16 ms·

No security ever built into Obamacare site: Hacker

47 points by 001sky 13y ago

wdewind 13y ago
This guy claims SQL injection and XSS.
- akama 13y ago
  Dave Kennedy is a reputable source of security info. If he claims something, I would be inclined to listen.
- deleted 13y ago
  [deleted]
- tptacek 13y ago
  Where did you see those claims? I would not be amazed to learn that there was SQLI on the site, but I don't see it in his report. Are you talking about his report to the press earlier in November? He appeared to have been referring to cached search autocomplete terms with SQL syntax in them, evidence of people attempting SQL injection against the site. Which, of course, people would do whether the site was Healthcare.gov or CatBnb.com.
  - wdewind 13y ago
    Maybe he didn't, I tried to guess what he meant when he says, > "Everything from hacking someone's computer so when you visit a website it tries your computer back to being able to extract first names, last names, locations" at 0:24 and guessed XSS + SQLI but I could be wrong about the SQLI now that I'm paying closer attention to how he phrased it.
lettergram 13y ago
I'm sure by putting that message out there, we are about to see HealthCare.gov be put to the test...
- darkstar999 13y ago
  It has been and will be put to the test by all hat colors regardless of press.
Amadou 13y ago
I don't have the reference handy, but I recall an article from this past Summer that said the designers of the site had put security on the back-burner. Their plan was to get the system working and worry about security afterwards. That really alarmed me. Being more than a little involved with security implementations over the last decade, the #1 rule is that you can't tack-on security afterwards. If you try, it will be fragile and ultimately ineffective. You absolutely must design with security as a major requirement from the start. So, I am not surprised to see this report, it lines up exactly with what I've been expecting since Summer.
- tptacek 13y ago
  Well then the #1 rule is also the most widely violated rule on the Internet.
  - Amadou 13y ago
    Yep. Hence the constant stream of security issues.
plcancel 13y ago
The bit about the federal government not being required to alert users to any security breaches is alarming as well. I guess that's not surprising. But, "monitor your own credit" isn't a risk I'm willing to take just to use a barely functioning website.
hackinthebochs 13y ago
I see a whole lot of blowhards running their mouths about potential security problems with the site. I've heard of one actual password-reset vulnerability. If the site were completely full of holes like people claim, there would be scores of "security research companies" clamoring to be the first to name them. Yet we're not seeing that. I'm really not buying it.
- borski 13y ago
  That's not quite right. The site does have issues. Naming the vulnerabilities is subject to responsible disclosure. Hypothetically, were Tinfoil Security to find any issues, we would disclose them to the feds and give them ample time to fix the issues (which, for the government, would potentially be months) before we went out publicly to name what the issues were.
  - 001sky 13y ago
    And the 'bad guys' are likely exploiting anything they've found so far
  - tptacek 13y ago
    Post a SHA1 hash or two, here or on Twitter. I believe you, but let's keep it concrete.
    - borski 13y ago
      I hear you, but I can't. I considered not even posting that comment at all, but thought the greater point deserved to be aired.
danso 13y ago
In a project this convoluted...not in terms of actual feature complexity, but the shitwork that was generated by bureaucracy and political infighting...how could Healthcare.gov not have serious issues with XSS and SQL? Think back to Egor Homanov's amazing hack of Github using a Rails vulnerability to well-known to Rails core team that argued it was not an issue because only fools wouldn't use attr_protected. Github has brilliant programmers and (one would hope) a well-oiled engineering environment and still was vulnerable to this fatal flaw. Now imagine a project with far lesser engineers, highly paid but no real ownership, controlled by people who care more about political deadlines than actual functionality. And top it off with what seems like a hodgepdoge of arcane technology and processes. How could there not be at least a few catastrophic holes? On a sidenote...I've seen a few references to "MarkLogic" being the datastore for Healthcare.gov. It's not open-source and has little adoption in the developer community: http://slashdot.org/story/13/11/24/1437203/nyt-healthcaregov-project-chaos-due-partly-to-unorthodox-database-choice http://slashdot.org/story/13/11/24/1437203/nyt-healthcaregov... Whose genius idea was it to use a non-notable proprietary database software for this? And what was the reasoning? Technical, or political?
