11 ms·
Denial-of-service tool targeting Healthcare.gov site discovered
- trebor 13y agoBased on the program icon in the screen shot, I think the tool was written in Delphi 6. I haven't seen that in years!
- jcromartie 13y agoWasn't there just something on HN claiming DDOS as protected speech?
- leeoniya 13y agoWith so much opposition to Obamacare, i would be more surprised if a tool like this did NOT exist.
- aelaguiz 13y agoThe screenshots of IDA with Delphi in it really bring me back. Ahh reverse engineering, life was so simple then. Whoever wrote this was definitely older. Nobody under 35 knows Delphi ;)
- tazjin 13y agoDelphi is the standard programming language taught to many German kids in school. I have many friends in Germany (I live in Sweden) and they have horrible stories from those "lessons" :-) Problem is not all of them are knowledgeable/interested enough to realise that what they're being taught is deprecated and not worth a lot.
- aelaguiz 13y agoIt always shocks me how long technology hangs around. It's easy to forget how many critical systems are powered by VB3 or Cobol.
- ErikAugust 13y agoIt would be cool with in modern web development there were a tool that allowed you to design webpages as easily as you could design UI in VB3. Just saying.
- thwarted 13y agoThere have been a few attempts. The autogenerated code isn't/wasn't all that great. I periodically use something like Quickbase, which lets you focused on the data collection and processing aspect, rather than where widgets go on the screen (VB3's UI being the first thing you interact with and what everything is tied to leads to some less than ideal maintenance nightmares).
- TimJYoung 13y agoOur product, Elevate Web Builder, provides this type of functionality: http://www.elevatesoft.com/products?category=ewb&type=web http://www.elevatesoft.com/products?category=ewb&type=web For example, coding a button event handler is just like it is in Visual Studio/Delphi - just double-click on the button in the form designer and you're in the code editor positioned inside of an empty event handler code block.
- ErikAugust 13y agoVery cool.
- vidarh 13y ago> what they're being taught is deprecated and not worth a lot. It's only "not worth a lot" if the only thing they're being taught is the specifics of the language. If they're being taught to program, then that skill is trivially transferrable to other languages.
- 300bps 13y agoI read the summary at http://www.arbornetworks.com/asert/2013/11/healthcare-gov-dos-tool/ http://www.arbornetworks.com/asert/2013/11/healthcare-gov-do... Sorry, I don't buy that anyone would've written a custom application to DDoS a web site by slowly loading two relatively static pages on the site when there are a billion tools out there that will do the same thing far more effectively (see LOIC for just one popular example). This almost seems like a false flag to make healthcare.gov into an innocent victim of a DDoS attack when as the original article says there is no evidence of an actual DDoS attack.
- caryhartline 13y agoThere is no evidence that it's a "false flag" either. We'll just have to wait it out for more information.
- deleted 13y ago[deleted]
- generj 13y agoI agree with this viewpoint, though I think it's also possible that a lone actor, frustrated with Obamacare, acted out using the only tools he knew in a 1/2 hour. It wouldn't surprise me if healthcare.gov was very vulnerable to DDOS attacks - we are talking about a 2013 site which is hosted in a single data-center.
- AsymetricCom 13y agoI wonder if a five 9's site is possible from a single datacenter. I can't imagine why not, given it's 3,000m under a mountain.
- generj 13y agoA five 9's website is much easier to achieve using multiple, redundant, data centers. Otherwise you end up with unforeseen events, like a tornado taking out power, or a backhoe incident, or internet outages.
- grecy 13y agoWow, the government brings in a program to genuinely try and help people, and the people want to tear it down because it "violates their rights". America you so crazy.
- VonGuard 13y agoThis comes from a very concerted effort by highly placed folks in the US (Koch Brothers, health care companies). Essentially, they create fear and confusion around the new laws through Fox News and dial-in radio, and American idiots eat it up like it was the Bible truth. The people in this country who are against the health care law, uniformly, know nothing about it and regurgitate Fox News BS when asked why it's a bad law. Thing is, the law has its issues, but the other side never gets near them, they just make shit up "death panels" and government interference and stuff. I, as an American, am super embarrassed by all this. It doesn't help that the health care companies wrote the fucking law, anyway... now they're fighting against it! The sad truth is, unless we have a single-payer, socialized medical system, none of these changes will help much. Really, the biggest change the new law enacts is that it forces health care companies to cover people with pre-existing conditions like Diabetes and heart disease. Right now, they can tell you to go away, they won't cover that stuff. IN 2014, I hear they'll be forced to at least offer you a psychotically expensive plan if you have diabetes.... Ah, this country sucks ass.
