A website Tuesday published a data dump (aka dox) that included the supposed social security number and last-known Chicago phone numbers for Michelle Obama, as well as a recent credit report from TransUnion in her name. Dated March 11, 2013, that credit report lists multiple bank and credit card accounts, including credit limits, details of any late payments, as well as account numbers, although the last four numbers of each account were starred out.
"Blame your husband, we still love you, Michelle. <3" read a message posted above the information.
The website behind the dox, Exposed.su, began publishing sensitive information on public officials and celebrities Monday. By Tuesday, the list of doxed people had grown to include not just Michelle Obama, but also Vice President Joe Biden, FBI director Robert Mueller, Attorney General Eric Holder and Los Angeles Police Department chief Charlie Beck.
[ The hacktivist group Anonymous has been upping its doxing attacks on business and government. Anonymous Takes On State Department, More Banks. ]
As part of what the site has dubbed "The Secret Files," it also published personal details -- and in some cases, credit reports with last-known addresses and phone numbers -- for Arnold Schwarzenegger, Ashton Kutcher, Beyonce, Britney Spears, Donald Trump, Hulk Hogan, Jay-Z, Kim Kardashian, Mel Gibson, Paris Hilton and Sarah Palin.
Some sites, such as U.S. News & World Report, have commented that the supposed dox looks like a hoax. But at least some of the published information appears to be legitimate. "Social security numbers posted on [Mel] Gibson, Jay-Z and others matched records in public databases," reported AP. Likewise, RT reported that a call to a number listed for Beyonce was transferred to an operator for Gelfand, Rennert & Feldman, which bills itself as "a leading full-service business management firm for entertainers, executives and select high net worth individuals."
The Justice Department is already looking into the alleged dox. "The FBI is investigating," said an FBI spokeswoman when reached by phone, who suggested that the Secret Service would likely also be involved. Reached for comment by phone, a spokesman for the Secret Service said, "We are investigating the matter but we don't have any further comment at this time."
Interestingly, an Exposed.su page that timed out said that the site is using CloudFlare, which is a service designed to maintain high levels of website performance and availability. A spokeswoman for CloudFlare -- reached by phone and asked if Exposed.su was using CloudFlare -- said the company typically doesn't comment on its customers, but noted that anyone can sign up for the service via the CloudFlare website.
She also noted that all clients agree to comply with CloudFlare's terms of service, which state that CloudFlare reserves the right to investigate any of its customers, and that "if the investigation reveals any information, act or omission, which in CloudFlare's sole opinion, constitutes a violation of any local, state, federal or foreign law or regulation, this Agreement, or is otherwise deemed harm the Service, CloudFlare may immediately shut down your access to the Service."
Much of the published information could be used by identity thieves who wanted to impersonate any of the aforementioned figures -- for example, to open a bank account in their name. Celebrity news website TMZ first reported on the hack Monday, and it cited unnamed sources Tuesday who said that criminals have already attempted to put the information to use.
Who's to blame for the dox? A recent tweet from a Twitter account tied to the website -- the Exposed Twitter feed -- contained a Russian message, here translated into English: "Hello world, we are exposed to. Our goal is to show you all that this is only one of a few tricks up his sleeve lone wolves." Some news reports said that an early version of the Exposed site contained anti-police messages written in Russian.
The choice of a ".su" top-level domain for the Exposed.su website also offers clues about the website operator's identity. Notably, many Russian botnet herders have been switching their Zeus command-and-control servers from websites registered with the Russia top-level domain ".ru" to the ".su" domain instead, according to a post to Swiss security blog abuse.ch.
"For those of you who don't know: .su is (or should I say was) the top level domain for the Soviet Union, which we all know doesn't exist any more," according to abuse.ch. "Nevertheless, TLD .su (which is operated by RIPN) is still active today which means that people can still register domain names with that TLD."
The .su domain was launched in 1990, one year before the Soviet Union was formally dissolved.
The Enterprise Connect conference program covers the full range of platforms, services and applications that comprise modern communications and collaboration systems. Hear case studies from senior enterprise executives, as well as from the leaders of major industry players like Cisco, Microsoft, Avaya, Google and more. Register for Enterprise Connect 2013 today with code IWKPREM to save $200 off a conference pass or get a free Expo Pass. It happens March 18-21 in Orlando, Fla.