mcphilip 13y ago
>According to the Department of Health and Human Services, which oversaw the implementation of the website, the components used to build the site are compliant with standards set by Federal security authorities. This sounds similar to saying the steel plating on the Titanic was compliant with industry standards. All because you have sound components doesn't mean they will result in a sound product. Unfortunately, I don't expect many people outside this industry will realize how hollow this statement is.
- elwell 13y ago
  You'd think by now someone would have done a weekend project open-source version of this site. I wonder if the specs are available (I have no idea how involved the site actually is, but surely it's not 500M LOC worth.).
  - MichaelGG 13y ago
    Weekend project of integrating with ancient healthcare mainframes? OK.
    - spamizbad 13y ago
      I laughed. No first-hand experience, but a buddy of mine has to work on fancy web code that just has to deal with just 1 ancient COBOL backend from an insurance company - he spent over half of his project's time dealing with it. And he was lucky: The original COBOL Programmer was still on the payroll and available for questions!
      - djur 13y ago
        I've worked on two roughly similar but much smaller projects, one of them with an AS/400 admin who had to be sent documentation on what JSON is (he was "familiar with" XML but hadn't used it before), and another working through a middleman company which had built a reasonably sane API to query a small subset of the offerings of several insurance companies across a particular set of states. Both projects were a huge pain in the ass, and neither of them even required testing for eligibility. When I think of healthcare.gov, I think of that same pain in the ass multiplied by the large number of states and additional insurance companies involved... as well as testing for eligibility, doing income validation, calculating subsidies... probably some state-by-state regulatory requirements... just the sheer number of external organizations and systems involved boggles the mind. Frankly, I'm shocked it works even to the extent it does. Incidentally, the complexity involved in building a site like this for so much of the country is why the ACA was set up for every state to implement their own exchange. Unfortunately, a lot of states didn't pull their weight and now it's the feds' mess to clean up.
rdtsc 13y ago
"Poking and prodding" can get them in legal hot water. I understand (and please correct me if I am wrong) Only NSA legally, are allowed to "poke and prod sites". Well, and I guess by legally you can interpret that as "they are legally allowed to" or "nobody is really prepared to tell them no". Anyway, a lot of anti-hacking laws are written that "poking and prodding is not benign" admitting to too many details of that on national media might be a case of bad judgement.
- ams6110 13y ago
  Get who in hot water? The botnets that continually, around the clock 365 days a year "poke and prod" nearly every IP address that responds to port 80 or 443?
  - rdtsc 13y ago
    David Kennedy, they guy who just admitted it on TV? > The botnets that continually, around the clock 365 days a year "poke and prod" nearly every IP address that responds to port 80 or 443? If you can find an operator that confesses it publicly. How many do it? Pretty sure if say Vasile Bogdan from Bucharest, calling CNN confessing he just broke into Bank of America CC processing center, he might find himself on Interpol's most wanted list.
- theboss 13y ago
  You are very wrong. Poking and proding is completely legal and isn't going to send anyone to jail. He's not performing a full pen-test on the site. He's not looking to get a shell. He's just checking out best practices. Is there an HSTS header? Is my input validated? etcetc. The main hacking law that applies here is the CFAA and Dave definitely isn't violating it. To violate it you have to access something you're not allowed to. Nobody will EVER go to jail for an XSS or the types of things he's poking around for. This is because the computer the code is running on is his own....
  - tptacek 13y ago
    Reflected XSS testing can easily end up disrupting the whole site for every user; all it takes is for input to some endpoint to get stored and replayed across the site. Relying on the idea that any kind of active testing against a site you don't own is safe, technically or legally, is a bad idea.
