DOGE.gov A Definite Display Of Dogy Things Not To Do In Day 2

HELLFIRE

Usual preface from my DSLR days : sharing this story strictly and solely from a security / privacy POV to the exclusion of everything else. The snarky alliteration in the title is all me. Take what you will from this...

https://www.404media.co/anyone-can-push-updates-to-the-doge-gov-website-2/ -- Anyone Can Push Updates to the DOGE.gov Website (paywall)
https://archive.is/aTSIM

... Two different web development experts who asked to remain anonymous because they were probing a federal website told 404 Media that doge.gov is seemingly built on a Cloudflare Pages site that is not currently hosted on government servers. The database it is pulling from can be and has been written to by third parties, and will show up on the live website. Both sources told 404 Media that they noticed Doge.gov is pulling from a Cloudflare Pages website, where the code that runs it is actually deployed. One of the sources told 404 Media that they were able to push updates to a database of government employment information after studying the website’s architecture and finding the database’s API endpoints. ... “Feels like it was completely slapped together,” they added. “Tons of errors and details leaked in the page source code.” Both sources said that the way the site is set up suggests that it is not running on government servers. “Basically, doge.gov has its codebase, probably through GitHub or something,” the other developer who noticed the insecurity said. “They’re deploying the website on Cloudflare Pages from their codebase, and doge.gov is a custom domain that their pages.dev URL is set to. So rather than having a physical server or even something like Amazon Web Services, they’re deploying using Cloudflare Pages which supports custom domains.” ...

https://securityboulevard.com/2025/02/doge-gov-debacle-how-a-government-website-went-to-the-dogs-and-what-it-means-for-cybersecurity/ -- DOGE.gov Debacle: How a Government Website Went to the Dogs and What It Means for Cybersecurity

For a purely technical step-by-step analysis, though the Conclusion pulls no punches :

Well, folks, it looks like the Department of Government Efficiency (DOGE) accidentally took their name a bit too literally and decided to efficiently showcase every "what not to do" in the cybersecurity handbook. Who knew that "open government" meant leaving your database wide open for a game of digital graffiti? While the DOGE.gov website didn't contain sensitive data (thank goodness for small mercies), this incident is the equivalent of leaving your front door unlocked and a sign saying "Please come in and rearrange our furniture!" It's a stark reminder that even seemingly innocuous websites can become billboards for hackers with a sense of humor – or worse, those with malicious intent.

And to the DOGE team: Don't feel too bad. At least you've given cybersecurity professionals everywhere a new cautionary tale to tell around the glow of their monitors.

Regards

GrumpyCanadian

HELLFIRE I thought they said that Mr. DOGE was selecting smart people from within his companies. If said "smart", motivated people threw an official government Web site together like this, it begs the question of what sort of security and safety howlers might be lurking below the surface at Tesla and SpaceX (among others).

HELLFIRE

HELLFIRE sharing this story strictly and solely from a security / privacy POV to the exclusion of everything else.

... repeating this again, so MODs don't lock the thread.

Regards

Somewhat-Reticent

Cheap?

Somewhat-Reticent

GrumpyCanadian smart

Smart ≠ Wise … perhaps meant "smart" as in "smart device" or "smart phone" ?
Or perhaps meaning was "smart in own opinion"?

Rook

Hopefully they'll be more security-minded when they acquire all of the personal data of every taxpayer and Social Security recipient in the U.S.

Elon Musk’s DOGE seeks access to taxpayer data at IRS: AP sources
Social Security head steps down over DOGE access of recipient information: AP sources

HELLFIRE

Rook Hopefully they'll be more security-minded

... speaking for myself -- and to keep things ontopic -- in the time I've been posting these Security / Privacy / AI stories, see this graphic ... no offenses to any "Daves" out there.

My Sarcastic / Cynical 00000010bits

Regards

Astyanax

Rook How else are they supposed to root out who's getting fraudulent SS payments without looking at recipients? Same goes for IRS tax refunds and credits.

Rook

Yeah, human error is always going to be a problem regardless of the "protection" offered by the hardware and/or software we use.
(Pretty funny how human error in the article is called "Dave." )

Rook

Those agencies already have people who do that. And they seem to actually know what they're doing.

Astyanax

Rook
So what DOGE and Musk are saying are all lies? Not a single word of anything they’re reporting is true and it’s all a giant put-on and fraud?

Rook

Astyanax Most of it, yes. He admitted in his press conference that some of what he says is going to be untrue. That part was correct. (He then followed that admission with another lie, lol.)

Anyway, from a security standpoint, these guys are a joke. And they're playing with databases that contain a lot of private/sensitive information. Seems like a recipe for disaster.

Kathy_9

The original article is still available for your reading pleasure but the comments have run their course.