Trump's cyber-guru Giuliani runs ancient 'easily hackable website'
Stunned security experts tear strips off president-elect pick hours after announcement
13 Jan 2017 at 02:07,
Darren Pauli
US president-elect Donald Trump's freshly minted cyber-tsar Rudy Giuliani runs a website with a content management system years out of date and potentially utterly hackable.
Former New York City mayor and Donald loyalist Giuliani was
today unveiled by Trump's transition team as the future president's cybersecurity adviser – meaning Giuliani will play a crucial role in the defense of America's computer infrastructure.
Giulianisecurity.com, the
website for the ex-mayor's eponymous infosec consultancy firm, is powered by a roughly five-year-old build of Joomla! that is packed
with vulnerabilities. Some of those bugs can be potentially exploited by miscreants using
basic SQL injection techniques to compromise the server.
This seemingly insecure system also has a surprising number of network ports open – from MySQL and anonymous LDAP to a very out-of-date OpenSSH 4.7 that was released in 2007. It also runs a rather old version of FreeBSD.
Security gurus are right now
tearing strips off Trump's cyber-wizard pick. Top hacker Dan Tentler was
first to point out the severely out-of-date Joomla! install.
"It speaks volumes," Tentler told
The Register, referring to Giuliani's computer security credentials, or lack of, and fitness for the top post.
"Seventy-year-old luddite autocrats who often brag about not using technology are somehow put in charge of technology: it's like setting our country on fire and giving every extranational hacker a roman candle – or, rather, not setting on fire, but dousing in gasoline."
Content management system developer Michael Fienen also pulled no punches:
Damning ... Web dev
Michael Fienen weighs in on Facebook
It gets worse. "Giuliani is running a version of PHP that was released in 2013, and a version of Joomla that was released around 2012," said Ty Miller, a director at Sydney-based infosec biz Threat Intelligence.
"Using the version information, within minutes we were able to identify a combined list of 41 publicly known vulnerabilities and 19 publicly available exploits. Depending upon the configuration of the website, these exploits may or may not work, but is an indication that Giuliani's security needs to be taken up a level."
"You can probably break into Giuliani's server,"
said Robert Graham of Errata Security. "I know this because other FreeBSD servers in the same data center have already been broken into, tagged by hackers, or are now serving viruses.
"But that doesn't matter. There's nothing on Giuliani's server worth hacking."
Another computer security expert, speaking to
The Register on condition of anonymity, analyzed Giuliani's website for us. Our guru, based in Australia, said that while the pending cyber-tsar is likely to have outsourced management of his online base, the fact that the mayor-turned-cyber-expert didn't check for lax security on his own website is not exactly confidence inspiring.
Essentially, it calls into question his judgement in terms of who he turns to for advice and expertise. We have reproduced our contact's assessment in full on the next page. ®
