12:20 PM

Hackers Appear To Target Michelle Obama, FBI Director

Michelle Obama is among several public figures whose personal information appeared to be published via a website with a Soviet Union registration; some watchers see signs of hoax.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
First lady Michelle Obama apparently has been doxed.

A website Tuesday published a data dump (aka dox) that included the supposed social security number and last-known Chicago phone numbers for Michelle Obama, as well as a recent credit report from TransUnion in her name. Dated March 11, 2013, that credit report lists multiple bank and credit card accounts, including credit limits, details of any late payments, as well as account numbers, although the last four numbers of each account were starred out.

"Blame your husband, we still love you, Michelle. <3" read a message posted above the information.

The website behind the dox, Exposed.su, began publishing sensitive information on public officials and celebrities Monday. By Tuesday, the list of doxed people had grown to include not just Michelle Obama, but also Vice President Joe Biden, FBI director Robert Mueller, Attorney General Eric Holder and Los Angeles Police Department chief Charlie Beck.

[ The hacktivist group Anonymous has been upping its doxing attacks on business and government. Anonymous Takes On State Department, More Banks. ]

As part of what the site has dubbed "The Secret Files," it also published personal details -- and in some cases, credit reports with last-known addresses and phone numbers -- for Arnold Schwarzenegger, Ashton Kutcher, Beyonce, Britney Spears, Donald Trump, Hulk Hogan, Jay-Z, Kim Kardashian, Mel Gibson, Paris Hilton and Sarah Palin.

Some sites, such as U.S. News & World Report, have commented that the supposed dox looks like a hoax. But at least some of the published information appears to be legitimate. "Social security numbers posted on [Mel] Gibson, Jay-Z and others matched records in public databases," reported AP. Likewise, RT reported that a call to a number listed for Beyonce was transferred to an operator for Gelfand, Rennert & Feldman, which bills itself as "a leading full-service business management firm for entertainers, executives and select high net worth individuals."

The Justice Department is already looking into the alleged dox. "The FBI is investigating," said an FBI spokeswoman when reached by phone, who suggested that the Secret Service would likely also be involved. Reached for comment by phone, a spokesman for the Secret Service said, "We are investigating the matter but we don't have any further comment at this time."

Interestingly, an Exposed.su page that timed out said that the site is using CloudFlare, which is a service designed to maintain high levels of website performance and availability. A spokeswoman for CloudFlare -- reached by phone and asked if Exposed.su was using CloudFlare -- said the company typically doesn't comment on its customers, but noted that anyone can sign up for the service via the CloudFlare website.

She also noted that all clients agree to comply with CloudFlare's terms of service, which state that CloudFlare reserves the right to investigate any of its customers, and that "if the investigation reveals any information, act or omission, which in CloudFlare's sole opinion, constitutes a violation of any local, state, federal or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."

Much of the published information could be used by identity thieves who wanted to impersonate any of the aforementioned figures -- for example, to open a bank account in their name. Celebrity news website TMZ first reported on the hack Monday, and it cited unnamed sources Tuesday who said that criminals have already attempted to put the information to use.

Who's to blame for the dox? A recent tweet from a Twitter account tied to the website -- the Exposed Twitter feed -- contained a Russian message, here translated into English: "Hello world, we are exposed to. Our goal is to show you all that this is only one of a few tricks up his sleeve lone wolves." Some news reports said that an early version of the Exposed site contained anti-police messages written in Russian.

The choice of a ".su" top-level domain for the Exposed.su website also offers clues about the website operator's identity. Notably, many Russian botnet herders have been switching their Zeus command-and-control servers from websites registered with the Russia top-level domain ".ru" to the ".su" domain instead, according to a post to Swiss security blog abuse.ch.

"For those of you who don't know: .su is (or should I say was) the top level domain for the Soviet Union, which we all know doesn't exist any more," according to abuse.ch. "Nevertheless, TLD .su (which is operated by RIPN) is still active today which means that people can still register domain names with that TLD."

The .su domain was launched in 1990, one year before the Soviet Union was formally dissolved.

The Enterprise Connect conference program covers the full range of platforms, services and applications that comprise modern communications and collaboration systems. Hear case studies from senior enterprise executives, as well as from the leaders of major industry players like Cisco, Microsoft, Avaya, Google and more. Register for Enterprise Connect 2013 today with code IWKPREM to save $200 off a conference pass or get a free Expo Pass. It happens March 18-21 in Orlando, Fla.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
3/24/2013 | 3:35:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
If a hacker is trying to get into the Presidents accounts, what better way then to compromise the machine closest to his. I am sure that the rest of his family also gets their fair share of attacks as well. I think that the mindset might be that her accounts have more accessible vulnerabilities. People that are famous or are if interest are just naturally going to be targeted more than the average Joe. I would not be surprised if these individuals hire third party security companies and consultants to manage and secure their systems, and if they havenGt they should.

Paul Sprague
InformationWeek Contributor
User Rank: Apprentice
3/14/2013 | 8:24:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
I'm no cyber security expert but this tells me that the state of cyber security protocols in our government need to be reviewed if hackers can get personal info on the first lady.
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Post a Comment
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.