In a concerning revelation for cybersecurity, a security researcher has identified over 100 significant vulnerabilities in publicly accessible software code used by UK government departments, exposing sensitive data due to inadequate cybersecurity practices. This finding underscores the risks associated with the government’s decision to openly share code developed with taxpayers’ money, a practice that has been in place for approximately ten years to foster transparency and cost-efficient code reuse.
The UK government’s commitment to transparency in software development includes various agencies such as the Department of Health and Social Care and local authorities. However, due to ongoing funding constraints, key departments are reportedly neglecting the necessary maintenance and improvement of their technological infrastructures. Chris Nesbitt-Smith, a researcher at ControlPlane, utilized consumer-level AI models to uncover these vulnerabilities, emphasizing that most issues would have likely been identified during standard IT health assessments. He remarked that these vulnerabilities are far from the sophisticated threats often highlighted in media discussions about cyberattacks.
Among the identified vulnerabilities was a critical oversight in the Planning Inspectorate, which is responsible for land-use matters in England. A major issue arose when the Inspectorate inadvertently exposed login credentials by committing them to a public GitHub repository. The compromised credentials afforded excessive access, with the potential permitting unfettered interaction with sensitive systems. Nesbitt-Smith illustrated the gravity of this oversight, noting that the breach could have resulted in data encryption, theft, or ransom situations, as the exposed credentials facilitated extensive access to SharePoint sites and personnel OneDrive accounts, which include sensitive HR records.
The Planning Inspectorate quickly responded to the incident, with a spokesperson stating that their cyber monitoring tools detected the researcher’s activities shortly after they began and that they had already classified the situation as a cybersecurity incident. The vulnerability was resolved within minutes, and officials confirmed no data breach had occurred. Enhanced monitoring and process reviews have since been implemented to prevent similar vulnerabilities in the future.
Amanda Brock, CEO of OpenUK, clarified that the issues raised were not inherently linked to open-source software but rather poor internal security practices when utilizing common public tools. She emphasized that the exposure of data was a result of inadequate process adherence rather than a flaw inherent in open-source systems.
Nesbitt-Smith’s analysis extended to approximately two-thirds of the 349 public sector code bases he reviewed, revealing vulnerabilities within the Department of Education’s software. Critical risks were found in resources used by educational institutions, including those handling sensitive personal information related to teachers and the government’s registry of training providers. Additionally, a vulnerability was identified in a Scottish Government open data portal, allowing unauthorized access to administrative account settings.
The increased use of AI in vulnerability discovery has ignited debate among public sector departments regarding the publication of source code. In light of security concerns raised by AI models, there have been calls for the NHS and other agencies to consider withdrawing from open-source code practices. Experts warn that such a withdrawal without addressing underlying vulnerabilities could be detrimental, potentially drawing more attention to existing weaknesses rather than solving them.
The vulnerabilities outlined trigger discussions about the tactics and techniques utilized in cyberattacks, referencing the MITRE ATT&CK framework. Potential tactics may include initial access via credential dumping and exploitation of web applications, as well as persistence and privilege escalation through improper credential management. As cybersecurity continues to evolve, the focus on maintaining robust security protocols and improving code quality within public sector entities remains critical to safeguarding sensitive information.