Quite interesting: China tech firm claimed it could hack [UK] Foreign Office.
https://www.bbc.com/news/technology-68372568
In the interest of saving you a click:
A Chinese cyber security firm claimed it had the ability to hack the UK's Foreign Office, leaked documents suggest.
[...]
i-Soon is one of many private companies that provide cyber security services for China's military, police and security services.
It employs less than 25 staff at its Shanghai headquarters.
The collection of 577 documents and chat logs were leaked on GitHub - an online developer platform - on 16 February.
Hahaha.
First of all, I'd be surprised if the UK Foreign Office is notably unhackable. I'm sure any motivated cybersecurity firm on the planet could hack it if they wanted to.
But that's not why I'm laughing. I'm laughing because the info was leaked from GitHub. This is funny to me because GitHub is probably much less hackable than the Foreign Office. But it does have certain features that make it easy for careless or ignorant users to expose their secrets to anyone making a legitimate query.
For example, careless developers will include authentication keys in their code. This then gets published, and anyone who cares can grab those keys and unlock whatever it is they're supposed to control.
Github publishes a running log of accounts that have been updated. Anyone can read those longs, and then read the public accounts that have been recently updated. If those accounts carelessly have secrets in them, those secrets are now public. If the public account includes authentication keys for private accounts, anyone who cares now has access to those private accounts and the further secrets they contain.
This is actually a pretty commonplace scenario, since github repositories very often cross-build with other github repositories. Cross-building between a public account and a private account can expose the private accounts auth keys in your public logs, if you're careless about such things. Another commonplace scenario is builds that integrate with Amazon Web Services. A careless developer can expose their AWS auth keys, and give anyone who cares access to their AWS account(s). Building a bot farm or dark web node in someone else's AWS account is tight!
So, to me, the fact that this came to light from a GitHub leak is hilarious. It says more about the incompetence of the i-Soon "cyber security" team, than it does about the people responsible for cyber security at the Foreign Office.