Panama Papers: Why a nation state super hacker isn't responsible

Mossack Fonseca had its data stolen via an embarrassingly easy security flaw

As politicians and celebrities come under immense public scrutiny following the Panama Papers hack, the clever money seems to be on the Mossack Fonseca leak being caused by an external hacker.

With 11 million documents, including 4.8 million emails, among the 2.6TB of data exfiltrated from the Panamanian law firm, it's hardly surprising that claims of 'nation state hackers' are being made.

However, this wasn't the work of some shadowy intelligence-led operation exploiting zero-days and applying the skills of master hackers. Not least as Suddeutsche Zeitung, the German newspaper which ran the investigation into the contents of the leaked documents, insists it had received the files steadily over the course of a year and the data was constantly being updated.

You also have to ask yourself what a nation state would have to gain from exposing the tax avoidance shenanigans of the establishment. It's far more likely to be politically motivated at the hacktivist end of the scale, if you ask me. Indeed, I reckon we could be talking about a revolution.

No, not that kind - rather the Revolution Slider WordPress plugin. Here's the thing, investigations show that the law firm was making data accessible via a web portal that was running a version of Drupal known to be vulnerable to various exploits.

Already this is 'a bad thing' from the data security perspective. That becomes much worse when you then realise that, as WordPress security experts Wordfence discovered, the Mossack Fonseca website was running both WordPress and a version of the Revolution Slider that remote attackers can exploit to get a shell on the server.

It doesn't take a super hacker or nation state to exploit this kind of trivial vulnerability. That the slider plugin was most likely operational throughout the entire leak exposure window across the last year makes it a good guess as an easy entry point for that client data.

As WordFence says: "Once an attacker had access to WordPress, the wp-config.php file which contains the database credentials and then the WordPress database, they can see the mail server address and a username and password to sign-in and begin to send email. They would also have had whatever other privileges were conferred on that account."

It concerns me that even after the Panama Papers leak captured the attention of the entire world, the Mossack Fonseca client portal providing access to data (according to WordFence investigators) "was running, and continues to run, a version of Drupal that has over 23 vulnerabilities". They go on to say that breaking into this system "wouldn't even tax a beginner security analyst" - and they are right.

Of course, all this can only be guesswork, albeit educated guesswork. One thing is for sure though, the very presence of easily exploitable plugins on the Mossack Fonseca website reveals rather poor security know-how. I've said it beforeand I shall say it again, the number one WordPress security lesson is to update everything and update it bloody quickly!

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Global ransom DDoS extortionists are retargeting companies
distributed denial of service (DDOS)

Global ransom DDoS extortionists are retargeting companies

22 Jan 2021
BEC scammers are using Google Forms to identify easy victims
phishing

BEC scammers are using Google Forms to identify easy victims

21 Jan 2021
FBI warns of ongoing corporate vishing attacks
phishing

FBI warns of ongoing corporate vishing attacks

19 Jan 2021
Hackers using COVID vaccine as a lure to spread malware
hacking

Hackers using COVID vaccine as a lure to spread malware

15 Jan 2021

Most Popular

School laptops sent by government arrive loaded with malware
malware

School laptops sent by government arrive loaded with malware

21 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is the Raspberry Pi Pico?
Hardware

What is the Raspberry Pi Pico?

21 Jan 2021