12:20 PM

Hackers Appear To Target Michelle Obama, FBI Director

Michelle Obama is among several public figures whose personal information appeared to be published via a website with a Soviet Union registration; some watchers see signs of hoax.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
First lady Michelle Obama apparently has been doxed.

A website Tuesday published a data dump (aka dox) that included the supposed social security number and last-known Chicago phone numbers for Michelle Obama, as well as a recent credit report from TransUnion in her name. Dated March 11, 2013, that credit report lists multiple bank and credit card accounts, including credit limits, details of any late payments, as well as account numbers, although the last four numbers of each account were starred out.

"Blame your husband, we still love you, Michelle. <3" read a message posted above the information.

The website behind the dox, Exposed.su, began publishing sensitive information on public officials and celebrities Monday. By Tuesday, the list of doxed people had grown to include not just Michelle Obama, but also Vice President Joe Biden, FBI director Robert Mueller, Attorney General Eric Holder and Los Angeles Police Department chief Charlie Beck.

[ The hacktivist group Anonymous has been upping its doxing attacks on business and government. Anonymous Takes On State Department, More Banks. ]

As part of what the site has dubbed "The Secret Files," it also published personal details -- and in some cases, credit reports with last-known addresses and phone numbers -- for Arnold Schwarzenegger, Ashton Kutcher, Beyonce, Britney Spears, Donald Trump, Hulk Hogan, Jay-Z, Kim Kardashian, Mel Gibson, Paris Hilton and Sarah Palin.

Some sites, such as U.S. News & World Report, have commented that the supposed dox looks like a hoax. But at least some of the published information appears to be legitimate. "Social security numbers posted on [Mel] Gibson, Jay-Z and others matched records in public databases," reported AP. Likewise, RT reported that a call to a number listed for Beyonce was transferred to an operator for Gelfand, Rennert & Feldman, which bills itself as "a leading full-service business management firm for entertainers, executives and select high net worth individuals."

The Justice Department is already looking into the alleged dox. "The FBI is investigating," said an FBI spokeswoman when reached by phone, who suggested that the Secret Service would likely also be involved. Reached for comment by phone, a spokesman for the Secret Service said, "We are investigating the matter but we don't have any further comment at this time."

Interestingly, an Exposed.su page that timed out said that the site is using CloudFlare, which is a service designed to maintain high levels of website performance and availability. A spokeswoman for CloudFlare -- reached by phone and asked if Exposed.su was using CloudFlare -- said the company typically doesn't comment on its customers, but noted that anyone can sign up for the service via the CloudFlare website.

She also noted that all clients agree to comply with CloudFlare's terms of service, which state that CloudFlare reserves the right to investigate any of its customers, and that "if the investigation reveals any information, act or omission, which in CloudFlare's sole opinion, constitutes a violation of any local, state, federal or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."

Much of the published information could be used by identity thieves who wanted to impersonate any of the aforementioned figures -- for example, to open a bank account in their name. Celebrity news website TMZ first reported on the hack Monday, and it cited unnamed sources Tuesday who said that criminals have already attempted to put the information to use.

Who's to blame for the dox? A recent tweet from a Twitter account tied to the website -- the Exposed Twitter feed -- contained a Russian message, here translated into English: "Hello world, we are exposed to. Our goal is to show you all that this is only one of a few tricks up his sleeve lone wolves." Some news reports said that an early version of the Exposed site contained anti-police messages written in Russian.

The choice of a ".su" top-level domain for the Exposed.su website also offers clues about the website operator's identity. Notably, many Russian botnet herders have been switching their Zeus command-and-control servers from websites registered with the Russia top-level domain ".ru" to the ".su" domain instead, according to a post to Swiss security blog abuse.ch.

"For those of you who don't know: .su is (or should I say was) the top level domain for the Soviet Union, which we all know doesn't exist any more," according to abuse.ch. "Nevertheless, TLD .su (which is operated by RIPN) is still active today which means that people can still register domain names with that TLD."

The .su domain was launched in 1990, one year before the Soviet Union was formally dissolved.

The Enterprise Connect conference program covers the full range of platforms, services and applications that comprise modern communications and collaboration systems. Hear case studies from senior enterprise executives, as well as from the leaders of major industry players like Cisco, Microsoft, Avaya, Google and more. Register for Enterprise Connect 2013 today with code IWKPREM to save $200 off a conference pass or get a free Expo Pass. It happens March 18-21 in Orlando, Fla.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
3/24/2013 | 3:35:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
If a hacker is trying to get into the Presidents accounts, what better way then to compromise the machine closest to his. I am sure that the rest of his family also gets their fair share of attacks as well. I think that the mindset might be that her accounts have more accessible vulnerabilities. People that are famous or are if interest are just naturally going to be targeted more than the average Joe. I would not be surprised if these individuals hire third party security companies and consultants to manage and secure their systems, and if they havenGt they should.

Paul Sprague
InformationWeek Contributor
User Rank: Apprentice
3/14/2013 | 8:24:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
I'm no cyber security expert but this tells me that the state of cyber security protocols in our government need to be reviewed if hackers can get personal info on the first lady.
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-06-23
A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.
PUBLISHED: 2018-06-23
demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) during the &quot;Create an array for saving the template argument values&quot; XNEWVEC call. This can occur during execution of objdump.
PUBLISHED: 2018-06-23
finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.
PUBLISHED: 2018-06-23
A Stack Exhaustion issue was discovered in debug_write_type in debug.c in GNU Binutils 2.30 because of DEBUG_KIND_INDIRECT infinite recursion.
PUBLISHED: 2018-06-23
The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key, as demonstrated by a long remoteIp parameter to cgi-bin/CGIProxy.fcgi on port 34100.