Congratulations, Barack — Now fix your websites
Change? Start with security
President elect Barack Obama’s embrace of online video and social networking may have propelled him to victory, but unless he’s careful, his administration could be brought down by the same sloppy security problems that have plagued MySpace, Facebook, and dozens of other Web 2.0 properties.
A cursory look at Change.gov and MyBarackObama reveal enough amateur mistakes to make even the most ardent supporters wonder just who in the heck is in charge of security. For one, the content management system for both of the sites is easily accessible to anyone. And as far as we can tell, neither page is protected by secure sockets layer — the “s” following a web address’s “http” that assures you the connection is encrypted.
Security 101 would dictate that pages this sensitive should be restricted to select internet protocol addresses, or at the very least, encrypted to prevent so-called man-in-the-middle attacks. There are no such protections on Change.gov or MyBarackObama, the latter suggesting that this lack of attention to security has been allowed to persist for some time now.
Change, or just more of the same?
The failure of Obama’s webmasters to follow anything remotely like best practices is more than a little troubling because it suggests they don’t fully grasp the security realities of living in a Web 2.0 world. Miscreants have been all too happy to exploit weaknesses in Facebook and MySpace even when they amount to little more than pranks. Imagine the damage that could be done by someone publishing an errant blog post or malicious hyperlink to the website belonging to the President of the United States.
This backdoor leads to Google
Then consider this: If Change.gov were to be breached by miscreants, it wouldn’t be the first time an Obama website has been hacked. As previously reported, the campaigns for both Obama and his Republican rival John McCain were penetrated by sophisticated overseas attackers who stole large amounts of information. You’d think that would have been enough to give the Obama camp religion about the importance of good computer hygiene, but evidently not.
We left messages for Obama’s press contacts, but had not received any response by time of publication. We similarly reached out to Blue State Digital, the company that designed the CMS for Change.gov, but no one was available to speak with us late Wednesday afternoon. At some point, it would be nice to know if the system has been audited by an outside security firm. If anyone gets back to us about that, we’ll be sure to update this article.
In the meantime, remember that for all Barack Obama’s talk about change, his Web 2.0 security posture so far seems to be more of the same. ®
Web Security 101 - some readers don’t seem to understand
3) Finally, consider that google-analytics.com is hosted on a non-SSL page. So if an attacker wanted to target an admin user, sniffing/manipulating their change.gov Web traffic can result in the same effects as #2. This is easily down. Another possibility is manipulating the admin users DNS server, enough weaknesses currently exist, where google-analytics would be made to point to a malicious server instead.
The story is technically accurate.
I wonder if the Blue State Digital CMS sends an auto-gen'd password in a plain text email for a password reset. Obviously if they send a new password in a plain text email there is the slight risk it could be intercepted. I've not attempted to reset anyone's password but if they don't ask security questions (you know, like how the El Reg does*) before the reset you could have fun randomly resetting Blue State Staffer's passwords :).
*Paris tagged comments don't require the same level of security as the site of the President-Elect. Maybe Blue State, like the Reg, also saves passwords in plain text in the DB?
the phrase "likelihood is quite near zero" is (i) true and (ii) the flaw in your argument.