Risk
3/12/2013
12:20 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Hackers Appear To Target Michelle Obama, FBI Director

Michelle Obama is among several public figures whose personal information appeared to be published via a website with a Soviet Union registration; some watchers see signs of hoax.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
First lady Michelle Obama apparently has been doxed.

A website Tuesday published a data dump (aka dox) that included the supposed social security number and last-known Chicago phone numbers for Michelle Obama, as well as a recent credit report from TransUnion in her name. Dated March 11, 2013, that credit report lists multiple bank and credit card accounts, including credit limits, details of any late payments, as well as account numbers, although the last four numbers of each account were starred out.

"Blame your husband, we still love you, Michelle. <3" read a message posted above the information.

The website behind the dox, Exposed.su, began publishing sensitive information on public officials and celebrities Monday. By Tuesday, the list of doxed people had grown to include not just Michelle Obama, but also Vice President Joe Biden, FBI director Robert Mueller, Attorney General Eric Holder and Los Angeles Police Department chief Charlie Beck.

[ The hacktivist group Anonymous has been upping its doxing attacks on business and government. Anonymous Takes On State Department, More Banks. ]

As part of what the site has dubbed "The Secret Files," it also published personal details -- and in some cases, credit reports with last-known addresses and phone numbers -- for Arnold Schwarzenegger, Ashton Kutcher, Beyonce, Britney Spears, Donald Trump, Hulk Hogan, Jay-Z, Kim Kardashian, Mel Gibson, Paris Hilton and Sarah Palin.

Some sites, such as U.S. News & World Report, have commented that the supposed dox looks like a hoax. But at least some of the published information appears to be legitimate. "Social security numbers posted on [Mel] Gibson, Jay-Z and others matched records in public databases," reported AP. Likewise, RT reported that a call to a number listed for Beyonce was transferred to an operator for Gelfand, Rennert & Feldman, which bills itself as "a leading full-service business management firm for entertainers, executives and select high net worth individuals."

The Justice Department is already looking into the alleged dox. "The FBI is investigating," said an FBI spokeswoman when reached by phone, who suggested that the Secret Service would likely also be involved. Reached for comment by phone, a spokesman for the Secret Service said, "We are investigating the matter but we don't have any further comment at this time."

Interestingly, an Exposed.su page that timed out said that the site is using CloudFlare, which is a service designed to maintain high levels of website performance and availability. A spokeswoman for CloudFlare -- reached by phone and asked if Exposed.su was using CloudFlare -- said the company typically doesn't comment on its customers, but noted that anyone can sign up for the service via the CloudFlare website.

She also noted that all clients agree to comply with CloudFlare's terms of service, which state that CloudFlare reserves the right to investigate any of its customers, and that "if the investigation reveals any information, act or omission, which in CloudFlare's sole opinion, constitutes a violation of any local, state, federal or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."

Much of the published information could be used by identity thieves who wanted to impersonate any of the aforementioned figures -- for example, to open a bank account in their name. Celebrity news website TMZ first reported on the hack Monday, and it cited unnamed sources Tuesday who said that criminals have already attempted to put the information to use.

Who's to blame for the dox? A recent tweet from a Twitter account tied to the website -- the Exposed Twitter feed -- contained a Russian message, here translated into English: "Hello world, we are exposed to. Our goal is to show you all that this is only one of a few tricks up his sleeve lone wolves." Some news reports said that an early version of the Exposed site contained anti-police messages written in Russian.

The choice of a ".su" top-level domain for the Exposed.su website also offers clues about the website operator's identity. Notably, many Russian botnet herders have been switching their Zeus command-and-control servers from websites registered with the Russia top-level domain ".ru" to the ".su" domain instead, according to a post to Swiss security blog abuse.ch.

"For those of you who don't know: .su is (or should I say was) the top level domain for the Soviet Union, which we all know doesn't exist any more," according to abuse.ch. "Nevertheless, TLD .su (which is operated by RIPN) is still active today which means that people can still register domain names with that TLD."

The .su domain was launched in 1990, one year before the Soviet Union was formally dissolved.

The Enterprise Connect conference program covers the full range of platforms, services and applications that comprise modern communications and collaboration systems. Hear case studies from senior enterprise executives, as well as from the leaders of major industry players like Cisco, Microsoft, Avaya, Google and more. Register for Enterprise Connect 2013 today with code IWKPREM to save $200 off a conference pass or get a free Expo Pass. It happens March 18-21 in Orlando, Fla.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Apprentice
3/24/2013 | 3:35:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
If a hacker is trying to get into the Presidents accounts, what better way then to compromise the machine closest to his. I am sure that the rest of his family also gets their fair share of attacks as well. I think that the mindset might be that her accounts have more accessible vulnerabilities. People that are famous or are if interest are just naturally going to be targeted more than the average Joe. I would not be surprised if these individuals hire third party security companies and consultants to manage and secure their systems, and if they havenGÇÖt they should.

Paul Sprague
InformationWeek Contributor
Jonathan_Camhi
50%
50%
Jonathan_Camhi,
User Rank: Apprentice
3/14/2013 | 8:24:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
I'm no cyber security expert but this tells me that the state of cyber security protocols in our government need to be reviewed if hackers can get personal info on the first lady.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web