Obamacare site not safe, say cyber security experts

By Peter Gothard
17 Jan 2014 View Comments
US President Barack Obama at the G20 summit in St Petersburg

Cyber security professionals have warned that the US government's HealthCare.gov website is not safe from hackers, three months after oversights had already been flagged up.

David Kennedy of security consultants TrustedSec told Reuters that the service – informally dubbed "Obamacare" – has not corrected 20 gaps in security in the system that he and other security professionals alerted the government to soon after the service went live at the start of October 2013.

Further reading

Obamacare is designed to serve 36 states across the US, and has already been besieged by technical errors since launch, going so far as to damage its namesake president's reputation.

Kennedy alleges that hackers can easily access personal customer information, change data that exists on the servers and even find access routes through the HeathCare.gov servers to the endpoints through which customers are accessing the site.

Kennedy is to offer his concerns to the House Science, Space and Technology Committee later today, and has described what he has to impart as "alarming".

Kevin Johnson, another expert who analysed Kennedy's findings, went as far as calling the site "fundamentally flawed". Kennedy himself reported a specific flaw in which he said he was able to extract 70,000 customer health records from the site within four minutes simply by writing a simple computer program to automate the process.

Kennedy said he did even have to directly hack the site to carry out the transaction, as all the records were available on the internet, rather than stored on secure servers.

However, the federal agency that oversees the site, the Centers for Medicare and Medicaid Services, also told Reuters that, to date, "there have been no successful security attacks on HealthCare.gov", and that no "person or group has maliciously accessed personally identifiable information" on the site.

While claiming security testing is conducted to "industry best practices" on an "ongoing basis", the agency did not directly deny Kennedy's claims, and has said it takes the matter seriously.

Reader comments
blog comments powered by Disqus
Windows 10 - will you upgrade?

Microsoft has made an early version of Windows 10 - its next operating system - available for download. The OS promises better integration and harmonisation across platforms, including mobile and desktop. Will your business be upgrading?

38 %
26 %
15 %
21 %