Feeds

Congratulations, Barack — Now fix your websites

Change? Start with security

  • alert
  • submit to reddit

Top three mobile application threats

President elect Barack Obama’s embrace of online video and social networking may have propelled him to victory, but unless he’s careful, his administration could be brought down by the same sloppy security problems that have plagued MySpace, Facebook, and dozens of other Web 2.0 properties.

A cursory look at Change.gov and MyBarackObama reveal enough amateur mistakes to make even the most ardent supporters wonder just who in the heck is in charge of security. For one, the content management system for both of the sites is easily accessible to anyone. And as far as we can tell, neither page is protected by secure sockets layer — the “s” following a web address’s “http” that assures you the connection is encrypted.

Security 101 would dictate that pages this sensitive should be restricted to select internet protocol addresses, or at the very least, encrypted to prevent so-called man-in-the-middle attacks. There are no such protections on Change.gov or MyBarackObama, the latter suggesting that this lack of attention to security has been allowed to persist for some time now.

Administrative page for Change.gov

Change, or just more of the same?

Even more troubling is the discovery that administrative pages for both sites are linked to Google Analytics. This is a hard configuration to make sense of. It means that Google, a private company with important business before the US government, has complete administrative access to one of the government’s most important websites. It would also appear to run contrary to this privacy policy pledging “not to make Personal Information available to anyone other than our employees, staff, and agents.”

The failure of Obama’s webmasters to follow anything remotely like best practices is more than a little troubling because it suggests they don’t fully grasp the security realities of living in a Web 2.0 world. Miscreants have been all too happy to exploit weaknesses in Facebook and MySpace even when they amount to little more than pranks. Imagine the damage that could be done by someone publishing an errant blog post or malicious hyperlink to the website belonging to the President of the United States.

Google Analytics in page source

This backdoor leads to Google

Then consider this: If Change.gov were to be breached by miscreants, it wouldn’t be the first time an Obama website has been hacked. As previously reported, the campaigns for both Obama and his Republican rival John McCain were penetrated by sophisticated overseas attackers who stole large amounts of information. You’d think that would have been enough to give the Obama camp religion about the importance of good computer hygiene, but evidently not.

We left messages for Obama’s press contacts, but had not received any response by time of publication. We similarly reached out to Blue State Digital, the company that designed the CMS for Change.gov, but no one was available to speak with us late Wednesday afternoon. At some point, it would be nice to know if the system has been audited by an outside security firm. If anyone gets back to us about that, we’ll be sure to update this article.

In the meantime, remember that for all Barack Obama’s talk about change, his Web 2.0 security posture so far seems to be more of the same. ®

Combat fraud and increase customer satisfaction

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.