Slashdot Mirror
Hackers Break Into HealthCare.gov
mpicpp is one of many to point out that hackers broke into the HealthCare.gov website in July and uploaded malicious software. "Hackers silently infected a Healthcare.gov computer server this summer. But the malware didn't manage to steal anyone's data, federal officials say. On Thursday, the Health and Human Services Department, which manages the Obamacare website, explained what happened. And officials stressed that personal information was never at risk. "Our review indicates that the server did not contain consumer personal information; data was not transmitted outside the agency, and the website was not specifically targeted," HHS spokesman Kevin Griffis said. But it was a close call, showing just how vulnerable computer systems can be. It all happened because of a series of mistakes. A computer server that routinely tests portions of the website wasn't properly set up. It was never supposed to be connected to the Internet — but someone had accidentally connected it anyway. That left it open to attack, and on July 8, malware slipped past the Obamacare security system, officials said.
The country's in the very best of hands.
"the malware didn't manage to steal anyone's data, federal officials say."
Mostly because at the time, no one had yet been able to successfully complete the sign up process.
How, in this day and age, does this kind of stupid shit keep happening? How are network admins not creating L2 & L3 separations in the network, with internal firewalls and IDS? How are operations engineers not building local firewalls on machines, and locking down through security policies?
This isn't 1994 any more people. Hand crafted individual artisanal servers, personally wrapped in cotton wool and hand reared by the friendly neckbeard, are not how things should be done at scale in this day and age.
FTFA: "Our review indicates that the server did not contain consumer personal information..."
So we're consumers to government services now?
It was bad enough when the corporations changed from using customers to consumers, but no way in hell should the government use that term in reference to its citizens.
--- Keep the choice with the user..
exactly one :-D
> It was never supposed to be connected to the Internet — but someone had accidentally connected it anyway.
This is where "we don't need security because the machines will never be connected to the internet" falls apart.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
TFA is on CNN, not on Fox.
Nowhere in the article there's any blame addressed to Obama.
I think maybe you're seeing things brother..
healthcare.gov was better protected then sony? homedepot? target?
Not too bad.
The Kruger Dunning explains most post on
We don't know either. It's media speak for some arbitrary subset of data about someone that some administration mouthpiece has fed the stenographe^Hreporters after consulting with some government lawyer somewhere.
Sorry. Can't help you.
Maw! Fire up the karma burner!
Give the job of fixing this to the newly minted Federal Government CTO announced on SlashDot just today! http://en.wikipedia.org/wiki/M...
Oh wait, problem, that's not her job, that falls under the Secretary of Health and Human Services control... Washington DC is broken, very broken...
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Exactly. The original breach was said to have occurred on July 8th. Despite "daily reviews" by the security team it went undetected until August 25th. That's what....6 weeks? I'm envisioning some sort of Falcon and the Snowman atmosphere with paper shredder margaritas for all.
Naturally, the administration is playing this whole thing down as "run-of-the-mill, low-level hacker stuff". Uh huh. Then why did it take 6 fucking weeks to find it? "It wasn't even designed to steal patient data", they claim. And what do you suppose were the intentions of the people behind this? Maybe just come in, take a stroll around and then put everything back nice and neat? No harm no foul.
I smell another cover-up in the making...just watch. All of the system logs and emails are going to disappear a-la the Lois Learner IRS saga. At the end of it all some low level drone will take the fall. Business as usual in the Nation's Capital.
"Yes - it's a big failure" - Yes, that much we can certainly agree on. Here is a little news flashback for you (I intentionally did not choose a story from Fox News or similar Right-leaning news source) : http://www.huffingtonpost.com/...
Not surprisingly, the administration has quitely stopped releasing signup numbers, despite a promise to do so in the article above: http://hotair.com/archives/201...
The Obama administration continues to play fast and loose with the term "enrollment" and still refuse to tell the public how many people have actually paid for an insurance plan via the Obamacare website.
I'm not suggesting that people should "die" when they get sick. Far from it. I believe that Americans should get the best medical care available.
What I am suggesting is that the implementation of the Affordable Care Act has been a collosal bungle, the likes of which the free world has never seen.
I deliberately chose to post from a left wing site (Huffington) and a right wing site (as you noted, Hot Air). Both articles reach the same conclusion. A fact that you seemingly have failed to grasp. Are you disputing the collective conclusions or are you just pissed off that things didn't work out the way you wanted them to?
In most cases you'd expect hackers to hack in and break the site, in this case they probably felt obligated to fix it knowing that that would annoy far more people than taking it off-line :)
-- If at first you don't succeed, lie!
Why does people who do not like the idea of the government collecting and storing personal data (under threat of law in most cases) that until recently was private and confidential on servers accessible by the internet have to be trolls for the Koch brothers?
And why would that be bad?
Here is the problem that maybe you simply do not get. Storing all your information on the internet is not a good thing. We have fought tooth and nail forever trying to get people to understand that and now the government decides it is best practice. So yes, completely make fools of fools might very well be warranted here. Maybe then it would cause people like you to wake up.
"Misstatement of the Year" is not as headline grabby.
Table-ized A.I.
The signups have been tracked by one guy - current total is some 9m. Check out http://acasignups.net/
After the startup glitches (your HuffPo link was from last year, and is well out of date) the site seems to be functioning OK.
No, he was either lying, or he intentionally did not listen to his advisers who were trying to tell him that people would not be able to keep their insurance or their doctors. Well, it is also possible that he assumed that people had voluntarily chosen doctors and insurance they did not like, so would be perfectly happy to give it up for insurance which covered less and cost more and doctors who delivered poorer service (largely because new regulations would require the doctors to spend more time filling out forms for bureaucrats than actually treating their patients).
The truth is that all men having power ought to be mistrusted. James Madison
I am not posting this AC cause I dont care, you need to know..,.I just left the healthcare IT industry after 4 years...because security was a sham. It was up to me, the admin, to go on my own and secure everything. I had to do this after hours, on my on time, cause during the core business hours I had to do releases, stand up more servers, baby sit the dev's, fix customer SSO issues, etc. Developers run the web sites..dont believe me..well try to get Ruby devs to change the code ruby auto generates from "Select * from users" to only select the user. Try to make the DB not return a query formed like that. try to break the tables apart so when the code is trying to verify a user who is loggin in, the same row doesnt contain EVERYTHING about them.The devs shit bricks and bitch they cant meet schedule... cause THATS HOW RUBY WANTS IT (or java to some extent). and these are the devs on US soil. the ones in india dont really care, they get paid by the hour, a low amount, so why not argue over shit like this for weeks and miss schedule and drive up the cost(their income) I have worked for two large healthcare websites, that currently hold around 100+ million US users PHI data, and the systems are not as secure as they should be. If they were targeted, they would fold. I know because for some long periods of time i was the ONLY admin at these sites. when i try to lock some things down, ruby or java broke. The customer wants a new feature, by next week, then we did it. Customers like CVS pharmacy, Cigna, Humana. Not to mention the the majority of US companies are going towards a tele-health option for their employees. So when YOU get that letter in the mail saying you now havea tele-health option, guess what, we already have ALL your personal data, from your employer.. whether you choose to sign up or not. Im not saying telehealth is a bad idea, just that in today's society, profit drives everything, security is way down the list of priorities...and as these breaches continue to happen, remember it is not THE ADMINS fault...we can only do so much. yes this is Obamas fault, he is like the CEO. every CEO i have worked for has been more concerned with profit, schedule, capabilities then securing YOUR data.
#include bier;