Attacker Infects Healthcare.gov Test Server

Hackers breached a test server supporting the Obama administration's HealthCare.gov website, but did not make off with any consumer data, according to federal officials.

Security experts long have been concerned about potential security vulnerabilities in the Obama Administration's HealthCare.gov site, which got off to a rocky start last year after its launch.

In a prepared statement, Aaron Albright, a spokesperson for the Department of Health and Human Services' Centers for Medicare and Medicaid Services (CMS), says the agency's review indicates the compromised server did not contain consumers' personal information, and no data was stolen. In addition, it does not appear that the HealthCare.gov website was specifically targeted, he says.

A Wall Street Journal report says the server was compromised in July. The attacker was able to upload malware to server -- an infection that was discovered in August when the CMS security team uncovered an anomaly via the system security logs of one of the servers on the system. Further investigation found malicious files on the test server.

The malware was described as "commonplace," and was designed to launch a denial-of-service attack against other sites, as opposed to exfiltrating data. Additionally, an analysis of network traffic revealed no evidence information was sent to an external IP address.

A source with the Department of Health and Human Services reportedly told The Wall Street Journal  that the test server was protected by a default password and was never meant to be connected to the Internet.

"Like a lot of the other breaches that have made headlines over the past few months, this was the result of simple, compounded mistakes," says Eric Cowperthwaite, vice president of advanced security and strategy at Core Security. "A basic security flaw went overlooked, and it was assumed that because the system in question wasn’t supposed to be connected to the internet, it wasn’t high priority and didn’t warrant continuous monitoring. But accidently connecting a system like this to the Internet happens all the time. Complex enterprise systems are susceptible to mistakes."

Even though federal officials say no data was stolen, there are still reasons to be concerned, argues Trey Ford, global security strategist at Rapid7.

"We do not have clarity in regard to the lack of change control on the firewall, and how or why this test server was exposed to the Internet," Ford tells Dark Reading. "Finally, we do not know how many daily scans went un-reviewed -- it seems like several weeks, so this also points to a lack of attention to the Internet exposed edge of this data center."

Auditors will find production data in test environments more frequently than they’ll want to admit, he adds.

"I am very interested in learning more about how the test environment reflects production -- while we hope and trust that production systems no longer have default credentials, we also want to know that live production data is carefully managed, and does not live on a neglected test network," he says.

No matter the size of the organization, ensuring total visibility and understanding security risks is critical to protecting users, says Brad Hibbert, vice president of product strategy and operations at BeyondTrust. This includes both internal and external risks.

"Many of the latest attacks we have seen in the news target these lower priority systems where hackers gain a foothold in the environment," he says.