Obamacare website developers rush to fix bug suggesting hacking methods

This article is more than 5 years old
A screenshot of Healthcare.gov
Healthcare.gov suggests hacking attacks to users. Photograph: Healthcare.gov

A flaw in the website of President Obama's flagship Affordable Care programme has left the site and its users vulnerable to hacking, the Guardian has discovered.

Healthcare.gov has been unknowingly recording hack attempts through its search box and re-presenting the code as automatically completed options.

The bug could invite hackers to plant malicious code, which could then infect users' computers, but while site managers have removed the most obvious mistakes, several serious flaws remain and attacks continue to be suggested to users.

Although most of them are harmless, some saved options present the possibility of further attacks using a flaw known as "cross site scripting", or XSS.

If visitors to Healthcare.gov type a semicolon (;), apostrophe (') or less-than sign (<) into the search box, they are presented with a list of the most popular searches beginning with those characters.

That includes a variety of terms used in hacking techniques such as XSS and SQL injection attacks; both types of attacks involve forming a search term in such a way that the target interprets it as a command.

Some examples of attempted hacks in Healthcare.gov's autocomplete.
Some examples of attempted hacks in Healthcare.gov's autocomplete. Photograph: /Healthcare.gov

The fact that the site is showing such terms in its search bar's autocomplete is indicative of the quantity of attacks it has come under.

In early November, Roberta Stempfley, who is in charge of cyber security at the Department of Homeland Security, told the House of Representatives' Homeland Security committee that the agency had been passed "about 16 reports" of hacking attempts of the website serious enough to warrant investigation.

It is unknown how many minor attacks the site has come under, but there are apparently enough for the search bar's autocomplete to consider them common search terms.

None of the attacks displayed by the site work, and as such it would be merely embarrassing for the Department of Health and Human Services to so publicly display the pressure it is under.

But some of the malformed search terms hint at deeper problems with the site.

Users who search for a term like "admin" see it being suggested correctly, with the already-typed letters showing up in bold, and the suggested completion showing unbolded. But if the same user searches for a term like "<admin>", the site's formatting breaks. The already-typed letters do not show up at all, and the untyped letters are bolded, as seen in the following image:

How special characters break the Healthcare.gov search box
How special characters break the Healthcare.gov search box Photograph: /Healthcare.gov

Examination of the code returned shows that the typed characters are passed to the user's browser as javascript, where the "<" character causes them to be incorrectly displayed.

Worse still, some typed code is simply executed. Users searching for "<input>" receive an autocomplete suggestion which contains a copy of the search box:

How <input> breaks the search box.
How <input> breaks the search box. Photograph: /Healthcare.gov

The autocomplete suggestions are a potential weakness in the site; that makes the inability of the site's team to control which suggestions enter the database a more serious issue than mere embarrassment.

"The developers do seem to be actively filtering out swear words from being displayed in the suggestions list (I spent some time trying to get one in particular to appear) but they are not filtering out strings associated with attacks", says Trend Micro's Rik Ferguson.

"Does this mean that they did not anticipate such a high level of interest in poking holes in the website? That would be a bad thing.

"They do not appear to have spent a lot of time on the sanitisation of input (the best mitigation against these sorts of attacks) judging by the poor error handling and the oddities that can be achieved, for example, with the input tag. This too would be a bad thing – and neither of these bode well for the robustness of the site."

Twenty-four hours after the autocomplete suggestions became public, the list was edited to remove some of the most obvious attempted attacks, including ";select * from users" and ";show tables; ", but many still remain.

Obamacare is not to blame for Walmart's weak sales