Trump's cyber-guru Giuliani runs ancient 'easily hackable website'
Stunned security experts tear strips off president-elect pick hours after announcement
US president-elect Donald Trump's freshly minted cyber-tsar Rudy Giuliani runs a website so insecure that its content management system is years out of date and potentially utterly hackable.
Former New York City mayor and Donald loyalist Giuliani was today unveiled by Trump's transition team as his cybersecurity adviser – meaning Giuliani will play a crucial role in the defense of America's computer infrastructure.
Giulianisecurity.com, the website for the ex-mayor's eponymous infosec consultancy firm, runs a build of Joomla! version 3 released in 2013 that is packed with vulnerabilities. Some of those bugs can be potentially exploited by miscreants using basic SQL injection techniques to compromise the server.
Security gurus are right now tearing strips off Trump's cyber-wizard pick. Top hacker Dan Tentler was first to point out the severely out-of-date Joomla! install.
"It speaks volumes," Tentler told The Register, referring to Giuliani's computer security credentials, or lack of, and fitness for the top post.
"Seventy-year-old luddite autocrats who often brag about not using technology are somehow put in charge of technology: it's like setting our country on fire and giving every extranational hacker a roman candle – or, rather, not setting on fire, but dousing in gasoline."
Damning ... Web dev Michael Fienen weighs in on Facebook
It gets worse. "Giuliani is running a version of PHP that was released in 2013, and a version of Joomla that was released around 2012," said Ty Miller, a director at Sydney-based infosec biz Threat Intelligence.
"Using the version information, within minutes we were able to identify a combined list of 41 publicly known vulnerabilities and 19 publicly available exploits. Depending upon the configuration of the website, these exploits may or may not work, but is an indication that Giuliani's security needs to be taken up a level."
The most surprising fact in all of this is that the Giuliani Security website hasn't ALREADY been hacked. They might as well put out a sign.
— Michael Fienen (@fienen) January 12, 2017
Another computer security expert, speaking to The Register on condition of anonymity, analyzed Giuliani's website for us. Our guru, based in Australia, said that while the pending cyber-tsar is likely to have outsourced management of his online base, the fact that the mayor-turned-cyber-expert didn't check for lax security on his own website is not going to instill any confidence.
We have reproduced our contact's assessment in full on the next page. ®
Sponsored: Customer Identity and Access Management
