Panama Papers: Why a nation state super hacker isn't responsible

Mossack Fonseca had its data stolen via an embarrassingly easy security flaw

As politicians and celebrities come under immense public scrutiny following the Panama Papers hack, the clever money seems to be on the Mossack Fonseca leak being caused by an external hacker.

With 11 million documents, including 4.8 million emails, among the 2.6TB of data exfiltrated from the Panamanian law firm, it's hardly surprising that claims of 'nation state hackers' are being made.

However, this wasn't the work of some shadowy intelligence-led operation exploiting zero-days and applying the skills of master hackers. Not least as Suddeutsche Zeitung, the German newspaper which ran the investigation into the contents of the leaked documents, insists it had received the files steadily over the course of a year and the data was constantly being updated.

You also have to ask yourself what a nation state would have to gain from exposing the tax avoidance shenanigans of the establishment. It's far more likely to be politically motivated at the hacktivist end of the scale, if you ask me. Indeed, I reckon we could be talking about a revolution.

No, not that kind - rather the Revolution Slider WordPress plugin. Here's the thing, investigations show that the law firm was making data accessible via a web portal that was running a version of Drupal known to be vulnerable to various exploits.

Already this is 'a bad thing' from the data security perspective. That becomes much worse when you then realise that, as WordPress security experts Wordfence discovered, the Mossack Fonseca website was running both WordPress and a version of the Revolution Slider that remote attackers can exploit to get a shell on the server.

It doesn't take a super hacker or nation state to exploit this kind of trivial vulnerability. That the slider plugin was most likely operational throughout the entire leak exposure window across the last year makes it a good guess as an easy entry point for that client data.

As WordFence says: "Once an attacker had access to WordPress, the wp-config.php file which contains the database credentials and then the WordPress database, they can see the mail server address and a username and password to sign-in and begin to send email. They would also have had whatever other privileges were conferred on that account."

It concerns me that even after the Panama Papers leak captured the attention of the entire world, the Mossack Fonseca client portal providing access to data (according to WordFence investigators) "was running, and continues to run, a version of Drupal that has over 23 vulnerabilities". They go on to say that breaking into this system "wouldn't even tax a beginner security analyst" - and they are right.

Of course, all this can only be guesswork, albeit educated guesswork. One thing is for sure though, the very presence of easily exploitable plugins on the Mossack Fonseca website reveals rather poor security know-how. I've said it beforeand I shall say it again, the number one WordPress security lesson is to update everything and update it bloody quickly!

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

The Ritz suffers data breach after hackers pose as staff
data breaches

The Ritz suffers data breach after hackers pose as staff

17 Aug 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020

Most Popular

Windows XP source code allegedly leaked online
Microsoft Windows

Windows XP source code allegedly leaked online

25 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020