US president-elect Donald Trump's freshly minted cyber-tsar Rudy Giuliani runs a website with a content management system years out of date and potentially utterly hackable.
Former New York City mayor and Donald loyalist Giuliani was today unveiled by Trump's transition team as the future president's cybersecurity adviser – meaning Giuliani will play a crucial role in the defense of America's computer infrastructure.
Giulianisecurity.com, the website for the ex-mayor's eponymous infosec consultancy firm, is powered by a roughly five-year-old build of Joomla! that is packed with vulnerabilities. Some of those bugs can be potentially exploited by miscreants using basic SQL injection techniques to compromise the server.
This seemingly insecure system also has a surprising number of network ports open – from MySQL and anonymous LDAP to a very out-of-date OpenSSH 4.7 that was released in 2007. It also runs a rather old version of FreeBSD.
"It speaks volumes," Tentler told The Register, referring to Giuliani's computer security credentials, or lack of, and fitness for the top post.
"Seventy-year-old luddite autocrats who often brag about not using technology are somehow put in charge of technology: it's like setting our country on fire and giving every extranational hacker a roman candle – or, rather, not setting on fire, but dousing in gasoline."
Content management system developer Michael Fienen also pulled no punches:
Damning ... Web dev Michael Fienen weighs in on Facebook
It gets worse. "Giuliani is running a version of PHP that was released in 2013, and a version of Joomla that was released around 2012," said Ty Miller, a director at Sydney-based infosec biz Threat Intelligence.
"Using the version information, within minutes we were able to identify a combined list of 41 publicly known vulnerabilities and 19 publicly available exploits. Depending upon the configuration of the website, these exploits may or may not work, but is an indication that Giuliani's security needs to be taken up a level."
Found on /r/sysadmin, presented without comment. pic.twitter.com/UmWe7tHURv— Ryan Castellucci (@ryancdotorg) January 12, 2017
The most surprising fact in all of this is that the Giuliani Security website hasn't ALREADY been hacked. They might as well put out a sign.— Michael Fienen (@fienen) January 12, 2017
"You can probably break into Giuliani's server," said Robert Graham of Errata Security. "I know this because other FreeBSD servers in the same data center have already been broken into, tagged by hackers, or are now serving viruses.
"But that doesn't matter. There's nothing on Giuliani's server worth hacking."
Another computer security expert, speaking to The Register on condition of anonymity, analyzed Giuliani's website for us. Our guru, based in Australia, said that while the pending cyber-tsar is likely to have outsourced management of his online base, the fact that the mayor-turned-cyber-expert didn't check for lax security on his own website is not exactly confidence inspiring.
Essentially, it calls into question his judgement in terms of who he turns to for advice and expertise. We have reproduced our contact's assessment in full on the next page. ®