Risk
3/12/2013
12:20 PM
50%
50%

Hackers Appear To Target Michelle Obama, FBI Director

Michelle Obama is among several public figures whose personal information appeared to be published via a website with a Soviet Union registration; some watchers see signs of hoax.

Anonymous: 10 Things We Have Learned In 2013
Anonymous: 10 Things We Have Learned In 2013
(click image for larger view and for slideshow)
First lady Michelle Obama apparently has been doxed.

A website Tuesday published a data dump (aka dox) that included the supposed social security number and last-known Chicago phone numbers for Michelle Obama, as well as a recent credit report from TransUnion in her name. Dated March 11, 2013, that credit report lists multiple bank and credit card accounts, including credit limits, details of any late payments, as well as account numbers, although the last four numbers of each account were starred out.

"Blame your husband, we still love you, Michelle. <3" read a message posted above the information.

The website behind the dox, Exposed.su, began publishing sensitive information on public officials and celebrities Monday. By Tuesday, the list of doxed people had grown to include not just Michelle Obama, but also Vice President Joe Biden, FBI director Robert Mueller, Attorney General Eric Holder and Los Angeles Police Department chief Charlie Beck.

[ The hacktivist group Anonymous has been upping its doxing attacks on business and government. Anonymous Takes On State Department, More Banks. ]

As part of what the site has dubbed "The Secret Files," it also published personal details -- and in some cases, credit reports with last-known addresses and phone numbers -- for Arnold Schwarzenegger, Ashton Kutcher, Beyonce, Britney Spears, Donald Trump, Hulk Hogan, Jay-Z, Kim Kardashian, Mel Gibson, Paris Hilton and Sarah Palin.

Some sites, such as U.S. News & World Report, have commented that the supposed dox looks like a hoax. But at least some of the published information appears to be legitimate. "Social security numbers posted on [Mel] Gibson, Jay-Z and others matched records in public databases," reported AP. Likewise, RT reported that a call to a number listed for Beyonce was transferred to an operator for Gelfand, Rennert & Feldman, which bills itself as "a leading full-service business management firm for entertainers, executives and select high net worth individuals."

The Justice Department is already looking into the alleged dox. "The FBI is investigating," said an FBI spokeswoman when reached by phone, who suggested that the Secret Service would likely also be involved. Reached for comment by phone, a spokesman for the Secret Service said, "We are investigating the matter but we don't have any further comment at this time."

Interestingly, an Exposed.su page that timed out said that the site is using CloudFlare, which is a service designed to maintain high levels of website performance and availability. A spokeswoman for CloudFlare -- reached by phone and asked if Exposed.su was using CloudFlare -- said the company typically doesn't comment on its customers, but noted that anyone can sign up for the service via the CloudFlare website.

She also noted that all clients agree to comply with CloudFlare's terms of service, which state that CloudFlare reserves the right to investigate any of its customers, and that "if the investigation reveals any information, act or omission, which in CloudFlare's sole opinion, constitutes a violation of any local, state, federal or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."

Much of the published information could be used by identity thieves who wanted to impersonate any of the aforementioned figures -- for example, to open a bank account in their name. Celebrity news website TMZ first reported on the hack Monday, and it cited unnamed sources Tuesday who said that criminals have already attempted to put the information to use.

Who's to blame for the dox? A recent tweet from a Twitter account tied to the website -- the Exposed Twitter feed -- contained a Russian message, here translated into English: "Hello world, we are exposed to. Our goal is to show you all that this is only one of a few tricks up his sleeve lone wolves." Some news reports said that an early version of the Exposed site contained anti-police messages written in Russian.

The choice of a ".su" top-level domain for the Exposed.su website also offers clues about the website operator's identity. Notably, many Russian botnet herders have been switching their Zeus command-and-control servers from websites registered with the Russia top-level domain ".ru" to the ".su" domain instead, according to a post to Swiss security blog abuse.ch.

"For those of you who don't know: .su is (or should I say was) the top level domain for the Soviet Union, which we all know doesn't exist any more," according to abuse.ch. "Nevertheless, TLD .su (which is operated by RIPN) is still active today which means that people can still register domain names with that TLD."

The .su domain was launched in 1990, one year before the Soviet Union was formally dissolved.

The Enterprise Connect conference program covers the full range of platforms, services and applications that comprise modern communications and collaboration systems. Hear case studies from senior enterprise executives, as well as from the leaders of major industry players like Cisco, Microsoft, Avaya, Google and more. Register for Enterprise Connect 2013 today with code IWKPREM to save $200 off a conference pass or get a free Expo Pass. It happens March 18-21 in Orlando, Fla.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
3/24/2013 | 3:35:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
If a hacker is trying to get into the Presidents accounts, what better way then to compromise the machine closest to his. I am sure that the rest of his family also gets their fair share of attacks as well. I think that the mindset might be that her accounts have more accessible vulnerabilities. People that are famous or are if interest are just naturally going to be targeted more than the average Joe. I would not be surprised if these individuals hire third party security companies and consultants to manage and secure their systems, and if they havenGÇÖt they should.

Paul Sprague
InformationWeek Contributor
Jonathan_Camhi
50%
50%
Jonathan_Camhi,
User Rank: Apprentice
3/14/2013 | 8:24:53 PM
re: Hackers Appear To Target Michelle Obama, FBI Director
I'm no cyber security expert but this tells me that the state of cyber security protocols in our government need to be reviewed if hackers can get personal info on the first lady.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-4801
Published: 2014-12-18
Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x through 2.0.1.1, 3.x before 3.0.1.6 iFix 4, 4.x before 4.0.7 iFix 2, and 5.x before 5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.