Slashdot Mirror
Outdated and Vulnerable WordPress, Drupal Versions Contributed To Panama Papers Breach (wptavern.com)
An anonymous reader quotes a report from WordPress Tavern: Authorities have not yet identified the hacker behind the Panama Papers breach, nor have they isolated the exact attack vector. It is clear that Mossack Fonseca, the Panamanian law firm that protected the assets of the rich and powerful by setting up shell companies, had employed a dangerously loose policy towards web security and communications. The firm ran its unencrypted emails through an outdated (2009) version of Microsoft's Outlook Web Access. Outdated open source software running the frontend of the firm's websites is also now suspected to have provided a vector for the compromise. Forbes has identified outdated WordPress and Drupal installations as security holes that may have led to the data leak. [WordPress Tavern Editor Sarah Gooding] found that the firm's WordPress-powered site is currently running on version 4.1 (released in December 2014), based on its version of autosave.js, which is identical to the autosave.js file shipped in 4.1. The main site is also loading a number of outdated scripts and plugins. Its active theme is a three-year-old version of Twenty Eleven (1.5), which oddly resides in a directory labeled for /twentyten/. The Mossack Fonseca client portal changelog.txt file is public, showing that its Drupal installation hasn't been updated for three years. Since the release of version 7.23, the software has received 25 security updates, which means that the version it is running includes highly critical known vulnerabilities that could have given the hacker access to the server.
We should give that person a medal for handing those dox to the press...
ELOI, ELOI, LAMA SABACHTHANI!?
Every law firm I have ever had tangential contact in an IT role has always been stupid cheap cheap cheap and self-righteous and arrogant about it. I don't do business with law firms just because of the headaches they cause friends and acquaintances about not paying, wanting the moon for a buck, etc.
A breach like this is not an unexpected result.
"Authorities have not yet identified the hacker behind the Panama Papers breach", well it was the CIA/NSA.
Look at the lack of US based names, so far there has been nothing but known criminals, on the other hand Russia, Pakistan, Iceland, UK have huge names outted.
I'm amused.
I would hope that the web server is on a machine with its own internet connection that doesn't share ANYTHING with the internal corporate network besides perhaps a UPS. The less a website is linked to the better.
I'm no web expert, but I have had this conversation over and over again with small to mid-sized business owners. First, assume your web server is going to get herpes. Make your next decision accordingly. Big companies with big budgets have more options.
Should have hired me instead, suckers!
Keeping multiple WordPress websites up to date has become such a nuisance that I'm converting the older ones to static websites. Those 4,000+ hackers per day have nothing to hack at a static website and go away to find easier targets.
Exchange 2010 was released in November 2009.
How do you know if your WordPress or Drupal site is vulnerable? If the version number is greater than zero of course!
Seriously. Unless all you need is a Geocities-type page with some static text and animated GIFs on the cheap, stay away from WordPress and Drupal!
Morphing Software
The Russians goes on the offensive in the domestic media, accusing the dox were faked by CIA trying to smear his good name.
The Chinese censors it in their domestic media.
The Ice Lander protests and their Prime Minister resigns.
ELOI, ELOI, LAMA SABACHTHANI!?
This kind of puts to rest all those new world order conspiracy theories doesn't it? I mean, they can't be that brilliant if they can't even fucking update WordPress once a month. It's literally a calendar reminder to click a button.
If it ain't broke, don't fix it.
This public outing of Mossack Fonseca's pathetic computer security will have the unfortunate consequence of convincing the rest of the firms in that line of work to get more serious about their own. For those who want greater transparency in the world of tax havens this hack of Mossack Fonseca might be a wrench in the works.
I deny that I have not avoided attaining the opposite of that which I do not want.
What the hell is sensitive client data doing on an Internet connected machine?
Have gnu, will travel.
So they were running essentially an automatic version of this guy
Monstar L
Wordpress vulnerabilities - for once they're a help and not a hindrance.
Just cruising through this digital world at 33 1/3 rpm...
Bernie Sanders warned us about this back in 2011 or so...
https://www.youtube.com/watch?...
Sanders made a speech on the Senate floor in October of 2011 that warned that a proposed trade agreement with Panama would open the floodgates of American money flowing into off-shore tax havens, a plea that ultimately fell on deaf ears as the agreement was signed by President Barack Obama later that year.
Just cruising through this digital world at 33 1/3 rpm...
I hope they catch them and throw the book at them. Life imprisonment at least.
They have embarrassed more very powerful people than Snowden and Assange combined. This type of activity must be stopped.
There apps are only as secure as the underlying Operating System and PLATFORM they run on, which in the case of WinTEL means not secure at all.
With them optimizing profits, they probably had no money for IT security to spare. Save a million, lose a billion (or rather more in this instance). The fatal combination of greed and stupidity at its finest. Will not be the last instance of something this large happening due to non-understanding of IT security.
When the first successful hack costs you everything, learning from experience is not a good strategy. Consulting and listening to some (admittedly expensive, but worth it) real experts may be a good idea.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Naaaa, sounds like the first person above script-kiddy level got in. Boring from a technological point-of-view. Even a reasonably done simplistic penetration-test would probably have shown how bad things are. I guess they had no money for that with them all busy getting rich.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Biggest contributor to Panama breach:
People doing illegal things in the first place.
"The firm ran its unencrypted emails through an outdated (2009) version of Microsoft's Outlook Web Access."
Looks like a release date and not a title to me...
We're talking about 2.6TB of data here, 11.5 million documents, photos, scans, and emails created over a time span of 1970 til now, received in batches during a year.
I highly doubt some external used an exploit in customer facing portals to download this many individual files.
