Healthcare.gov: *500 MILLION* Lines of Code and Your Username and Password Are NOT Safe

"If someone can't register, that's obviously bad -- but if the information gets hacked, you're talking about one of the biggest breaches in American history," Kennedy said.

CNN's (yes, that CNN!) MONEY website has this recent article, "To fix Obamacare website, blow it up, start over" but that's not the most alarming point to the piece, even though the next-best recommendation is that "just fixing it" (i.e., debugging) will take 6-12 months. Extremely bad news if you're being forced to get insurance through it:

After assessing the website, Dave Kennedy, the CEO of information-security company Trusted Sec, estimates that about 20% of Healthcare.gov needs to be rewritten. With a whopping 500 million lines of code, according to a recent New York Times report, Kennedy believes fixing the site would probably take six months to a year.
...
To put 500 million lines of code into perspective, it took just 500,000 lines of code to send the Curiosity rover to Mars. Microsoft's Windows 8 operating system reportedly has about 80 million lines of code. And an online banking system might feature between 75 million and 100 million lines. A "more normal range" for a project like Healthcare.gov is about 25 million to 50 million lines of code, Kennedy said.

"The [500 million lines of code] says right off the bat that something is egregiously wrong," said Kennedy. "I jumped back when I read that figure. It's just so excessive."

"Projects that are done rapidly usually have a lot of [repetitive] code," said Arron Kallenberg, a software engineer and tech entrepreneur. "So when you have a problem, instead of debugging something in a single location, you're tracking it down all through the code base."

I've written code. I've debugged code. Granted, it was back in the dinosaur days of IBM mainframe punch cards, when you handwrote your code, character by character, on what looked like graph paper that was then fed to an OCR reader so you had to be sure the filled boxes said exactly what they needed to say. It was a horrific, tedious, painstaking, line-by-line-by-thousands-of-lines process.

[Image courtesy of Mainframesupport.wordpress.com]

Boy, does this bring back memories. Debugging code was often done by getting what's called a "core memory dump" or just "core dump", for short. It's the contents of the computer's digital memory at the point that the application crashed. It was printed on reams of paper (remember, no personal computers back then, nothing but dumb, black-and-white terminals). And it was not fun. But to this day, it's been an unconscious, stock phrase in my lexicon for whenever someone was being too long-winded or whenever I needed all the facts on something. "He gave me a core dump on his life" or "I need to get a core dump on that problem." I'm sure it's caused some confusion to anyone who's heard me say it.

Programming languages are much different in the years since COBOL was king, but it still is difficult to debug that big a series of programs.

So Healthcare.gov is bloated to 10 or 20 times the size it should be. Kennedy's estimate makes perfect sense: it could take 10 times as long as the White House is most recently figuring (Nov.30, one month or so from now) to debug that much code.

But the worst news is this: The info-security company CEO analyzed Healthcare.gov here, and concluded you're putting all your most private info on the line for anyone to hack:

...you can enumerate valid and invalid user accounts in the database. Even worse is there are no form or appearance of automation deterrents such as CAPTCHA or image verifications that a human is attempting this. We can easily feed this through Burp Intruder for the content length from the response to see which usernames were actually valid. Essentially you could enumerate the entire database of user accounts in the new healthcare.gov website through brute forcing the response codes and finding valid usernames.

Additionally, developer comment code is plastered everywhere which gives an attacker a significant amount of understanding about the application – these are literally everywhere on almost every page that’s opened and all third party files...

Here are two definitions of "enumeration":

...a computer program used to retrieve usernames and info on groups, shares, and services of networked computers. This type of program scans networks for vulnerabilities in the security of that network. If there is a vulnerability with the security of the network, it will send a report back to a hacker who may use this info to exploit that network glitch to gain entry to the network or for other malicious activities. Ethical hackers often also use the information to remove the glitches and strengthen their network.

This definition is written from the perspective of a company trying to discover where its software's weaknesses are so they can fix them:

Network Enumeration/Discovery

Before we can gain unauthorized access to a network, we have to know the topology of the network. Every piece of information we can obtain about the target network adds a piece to the puzzle. We specifically scan the target network to obtain a list of live hosts, as well as to begin mapping the target to get a sense of its architecture and the kind of traffic (for example, TCP, UDP, IPX) that is allowed. The goal of discovery is to start with no information and gather as much data as possible about the target network and systems. We then use this information to identify potential exploits.

The process of discovering this information is called network enumeration and is the first step to an external penetration test. This step is performed largely over the Internet using readily available software and publicly accessible repositories of information. Most of the information we obtain in this step is freely available and legal to obtain. However, many companies monitor who tries to get this information since it may indicate a prelude to an attack.

~ from the article "Security Through Penetration Testing: Internet Penetration" by Ajay Gupta, Thomas Klavinsky, Scott Laliberte, Mar 15, 2002, on the website informIT, a Pearson Education site

Is Healthcare.gov monitoring who tries to get this information from its site, so it can ward off potential cyberattacks? I kinda doubt it, given what the CEO Kennedy writes in his article:

We’ve also identified some significant [other risks/exposures] that we can’t post online due to the critical nature of them and attempting to contact the development team for the website to remediate.

All this, from the Technology-King President. (Seriously, read that link to see how all his genius Technology Czars botched everything up, not just this, all these years).

How did Obama's administration choose a software provider that had already botched $2.127 BILLION in software systems that never worked and were thus fired by "the government of Canada and the government of Ontario (and the government of New Brunswick)"?

And why aren't people calling their Senators and Congressmen on this to make them force pulling the plug and letting insurers re-offer people the plans they've been cancelling?