No security ever built into Obamacare site: Hacker
Source: CNBC
It could take a year to secure the risk of "high exposures" of personal information on the federal Obamacare online exchange, a cybersecurity expert told CNBC on Monday.
"When you develop a website, you develop it with security in mind. And it doesn't appear to have happened this time," said David Kennedy, a so-called "white hat" hacker who tests online security by breaching websites. He testified on Capitol Hill about the flaws of HealthCare.gov last week. "It's really hard to go back and fix the security around it because security wasn't built into it," said Kennedy, chief executive of TrustedSec. "We're talking multiple months to over a year to at least address some of the critical-to-high exposures on the website itself."
<snip>
Last month, a Sept. 27 government memorandum surfaced in which two HHS officials said the security of the site had not been properly tested before it opened, creating "a high risk." HHS had explained then that steps were taken to ease security concerns after the memo was written, and that consumer information was secure. Technicians fixed a security bug in the password reset function in late October, the agency said.
But on CNBC, Kennedy disputed those claims, saying vulnerabilities remain on "everything from hacking someone's computer so when you visit the website it actually tries to hack your computer back, all the way to being able to extract email addresses, users names—first name, last name—[and] locations."
Read more: http://www.cnbc.com/id/101225308
If this is true, it seems probable that someone with a political agenda against ACA will exploit it, and publicize it.
= new reply since forum marked as read
But I know quite a bit about IT security, so I cannot fathom how the premise of this story can simply be bullshit. Web applications with a decade of development history deal with exploits quite commonly.
He posted a screenshot of some python scripts (which could do nothing but echo out content) that supposedly interface with the provider web services to extract user data:
I've mined data off government websites (public data mind you) by coming up with the proper requests and plugging in automatically incrementing id's (instead of hashes) to extract data quickly, up to millions of records. If their webservices did not require authentication and were using SOAP protocol (likely), he could easily have requested info if an increment id was the sole request parameter.
And by the way, it's "reeks," not "wreaks." 
Doesn't mean I can't learn something but at this point I stand by my statement. And that's a s far as I'm going with it.
The word is wreaks... as in wreak havoc... I wasn't referring to smells.
