Denial-of-service tool targeting Healthcare.gov site discovered

[BlueStreak]

65. I am not surprised the didn't FIND other attacks

because they were pretty inept across the board and it seemed there was nobody with overall responsibility for the success of the project.

However, many of the problems that persisted through the first 3 weeks were exactly the symptoms one would expect from a DOS attack, especially if the connections between the various components were across the open Internet. In other words, when pages loaded inconsistently, sometimes showing data, and other times evidently timing out without actually displaying error messages, that type of result could happen if there was a DoS attack aimed at the back end servers.

I understood the idea of a first-day overload or even an overload for the first week. However, this did not explain why we were seeing exactly the same kind of "overload" symptoms 3 weeks into it, even in the middle of the night. That could not possibly have been a human-generated overload, but certainly could have been a DoS load.

My guess is that they didn't make any plans or prepare any safeguards against DoS and didn't really discover attacks for the first few days. But a week into it, I bet they had discovered there were attacks going on. They just don't want to acknowledge that publicly because that might tend to legitimize this for copy-cat perps.