Panama Papers and WordPress
April 9, 2016 - Uncategorized
The extraordinary leak of documents from law firm Mossack Fonseca that has spun a spotlight on the tax-avoiding efforts by the world’s elite was likely the result of unpatched content management systems (CMSes).
A slew of stories this past week drawn from the 11.5 million documents and 2.6TB of data have seen the prime minister of Iceland resign, sparked calls for the resignation of UK prime minister David Cameron, and caused significant embarrassment to hundreds of others across the world.
The information was assumed to have come from a hacked email server – and that may still be true – but increasingly the evidence points to the fact that hackers found their way into the law firm’s system through unpatched versions of the common WordPress and Drupal CMSes.
Mossack Fonseca has two main websites: its front-facing website, which runs on WordPress; and a customer portal for sharing sensitive information with customers, which runs Drupal.
Both of those sites were running outdated versions of the software and in both cases significant security holes existed that would have allowed hackers access.
The main website’s WordPress installation was three months out of date and one company, WordFence, has gone into an extensive rundown of what it believes was the entry point: an unpatched version of the Revolution Slider plugin – a plugin used to simplify website design.