5 ms·

The world's biggest "offshore" tax heaven is not any of the Caribbean islands. It's not Switzerland. It's not Hong Kong. It's South Dakota. [1] Former hedge f

by Jerry2 5y ago

The world's biggest "offshore" tax heaven is not any of the Caribbean islands. It's not Switzerland. It's not Hong Kong. It's South Dakota. [1] Former hedge fund manager and financial book author Patrick Boyle explains what these Pandora Papers mean in a video [2]. There are rumors and speculations that both the Panama and Pandora Papers leaks were released by the CIA. The leak is so massive and so many entities were hacked that only a nation state could have pulled it off. And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks. And none of the media companies are asking the question of who is behind these leaks for a very good reason. Just imagine if Wikileaks had released something like this... all these news orgs would immediately blame it on "russians" and claim it's all fake. [1] https://www.cnbc.com/2021/10/05/heres-how-states-like-south-dakota-have-become-global-tax-havens.html https://www.cnbc.com/2021/10/05/heres-how-states-like-south-... [2] https://www.youtube.com/watch?v=INRs9rnciyI https://www.youtube.com/watch?v=INRs9rnciyI

ghayes 5y ago
> And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks. That’s a pretty bold conclusion from the premises provided.
lelandfe 5y ago
> so many entities were hacked Weren’t the Panama Papers almost exclusively data from Mossack Fonseca?
mhoad 5y ago
It’s very clear that you don’t work with in infosec if you have it in your mind that hacking 14 offshore financial services company is indicative of nation state level activity. The evidence isn’t that great for the claim you’re making. The other one I hear often when people make this claim which is how good a job the hackers did packaging it and getting it to all the right places in relative secrecy. I mean.. I kind of see where your coming from if you compare it to the Epik hack recently but I don’t think quietly emailing journalists is some unobtainable skill either for even a single person let alone small crew. Edit: just by way of reference I wanted to point you to a great example of some of the many motivated people and groups out there who I think are way more likely: https://theanarchistlibrary.org/library/subcowmandante-marcos-hack-back https://theanarchistlibrary.org/library/subcowmandante-marco...
- Natsu 5y ago
  I do think it is interesting how journalists will alternate between finding severe ethical problems with signal boosting hackers and waving around dirty laundry like a flag.
- lelandfe 5y ago
  I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration. Luckily, Wired did an expose of Mossack Fonseca's security lapses in 2018, and yeah, wow – if any of this is evidence of their broader security patterns at the time of the breach, you definitely would not have needed a team of Fancy Bear hackers to pull this one off: > Mossack Fonseca has failed to update its Outlook Web Access login since 2009 > Mossack Fonseca's client portal is also vulnerable to the DROWN attack... The portal, which runs on the Drupal open source CMS, was last updated in August 2013 > The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal's backend can also be accessed by guessing the URL structure > Mossack Fonseca's emails were also not encrypted [and] the company did not use the TLS security protocol https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems https://www.wired.co.uk/article/panama-papers-mossack-fonsec... That all being said, of course none of this means it wasn't a nation state! It definitely could have been – the incentives were certainly there. But to call it "obviously" the job of state-employed hackers seems wrong.
- _8j50 5y ago
