Customer Success Testimonial: Recovery is Everything

President elect Barack Obama’s embrace of online video and social networking may have propelled him to victory, but unless he’s careful, his administration could be brought down by the same sloppy security problems that have plagued MySpace, Facebook, and dozens of other Web 2.0 properties.

A cursory look at Change.gov and MyBarackObama reveal enough amateur mistakes to make even the most ardent supporters wonder just who in the heck is in charge of security. For one, the content management system for both of the sites is easily accessible to anyone. And as far as we can tell, neither page is protected by secure sockets layer — the “s” following a web address’s “http” that assures you the connection is encrypted.

Security 101 would dictate that pages this sensitive should be restricted to select internet protocol addresses, or at the very least, encrypted to prevent so-called man-in-the-middle attacks. There are no such protections on Change.gov or MyBarackObama, the latter suggesting that this lack of attention to security has been allowed to persist for some time now.

Change, or just more of the same?

Even more troubling is the discovery that administrative pages for both sites are linked to Google Analytics. This is a hard configuration to make sense of. It means that Google, a private company with important business before the US government, has complete administrative access to one of the government’s most important websites. It would also appear to run contrary to this privacy policy pledging “not to make Personal Information available to anyone other than our employees, staff, and agents.”

The failure of Obama’s webmasters to follow anything remotely like best practices is more than a little troubling because it suggests they don’t fully grasp the security realities of living in a Web 2.0 world. Miscreants have been all too happy to exploit weaknesses in Facebook and MySpace even when they amount to little more than pranks. Imagine the damage that could be done by someone publishing an errant blog post or malicious hyperlink to the website belonging to the President of the United States.

This backdoor leads to Google

Then consider this: If Change.gov were to be breached by miscreants, it wouldn’t be the first time an Obama website has been hacked. As previously reported, the campaigns for both Obama and his Republican rival John McCain were penetrated by sophisticated overseas attackers who stole large amounts of information. You’d think that would have been enough to give the Obama camp religion about the importance of good computer hygiene, but evidently not.

We left messages for Obama’s press contacts, but had not received any response by time of publication. We similarly reached out to Blue State Digital, the company that designed the CMS for Change.gov, but no one was available to speak with us late Wednesday afternoon. At some point, it would be nice to know if the system has been audited by an outside security firm. If anyone gets back to us about that, we’ll be sure to update this article.

In the meantime, remember that for all Barack Obama’s talk about change, his Web 2.0 security posture so far seems to be more of the same. ®

Ensure Ease of Recovery with Asigra’s Agentless Software