

You can pretty much call the election right there gentleman. I don't have any political preference in the matter (I'm an Aussie), but I predict that Republican extremists are going to take this and run with it as far as possible. Not only are people going to see the Palin/McCain team as the underdog, because everyone loves an underdog, but they'll also be portrayed as the victim of evil attacks by the democrats (even though it was his son, and I'm sure his son has little political preferences yet) That just sucks and frankly it scares the living shit out of me that someone like Palin could potentially end up being the "leader of the free world" when she has shown some incredibly odd positions over time. EDIT - just adding this in as a clarification incase anyone wants to call this anti-right propaganda (as I saw myself downmodded earlier, if anything I'm anti-noob) I've got no problem whatsoever with McCain being President if his age wasn't a factor. He's earned his right. It's just that there is a growing anti-American sentiment in the rest of the world (I see it all the time in Aus) and it would be a step backwards to have someone like Palin being literally a heartbeat away from the top spot, especially with the absolute mess that it appears Bush has made. You guys need a leader, not a pretty face.

anamax 18y ago
> It's just that there is a growing anti-American sentiment in the rest of the world Of course there is - you feel safe. When that changes, you'll be pro-American again. Yes, we've noticed that when something bad happens, it's always "When will the Americans get here to help?" and (annoyingly often) "Why didn't the US stop {whatever} from happening to us?" Feel free to rely on the Euros instead. Heck, maybe the Chinese or Russians will come through. BTW - Your assumption that Americans should care about how "the world" feels is probably wrong. Yes, I know that you think that we should, but ....
- froo 18y ago
  Wow.. just wow, there is so much I can say about your comment that I'm curious if you're just trolling. I'll answer you anyway. At what point have I ever said (or implied) I was anti-American on this site, or any other site (I use a similar handle on every site, so it can be verified) or for that matter EVER. The answer? Never, because I am simply not anti-American. Your kind of insular attitude proves exactly what I'm saying. EDIT - For the record: I thought the Americans and the Aussies were allies? Why else were the British and the Aussies the first 2 countries to sign up for the coalition on the willing and along with the American and British the only countries that provided significant military presence in the gulf (http://news.bbc.co.uk/2/hi/americas/2862343.stm http://news.bbc.co.uk/2/hi/americas/2862343.stm) Didn't we also send troops to Afghanistan? Both of these military actions were unpopular in Australia from day zero and both of which hurt trade agreements in the middle east for us (depending on who you talk too, some have suggested it has increased our chances for retaliatory terrorist acts, I simply don't know though), but we went anyway. Also, moving away from military alliances, we only had a change of Government last year so things have changed since but for a while, both the Americans and the Australians were the only 2 countries to have not signed the Kyoto Protocol. This was mostly due to Howard wanting to not have the Americans as the only country as not having signed (he was very pro-american). Within a week of a change of government, Rudd had signed and it was well received by the public.

bbb 18y ago

Hypothetically, it is really easy get away with something like this: 1) Go to a well-trafficked coffee shop that you've never been to before. Pay with cash. 2) Use a bootable Linux CD or a virtual machine for the actual "attack." (Xen, VMWare, anything.) 3) Spoof your wireless MAC address. (if you are paranoid) 4) Perform your "special investigation." Post your info to wikileaks. 5) Reboot without the Linux CD or securely delete the virtual machine when you are done. 6) Don't brag about it. See, you don't even need a proxy. It's not that hard. How can anyone be so stupid to get caught anyway?

ryanwaggoner 18y ago
1.5) ensure the coffee shop has no security cameras
- bbb 18y ago
  Good point. But if there are a lot of laptop-using customers even a security camera shouldn't be too much of a problem. After all, just being there is not a crime in itself. And wiping your system will delete all evidence that could link you to any log files.
- tlrobinson 18y ago
  Or devise some system that can autonomously sniff from inside a laptop. Even better, use a tiny embedded Linux device like gumstix (http://www.gumstix.com/ http://www.gumstix.com/). You could even hide it somewhere and leave, let it do it's thing, and either pick it up later, or have it transmit it's findings to you over the net (through some anonymous proxy, of course) And this is why SSL is important.
- mattmaroon 18y ago
  Just don't go inside the coffee shop. Do it from a car or the restaurant next door, just to be safe. Or better yet, drive down the road looking for a resident with an unprotected WiFi connection.
Alex3917 18y ago
If you are going to go into town anyway, why not just go to the library and use their computers?

KevBurnsJr 18y ago

zip archive on wikileaks http://wikileaks.org/wiki/Sarah_Palin_Yahoo_inbox_2008 http://wikileaks.org/wiki/Sarah_Palin_Yahoo_inbox_2008

rsheridan6 18y ago

AFAICT, what we know at this point is that Palin's email was hacked and somebody claiming that Kernell's email address was theirs claimed to have done it on 4chan. I think it's a little irresponsible to have a headline that shouts "Palin Hacker Caught" when he hasn't admitted to it, been convicted of it, or even been charged yet. I'm not saying he didn't do it, but internet trolls have been known to attribute their actions to others before.

pmorici 18y ago
That's a good point, the person in question could also have had their computer compromised and are being framed...
BrandonM 18y ago
Agreed. I flagged the submission for having a sensationalist, unfounded, unnecessarily-political headline.

ajkirwin 18y ago

I'm not so sure that he should be prosecuted at all. The equivalence to this is breaking into someone's house.. by asking their two year old if they can go inside and for the key. It's an equivalent level of security.

ars 18y ago
If you asked a two year old if you can come in and did, you would/could be prosecuted. For trespassing amongst other crimes. Two year olds do not have legal capacity to consent. Technically you could be prosecuted if a 15 year old let you in - although you probably wouldn't be. It depends on the parents. And it depends on what you did - specifically did you commit an additional crime while there. Reading someones private email is a crime, as is posting it, as is trying to mess with an election. If you told the kid a lie in order to get in you could also be prosecuted for fraud. Just because you can, does not mean you should.

noahlt 18y ago

So it wasn't Anonymous, since he was posting as 'Rubico'.

nihilocrat 18y ago

This guy (I mean whoever did it, not necessarily who the article purports did it) is ultimately pretty dumb; it's one thing to point out "it is easy to break into a public figure's Yahoo email because the security questions rely entirely on security-through-obscurity" but it's another thing to actually do it. Like others have said, the defense provided sounds pretty feasible; I'm no legal expert, so it's very plausible he has done nothing really wrong, and it might be the case where prosecution will lead to a dangerous interpretation of laws that would make "truly" innocent people guilty. As usual, the end result will probably be less about law and more about the candidate involved making sure the situation turns out how she wants it to, the justice system is eager to put people in jail so I figure punishment will be likely. Everyone hates college students, lazy hippies! Also, he should have probably just used TOR. I'm not really that good of a cracker, preferring to instead program useful things and then getting paid for it, so would this have covered his tracks pretty well? Either way, it's pretty amazingly funny to see a /b/tard easily get access to a public figure's email and let 4chan get a hold of it, and then see the news media act like it's some sinister hacker network that did it. Well played.