Slashdot Mirror
Outdated and Vulnerable WordPress, Drupal Versions Contributed To Panama Papers Breach (wptavern.com)
An anonymous reader quotes a report from WordPress Tavern: Authorities have not yet identified the hacker behind the Panama Papers breach, nor have they isolated the exact attack vector. It is clear that Mossack Fonseca, the Panamanian law firm that protected the assets of the rich and powerful by setting up shell companies, had employed a dangerously loose policy towards web security and communications. The firm ran its unencrypted emails through an outdated (2009) version of Microsoft's Outlook Web Access. Outdated open source software running the frontend of the firm's websites is also now suspected to have provided a vector for the compromise. Forbes has identified outdated WordPress and Drupal installations as security holes that may have led to the data leak. [WordPress Tavern Editor Sarah Gooding] found that the firm's WordPress-powered site is currently running on version 4.1 (released in December 2014), based on its version of autosave.js, which is identical to the autosave.js file shipped in 4.1. The main site is also loading a number of outdated scripts and plugins. Its active theme is a three-year-old version of Twenty Eleven (1.5), which oddly resides in a directory labeled for /twentyten/. The Mossack Fonseca client portal changelog.txt file is public, showing that its Drupal installation hasn't been updated for three years. Since the release of version 7.23, the software has received 25 security updates, which means that the version it is running includes highly critical known vulnerabilities that could have given the hacker access to the server.
We should give that person a medal for handing those dox to the press...
ELOI, ELOI, LAMA SABACHTHANI!?
Every law firm I have ever had tangential contact in an IT role has always been stupid cheap cheap cheap and self-righteous and arrogant about it. I don't do business with law firms just because of the headaches they cause friends and acquaintances about not paying, wanting the moon for a buck, etc.
A breach like this is not an unexpected result.
Keeping multiple WordPress websites up to date has become such a nuisance that I'm converting the older ones to static websites. Those 4,000+ hackers per day have nothing to hack at a static website and go away to find easier targets.
these havens house nearly a quarter of all companies in existence on the planet. I find it highly suspicious that so far no one of significance form the US has been outed. Even Australia has 800 people identified in there. It seems of having being scrubbed before being released to the press.
How do you know if your WordPress or Drupal site is vulnerable? If the version number is greater than zero of course!
Seriously. Unless all you need is a Geocities-type page with some static text and animated GIFs on the cheap, stay away from WordPress and Drupal!
Morphing Software
The Russians goes on the offensive in the domestic media, accusing the dox were faked by CIA trying to smear his good name.
The Chinese censors it in their domestic media.
The Ice Lander protests and their Prime Minister resigns.
ELOI, ELOI, LAMA SABACHTHANI!?
This public outing of Mossack Fonseca's pathetic computer security will have the unfortunate consequence of convincing the rest of the firms in that line of work to get more serious about their own. For those who want greater transparency in the world of tax havens this hack of Mossack Fonseca might be a wrench in the works.
I deny that I have not avoided attaining the opposite of that which I do not want.
What the hell is sensitive client data doing on an Internet connected machine?
Have gnu, will travel.
Bernie Sanders warned us about this back in 2011 or so...
https://www.youtube.com/watch?...
Sanders made a speech on the Senate floor in October of 2011 that warned that a proposed trade agreement with Panama would open the floodgates of American money flowing into off-shore tax havens, a plea that ultimately fell on deaf ears as the agreement was signed by President Barack Obama later that year.
Just cruising through this digital world at 33 1/3 rpm...
I hope they catch them and throw the book at them. Life imprisonment at least.
They have embarrassed more very powerful people than Snowden and Assange combined. This type of activity must be stopped.
With them optimizing profits, they probably had no money for IT security to spare. Save a million, lose a billion (or rather more in this instance). The fatal combination of greed and stupidity at its finest. Will not be the last instance of something this large happening due to non-understanding of IT security.
When the first successful hack costs you everything, learning from experience is not a good strategy. Consulting and listening to some (admittedly expensive, but worth it) real experts may be a good idea.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Biggest contributor to Panama breach:
People doing illegal things in the first place.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
We're talking about 2.6TB of data here, 11.5 million documents, photos, scans, and emails created over a time span of 1970 til now, received in batches during a year.
I highly doubt some external used an exploit in customer facing portals to download this many individual files.
But why would an American go to Panama if they can just go to Delaware?
The people that use services in Panama do that because their local jurisdiction is on the ball w.r.t. tax evasion...
1. Even in the highly unlikely scenario that Wordpress was installed on the same system as Outlook Web Access, it would not provide access to the Exchange email system.
2. There is nothing wrong with "outdated 2009" Outlook Web Access. That would be either Excahange 2007 or more likely Exchange 2010. Both are still fully supported and do not suffer any egregious vulnerabilities that would allow co-installed Wordpress to access the Exchange Server.
3. Encrypted email? Who the fuck does that? No one, that's who. Let's not bother with any pretentious or condescending horseshit. Probably half of the world's email sits on Exchange servers, corporate on-premise or Office365/Outlook.com/Hotmail... None of it is encrypted at rest. Despite the available option and Google's recent TLS push, SMTP is not generally not encrypted. So, email in flight is even more open than at rest. This is the way it is everywhere and is not a major security issue.
4. The Panama Papers consist of 2.6 TERABYTES of data! Have you ever tried to push or pull that much data over the internet? It is a huge undertaking, even with very high speed connections. While technically possible, it is unlikely that that much data was siphoned off remotely, especially form slow-ass Exchange servers.
This entire article is pure fantastical supposition and utter horseshit. 2.6TB of Exchange emails DID NOT come through any Wordpress exploit. This data almost certainly came from an inside source and was walked out on a USB external drive which itself would have taken over 36 hours to copy the data to.
This "story" is utter horseshit. Just like the international outrage over legal financial activities. It's all manufactured nonsense.
From a French journal, the possible reasons for the lack of US based names :
- Mossack Fonseca is not the only player.
- US taxation is lower than the average in OECD countries
- FACTA
- The US have their own tax heavens