Panama Papers: Why a nation state super hacker isn't responsible

Mossack Fonseca had its data stolen via an embarrassingly easy security flaw

As politicians and celebrities come under immense public scrutiny following the Panama Papers hack, the clever money seems to be on the Mossack Fonseca leak being caused by an external hacker.

With 11 million documents, including 4.8 million emails, among the 2.6TB of data exfiltrated from the Panamanian law firm, it's hardly surprising that claims of 'nation state hackers' are being made.

Advertisement - Article continues below

However, this wasn't the work of some shadowy intelligence-led operation exploiting zero-days and applying the skills of master hackers. Not least as Suddeutsche Zeitung, the German newspaper which ran the investigation into the contents of the leaked documents, insists it had received the files steadily over the course of a year and the data was constantly being updated.

You also have to ask yourself what a nation state would have to gain from exposing the tax avoidance shenanigans of the establishment. It's far more likely to be politically motivated at the hacktivist end of the scale, if you ask me. Indeed, I reckon we could be talking about a revolution.

No, not that kind - rather the Revolution Slider WordPress plugin. Here's the thing, investigations show that the law firm was making data accessible via a web portal that was running a version of Drupal known to be vulnerable to various exploits.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Already this is 'a bad thing' from the data security perspective. That becomes much worse when you then realise that, as WordPress security experts Wordfence discovered, the Mossack Fonseca website was running both WordPress and a version of the Revolution Slider that remote attackers can exploit to get a shell on the server.

It doesn't take a super hacker or nation state to exploit this kind of trivial vulnerability. That the slider plugin was most likely operational throughout the entire leak exposure window across the last year makes it a good guess as an easy entry point for that client data.

As WordFence says: "Once an attacker had access to WordPress, the wp-config.php file which contains the database credentials and then the WordPress database, they can see the mail server address and a username and password to sign-in and begin to send email. They would also have had whatever other privileges were conferred on that account."

Advertisement - Article continues below

It concerns me that even after the Panama Papers leak captured the attention of the entire world, the Mossack Fonseca client portal providing access to data (according to WordFence investigators) "was running, and continues to run, a version of Drupal that has over 23 vulnerabilities". They go on to say that breaking into this system "wouldn't even tax a beginner security analyst" - and they are right.

Of course, all this can only be guesswork, albeit educated guesswork. One thing is for sure though, the very presence of easily exploitable plugins on the Mossack Fonseca website reveals rather poor security know-how. I've said it beforeand I shall say it again, the number one WordPress security lesson is to update everything and update it bloody quickly!

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ethical-hacking/356252/poorly-secured-banking-apps-lead-to-cyber-threats
ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020
Visit/security/malware/356231/most-malware-came-through-https-connections-in-q1-2020
malware

Most malware came through HTTPS connections in Q1 2020

25 Jun 2020
Visit/security/phishing/356211/phishing-attacks-target-unsuspecting-wells-fargo-customers
phishing

Phishing attacks target unsuspecting Wells Fargo customers

24 Jun 2020
Visit/security/hacking/356210/trump-administration-wants-to-enhance-the-security-of-gov-sites
hacking

Trump administration wants to enhance the security of .gov sites

24 Jun 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020