Panama Papers: Why a nation state super hacker isn't responsible

Mossack Fonseca had its data stolen via an embarrassingly easy security flaw

As politicians and celebrities come under immense public scrutiny following the Panama Papers hack, the clever money seems to be on the Mossack Fonseca leak being caused by an external hacker.

With 11 million documents, including 4.8 million emails, among the 2.6TB of data exfiltrated from the Panamanian law firm, it's hardly surprising that claims of 'nation state hackers' are being made.

However, this wasn't the work of some shadowy intelligence-led operation exploiting zero-days and applying the skills of master hackers. Not least as Suddeutsche Zeitung, the German newspaper which ran the investigation into the contents of the leaked documents, insists it had received the files steadily over the course of a year and the data was constantly being updated.

You also have to ask yourself what a nation state would have to gain from exposing the tax avoidance shenanigans of the establishment. It's far more likely to be politically motivated at the hacktivist end of the scale, if you ask me. Indeed, I reckon we could be talking about a revolution.

No, not that kind - rather the Revolution Slider WordPress plugin. Here's the thing, investigations show that the law firm was making data accessible via a web portal that was running a version of Drupal known to be vulnerable to various exploits.

Already this is 'a bad thing' from the data security perspective. That becomes much worse when you then realise that, as WordPress security experts Wordfence discovered, the Mossack Fonseca website was running both WordPress and a version of the Revolution Slider that remote attackers can exploit to get a shell on the server.

It doesn't take a super hacker or nation state to exploit this kind of trivial vulnerability. That the slider plugin was most likely operational throughout the entire leak exposure window across the last year makes it a good guess as an easy entry point for that client data.

As WordFence says: "Once an attacker had access to WordPress, the wp-config.php file which contains the database credentials and then the WordPress database, they can see the mail server address and a username and password to sign-in and begin to send email. They would also have had whatever other privileges were conferred on that account."

It concerns me that even after the Panama Papers leak captured the attention of the entire world, the Mossack Fonseca client portal providing access to data (according to WordFence investigators) "was running, and continues to run, a version of Drupal that has over 23 vulnerabilities". They go on to say that breaking into this system "wouldn't even tax a beginner security analyst" - and they are right.

Of course, all this can only be guesswork, albeit educated guesswork. One thing is for sure though, the very presence of easily exploitable plugins on the Mossack Fonseca website reveals rather poor security know-how. I've said it beforeand I shall say it again, the number one WordPress security lesson is to update everything and update it bloody quickly!

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Russia launched over a million cyber attacks in three months
hacking

Russia launched over a million cyber attacks in three months

13 Apr 2021
Hackers leak data from dark web marketplace
cyber security

Hackers leak data from dark web marketplace

9 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
REvil threatens to release Apple’s hardware schematics
ransomware

REvil threatens to release Apple’s hardware schematics

21 Apr 2021