Obamacare Website: A Hacker’s “Wet Dream”

We’re pretty sure members of the U.S. Congress don’t often receive testimony containing the term “wet dream,” but that was the descriptive metaphor used by a security expert called upon to assess the vulnerabilities of the much-maligned Obamacare website.

Kevin Mitnick – known in the 1990s as the “World’s Most Wanted Hacker” – has spent the last decade-and-a-half analyzing internet security and making recommendations regarding “penetration testing.”

What does he think of the Obamacare site?  Not much …

“Healthcare.gov retrieves information from numerous third-party databases belonging to the IRS, Social Security Administration, Department of Homeland Security, and other State agencies,” Mitnick testified. “It would be a hacker’s wet dream to break into Healthcare.gov and potentially gain access to the information stored in these databases. A breach may result in massive identity theft never seen before — these databases house information on every U.S. citizen!”

Wait … hopefully a website costing taxpayers more than a billion dollars to launch took into account sufficient security precautions, right?

Right?

Um … no.

“It’s shameful the team that built the Healthcare.gov site implemented minimal, if any, security best practices to mitigate the significant risk of a system compromise or access to consumer proprietary information,” Mitnick testified.

According to Mitnick, the recent hacking of consumer information from retailer Target should serve as “a big wake up call for the Government.”

“It’s time for the Healthcare.gov to shore up their defenses by adopting best security practices, including identifying and remediating security flaws that will be exploited by our adversaries,” he wrote.

Or … just scrap the whole thing.

MITNICK TESTIMONY (.pdf)