kevin818 13y ago
This is what happens when you build a website with contractors from several different places. Things slip through the cracks, in this case security was one of those things.
deleted 13y ago
[deleted]
tptacek 13y ago
This sounds like grandstanding horseshit. Fewer than 1 in 10 companies we work with even attempts to "build security in from the start", and far fewer come close to succeeding. Any consultant that told a client to "start over from scratch" after finding little more than open redirects and username enumeration† would be laughed out of the room. Actually, scratch that: you can expect to be laughed out of the room for suggesting a rewrite after finding remote code execution. Like every other piece of software put on the Internet by the government, banks, health care consortiums, arms manufacturers, cat sharing startups or network equipment vendors, Healthcare.gov will achieve some semblance of security over the long term by having the crap beat out of it in production. Hopefully by good people first. They won't get there by starting over on the advice like this. This story is an embarrassment for my field. † I found the "report" to Congress; documented vulnerabilities include "undisclosed", open redirects, attacker control over the XML output of a search endpoint, a "test" subdomain on the Internet (no additional findings), Google search results with the token "test" in them (no additional findings), publicly indexed profiles on DATA.HEALTHCARE.GOV (the public dataset site), username enumeration via "this name taken" errors, the fact that they use Experian, the presence of jquery.fileupload.js, and CORS. I'm not sure any of these would even be sev:medium in a Matasano report; many would be sev:info, and a few, like Experian, wouldn't be documented at all.
- yahelc 13y ago
  The story reads like "Area Consultant Advises Government To Pay Exorbitant Fees For His Services".
- andrewflnr 13y ago
  I don't think it's unreasonable to expect that a website which people are legally obligated to use by a certain deadline, entering very sensitive information in the process, have a decent standard of security at launch. I don't see "having the crap beat out it in production" as a good strategy here, and certainly is worth complaining about, even if not worth re-writing over. Would you be comfortable entering your SSN at healthcare.gov?
  - tptacek 13y ago
espeed 13y ago
David Kennedy's Bio: https://www.trustedsec.com/about-us/leadership/ https://www.trustedsec.com/about-us/leadership/
- tptacek 13y ago
  His bio said he spoke at Black Hat. I can't find anything listed by him except for an "Arsenal" talk, which is a lightning talk people can give about open-source tools they've written. Can someone find a real BH talk this guy has given?
  - espeed 13y ago
    Under his site's "Presentations" section (https://www.trustedsec.com/downloads/presentations/ https://www.trustedsec.com/downloads/presentations/), it lists this talk... "July 2010 – Blackhat and Defcon Presentation on PowerShell" (http://www.trustedsec.com/files/PowerShell_Defcon.pdf http://www.trustedsec.com/files/PowerShell_Defcon.pdf)
    - tptacek 13y ago
      Thanks. Yep, that counts.
      - hellokitteh 13y ago
        The guy co-authored Metasploit: The Penetration Testers Guide book. Doesn't the fact that you're unaware of this prominent person call into question your own credibility?
        borski 13y ago
        No. 'tptacek is a VERY well respected individual within the infosec community. Moreover, if I knew every author or every infosec book, I would have very little time to do anything else.
        tptacek 13y ago
wavesounds 13y ago
Does anyone in California know if you can get a discount on private health insurance if you're currently unemployed (healthy non-smoker) trying to start a business and don't want to sign up for Medi-Cal because the only doctors are far away and crowded? Also the Covered CA site has an expired security certificate.
sehrope 13y ago
This'd be a great use case for a bug bounty. It's a situation where you have tons of bugs[1] and tons of cash to pay out a bounty. It'd probably be cheaper to open source all the code and hire one full time person to manage the bounty program then whatever they're trying out right now. [1]: Pure speculation as I have neither used the site or looked at the code but I'm assuming most people will agree with me
infra178 13y ago
Smart power ™
Kilo-byte 13y ago
sensationalist headline with little content to back it up