  I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough people to get to them and do the manual work in time. On average it takes them like a day before they start lateral movement. These are not sophisticated elite hackers. If I had to guess the number of individuals that can pull of a sophisticated attack (0 day, at least develop exploit from a cve report/patch, target specific implant/c2, knowledge of how to evade enterprise EDRs) is in the hundreds if not thousands. Most of them don't work for governments. Ransomware actors get caught because naturally their attack is meant to be discovered. If they decided to silently drop implants everywhere, how many companies do you think can afford to pay for forensics/IR at a massive scale, even if an intrusion is found? Also, who said it was a hack? It could have been an employee that obtained enough access to get the docs and avoid audit logging.
patall 5y ago
> claim it's all fake. Did that happen? I am not from the US, so I don't know, but here in Europe it always seemed clear that all leaks by WikiLeaks were genuine. People were discussing whether it's good to leak such stuff but the authenticity was not in doubt.
- mhoad 5y ago
  I think the OP was kind of caricaturing what are some valid criticisms of Wikileaks. The four main ones I think have been they were accused of selectively releasing things in a way that looked awfully political. They just so happened to line up with a bunch of political statements Julian Assange had made in private chats that were later leaked. The second one was that the way in which they went about providing active support in getting some of their documents from sources went way beyond all previously recognised standards of journalism. Third one of the things that did ultimately come out of the DNC leak they were a part of was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. The reason for that was that it was an intelligence operation by the Russians that was specifically designed to throw the election at the last minute. Understandably people were a bit upset by this and began to ask a lot of questions focusing on at what point were Wikileaks aware that this was an intelligence operation and I don’t think there are good answers for that still to this day. The fourth main one is that they have been historically irresponsible with how they have released information and it likely got innocent people killed or put in jail. So overall I think there’s a bit of a question of do they act differently behind closed doors that isn’t consistent with their public image because there is at least some evidence of that now.
  - Semaphor 5y ago
    > was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. Source? > historically irresponsible with how they have released information and it likely got innocent people killed or put in jail. Wasn’t that the media essentially leaking the keys?
    - 5y ago
slim 5y ago
You mean ICIJ is a cover for the CIA ?
jlg23 5y ago
> And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks. Maybe a little bit too obvious? Or maybe that is what "they" want us to believe. Or in short: It is an obvious possibility, nothing proven.
wodenokoto 5y ago
If this was a CIA leak, why was the leaked data sold to governments? The Danish tax ministry bought leaked data from the Panama papers in 2016 [1] 1: https://www.sktst.dk/aktuelt/pressemeddelelser/status-paa-panama-papers-skattestyrelsen-har-afgjort-sager-for-610-mio-kr/ https://www.sktst.dk/aktuelt/pressemeddelelser/status-paa-pa... (sorry, source in Danish)
- BryanBeshore 5y ago
  possibly to do the opposite of what everyone would think you’d do?
- after_care 5y ago
  CIA isn’t above being a revenue generating department.
  - libertine 5y ago
    I don't think it would about the revenue, but just to mimic what actual hackers would do. CIA has access to "infinite" money.
    - psd1 5y ago
      I don't think that precludes them taking easy money that Congress doesn't need to know about
- VMG 5y ago
  why not?
- ThinkBeat 5y ago
  Why would the CIA not sell information to governments? That is money to fund future blackops, office coffee, new permanent markers, or whatever else the CIA may need. Leaking information and earning money on it seems like a win win. You supply an article that the Danish government paid for some access to the Panama papers. Do you have any documentation that this happened with the Pandora papers?

