Mossack Fonseca (MF), the Panamanian law firm at the center of the so called Panama Papers Breach may have been breached via a vulnerable version of Revolution Slider. The data breach has so far brought down the Prime Minister of Iceland and surrounded Russian President Putin and British Prime Minister David Cameron with controversy, among other famous public figures. It is the largest data breach to journalists in history, weighing in at 2.6 terabytes and 11.5 million documents.

Forbes have reported that MF was giving their customers access to data via a web portal running a vulnerable version of Drupal. We performed an analysis on the MF website and have noted the following:

The MF website runs WordPress and is currently running a version of Revolution Slider that is vulnerable to attack and will grant a remote attacker a shell on the web server.

Viewing this link on the current MF website to a Revolution Slider file reveals the version of revslider they are running is 2.1.7. Versions of Revslider all the way up to 3.0.95 are vulnerable to attack.

Mossack Fonseca running vulnerable Revolution Slider



It appears that MF have now put their site behind a firewall which would protect against this vulnerability being exploited. This is a recent change within the last month.

Looking at their IP history on Netcraft shows that their IP was on the same network as their mail servers.

Screen Shot 2016-04-07 at 9.58.56 AM

ViewDNS.info further confirms that this was a recent move to protect their website:

Screen Shot 2016-04-07 at 10.09.51 AM

According to service crawler Shodan, one of the IP’s on their 200.46.144.0 network runs Exchange 2010 mail server which indicates this network block is either their corporate network or at the very least has a range of IT assets belonging to the company. We also show they’re running VPN remote access software.

You can view the IP addresses used for email for MF below which are all on the same network block:

Screen Shot 2016-04-07 at 10.01.52 AM

To summarize so far:

We’ve established that they were (and still are) running one of the most common WordPress vulnerabilities, Revolution Slider.
Their web server was not behind a firewall.
Their web server was on the same network as their mail servers based in Panama.
They were serving sensitive customer data from their portal website which includes a client login to access that data.
A theory on what happened in the Mossack Fonseca breach:

A working exploit for the Revolution Slider vulnerability was published on 15 October 2014 on exploit-db which made it widely exploitable by anyone who cared to take the time. A website like mossfon.com which was wide open until a month ago would have been trivially easy to exploit. Attackers frequently create robots to hit URLs like : http://mossfon.com/wp-content/plugins/revslider/release_log.txt

Once they establish that the site is vulnerable from the above URL the robot will simply exploit it and log it into a database and the attacker will review their catch at the end of the day. It’s possible that the attacker discovered they had stumbled across a law firm with assets on the same network as the machine they now had access to. They used the WordPress web server to ‘pivot’ into the corporate assets and begin their data exfiltration.

Technical details of the vulnerability in Revolution Slider

This is a brief technical summary from one of our analysts describing the nature of the vulnerability in Revolution Slider that was exploited.

Revolution Slider (also known as Slider Revolution) version 3.0.95 or older is vulnerable to unauthenticated remote file upload. It has an action called `upload_plugin` which can be called by an unauthenticated user, allowing anyone to upload a zip file containing PHP source code to a temp directory within the revslider plugin.

The code samples below point you to where the specific problem is in revslider. Note that the revslider developer is allowing unprivileged users to make an AJAX (or dynamic browser HTTP) call to a function that should be used by privileged users only and which allows the creation of a file an attacker uploads.

Screen Shot 2016-04-07 at 10.31.37 AM

A demonstration of Revolution Slider being exploited

The following video demonstrates how easy it is to exploit the Revolution Slider vulnerability on a website running the newest version of WordPress and a vulnerable version of Revolution Slider.



Conclusion

As a courtesy we have reached out to Mossack Fonseca to inform them about the Slider Revolution vulnerability on their site and have not yet received a response. They appear to be protected against it being exploited, or perhaps re-exploited in this case but the WordPress plugin on the site still needs updating.

To protect your WordPress installation it is critically important that you update your plugins, themes and core when an update becomes available. You should also monitor updates for security fixes and give those the highest priority. You can find out if a WordPress plugin includes a security update by viewing the changes in the “Changelog”.

In this case the site owners did not update for some time and it resulted in world leaders being toppled and the largest data breach to journalists in history.

https://www.wordfence.com/blog/2016/04/mossack-fonseca-breach-vulnerable-slider-revolution/?utm_source=list&utm_medium=email&utm_campaign=mfon

Quite Interesting...

Hmm.... And I have been wondering how my websites got hacked recently...

Oya na,when i dey tell people for that "flash share" thread se any thing dey hackable dem no believe.

Cyber crime is a huge threat to all webmasters, hence adequate attention and priority should given to any process or routine that can make a site safer, though we can't completely eliminate the threat but we can reduce it to the bearest Minimum. So as a webmaster, always update your plugins as soon as an update is available...

You go fear outdated plugins na.
Need Ithemes Security plugin to protect your WordPress site? Send a PM for a token.

cc Lalasticlala seun dominique

This is a call to all websites using wordpress... Even some themes are vulnerable. If you cannot hide your Theme Name, at least use a security plugin or change the admin area to the blog. I get to see a lot of www.yourwebsite.com/wp-admin as the back end. now that's appalling. You have a lot of resources on how to change that with the help of a plugin.

Wordpress is awesome in building a website. Even almighty CNN website is running on WordPress (but you'll never know) and that fact has been blocked out. Looking at the source page will reveal nothing.

I still wonder why a high profile web like that will make use of wordpress to power that part of the site. It's like GTB using wordpress for her website (many money go don miss)

cc Lalasticlala seun adewasco2k

H

there is nothing like secret. Even dem celebrity nude pix was hacked and it was on apple cloud platform

Space for sale!!










Nothing is free even in Freetown not to mention Nairaland

It seems the person that exposed those documents really planned it, how on earth did he download a file of many. 2.5 terabyte.

Abeg, make una break am to a common man language

I smell something

J

Abbeyunique2:
there is nothing like secret

Abi na

Be expectin McBrooklyn he go soon cum type "who you epp" ere.. .... ......

I believed so much in WordPress.

There is no absolute secret in life

Panama Jean's. I remind of younger days.


I wan ask is it true that Obama is Osama, I watched one video on YouTube the kinda resemble each other.

Ok

Hmm if the site was running on https then the company providing the S service is liable to pay for damages.

now this is what am talking about!

If they had used C# ASP.Net this hack would not have been possible.

Looters Exposed.
That is what matters most.

mheen don't f*ck with hackers oo.....everything is hackable. even nuclear security programing ,ios name it.

vision2050:


I wan ask is it true that Obama is Osama, I watched one video on YouTube the kinda resemble each other.

Ko le ye mi lai lai ooo this is too panama listic grammatic ooo oyibo na winsh

Wpscan makes the work easier