47 points by 001sky 13y ago

wdewind 13y ago

This guy claims SQL injection and XSS.

akama 13y ago
Dave Kennedy is a reputable source of security info. If he claims something, I would be inclined to listen.
deleted 13y ago
[deleted]
tptacek 13y ago
Where did you see those claims? I would not be amazed to learn that there was SQLI on the site, but I don't see it in his report. Are you talking about his report to the press earlier in November? He appeared to have been referring to cached search autocomplete terms with SQL syntax in them, evidence of people attempting SQL injection against the site. Which, of course, people would do whether the site was Healthcare.gov or CatBnb.com.
- wdewind 13y ago
  Maybe he didn't, I tried to guess what he meant when he says, > "Everything from hacking someone's computer so when you visit a website it tries your computer back to being able to extract first names, last names, locations" at 0:24 and guessed XSS + SQLI but I could be wrong about the SQLI now that I'm paying closer attention to how he phrased it.

lettergram 13y ago

I'm sure by putting that message out there, we are about to see HealthCare.gov be put to the test...

darkstar999 13y ago
It has been and will be put to the test by all hat colors regardless of press.

Amadou 13y ago

I don't have the reference handy, but I recall an article from this past Summer that said the designers of the site had put security on the back-burner. Their plan was to get the system working and worry about security afterwards. That really alarmed me. Being more than a little involved with security implementations over the last decade, the #1 rule is that you can't tack-on security afterwards. If you try, it will be fragile and ultimately ineffective. You absolutely must design with security as a major requirement from the start. So, I am not surprised to see this report, it lines up exactly with what I've been expecting since Summer.

tptacek 13y ago
Well then the #1 rule is also the most widely violated rule on the Internet.
- Amadou 13y ago
  Yep. Hence the constant stream of security issues.

plcancel 13y ago

The bit about the federal government not being required to alert users to any security breaches is alarming as well. I guess that's not surprising. But, "monitor your own credit" isn't a risk I'm willing to take just to use a barely functioning website.

hackinthebochs 13y ago

I see a whole lot of blowhards running their mouths about potential security problems with the site. I've heard of one actual password-reset vulnerability. If the site were completely full of holes like people claim, there would be scores of "security research companies" clamoring to be the first to name them. Yet we're not seeing that. I'm really not buying it.

borski 13y ago
That's not quite right. The site does have issues. Naming the vulnerabilities is subject to responsible disclosure. Hypothetically, were Tinfoil Security to find any issues, we would disclose them to the feds and give them ample time to fix the issues (which, for the government, would potentially be months) before we went out publicly to name what the issues were.
- 001sky 13y ago
  And the 'bad guys' are likely exploiting anything they've found so far
- tptacek 13y ago
  Post a SHA1 hash or two, here or on Twitter. I believe you, but let's keep it concrete.
  - borski 13y ago
    I hear you, but I can't. I considered not even posting that comment at all, but thought the greater point deserved to be aired.

danso 13y ago

In a project this convoluted...not in terms of actual feature complexity, but the shitwork that was generated by bureaucracy and political infighting...how could Healthcare.gov not have serious issues with XSS and SQL? Think back to Egor Homanov's amazing hack of Github using a Rails vulnerability to well-known to Rails core team that argued it was not an issue because only fools wouldn't use attr_protected. Github has brilliant programmers and (one would hope) a well-oiled engineering environment and still was vulnerable to this fatal flaw. Now imagine a project with far lesser engineers, highly paid but no real ownership, controlled by people who care more about political deadlines than actual functionality. And top it off with what seems like a hodgepdoge of arcane technology and processes. How could there not be at least a few catastrophic holes? On a sidenote...I've seen a few references to "MarkLogic" being the datastore for Healthcare.gov. It's not open-source and has little adoption in the developer community: http://slashdot.org/story/13/11/24/1437203/nyt-healthcaregov-project-chaos-due-partly-to-unorthodox-database-choice http://slashdot.org/story/13/11/24/1437203/nyt-healthcaregov... Whose genius idea was it to use a non-notable proprietary database software for this? And what was the reasoning? Technical, or political?

