A select panel of experts met to discuss the security issues with Obama’s Healthcare.gov website. But only one of them demonstrated vulnerabilities live.
TrustedSEC CEO (and creator of the Social Engineering Toolkit) hit the ball out of the park yesterday at the Congressional Committee Hearing on the Affordable Healthcare Act – Healthcare.gov website security issues.
According to the opening statements by Chairman Lamar Smith, Healthcare.gov is “One of the largest collections of personal data in the world“. The site contains data from 7 different agencies, and includes personal information such as citizen’s birthdays and social security numbers.
According to the President, the website was safe, secure and open for business. But the administration has cut corners with the website that leaves the site open to hackers.
At the hearing, Kennedy said that through passive reconnaissance his company had discovered 17 different direct exposures which they reported. He would not talk about all of them, because as of the time of the hearing not all of them had been fixed. He then went on to actually demonstrate several possible ways that hackers could target the site.
David does not talk about all of the issues that they discovered, but their full report(PDF) that was submitted to congress is very interesting.
The report shows several issues that include:
- Open Redirection (where a malicious re-direct link could be inserted into a Healthcare.gov link)
- XML injection
- JQuery File Upload
- Exposed User Profiles!
But that is not all, there are also remnant website “test” links:
The Congressional Hearing and TrustedSEC’s report are both well worth your time.
Kudos to Dave, he did a phenomenal job, and as always, both expertly and professionally represented the white hat security field.
CYBER ARMS - Computer Security 