Cyberattack on UK parliament exploited weak email passwords

A rudimentary cyberattack has compromised the accounts of up to 90 people at the UK’s parliament last week, thanks to a lack of basic security practices.

The hacked accounts were using weak passwords that did not conform to the recommended parliamentary security standards, a House of Commons spokesperson confirmed in a statement. Less than 1 per cent of the 9000 email accounts in the parliamentary network were affected by the attack.

Hackers repeatedly attempted to access politicians’ emails during the “sustained and determined cyberattack” that took place last Friday. Members of both houses of parliament, including the prime minister, other government ministers and their aides all use the email network hit by the attack.

“This is a rudimentary routine attack,” says Dave Palmer, director of technology at UK security firm Darktrace. “This has the hallmarks of someone just doing it to show they can or of someone doing it for fun.”

Palmer says there is no evidence at the moment linking the attack to Russia or any other state, as has been speculated. It would take several weeks of detailed analysis before any such links could be established, he says, and given the unsophisticated nature of the attack it is not at all clear that it is politically motivated.

Wake-up call
But he says the attack is a “wake-up call” that should prompt parliament to look closely at the state of its cybersecurity. Simple security measures like multifactor authentication – requiring confirmation by app or text message before logging in – would make it much harder for hackers to gain access to email accounts. The UK’s National Cyber Security Centre advises all individuals to use this kind of security.

Forcing parliamentarians to use more secure passwords would also hinder these attacks. All of the affected accounts were using passwords that fell below the security standards set by the Parliamentary Digital Service.

Hackers may have started with a list of parliamentary email addresses and then tried to access the accounts with software that automatically runs through obvious and commonly used passwords, Palmer says. The attackers may also have tried to use passwords exposed in previous high-profile hacks on companies such as LinkedIn, Yahoo and Dropbox.

This attack could easily be performed by someone with no computer knowledge at all, says Palmer, and is the most basic kind of attack faced by companies on a daily basis. “It’s pretty disappointingly trivial,” he says.