- dllthomas 13y agoI respectfully disagree - I think the biggest change the law enacts is the cap on the MLR. Telling insurance companies they have to cover those with pre-existing conditions doesn't make them want to cover those with pre-existing conditions, it just makes them not want to be sued for one more thing. That is no kind of motivation to keep costs down or provide decent service - if Joe Sicko says "screw this, I am going to your competition" they break out the champaigne. With the MLR cap, having one more person means they can take home more money, so long as they're operating near the cap to begin with.
- deleted 13y ago[deleted]
- japhyr 13y agoIf you are discussing this topic, you might consider referring to the legislation as the "Affordable Health Care Act", which I believe is the title on the actual legislation. Calling it "Obamacare" triggers an overly emotional response from people on both side of this issue. Ask people if they want universal affordable health care, and most people will discuss the issue. Ask people if they want Obamacare, and you instantly raise all sorts of issues that have nothing to do with health care. Edit: I agree with many of the responses here as well. The actual name, which I believe has ten titled parts [0], is a bit of marketing copy as well. But at least it's marketing copy that relates to the substance of the act. Calling it Obamacare makes it personal, and this is about much more than Obama taking care of all of us. I'd love to see a neutral name for the legislation itself. I am starting to call it "the current health care legislation". [0] - http://www.hhs.gov/healthcare/rights/law/ http://www.hhs.gov/healthcare/rights/law/
- natmaster 13y agoAnd the Patriot Act is very Patriotic!
- fsckin 13y agoSome would argue that it's too patriotic.
- mistakenot 13y agoWhatever. But it isn't called Bushoppression by anyone, it is referred to by its actual name.
- natmaster 13y agoNoone calls Obamacare Obamasux or something stupid like the name you came up with. A more apt analogy would be Bushtactics.
- awj 13y ago...what does that have to do with anything? It's the actual name of the act. Making up a new name for something to signal your disapproval is the fastest way I can think of to indicate you aren't capable of discussion.
- ck2 13y agoDenying people access to healthcare.gov is like blocking an ambulance trying to take someone to the hospital, you'd have to be a pretty low criminal to do it. If you don't want healthcare then don't buy it and pay the fine (or refuse to pay the fine) just don't block others.
- ctdonath 13y agoThat's the problem: people DO want healthcare, but the legislation blocks them from buying the form of healthcare they want. Seriously ill people with perfectly good health insurance are getting their plans cancelled for want of irrelevant requirements; yes, many of us DO consider those causing such cancellations "pretty low criminals", hence the consternation unto DDOS.
- mistakenot 13y agoThe legislation does lots of things, including making it possible for people like me with pre-existing conditions to actually get insurance. Plans are cancelled because free market corporations decide to cancel them -- the law could have forced all those companies to continue policies while bringing them up to standards, but if it did, you'd be complaining about that.
- ctdonath 13y agoThe law indeed forced those companies to bring policies up to highly disputable standards, which for all practical purposes amounts to canceling them and requiring enrollment in much more expensive plans - that is indeed what I'm complaining about.
- RokStdy 13y agoI think you're missing the hypothetical above. I read it as "the law could have required insurers to bring policies up to snuff without increasing premiums". That presumably would have kept people from getting cancellation notices (and would have been a huge controverstifuck). In any case, I think you're wrong. I think it's nice that there's a minimum standard for what 'insurance' should actually do. I think mandating certain minimal care coverage is critical in preventing people from being fleeced by super cheap plans that don't cover crap.
- ancarda 13y agoAs someone who doesn't live in the States, can anyone explain the opposition to Obamacare other than the recent technical problems (which seem to happen anytime governments go near a computer)?
- gdubs 13y agoOn the left, people are upset it didn't go further and provide universal coverage via a single-payer system. On the right, people are upset that they are being mandated to buy insurance from a private company. There's irony in there somewhere. When voters are polled on the individual components of the plan, it is very popular. When polled on the plan as a whole, it is unpopular.
- ctdonath 13y agoSummary: my health care insurance is a matter between me, my doctor, and my chosen insurer - which is none of the government's business. Disrupting my insurance because of issues not relevant to my treatment is intolerable.