mcphilip 13y ago

>According to the Department of Health and Human Services, which oversaw the implementation of the website, the components used to build the site are compliant with standards set by Federal security authorities. This sounds similar to saying the steel plating on the Titanic was compliant with industry standards. All because you have sound components doesn't mean they will result in a sound product. Unfortunately, I don't expect many people outside this industry will realize how hollow this statement is.

elwell 13y ago
You'd think by now someone would have done a weekend project open-source version of this site. I wonder if the specs are available (I have no idea how involved the site actually is, but surely it's not 500M LOC worth.).
- MichaelGG 13y ago
  Weekend project of integrating with ancient healthcare mainframes? OK.
  - spamizbad 13y ago
    I laughed. No first-hand experience, but a buddy of mine has to work on fancy web code that just has to deal with just 1 ancient COBOL backend from an insurance company - he spent over half of his project's time dealing with it. And he was lucky: The original COBOL Programmer was still on the payroll and available for questions!
    - djur 13y ago
      I've worked on two roughly similar but much smaller projects, one of them with an AS/400 admin who had to be sent documentation on what JSON is (he was "familiar with" XML but hadn't used it before), and another working through a middleman company which had built a reasonably sane API to query a small subset of the offerings of several insurance companies across a particular set of states. Both projects were a huge pain in the ass, and neither of them even required testing for eligibility. When I think of healthcare.gov, I think of that same pain in the ass multiplied by the large number of states and additional insurance companies involved... as well as testing for eligibility, doing income validation, calculating subsidies... probably some state-by-state regulatory requirements... just the sheer number of external organizations and systems involved boggles the mind. Frankly, I'm shocked it works even to the extent it does. Incidentally, the complexity involved in building a site like this for so much of the country is why the ACA was set up for every state to implement their own exchange. Unfortunately, a lot of states didn't pull their weight and now it's the feds' mess to clean up.

rdtsc 13y ago

"Poking and prodding" can get them in legal hot water. I understand (and please correct me if I am wrong) Only NSA legally, are allowed to "poke and prod sites". Well, and I guess by legally you can interpret that as "they are legally allowed to" or "nobody is really prepared to tell them no". Anyway, a lot of anti-hacking laws are written that "poking and prodding is not benign" admitting to too many details of that on national media might be a case of bad judgement.

ams6110 13y ago
Get who in hot water? The botnets that continually, around the clock 365 days a year "poke and prod" nearly every IP address that responds to port 80 or 443?
- rdtsc 13y ago
  David Kennedy, they guy who just admitted it on TV? > The botnets that continually, around the clock 365 days a year "poke and prod" nearly every IP address that responds to port 80 or 443? If you can find an operator that confesses it publicly. How many do it? Pretty sure if say Vasile Bogdan from Bucharest, calling CNN confessing he just broke into Bank of America CC processing center, he might find himself on Interpol's most wanted list.
theboss 13y ago
You are very wrong. Poking and proding is completely legal and isn't going to send anyone to jail. He's not performing a full pen-test on the site. He's not looking to get a shell. He's just checking out best practices. Is there an HSTS header? Is my input validated? etcetc. The main hacking law that applies here is the CFAA and Dave definitely isn't violating it. To violate it you have to access something you're not allowed to. Nobody will EVER go to jail for an XSS or the types of things he's poking around for. This is because the computer the code is running on is his own....
- tptacek 13y ago
  Reflected XSS testing can easily end up disrupting the whole site for every user; all it takes is for input to some endpoint to get stored and replayed across the site. Relying on the idea that any kind of active testing against a site you don't own is safe, technically or legally, is a bad idea.

