Panama Papers: Why a nation state super hacker isn't responsible

Mossack Fonseca had its data stolen via an embarrassingly easy security flaw

As politicians and celebrities come under immense public scrutiny following the Panama Papers hack, the clever money seems to be on the Mossack Fonseca leak being caused by an external hacker.

With 11 million documents, including 4.8 million emails, among the 2.6TB of data exfiltrated from the Panamanian law firm, it's hardly surprising that claims of 'nation state hackers' are being made.

However, this wasn't the work of some shadowy intelligence-led operation exploiting zero-days and applying the skills of master hackers. Not least as Suddeutsche Zeitung, the German newspaper which ran the investigation into the contents of the leaked documents, insists it had received the files steadily over the course of a year and the data was constantly being updated.

You also have to ask yourself what a nation state would have to gain from exposing the tax avoidance shenanigans of the establishment. It's far more likely to be politically motivated at the hacktivist end of the scale, if you ask me. Indeed, I reckon we could be talking about a revolution.

No, not that kind - rather the Revolution Slider WordPress plugin. Here's the thing, investigations show that the law firm was making data accessible via a web portal that was running a version of Drupal known to be vulnerable to various exploits.

Already this is 'a bad thing' from the data security perspective. That becomes much worse when you then realise that, as WordPress security experts Wordfence discovered, the Mossack Fonseca website was running both WordPress and a version of the Revolution Slider that remote attackers can exploit to get a shell on the server.

It doesn't take a super hacker or nation state to exploit this kind of trivial vulnerability. That the slider plugin was most likely operational throughout the entire leak exposure window across the last year makes it a good guess as an easy entry point for that client data.

As WordFence says: "Once an attacker had access to WordPress, the wp-config.php file which contains the database credentials and then the WordPress database, they can see the mail server address and a username and password to sign-in and begin to send email. They would also have had whatever other privileges were conferred on that account."

It concerns me that even after the Panama Papers leak captured the attention of the entire world, the Mossack Fonseca client portal providing access to data (according to WordFence investigators) "was running, and continues to run, a version of Drupal that has over 23 vulnerabilities". They go on to say that breaking into this system "wouldn't even tax a beginner security analyst" - and they are right.

Of course, all this can only be guesswork, albeit educated guesswork. One thing is for sure though, the very presence of easily exploitable plugins on the Mossack Fonseca website reveals rather poor security know-how. I've said it beforeand I shall say it again, the number one WordPress security lesson is to update everything and update it bloody quickly!

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
IT Pro Panel: Why IT leaders need soft skills
professional development

IT Pro Panel: Why IT leaders need soft skills

26 Jul 2021