The Xbox Live accounts of some "high-profile" Microsoft employees have been hacked, and the company says it is "actively working with law enforcement" to disable the attack and "prevent its future use."
In a statement to NBC News Wednesday, Microsoft said it is "aware that a group of attackers" is using "social engineering techniques to compromise the accounts of a handful of high-profile Xbox Live accounts held by current and former Microsoft employees."
The attacks may be tied to those that done recently to well-known security writer and researcher Brian Krebs, who was a victim himself last Thursday. His KrebsOnSecurity blog suffered a denial-of-service attack, followed by a harrowing, real-life visit from police, with guns drawn, who had been told someone called 911 and reported that "Russians had broken into the home and shot my wife," Krebs wrote.
"The cop that took the report from me after the incident said someone had called 911 using a Caller ID number that matched my mobile phone number; the caller claimed to be me," Krebs wrote in describing the nightmare. (The practice of such a terrible "joke" is known as "SWATing.").
There was more. Last weekend, Krebs said he received an email from "a person who claimed to have direct knowledge of the attacks (perhaps because he, too, was involved)," Krebs wrote on his blog Monday.
"This individual said those who attacked my site were a group of young online video game enthusiasts who were upset that earlier in the week I’d written about ssndob.ru, a site that sells access to peoples’ credit files, Social Security numbers and other sensitive information."
According to this source, the hackers in this case belong to a four-man Xbox live gamer team that calls itself "Team Hype,"which until this past weekend had posted a number of videos to their own youtube.com channel...
According to the anonymous source, Team Hype consists of hackers who use the nicknames "Trojan" "Shadow," "Convict," and "Phobia." The source said the group used SSNs from ssndob.ru to hijack "gamertags," online personas tied to Xbox Live game accounts. In this case, specifically from Microsoft employees who work on the Xbox Live gaming platform. Some of the group members then sell those accounts to other Xbox Live players.
Krebs said the source wrote: "They hack/social engineer Gamertags off Microsoft employees by using SSNs ... I didn’t DDoS your site and I didn’t SWAT you, Phobia has been telling everyone he did. The method he released he said he gets SSNs, then calls phone companies and redirects the number and than gets xbox phone support to call number and confirm. I heard he got pissed that you released the site he uses. Also Trojan told a buddie of mines ‘fear’ (on AIM) something about a dead body in your closet about your swat."
As far as those Social Security numbers, a Microsoft spokesperson told NBC News that it does "not collect or use Social Security numbers in its services."
But, the spokeperson said, "The attackers who obtained Social Security numbers "may be using it to social engineer other companies that do rely on this personal data for authentication."
You can read more about Krebs' investigation into the case here, including a cached version of Team Hype's YouTube videos, now pulled from YouTube. It's both educational — and chilling.
— Via The Verge