Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information

CommentSave StorySave this story CommentSave StorySave this story But funding squeezes have left departments neglecting maintenance and improvement of their technology estate. The fact the credentials gave such wide access—and seemingly didn’t expire—compounded with the agency’s accidental publication of them, “made it particularly dangerous for them.” The complete Microsoft Entra ID would have given “god-tier” read and write access to all SharePoint sites and private employee OneDrive accounts, according to Nesbitt-Smith, including HR records. It also would have given access to sensitive libraries which safeguard evidence under legal hold for statutory planning inquiries and appeals, according to the security researcher who found it. “The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there,” Nesbitt-Smith says. A spokesperson for the Planning Inspectorate told WIRED its cyber monitoring tools immediately detected Nesbitt-Smith’s activity in August and that it had already been handling this as a cyber incident when ControlPlane made contact. The agency identified and fixed this vulnerability within 20 minutes of the report and verified that no data breach occurred. “We have reviewed and strengthened our systems and processes to prevent this type of issue recurring and we are grateful for the researcher’s work and for alerting us to it,” they told WIRED. The Planning Inspectorate issue “isn’t about open source but internal housekeeping when using public tools,” Amanda Brock, chief executive officer of nonprofit industry group OpenUK. “That data was exposed because of a failure not to follow good process,” she adds. “That’s not an open source security issue.” In around two-thirds of the 349 public sector codebases across 33 organizations Nesbitt-Smith scanned, he said he found vulnerabilities. Several of these were found in the Department of Education’s code, including in a procurement service used by schools, in a teacher application service containing personal details, qualifications, employment history and identity documents, and England’s main register of government-funded training providers and apprenticeships. He also found a vulnerability in a Scottish Government open data portal which would have allowed any visitor to read administrative account information and to change site configuration. The organizations have since dealt with the issues. Recently, there have been arguments for public sector departments to stop publishing source code in the open, now that AI has accelerated vulnerability discovery. The NHS reportedly ordered technology teams to transition away from open source code in May amid security concerns about the impact of AI models.