As we all now heard about the Panama Papers data breach and leak, it is now the time to find out how it all happened. Mossack Fonseca data breach, also known as Panama Papers, became the victim of a hack. The reason of the hack was that the company had a WordPress based site, but was not 100% secure and there were some security vulnerabilities.
It turned out that the company was running WP with a vulnerable version of Revolution Slider and the WP server along with email server were on the same network when the system was attacked.
Keep on reading and you will reveal how the hackers attacked the MF email servers via WP and Revolution Slider and how they got access to clients documents via Drupal.
In website security everything is affiliated. Once the hacker gets the access to a WP website, he can easily take the contents of wp-config.php which in its turn contains the WP database credentials in plain text. As soon as the hacker accesses the WordPress Database he gets whatever other privileges.
Some analysts state that the attacker gained access to the MF WordPress website via a well known Revolution Slider vulnerability.
As for gaining access to client corporate documents like PDF’s, it is because the system was powered by the old version of Drupal which has over 23 vulnerabilities.
Unfortunately, there is no 100% secure way to encrypt password that needs to be decrypted for use later. Plugin stores both encryption and decryption method, and if someone gets access to the system, they will get access to data and plugin. It might take them some time, but they will figure it out. Website needs to be protected from hackers, once they are in, they have access to everything.
