WordPress Plugin Possible Cause in Mossack Fonseca Breach

This "breach" happened a year ago and all sources indicate that it was an inside job.

Seeing Wordfence using this to promote their product does not create much confidence.

At best, this article is amateur hour for WordFence. It's focused on the topmost layers of the OSI model in an ecosystem requiring attention at all layers, from the wire -> up. Don't sell your product as anything more than consumer grade snake oil.

At the top, whether WordPress is secure or not has zero impact on a properly designed network. If a company is dumb enough to use WordPress on internal hosts, they have bigger problems. Add to this, that a properly designed network should have mitigated the chance that a web server be compromised and at least segregate the network and provide access control to sensitive data.

In short, the network was doomed regardless if WordFence was in place or not and it's damned irresponsible for WordFence to suggest they could protect clients from the kind of attack which played out here.

WordFence are a typical WordPress development company, in that they're web developers first, security / network experts when they need to make a sale.... It's consumer grade crap, which is why this article needs to be treated as such.

I should also mention that just because a web server has an outside IP in the same subnet as the mail server pool, doesn't mean it's on the same physical network. It could be on it's own completely separate physical network or segmented via vlans with full access controls in place. If you understood network security you would know how NAT works.

These guys got hacked because they failed on every level of network best practice or even the fundamentals. Taking advantage of this to sell a product which is equally as naive, is as I said, irresponsible if not negligent.

I respect the work these researchers are doing. But to be blunt: if I had that kind of sensitive data, there is no way I'd even consider having a WordPress on the same network. I'm not a security expert, but I like to think I avoid the most obvious pitfalls. And WordPress strikes me as a security pit the size of a continent and there are many reasonable alternatives.

This type of nonsense from WordFence shouldn't surprise anyone. I've written of their incompetence before: http://www.whitefirdesign.com/blog/2015/02/23/wordfence-real...

Laugh and move on...

No one other than person or people that released that data knows what happened for sure but, one hole in your security that will allow shell access is just as bad as another.

Some are worse than others but, all need to be fixed.

It also illustrates the complexity of security. The smallest decisions (a wordpress plugin), hosting your own wordpress web servers, using wordpress, can have on your security.

Whether you have an open door, an open window or an inside man to unlock it from the inside, they all leave you exposed.

That's only speculation. All Wordfence found is that their site had a vulnerable plugin and they are magically linking that to the compromise. No real forensics there.

I don't think a plugin could have caused this but we never know...

Nonetheless, it highlights very fragile nature of third party plugins. May be Wordpress ought to run some kind of certification program to analyze and certify plugins.

This article is speculative and does the security community a huge disservice. There is nothing interesting about this research, outside of spreading FUD via marketing scamy techniques like using link bait taking advantage of something that has global attention.

Allow me to explain why and how I’ve come to this conclusion:

1 - It all starts with the email they sent out:

“We performed an analysis of MF's network and it seems that the breach may have been caused by an outdated WordPress plugin: Revolution Slider. It turns out that not updating your WordPress plugins may result in the fall of world leaders and the largest data breach to journalists in history.”

I get it, they need people to click...

2 - In the Forbes article they reference, it reads:

“its portal used by customers to access sensitive data was most likely run on a three-year-old version of Drupal, 7.23. That platform has at least 25 known vulnerabilities at the time of writing, two of which could have been used by a hacker to upload their own code to the server and start hoovering up data.”

but of those 25 potential vulnerabilities, the key one according to WordFence was:

“Viewing this link on the current MF website to a Revolution Slider file reveals the version of revslider they are running is 2.1.7. Versions of Revslider all the way up to 3.0.95 are vulnerable to attack.”

I don’t buy it... the Drupal vulnerability at that time was actually more serious... as referenced in the same Forbes article: http://www.forbes.com/sites/thomasbrewster/2014/10/30/did-dr...

3 - In the same Forbes article they reference it states:

“In a letter, dated April 1 and posted on Wikileaks’Twitter profile, the firm told customers it was investigating an email server hack.”

So naturally, WordFence needed to connect the dots for the readers:

“Their web server was on the same network as their mail servers based in Panama.”

and here:

“Looking at their IP history on Netcraft shows that their IP was on the same network as their mail servers.”

Got it, they’re on the same network… but nowhere to they describe the process for traversing the network and any potential roadblocks they’d find… but then later after connecting the dots to the mail server, they revert to the data in the portal.. explained later...

4 - They create this video showing how to use a script to exploit the RevSlider vuln. They then type a number of commands to show you how exhaustive the control us:

Commands like:

- ls -la (listing what’s in a folder) - pwd (showing what directory they are in)

and to really show their control they navigate to /var/www/html (in other words to the same exact directory they’re supposed to have access to under the user they have control of). They then proceed to make statements how “they have full control of the server”. They have control of the web directory which is what they would have access too. To have full access to the server they’d need to show some form of privilege escalation that gives actual control of the server…

The argument the author makes to this point on his blog states:

“In the case of MF, they made client data accessible via a web interface to their customers. That means a web server had access to client data. So, as per my explanation above, all they had to do was break into the web server as www-data or whatever user the web server ran as and they have client data.”

So what's the point of the email reference above, if it was on the web server as they theorize?

Additionally, this only makes sense if the portal was on the same web server. There is no proof that the “portal” is on the same server as the web server. I understand why they didn't, using their own tool they didn't have the information: http://toolbar.netcraft.com/site_report?url=portal.mossfon.c...

If the vector was Drupal, it’d be more realistic that they leveraged a SQLi vulnerability to siphon the data if that was the vector at all… On that same note, if the user was the same web user, how is that known? Because they don’t update their website doesn’t mean they don’t apply basic sysadmin steps.. again, it’s speculative on both side, but that’s the issue when you don’t know enough…

Additionally, this is a lot of data we’re talking about.. It'd be very curious if they managed to store that amoutn of data on a web server and not some form of database server…

5 - In the same video they show how they can see the network cards are attached by using ifconfig… but again show no examples of how that information was used to tunnel into the rest of the environment and how they would have gone about doing something like that…. from their own admission, they show how the mail servers were on the same network, but that itself doesn’t make them susceptible.. there are a number of things that have to happen to be successful… The web server could be on it’s own DMZ, there could be a number of firewalls isolating parts of the network, there could be a number of things….

Additionally, they speculate it was WordPress … the platform for their main website, when in reality Drupal was the CMS used for the client portal.. wouldn’t it be more realistic to think it’d be Drupal where the real data resides?

6 - There are also statements to how attackers work.. using automated scripts to scan websites for potential vulnerabilities like Revsliders… while it’s true… the logic is flawed… these crawlers pull thousands of websites at any given time… a site like “mossfon.com” is not a high value target, unless it’s being targeted.. these scripts are automated, so are most of their attacks which will automatically upload their scripts and payloads… if the lists are scanned they’re looking for valuable targets, unfortunately mossfon.com isn’t one, unless you know what it is… this logic defies reason and understanding of how attacks happen…

In any event, those are my thoughts... unfortunate...

Thanks! - Truth Finder

Is there any evidence the leaks were actually due to a hack?

I think one thing here is clear: don't use image sliders.