kevin818 13y ago

This is what happens when you build a website with contractors from several different places. Things slip through the cracks, in this case security was one of those things.

deleted 13y ago

[deleted]

tptacek 13y ago

This sounds like grandstanding horseshit. Fewer than 1 in 10 companies we work with even attempts to "build security in from the start", and far fewer come close to succeeding. Any consultant that told a client to "start over from scratch" after finding little more than open redirects and username enumeration† would be laughed out of the room. Actually, scratch that: you can expect to be laughed out of the room for suggesting a rewrite after finding remote code execution. Like every other piece of software put on the Internet by the government, banks, health care consortiums, arms manufacturers, cat sharing startups or network equipment vendors, Healthcare.gov will achieve some semblance of security over the long term by having the crap beat out of it in production. Hopefully by good people first. They won't get there by starting over on the advice like this. This story is an embarrassment for my field. † I found the "report" to Congress; documented vulnerabilities include "undisclosed", open redirects, attacker control over the XML output of a search endpoint, a "test" subdomain on the Internet (no additional findings), Google search results with the token "test" in them (no additional findings), publicly indexed profiles on DATA.HEALTHCARE.GOV (the public dataset site), username enumeration via "this name taken" errors, the fact that they use Experian, the presence of jquery.fileupload.js, and CORS. I'm not sure any of these would even be sev:medium in a Matasano report; many would be sev:info, and a few, like Experian, wouldn't be documented at all.

yahelc 13y ago
The story reads like "Area Consultant Advises Government To Pay Exorbitant Fees For His Services".
andrewflnr 13y ago
I don't think it's unreasonable to expect that a website which people are legally obligated to use by a certain deadline, entering very sensitive information in the process, have a decent standard of security at launch. I don't see "having the crap beat out it in production" as a good strategy here, and certainly is worth complaining about, even if not worth re-writing over. Would you be comfortable entering your SSN at healthcare.gov?
- tptacek 13y ago

espeed 13y ago

David Kennedy's Bio: https://www.trustedsec.com/about-us/leadership/ https://www.trustedsec.com/about-us/leadership/

tptacek 13y ago
His bio said he spoke at Black Hat. I can't find anything listed by him except for an "Arsenal" talk, which is a lightning talk people can give about open-source tools they've written. Can someone find a real BH talk this guy has given?
- espeed 13y ago
  Under his site's "Presentations" section (https://www.trustedsec.com/downloads/presentations/ https://www.trustedsec.com/downloads/presentations/), it lists this talk... "July 2010 – Blackhat and Defcon Presentation on PowerShell" (http://www.trustedsec.com/files/PowerShell_Defcon.pdf http://www.trustedsec.com/files/PowerShell_Defcon.pdf)
  - tptacek 13y ago
    Thanks. Yep, that counts.
    - hellokitteh 13y ago
      The guy co-authored Metasploit: The Penetration Testers Guide book. Doesn't the fact that you're unaware of this prominent person call into question your own credibility?
      - borski 13y ago
        No. 'tptacek is a VERY well respected individual within the infosec community. Moreover, if I knew every author or every infosec book, I would have very little time to do anything else.
      - tptacek 13y ago

wavesounds 13y ago

Does anyone in California know if you can get a discount on private health insurance if you're currently unemployed (healthy non-smoker) trying to start a business and don't want to sign up for Medi-Cal because the only doctors are far away and crowded? Also the Covered CA site has an expired security certificate.

sehrope 13y ago

This'd be a great use case for a bug bounty. It's a situation where you have tons of bugs[1] and tons of cash to pay out a bounty. It'd probably be cheaper to open source all the code and hire one full time person to manage the bounty program then whatever they're trying out right now. [1]: Pure speculation as I have neither used the site or looked at the code but I'm assuming most people will agree with me

infra178 13y ago

Smart power ™

Kilo-byte 13y ago

sensationalist headline with little content to back it up