Doc4.html

DOC :04.txt

Authorities have not yet identified the hacker behind the Panama Papers breach, nor have they isolated the exact attack vector. It is clear that Mossack Fonseca, the Panamanian law firm that protected the assets of the rich and powerful by setting up shell companies, had employed a dangerously loose policy towards web security and communications.

The firm ran its unencrypted emails through an outdated (2009) version of Microsoft’s Outlook Web Access. Outdated open source software running the frontend of the firm’s websites is also now suspected to have provided a vector for the compromise.

In initial communications with German newspaper the Süddeutsche Zeitung (SZ), an anonymous source offered the data with a few conditions, saying that his/her life was in danger.

“How much data are we talking about?” the SZ asked.

“More than anything you have ever seen,” the source said.

The Panama Papers breach is the largest data leak in history by a wide margin, with 2.6 terabytes of data, 11.5 million documents, and more than 214,000 shell companies exposed.

Forbes has identified outdated WordPress and Drupal installations as security holes that may have led to the data leak.

Forbes discovered the firm ran a three-month-old version of WordPress for its main site, known to contain some vulnerabilities, but more worrisome was that, according to Internet records, its portal used by customers to access sensitive data was most likely run on a three-year-old version of Drupal, 7.23.

This information is partially inaccurate, however. While looking at the site today, I found that the firm’s WordPress-powered site is currently running on version 4.1 (released in December 2014), based on its version of autosave.js, which is identical to the autosave.js file shipped in 4.1. Since that time WordPress has had numerous critical security updates.

The main site is also loading a number of outdated scripts and plugins. Its active theme is a three-year-old version of Twenty Eleven (1.5), which oddly resides in a directory labeled for /twentyten/.

The Mossack Fonseca client portal changelog.txt file is public, showing that its Drupal installation hasn’t been updated for three years. Since the release of version 7.23, the software has received 25 security updates, which means that the version it is running includes highly critical known vulnerabilities that could have given the hacker access to the server. This includes a 2014 SQL injection vulnerability known in the Drupal community as “Drupalgeddon,” which affected ev...

Top topics in this doc (% words in doc assigned to this topic)

	(20%)	security firm customers vulnerabilities version emails wired outdated told files ...
	(14%)	access email site portal drupal client web systems hack servers ...
	(14%)	source software time open encrypted sensitive reporters password veracrypt encryption ...
	(8%)	wordpress server slider revolution mf website running version attacker database ...
	(7%)	data breach network attacks users technical critical exfiltrated discovered ip ...
	(6%)	companies clients records names country german laundering financial president rich ...

[Index]