Why is customer account info on a WCMS? The public-facing stuff should be hosted separate from the private/internal stuff (like customer accounts) such that if your public WCMS is breached, the private stuff should be protected. There should be a fire-wall between the public host and the private customer data hosts/servers. You wouldn't put customer details on a public WCMS normally. Your public site is a sales-ish tool.
For biz-to-biz transactions, typically a CRUD-centric tool would be used, not a WCMS.
That is unless they co-hosted too many different concerns on the same server or LAN/WAN, which is a sin at least as big as not patching WCMS.
Table-ized A.I.
I suspect that there's going to be a sudden outbreak of spontaneous Polonium poisoning in Panama due to this leak.
1. Even in the highly unlikely scenario that Wordpress was installed on the same system as Outlook Web Access, it would not provide access to the Exchange email system.
2. There is nothing wrong with "outdated 2009" Outlook Web Access. That would be either Excahange 2007 or more likely Exchange 2010. Both are still fully supported and do not suffer any egregious vulnerabilities that would allow co-installed Wordpress to access the Exchange Server.
3. Encrypted email? Who the fuck does that? No one, that's who. Let's not bother with any pretentious or condescending horseshit. Probably half of the world's email sits on Exchange servers, corporate on-premise or Office365/Outlook.com/Hotmail... None of it is encrypted at rest. Despite the available option and Google's recent TLS push, SMTP is not generally not encrypted. So, email in flight is even more open than at rest. This is the way it is everywhere and is not a major security issue.
4. The Panama Papers consist of 2.6 TERABYTES of data! Have you ever tried to push or pull that much data over the internet? It is a huge undertaking, even with very high speed connections. While technically possible, it is unlikely that that much data was siphoned off remotely, especially form slow-ass Exchange servers.
This entire article is pure fantastical supposition and utter horseshit. 2.6TB of Exchange emails DID NOT come through any Wordpress exploit. This data almost certainly came from an inside source and was walked out on a USB external drive which itself would have taken over 36 hours to copy the data to.
This "story" is utter horseshit. Just like the international outrage over legal financial activities. It's all manufactured nonsense.
So many servers run ancient versions of popular CMS packages and then wonder why their server constantly gets hacked.
Heaven forbid they are running WHMCS on a box with other websites (quickest way to get rooted).
It got so bad for us here, I had to write a script to scan customer servers just to find all of the outdated packages.
It amazes me to read some of the reports, seeing sites running decade old software is not uncommon.
Still is a battle to get people to actually update their sites once they have been notified about running old software.
There is more technical details in this article.
They are running a 2013 version of Drupal that is vulnerable to SQL injection (dubbed Drupalgeddon).
They are also running an Oracle HTTP server too. That web server seems to be ignoring the .htaccess setup by Drupal, and returns back the entire code of the .module files, and listings of directories, and such.
More interesting is how ICIJ setup their own collaboration around the documents using open source software, like VeraCrypt (fork of TruCrypt), Backlight (Ruby On Rails tool to index documents in Apache Solr), and Oxwall (a social media type of thing).
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
This has a lot of detailed information about the problems with Mossack Fonseca client portal: http://www.unicornriot.ninja/?... including the possibility of using the website vulns to get into Oracle.
--hongpong.com
What we still don't seem to have, is proof of any actual crimes.
Public outrage over morally questionable selfishness is pointless stupidity. Where is the crime? Where is the proof?
Actually, we have the proof. It's in the data dumps.
The actual actions involved are illegal tax shelters. These work for corporations because they are, in fact, legal. They also work for high net worth individuals, but only if they are willing to relocate their residence outside their home country for a period of time.
For the U.S., the magic number is ~191 days a year (indisputably, at least 51% of their time). For other countries, the numbers are different.
In all cases, however, the general rule is that you want to establish a legal tax shelter. And if you can't ... well, some people *still* don't want to pay taxes, and instead establish illegal tax shelters.
The primary reason that there are not a lot of U.S. individuals on the disclosure list is that most of these schemes were shut down in the U.S. about a decade ago (closer to 2004/2005, so add a couple of years to that). Now it's the turn of the rest of the world.
Here's an example from 2004 for the U.S..
The way the scheme operates is to relocate a business and your primary legal residence to an economic development zone (EDZ), which saves you 90% (as an exemption) on your federal income tax, if you employ a certain number of people in a business. Only the rules were pretty lax, and a lot of people didn't meet the 190+ days a year requirement, because they tried to count actually living in the U.S. as "vacation time".
As part of the laxity of those rules, you didn't have to personally employ the people, instead you could buy into a co-op that employed that number of people (what they did or didn't do really didn't matter -- the rules were lax), buy a vacation home in the area, and live there as much as you could.
Now it should be noted that not every co-op was a tax shelter scam, and there were people who in fact met the 190+ day requirement, and owned businesses in the EDZ's, that employed the required number of people. In addition, a number of the co-ops that were being used as scam shelters, actually had these honest people involved in them as well -- both as protective covering, and because it was handy to have the co-op deal with the details of the paperwork.
One of these shelters was "Kapok" in the U.S. Virgin Islands, which were an EDZ at the time, and remained so for about a decade.
The point is that, just because there are good apples, doesn't mean that there are not also rotten apples, and it's pretty clear that this disclosure, even for those which are not engaged themselves in illegal activity, is going to rip the bandaid off what is, at least in areas, a festering wound.
If you want to read more about Kapok, specifically, here's an article from 2004: http://amarillo.com/stories/20...
P.S.: if you want to know about how to legally take advantage of a tax loophole opened by Prop 13in California, at the last minute, by the Kaiser Family Foundation, I can enlighten you on that as well, but be aware, you pretty much have to be a rather large property holder (like the KFF) to take reasonable advantage of it. There are also some pretty careful zoning hurdles you have to pass ... but it's doable.