World's greatest hacker calls Healthcare.gov security 'shameful'

[lostinblue 1,989]

World's greatest hacker calls Healthcare.gov security 'shameful'

Published January 16, 2014

Security expert -- and once the world's most-wanted cyber criminal -- Kevin Mitnick submitted a scathing criticism to a House panel Thursday of ObamaCare's Healthcare.gov website, calling the protections built into the site "shameful" and "minimal."

In a letter submitted as testimony to the House Science, Space and Technology Committee, Mitnick wrote: "It's shameful the team that built the Healthcare.gov site implemented minimal, if any, security best practices to mitigate the significant risk of a system compromise."

Mitnick's letter, submitted to panel Chairman Lamar Smith, R-Texas, and ranking member Eddie Bernice Johnson, D-Texas, held comments from several leading security experts.

Mitnick concluded that, "After reading the documents provided by David Kennedy that detailed numerous security vulnerabilities associated with the Healthcare.gov Website, it's clear that the management team did not consider security as a priority."

RAW DATA: Security experts on Healthcare.gov issues

His comments were backed up by testimony by Kennedy, who is CEO and founder of TrustedSec LLC and a self-described "white hat hacker," meaning someone who hacks in order to fix security flaws and not commit cybercrime. In November, Kennedy and other experts testified before the same panel about security issues on Healthcare.gov.

Kennedy testified that most of the flaws they identified at the time still exist on the site, and said "indeed, it's getting worse," telling the panel that he and other experts have seen little improvement in the past two months.

"Nothing has really changed since our November 19 testimony," Kennedy said.

Only one-half of a vulnerability has been found and plugged since then, he told the committee. "They did a little bit of work on it and it's still vulnerable today."

Also speaking at the panel were Michael Gregg, chief executive officer of Superior Solutions, Waylon Krush, co-founder and CEO of Lunarline, and Dr. Lawrence Ponemon, chairman and founder of the Ponemon Institute.

There have been no confirmed security breaches or hacks of the site yet, despite the alarming current and past testimony from the panel. (At the November panel, Kennedy said the website "may have already been hacked.") The flaws that have been found are mere speculation, pointed out Krush, whose firm has done security work for the Department of Health and Human Services.

“Nobody here at this table can tell you there is a vulnerability,” he said during testimony. To actually test the flaws would require hacking the website itself, which would mean breaking the law, he noted.

http://www.foxnews.com/tech/2014/01/16/world-greatest-hacker-calls-healthcaregov-security-shameful/

[Darnell 8,479]

sounds like they need to redo the table.

[Peikko 1,575]

The committee is consulting experts, experts are making recommendations.. Of course, it could be that THE DEVIL KENYAN has a secret plot to steal everyone's SS# and sell them off to foreign powers in a bid to undermine the US and its economy.

[spookyturtle 9,466]

The committee is consulting experts, experts are making recommendations.. Of course, it could be that THE DEVIL KENYAN has a secret plot to steal everyone's SS# and sell them off to foreign powers in a bid to undermine the US and its economy.

I knew someone would see the light!! This is exactly what he is trying to do.

[Mr. Big Dog 10,747]

http://www.foxnews.com/tech/2014/01/16/world-greatest-hacker-calls-healthcaregov-security-shameful/

[The Nature Boy 4,224]

B. it was not on MSNBC, Al-Jazerra, Salon,CNN or other left wing approved sources so it is obvious right wing biased hate,no matter how many facts they quote

[JohnR! 5,495]

The committee is consulting experts, experts are making recommendations.. Of course, it could be that THE DEVIL KENYAN has a secret plot to steal everyone's SS# and sell them off to foreign powers in a bid to undermine the US and its economy.

Don't underestimate the power of the vast, huge and incommensurable conspiracy. It has been afoot since 1961. They thought of everything. Resistance is futile!

[JohnR! 5,495]

B. it was not on MSNBC, Al-Jazerra, Salon,CNN or other left wing approved sources so it is obvious right wing biased hate,no matter how many facts they quote

F. Consider taking the time and reading the copy posted by the OP. The spin should have you dizzy. Take a second look before you ingest it. Here are a couple of words to help you: Mole. Hill. You can shake it any way you want but it is still just swill.

[Merle 458]

http://www.sitepronews.com/2014/01/16/experts-call-healthcare-gov-security-shameful/

January 16, 2014

Experts Call Healthcare.gov Security Shameful

More then 20 Vulnerabilities Remain in Obamacare WebsiteBy SPN Staff Writers in Breaking NewsPhoto Credit: FutUndBeidl via flickrShare on facebookShare on twitterShare on google_plusone_shareShare on pinterest_shareShare on linkedinShare on emailMore Sharing Services0TranslateThe beleaguered Obamacare website is still at risk of being hacked due to a plethora of vulnerabilities, say a group of security experts.TrustedSec head of computer security David Kennedy testified before Congress today about Healthcare.govs security issues, saying only about 50 percent of the vulnerabilities discovered since last year have been patched.Kennedy, who also testified on the same subject last November, told Congress another 20-plus bugs have been found by other security researchers examining the site.Some issues still include critical or high-risk findings to personal information or risk of loss of confidentiality or integrity of the infrastructure itself, he said.Kennedy told Congress he asked a number of other security professionals to review his findings.I asked that they simply give their professional opinion on what they thought of the exposures and if they think best practices were followed on the healthcare.gov website, Kennedy said. The results were unanimous and unified its bad.Here is what some of them had to say:Counter Hack founder Ed SkoudisIve worked on dozens of large-scale breach cases over the past 12 years, looking at the root cause vulnerabilities and the attackers methods, Skoudis said. Reviewing the security issues discovered in the healthcare.gov site, I can tell you: this is a breach waiting to happen. Or, given the numerous vulnerabilities, perhaps a breach already has happened. These are exactly the kind of security flaws bad guys exploit in large-scale breaches. Urgent action is required to fix these flaws, applying well-known, time-tested, industry-standard security defenses.Mitnick Security Consulting CEO Kevin MitnickHealthcare.gov retrieves information from numerous third-party databases belonging to the IRS, Social Security Administration, Department of Homeland Security, and other State agencies, Mitnick said. It would be a hackers wet dream to break into Healthcare.gov and potentially gain access to the information stored in these databases. A breach may result in massive identity theft never seen before these databases house information on every U.S. citizen!Its shameful the team that built the Healthcare.gov site implemented minimal, if any, security best practices to mitigate the significant risk of a system compromise or access to consumer proprietary information.Secure Ideas CEO Kevin JohnsonIn my professional opinion, these findings exhibit not only a basic lack of security testing, but also reflect signs that standard IT change management and validation practices are not being followed, Johnson said. These security findings are typical findings we see when an application has been written by developers who have not been introduced to basic security training, nor understand the importance of security within an application.The findings disclose a wide range of issues that could cause serious harm to bothhealthcare.gov as well as any individual using the application. These flaws are not even complex problems that would require advanced security knowledge to detect. Instead, they are issues that are detected with simple, standard techniques, of which any developer or QA professional should be aware.The Centers for Medicare & Medicaid Services, which manages the health-care site, issued the following statement to Reuters:To date there have been no successful security attacks on HealthCare.gov and no person or group has maliciously accessed personally identifiable information from the site. Security testing is conducted on an ongoing basis using industry best practices to appropriately safeguard consumers personal information

[Merle 458]

Sorry about the last post. I am at work using my phone and that's how it copied and pasted it.

[Ban Hammer 13,489]

one post removed for tos violations