5 ms·

Mossack Fonseca Exposes Unmaintained Open Source CMS Risks

37 points by velmu 11y ago

timthelion 11y ago
I think that this article failes to see the main problem, which is the failiure to protect your data from your CMS. Sure, I run wordpress on my VPS, but my VPS has NO access to my data. My VPS is UNTRUSTED! ----- One thing that is problematic with the untrusted model, is that I also run my mail server on my VPS. Email is insecure, it is unencrypted as it travels through the internet. Unfortunately, I cannot do much about that fact. I should however, be worying more about separating my email server from my wordpress installation than about making sure that my wordpress has no security flaws. OF COURSE the wordpress could be hacked, even though I always install updates on time!
- spacecowboy_lon 11y ago
  Exactly your WordPress external facing sites should be hosted on a physically separate net work and system to your internal systems.
- pjc50 11y ago
  failiure to protect your data from your CMS How can you do that if the CMS is the place where the data is stored? That's why people use a CMS after all, to manage content.
  - mtbcoder 11y ago
    I'm assuming OP means data not related to the blog. In other words, if one chooses to run Wordpress, isolate it and its database on to a separate container, away from anything mission critical.
  - timthelion 11y ago
    OK, your CMS, AKA your blog, should not have the data of tens of thousands of customers in it...
    - pilsetnieks 11y ago
      It's not in this article but in the one about Drupal (http://drupal.ovh/drupal-panama-papers-leaks-mossack-fonseca http://drupal.ovh/drupal-panama-papers-leaks-mossack-fonseca) it says that they were running a customer portal for the purpose of giving customers access to those very same documents. So yes, they probably should have ran their Wordpress site and Drupal portal separately but it wouldn't have changed anything anyway.
- deleted 11y ago
  [deleted]
fowl2 11y ago
The fact that the software was Open Source is completely irrelevant, other than the fact that it means that it was possible to fix it, given resources.
pygy_ 11y ago
s/Open Source CMS/servers exposed to the internet/ The article later makes that point, actually. > Not due to the nature of Open Source, but because [these programs have] become an interesting target for malicious activities.
- Piskvorrr 11y ago
  ...which makes the title clickbait.
Neil44 11y ago
The only link made between Drupal/Wordpress and the hack is that Mossack used them, despite the headlines implication.
- blowski 11y ago
  I thought the same - I saw no evidence that WordPress or Drupal were an attack vector used at any point to get the information. You could say "someone in the company was using an old kettle, and then they got hacked, so make sure you get new kettles." Of course you should be keeping your installation of WordPress/Drupal or whatever up to date, but it's not obvious how relevant that is to this conversation.
jkmcf 11y ago
From many years consulting to both rich and poor startups, they don't want to pay for maintaining what's been built. Part of that might be how the work is sold to tech-ignorant business people.

37 points by velmu 11y ago

I think that this article failes to see the main problem, which is the failiure to protect your data from your CMS. Sure, I run wordpress on my VPS, but my VPS has NO access to my data. My VPS is UNTRUSTED! ----- One thing that is problematic with the untrusted model, is that I also run my mail server on my VPS. Email is insecure, it is unencrypted as it travels through the internet. Unfortunately, I cannot do much about that fact. I should however, be worying more about separating my email server from my wordpress installation than about making sure that my wordpress has no security flaws. OF COURSE the wordpress could be hacked, even though I always install updates on time!

spacecowboy_lon 11y ago
Exactly your WordPress external facing sites should be hosted on a physically separate net work and system to your internal systems.
pjc50 11y ago
failiure to protect your data from your CMS How can you do that if the CMS is the place where the data is stored? That's why people use a CMS after all, to manage content.
- mtbcoder 11y ago
  I'm assuming OP means data not related to the blog. In other words, if one chooses to run Wordpress, isolate it and its database on to a separate container, away from anything mission critical.
- timthelion 11y ago
  OK, your CMS, AKA your blog, should not have the data of tens of thousands of customers in it...
  - pilsetnieks 11y ago
    It's not in this article but in the one about Drupal (http://drupal.ovh/drupal-panama-papers-leaks-mossack-fonseca http://drupal.ovh/drupal-panama-papers-leaks-mossack-fonseca) it says that they were running a customer portal for the purpose of giving customers access to those very same documents. So yes, they probably should have ran their Wordpress site and Drupal portal separately but it wouldn't have changed anything anyway.
deleted 11y ago
[deleted]

fowl2 11y ago

The fact that the software was Open Source is completely irrelevant, other than the fact that it means that it was possible to fix it, given resources.

pygy_ 11y ago

s/Open Source CMS/servers exposed to the internet/ The article later makes that point, actually. > Not due to the nature of Open Source, but because [these programs have] become an interesting target for malicious activities.

Piskvorrr 11y ago
...which makes the title clickbait.

Neil44 11y ago

The only link made between Drupal/Wordpress and the hack is that Mossack used them, despite the headlines implication.

blowski 11y ago
I thought the same - I saw no evidence that WordPress or Drupal were an attack vector used at any point to get the information. You could say "someone in the company was using an old kettle, and then they got hacked, so make sure you get new kettles." Of course you should be keeping your installation of WordPress/Drupal or whatever up to date, but it's not obvious how relevant that is to this conversation.

jkmcf 11y ago

From many years consulting to both rich and poor startups, they don't want to pay for maintaining what's been built. Part of that might be how the work is sold to tech-ignorant business people.