by Jerry2 5y ago

ghayes 5y ago

> And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks. That’s a pretty bold conclusion from the premises provided.

lelandfe 5y ago

> so many entities were hacked Weren’t the Panama Papers almost exclusively data from Mossack Fonseca?

mhoad 5y ago

It’s very clear that you don’t work with in infosec if you have it in your mind that hacking 14 offshore financial services company is indicative of nation state level activity. The evidence isn’t that great for the claim you’re making. The other one I hear often when people make this claim which is how good a job the hackers did packaging it and getting it to all the right places in relative secrecy. I mean.. I kind of see where your coming from if you compare it to the Epik hack recently but I don’t think quietly emailing journalists is some unobtainable skill either for even a single person let alone small crew. Edit: just by way of reference I wanted to point you to a great example of some of the many motivated people and groups out there who I think are way more likely: https://theanarchistlibrary.org/library/subcowmandante-marcos-hack-back https://theanarchistlibrary.org/library/subcowmandante-marco...

Natsu 5y ago
I do think it is interesting how journalists will alternate between finding severe ethical problems with signal boosting hackers and waving around dirty laundry like a flag.
lelandfe 5y ago
I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration. Luckily, Wired did an expose of Mossack Fonseca's security lapses in 2018, and yeah, wow – if any of this is evidence of their broader security patterns at the time of the breach, you definitely would not have needed a team of Fancy Bear hackers to pull this one off: > Mossack Fonseca has failed to update its Outlook Web Access login since 2009 > Mossack Fonseca's client portal is also vulnerable to the DROWN attack... The portal, which runs on the Drupal open source CMS, was last updated in August 2013 > The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal's backend can also be accessed by guessing the URL structure > Mossack Fonseca's emails were also not encrypted [and] the company did not use the TLS security protocol https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems https://www.wired.co.uk/article/panama-papers-mossack-fonsec... That all being said, of course none of this means it wasn't a nation state! It definitely could have been – the incentives were certainly there. But to call it "obviously" the job of state-employed hackers seems wrong.
_8j50 5y ago
I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough people to get to them and do the manual work in time. On average it takes them like a day before they start lateral movement. These are not sophisticated elite hackers. If I had to guess the number of individuals that can pull of a sophisticated attack (0 day, at least develop exploit from a cve report/patch, target specific implant/c2, knowledge of how to evade enterprise EDRs) is in the hundreds if not thousands. Most of them don't work for governments. Ransomware actors get caught because naturally their attack is meant to be discovered. If they decided to silently drop implants everywhere, how many companies do you think can afford to pay for forensics/IR at a massive scale, even if an intrusion is found? Also, who said it was a hack? It could have been an employee that obtained enough access to get the docs and avoid audit logging.

patall 5y ago

> claim it's all fake. Did that happen? I am not from the US, so I don't know, but here in Europe it always seemed clear that all leaks by WikiLeaks were genuine. People were discussing whether it's good to leak such stuff but the authenticity was not in doubt.

mhoad 5y ago
I think the OP was kind of caricaturing what are some valid criticisms of Wikileaks. The four main ones I think have been they were accused of selectively releasing things in a way that looked awfully political. They just so happened to line up with a bunch of political statements Julian Assange had made in private chats that were later leaked. The second one was that the way in which they went about providing active support in getting some of their documents from sources went way beyond all previously recognised standards of journalism. Third one of the things that did ultimately come out of the DNC leak they were a part of was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. The reason for that was that it was an intelligence operation by the Russians that was specifically designed to throw the election at the last minute. Understandably people were a bit upset by this and began to ask a lot of questions focusing on at what point were Wikileaks aware that this was an intelligence operation and I don’t think there are good answers for that still to this day. The fourth main one is that they have been historically irresponsible with how they have released information and it likely got innocent people killed or put in jail. So overall I think there’s a bit of a question of do they act differently behind closed doors that isn’t consistent with their public image because there is at least some evidence of that now.
- Semaphor 5y ago
  > was that some of the documents were altered from the originals and so they were “mostly real” but did have fake things in them. Source? > historically irresponsible with how they have released information and it likely got innocent people killed or put in jail. Wasn’t that the media essentially leaking the keys?
  - 5y ago

slim 5y ago

You mean ICIJ is a cover for the CIA ?

jlg23 5y ago

> And given who was and who wasn't implicated in this and given which news orgs received these papers, it's pretty obvious that CIA or NSA or some other part of the US IC community was behind these leaks. Maybe a little bit too obvious? Or maybe that is what "they" want us to believe. Or in short: It is an obvious possibility, nothing proven.

wodenokoto 5y ago

If this was a CIA leak, why was the leaked data sold to governments? The Danish tax ministry bought leaked data from the Panama papers in 2016 [1] 1: https://www.sktst.dk/aktuelt/pressemeddelelser/status-paa-panama-papers-skattestyrelsen-har-afgjort-sager-for-610-mio-kr/ https://www.sktst.dk/aktuelt/pressemeddelelser/status-paa-pa... (sorry, source in Danish)

BryanBeshore 5y ago
possibly to do the opposite of what everyone would think you’d do?
after_care 5y ago
CIA isn’t above being a revenue generating department.
- libertine 5y ago
  I don't think it would about the revenue, but just to mimic what actual hackers would do. CIA has access to "infinite" money.
  - psd1 5y ago
    I don't think that precludes them taking easy money that Congress doesn't need to know about
VMG 5y ago
why not?
ThinkBeat 5y ago
Why would the CIA not sell information to governments? That is money to fund future blackops, office coffee, new permanent markers, or whatever else the CIA may need. Leaking information and earning money on it seems like a win win. You supply an article that the Danish government paid for some access to the Panama papers. Do you have any documentation that this happened with the Pandora papers?