Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Attacker Infects Healthcare.gov Test Server

Federal officials say no consumer data was impacted and second open enrollment period on HealthCare.gov will not be affected.

Hackers breached a test server supporting the Obama administration's HealthCare.gov website, but did not make off with any consumer data, according to federal officials.

Security experts long have been concerned about potential security vulnerabilities in the Obama Administration's HealthCare.gov site, which got off to a rocky start last year after its launch.

In a prepared statement, Aaron Albright, a spokesperson for the Department of Health and Human Services' Centers for Medicare and Medicaid Services (CMS), says the agency's review indicates the compromised server did not contain consumers' personal information, and no data was stolen. In addition, it does not appear that the HealthCare.gov website was specifically targeted, he says.

A Wall Street Journal report says the server was compromised in July. The attacker was able to upload malware to server -- an infection that was discovered in August when the CMS security team uncovered an anomaly via the system security logs of one of the servers on the system. Further investigation found malicious files on the test server.

The malware was described as "commonplace," and was designed to launch a denial-of-service attack against other sites, as opposed to exfiltrating data. Additionally, an analysis of network traffic revealed no evidence information was sent to an external IP address.

A source with the Department of Health and Human Services reportedly told The Wall Street Journal  that the test server was protected by a default password and was never meant to be connected to the Internet.

"Like a lot of the other breaches that have made headlines over the past few months, this was the result of simple, compounded mistakes," says Eric Cowperthwaite, vice president of advanced security and strategy at Core Security. "A basic security flaw went overlooked, and it was assumed that because the system in question wasn’t supposed to be connected to the internet, it wasn’t high priority and didn’t warrant continuous monitoring. But accidently connecting a system like this to the Internet happens all the time. Complex enterprise systems are susceptible to mistakes."

Even though federal officials say no data was stolen, there are still reasons to be concerned, argues Trey Ford, global security strategist at Rapid7.

"We do not have clarity in regard to the lack of change control on the firewall, and how or why this test server was exposed to the Internet," Ford tells Dark Reading. "Finally, we do not know how many daily scans went un-reviewed -- it seems like several weeks, so this also points to a lack of attention to the Internet exposed edge of this data center."

Auditors will find production data in test environments more frequently than they’ll want to admit, he adds.

"I am very interested in learning more about how the test environment reflects production -- while we hope and trust that production systems no longer have default credentials, we also want to know that live production data is carefully managed, and does not live on a neglected test network," he says.

No matter the size of the organization, ensuring total visibility and understanding security risks is critical to protecting users, says Brad Hibbert, vice president of product strategy and operations at BeyondTrust. This includes both internal and external risks.

"Many of the latest attacks we have seen in the news target these lower priority systems where hackers gain a foothold in the environment," he says.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/8/2014 | 12:00:32 PM
Re: An infection you hope to avoid
I agree with this. It created the additional damage in reputation and people would not hear test servers aspect of it, they will simply hear "the breach".
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/8/2014 | 11:58:48 AM
Re: Is it believable?
I agree, it is connected somewhere, such as database server, web server, application server, or any other third part interfaces to be tested. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/8/2014 | 11:56:53 AM
No internet no security
 

Enjoyed reading the article. Thanks for sharing it. As article points out no internet does not mean no security. There is lots of other threats coming from internal environment, more threats from inside than outside actually, we do not hear most for the inside threats and breaches.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/8/2014 | 9:36:28 AM
Re: An infection you hope to avoid
-- "a headline that you never want to see"

Unlikely that the headlines are going to get less frequent and the problem less critical.
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
9/8/2014 | 9:10:42 AM
Re: Is it believable?
I absolutely agree.  Just because it was a test server that wasn't supposed to connect to the internet, it doesn't change the fact that it didn't have the security controls in place.  What if it had indeed been connected to the internet and could have data siphoned off.  Or even yet, despite being a test server, I am sure it was connected to other systems.  All it takes is one server to be overlooked from a security perspective for the whole infrastructure to potentially become at risk for a breach.
PaulS681
50%
50%
PaulS681,
User Rank: Apprentice
9/6/2014 | 1:36:01 PM
Is it believable?
Is it believable that no consumer data was impacted? How do they know for sure?

Are we to just believe them that because this was a test server it had no real data on it? Many test systems use real data to properly test things out. While it is possible that there was none it still troublesome.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
9/5/2014 | 6:46:17 PM
An infection you hope to avoid
Damage was minimal but this is still a headline that you never want to see.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14821
PUBLISHED: 2019-09-19
An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->l...
CVE-2019-15032
PUBLISHED: 2019-09-19
Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.
CVE-2019-15033
PUBLISHED: 2019-09-19
Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.
CVE-2019-16412
PUBLISHED: 2019-09-19
In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enforced within the GUI.)
CVE-2019-16510
PUBLISHED: 2019-09-19
libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.