Student in Sarah Palin e-mail hacking case indicted

By Joshua S Hill Oct 8, 2008, 19:38 GMT

Vice Presidential candidate Alaska Governor Sarah Palin looks at her rival, Senator Joseph Biden, during the Vice presidential debate at Washington University in St. Louis, Missouri, USA, 02 October 2008. EPA/WHITNEY CURTIS

David Kernell, a 20 year old Tennessee college student, has turned himself into FBI custody and will be arraigned later on Wednesday for the alleged hacking of Governor Sarah Palin’s Yahoo email account.

Kernell came under suspicion early on in the case after a number of internet users tracked evidence back to him. He has been indicted by a federal grand jury, announced the US Department of Justice.

The hacker was identified as ‘rubico’ on the forum where images of Sarah Palin’s emails were posted. From there users linked the user to the e-mail address ‘rubico10 at yahoo.com’, which in turn led to David Kernell via connections between the username, his email address and websites like YouTube.com.

Days later saw Gabriel Ramuglia able to trace ‘rubico’ back to the IP address of Kernell’s Internet Service Provider. The FBI subsequently searched Kernell’s apartment on September the 21st.

According to the grand jury’s indictment, Kernell hacked into the Alaska governor’s ‘gov.palin at yahoo.com’ email address on or about the 16th of September using Yahoo’s password reset mechanism. According to the indictment, “…he [Kernell] reset the password to 'popcorn' by researching and correctly answering a series of personal security questions,"

Yahoo Mail, along with Google’s Gmail and Microsoft’s Hotmail, use a password-reset mechanism that can be hacked using social engineering. By simply finding out enough facts, often publically available via websites like Facebook or LiveJournal, users can guess the security questions and reset the password.