Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

British Parliament Hit by Cyberattack, Affecting Email Access

nytimes.com

Post reply on HN
Print view View original

11–20 of 27 posts

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#11

Post by anigbrowl »

sillysaurus3 wrote: post #8
anigbrowl wrote: post #2

To what extent are our security problems the result of feature creep and an inability to lock down simple protocols? For all the bloviating about national borders and so on, if a country can't secure its own legislature then its institutions are broken.

Not sure why this is downvoted. The main reason systems aren't secure is lack of simplicity. To put it another way, pentesting is almost always the art of exploiting complexity. It's true that you can have a system that's both simple and broken, but that's the exception.

That's what I was thinking. It seems like fundamental infrastructure should be boring but bulletproof, like mission-critical software in military or surgical applications.

The downvotes are just my regular stalkers.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#12

Post by anigbrowl »

cmurf wrote: post #4
anigbrowl wrote: post #2

To what extent are our security problems the result of feature creep and an inability to lock down simple protocols? For all the bloviating about national borders and so on, if a country can't secure its own legislature then its institutions are broken.

I wouldn't get too grandiose about saying the institutions are broken. It's just email, why not consider it like postal mail? Definitely not good, definitely needs to be fixed, but also definitely does not mean the legislature entirely is not secured or that institutions are all broken.

It's just email

How is that not critical infrastructure given legislators' need for secure and accessible communications?

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#13

Post by sillysaurus3 »

wdewind wrote: post #10
sillysaurus3 wrote: post #8

Earlier quoted context omitted.

Not sure why this is downvoted. The main reason systems aren't secure is lack of simplicity. To put it another way, pentesting is almost always the art of exploiting complexity. It's true that you can have a system that's both simple and broken, but that's the exception.

> The main reason systems aren't secure is lack of simplicity. I don't think it's that simple. There are two ways you can look at simplicity: 1. The lack of needless complexity, which is just another way of saying something is well built 2. Smaller modular components that do less and have clearer interfaces, ie: the unix way. If you mean the 1st, then sure, the main reason systems aren't secure is lack of being well…

To an extent. But a simpler interface is also easier to pentest. That means a pentest is more likely to catch a problem.

Pentests can't catch everything, so a simple system costs less to secure.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#14

Post by djrogers »

krona wrote: post #5

In what way have they been 'hacked'? Constituents can email their MPs and I'd imagine they all share the same few email servers. It's not hard to imagine that someone thought they'd 'have a go' (as was the case during the election period), and the reaction by Parliament has so far been a precautionary one.

FTA: > stolen data revealed the private login details of 1,000 British members of Parliament and parliamentary staff, 7,000 police employees and more than 1,000 Foreign Office officials.

Not sure how that wouldn’t be treated as a cyberattack. Note, the word used was not ‘hack’ - not all cyberattacks are hacks.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#15

Post by dpwm »

sillysaurus3 wrote: post #8
anigbrowl wrote: post #2

To what extent are our security problems the result of feature creep and an inability to lock down simple protocols? For all the bloviating about national borders and so on, if a country can't secure its own legislature then its institutions are broken.

Not sure why this is downvoted. The main reason systems aren't secure is lack of simplicity. To put it another way, pentesting is almost always the art of exploiting complexity. It's true that you can have a system that's both simple and broken, but that's the exception.

Some of the most effective security measures actually increase complexity.

Two-factor authentication increases complexity in every measurable way but mitigates against a number of softer attacks.

Adding encryption adds a ton of complexity but effectively removes all man-in-the-middle attacks.

The simplest way of storing passwords is in plaintext.

Privelege separation is far from the simplest way of structuring a daemon, but it effectively prevents exploits in the complex parts from allowing an attacker to gain remote root access.

Perhaps it is more that superfluous complexity is the problem.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#16

Post by sillysaurus3 »

dpwm wrote: post #15
sillysaurus3 wrote: post #8

Earlier quoted context omitted.

Not sure why this is downvoted. The main reason systems aren't secure is lack of simplicity. To put it another way, pentesting is almost always the art of exploiting complexity. It's true that you can have a system that's both simple and broken, but that's the exception.

Some of the most effective security measures actually increase complexity. Two-factor authentication increases complexity in every measurable way but mitigates against a number of softer attacks. Adding encryption adds a ton of complexity but effectively removes all man-in-the-middle attacks. The simplest way of storing passwords is in plaintext. Privelege separation is far from the simplest way of structuring a daem…

I think we're talking past each other. Complexity probably refers to anything beyond essential complexity. In the systems you mention, they all lack complexity by that definition.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#17

Post by Leynos »

krona wrote: post #5

In what way have they been 'hacked'? Constituents can email their MPs and I'd imagine they all share the same few email servers. It's not hard to imagine that someone thought they'd 'have a go' (as was the case during the election period), and the reaction by Parliament has so far been a precautionary one.

The story suggests that remote access has been disabled following a password leak, which suggests some form of malicious attack.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#18

Post by NotSammyHagar »

Why don't these people use 2 factor auth like a yubikey? And not sms because it can be hacked and redirected. I know the reason, they are not wanting these non-technical foofaws to be slightly inconvenienced. And they'd lose their second factors even if they had them - too bad, you shouldn't be able to get an official email without it. Give everyone a couple of those keys, put one on their keychain, one in their computer at home, one in their work computer. They'd be so much safer.

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#19

Post by nikcub »

Based on the names mentioned I searched for their email addresses in password dumps and they all match the large 500M+ lists (anti public and exploit.in - covered here[0]) that have been available on some of the credential-stuffing and hacking forums since late last year. They are aggregate lists composed of MySpace, LinkedIn and other breaches.

It appears someone has grepped out parliament.uk emails from those leaks and then published it separately, the earliest mention of such a list that I can find online is from mid-May.

The credential stuffing and darkweb markets are full of such lists as the scammers attempt to make a dollar or two from content that is otherwise publicly available by slicing it in interesting or appealing ways.

I doubt any of the credentials would have worked against the parliament Office 365 login[1] as either the IT admins would have noticed, and/or the list is old enough where it would have been noticed far earlier plus Office 365 even without MFA enabled or enforced will usually require an email or SMS confirmation for a new device login or a login that doesn't match user pattern.

The story mentions they disabled logins, but it appears to still work. This is likely just a precaution from the IT department over what is a relatively minor issue since it is easier to pretend you're doing something rather than having to explain to the media that this is an old issue and not that big a deal.

[0] https://www.cert.govt.nz/businesses-and-individuals/recent-t...

[1] https://intranet.parliament.uk

Re: British Parliament Hit by Cyberattack, Affecting Email Access

#20

Post by ryanlol »

nikcub wrote: post #19

Based on the names mentioned I searched for their email addresses in password dumps and they all match the large 500M+ lists (anti public and exploit.in - covered here[0]) that have been available on some of the credential-stuffing and hacking forums since late last year. They are aggregate lists composed of MySpace, LinkedIn and other breaches. It appears someone has grepped out parliament.uk emails from those leaks…

http://sprunge.us/HIYa

It must be total chaos in the UK now! 110748 super secret government emails and passwords leaked on a hacker forum :P

Post reply on HN