Hacker News Reader

It’s very clear that you don’t work with in infosec if you have it in your mind that hacking 14 offshore financial services company is indicative of nation state level activity.

The evidence isn’t that great for the claim you’re making. The other one I hear often when people make this claim which is how good a job the hackers did packaging it and getting it to all the right places in relative secrecy.

I mean.. I kind of see where your coming from if you compare it to the Epik hack recently but I don’t think quietly emailing journalists is some unobtainable skill either for even a single person let alone small crew.

Edit: just by way of reference I wanted to point you to a great example of some of the many motivated people and groups out there who I think are way more likely: https://theanarchistlibrary.org/library/subcowmandante-marco...

I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration.

Luckily, Wired did an expose of Mossack Fonseca's security lapses in 2018, and yeah, wow – if any of this is evidence of their broader security patterns at the time of the breach, you definitely would not have needed a team of Fancy Bear hackers to pull this one off:

> Mossack Fonseca has failed to update its Outlook Web Access login since 2009

> Mossack Fonseca's client portal is also vulnerable to the DROWN attack... The portal, which runs on the Drupal open source CMS, was last updated in August 2013

> The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal's backend can also be accessed by guessing the URL structure

> Mossack Fonseca's emails were also not encrypted [and] the company did not use the TLS security protocol

https://www.wired.co.uk/article/panama-papers-mossack-fonsec...

That all being said, of course none of this means it wasn't a nation state! It definitely could have been – the incentives were certainly there. But to call it "obviously" the job of state-employed hackers seems wrong.

I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough people to get to them and do the manual work in time. On average it takes them like a day before they start lateral movement. These are not sophisticated elite hackers.

If I had to guess the number of individuals that can pull of a sophisticated attack (0 day, at least develop exploit from a cve report/patch, target specific implant/c2, knowledge of how to evade enterprise EDRs) is in the hundreds if not thousands. Most of them don't work for governments.

Ransomware actors get caught because naturally their attack is meant to be discovered. If they decided to silently drop implants everywhere, how many companies do you think can afford to pay for forensics/IR at a massive scale, even if an intrusion is found?

Also, who said it was a hack? It could have been an employee that obtained enough access to get the docs and avoid audit logging.

I do think it is interesting how journalists will alternate between finding severe ethical problems with signal boosting hackers and waving around dirty laundry like a flag.

> And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks.

That’s a pretty bold conclusion from the premises provided.

> claim it's all fake.

Did that happen? I am not from the US, so I don't know, but here in Europe it always seemed clear that all leaks by WikiLeaks were genuine. People were discussing whether it's good to leak such stuff but the authenticity was not in doubt.

I think the OP was kind of caricaturing what are some valid criticisms of Wikileaks.

The four main ones I think have been they were accused of selectively releasing things in a way that looked awfully political. They just so happened to line up with a bunch of political statements Julian Assange had made in private chats that were later leaked.

The second one was that the way in which they went about providing active support in getting some of their documents from sources went way beyond all previously recognised standards of journalism.

Third one of the things that did ultimately come out of the DNC leak they were a part of was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. The reason for that was that it was an intelligence operation by the Russians that was specifically designed to throw the election at the last minute.

Understandably people were a bit upset by this and began to ask a lot of questions focusing on at what point were Wikileaks aware that this was an intelligence operation and I don’t think there are good answers for that still to this day.

The fourth main one is that they have been historically irresponsible with how they have released information and it likely got innocent people killed or put in jail.

So overall I think there’s a bit of a question of do they act differently behind closed doors that isn’t consistent with their public image because there is at least some evidence of that now.

On the first, it's not really strange to think people with documents to leak would look for an outlet that shares their political opinions. The "selective" leaks accusations are largely unfounded, with the one example given having been refused as much of the data had already been leaked.

On the second,you're referring to the supposed hacking claim in the indictment. Even if the accusations are true, the "hacking" provided no additional documents. You can take issue with Assange's action there, but all the documents were acquired by regular journalism standards.

I'd also like a source on the third one. Not someone discussing it, evidence of doctored documents.

And the fourth is just untrue. While Wikileaks was going through the documents, the Guardian published the decryption key in a book.

Your claim that their later releases included too much personal info is true, but that didn't kill people and it happened when Assange was trapped in the embassy unable to create the kind of vetting team.

> Third one of the things that did ultimately come out of the DNC leak they were a part of was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. The reason for that was that it was an intelligence operation by the Russians that was specifically designed to throw the election at the last minute.

Looking around, it seems screenshots of one document were marked 'confidential', the original documents without that were available, and media turned that into "Russia edited the documents". Is there any other evidence? I can't find it.

There isn't

> Third one of the things that did ultimately come out of the DNC leak they were a part of was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. The reason for that was that it was an intelligence operation by the Russians that was specifically designed to throw the election at the last minute.

This isn't a valid criticism of Wikileaks. If the Russians were responsible - and there was so much later-discredited bullshit kicked up about hypothetical Russians in 2016 I'm not taking that at face value - but if they were they could just have posted up a big torrent somewhere to the same overall effect.

Wikileaks isn't an important cog in that plan.

> The four main ones I think have been they were accused of selectively releasing things in a way that looked awfully political.

Others have addressed the other points, I just want to note the hypocrisy of the journalists making these claims, as if media outlets would never present facts in a partisan way or exhibit any kind of political bias. It's laughable on its face.

> was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them.

Source?

> historically irresponsible with how they have released information and it likely got innocent people killed or put in jail.

Wasn’t that the media essentially leaking the keys?

> the media essentially leaking the keys

"Essentially" seems to suggest that the media didn't literally publish the key. So let's be literal: Luke Harding, who is employed by The Guardian, published (not "leaked") the key, in a book published by - The Guardian.

Source for the first point is here around 37-38 mins in https://youtu.be/NKD1-xH9_Fk

I just want to make it clear that the source itself isn’t a YouTube video here but that this video happens to have an incredibly well respected person from the industry addressing that particular topic that might help provide context.

For the second point it went a bit beyond that. There are a lot of examples but here’s a couple https://www.wired.co.uk/article/wikileaks-private-medical-da...

If the video is not the actual source, why not link the actual source? I certainly have a bigger hate of videos than normal, as any kind of research into them requires far more work than proper text, so I’d be happy to get anything that can be more easily verified.

For the second point, according to the article it was pretty minor stuff where what The Guardian did was far worse.

Need a source for some of the DNC leak stuff was forged

> so many entities were hacked

Weren’t the Panama Papers almost exclusively data from Mossack Fonseca?

If this was a CIA leak, why was the leaked data sold to governments? The Danish tax ministry bought leaked data from the Panama papers in 2016 [1]

1: https://www.sktst.dk/aktuelt/pressemeddelelser/status-paa-pa... (sorry, source in Danish)

CIA isn’t above being a revenue generating department.

I don't think it would about the revenue, but just to mimic what actual hackers would do.

CIA has access to "infinite" money.

I don't think that precludes them taking easy money that Congress doesn't need to know about

Why would the CIA not sell information to governments?

That is money to fund future blackops, office coffee, new permanent markers, or whatever else the CIA may need.

Leaking information and earning money on it seems like a win win.

You supply an article that the Danish government paid for some access to the Panama papers.

Do you have any documentation that this happened with the Pandora papers?

possibly to do the opposite of what everyone would think you’d do?

why not?

> And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks.

Maybe a little bit too obvious? Or maybe that is what "they" want us to believe. Or in short: It is an obvious possibility, nothing proven.

You mean ICIJ is a cover for the CIA ?