Former most-wanted cybercriminal Kevin Mitnick concluded in a letter to Capitol Hill: "It's shameful the team that built the Healthcare.gov site implemented minimal, if any, security best practices to mitigate the significant risk of a system compromise." If the latest warnings from our intel agencies are any indication, it appears that Obamacare Keystone Kops didn't just leave out security protections, but also may have allowed foreign programmers to write in cyber-traps.
David Kennedy, head of computer security consulting firm TrustedSec LLC and a former cybersecurity official with the National Security Agency and the U.S. Marine Corps, warned that "Healthcare.gov is not secure today" and said nothing had changed since he gave Congress that assessment three months before. Among the vulnerabilities that the Obama administration still hasn't fixed:
--TrustedSec "identified the ability to enumerate user information (first, last, email, user id, profile, etc.) through one of the sub-sites that directly integrates into the healthcare.gov website."
--"Tens of thousands of user-based data appears to be vulnerable on the specified website and has not been addressed. There are a number of other exposures that have been reported privately that continue to expose users of the healthcare.gov website."
--Another exposure identified is "the ability to perform an open redirect." In fact, "there are multiple open redirects still vulnerable on the healthcare.gov website and supporting sub-sites." What this means is that "an attacker can send a targeted email to an individual that has signed up for healthcare.gov or is looking to and have it appear valid and legitimate and originate from the healthcare.gov website." These can open avenues so that victims click on links "redirecting to a malicious website that hacks the computer and takes complete control over it."
Out: "Got Covered?" In: "Got Hacked?"