- walshemj 13y agoSo you wont be accepting medicad and medicare when youre eligible then?
- ctdonath 13y agoBoth should be limited to the truly needy, rather than becoming de facto norms for _everyone_ in broad categories. I have no qualms about using a program I was compelled to paid into, while considering I shouldn't have been compelled to pay into it and that I'm a prime example of what's wrong with the system. And yes, I've said "no" to comparable "here, take even more taxpayer money" programs.
- mkramlich 13y agoOk that's an understandable position. Let's continue that logic and apply it everywhere else in life: The relationship between your neighbors and you is a matter solely between them and you. The government should not interfere. So, if for example your neighbor were to choose to rob your house, or murder a loved one, clearly, the government should not get involved. When you're driving, that's a matter between you, your car, and perhaps the road. And your relationship with other drivers or pedestrians is solely up to you and them. You should all be able to do whatever you want and/or work out any disputes between each other as they come up. Laws would be pesky and just be government interference. And by the way, as to your point about disrupting your insurance for reasons not relevant to your treatment. That's a big whoosh that misses the point of the ACA. The whole core point of the ACA was in reaction to private insurance companies which would deny or drop people who were seriously sick. Thus, effectively denying treatment, or forcing them to rely on rush-to-emergency-room treatment, rather than cheaper and less stressful preventative care, or experience catastrophic costs, which then either bankrupt them and/or get passed on to all other taxpayers and customers, against those others parties wishes, anyway. Making sure more people get more and better treatment, more consistently, is the whole point of the ACA. It's not perfect, nobody claims that. But it has a heck of a lot of objectively good elements which are pro-health.
- skwirl 13y agoWhile I personally am OK with the Affordable Care Act, and do not doubt for a second that many conservatives and libertarians are reveling in the troubles the federal healthcare exchange website has been facing, I do not for a second believe that it is due to a DDoS from people running this tool. I would be very surprised if this tool even existed before the exchange site was launched. It seems to be someone seeking attention after the fact, and here we are giving it to them.
- snowwrestler 13y agoTo be fair, the article does not report or claim that this tool has had any effect on the site. I guess Ars just finds it newsworthy, from a social perspective, that someone bothered to create this software.
- ck2 13y agoThere is no reason why both cannot be true. The site was built poorly and political foes are also trying to ddos it. Personally I think it would be nice if we had stronger laws and actual enforcement against ddos.
- chaz 13y agoNY's own health exchange received 10 million visits by evening of the first day. That seems like a lot of traffic for 20 million residents. As of Oct 28, only 37k people have enrolled in insurance. If the numbers are all true, the traffic seems fishy to me.
- awj 13y ago> I do not for a second believe that it is due to a DDoS from people running this tool. Have you seen some of the discussions about the ACA? There are people out there who seem to genuinely believe that it will destroy America. I would expect a DDoS to be in the realm of things someone in that position would do.
- thrillgore 13y agoDon't blame on malice what you can blame on ignorace!
- 13y ago
- mkramlich 13y agoI predicted things like this were being used. My rough logic is that when you see directly observible evidence of an entity (Republicans and/or Tea Party in Congress, or whatever you wish to label them) engaging in a DoS attack against the American people out in the open -- in the form of the repeated attempts to shutdown the Federal government and risk defaults, etc -- it's even easier to believe the same kinds of people will be arranging for DoS under the covers, through more shady means. Not that I'm saying these DoS attacks are effective, or even a significant factor. I don't have enough data to know. But I have no doubt they were at least attempted.
- spacebe4time 13y agoSo, do you have evidence that congressmen or members of their staff are doing this? Pulling $#@ out of your ass ins't rough logic. It's just that...
- beauzero 13y agoWe are talking about a government entity trying to tie together purposefully archaic data feeds from insurance companies, waterfall methodology, a myriad of different consulting companies, and changing requirements right up until the last month. ...and you are looking for a conspiracy?
- mkramlich 13y agoYou have made the mistake of assuming mutual exclusion when I for one did not. I am a software engineer and I do this professionally. I am fully aware of the kinds of technical issues, and procedurally issues, which can fully or at least even partially account for its woes. That was not my point. My point was pretty clear and I was very very careful with my exact wording, if you'd care to take a second look at my original comment you've attacked, and probably downvoted, erroneously.