5 ms·

It’s very clear that you don’t work with in infosec if you have it in your mind that hacking 14 offshore financial services company is indicative of nation sta

by mhoad 5y ago

It’s very clear that you don’t work with in infosec if you have it in your mind that hacking 14 offshore financial services company is indicative of nation state level activity. The evidence isn’t that great for the claim you’re making. The other one I hear often when people make this claim which is how good a job the hackers did packaging it and getting it to all the right places in relative secrecy. I mean.. I kind of see where your coming from if you compare it to the Epik hack recently but I don’t think quietly emailing journalists is some unobtainable skill either for even a single person let alone small crew. Edit: just by way of reference I wanted to point you to a great example of some of the many motivated people and groups out there who I think are way more likely: https://theanarchistlibrary.org/library/subcowmandante-marcos-hack-back https://theanarchistlibrary.org/library/subcowmandante-marco...

Natsu 5y ago
I do think it is interesting how journalists will alternate between finding severe ethical problems with signal boosting hackers and waving around dirty laundry like a flag.
lelandfe 5y ago
I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration. Luckily, Wired did an expose of Mossack Fonseca's security lapses in 2018, and yeah, wow – if any of this is evidence of their broader security patterns at the time of the breach, you definitely would not have needed a team of Fancy Bear hackers to pull this one off: > Mossack Fonseca has failed to update its Outlook Web Access login since 2009 > Mossack Fonseca's client portal is also vulnerable to the DROWN attack... The portal, which runs on the Drupal open source CMS, was last updated in August 2013 > The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal's backend can also be accessed by guessing the URL structure > Mossack Fonseca's emails were also not encrypted [and] the company did not use the TLS security protocol https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems https://www.wired.co.uk/article/panama-papers-mossack-fonsec... That all being said, of course none of this means it wasn't a nation state! It definitely could have been – the incentives were certainly there. But to call it "obviously" the job of state-employed hackers seems wrong.
_8j50 5y ago
I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough people to get to them and do the manual work in time. On average it takes them like a day before they start lateral movement. These are not sophisticated elite hackers. If I had to guess the number of individuals that can pull of a sophisticated attack (0 day, at least develop exploit from a cve report/patch, target specific implant/c2, knowledge of how to evade enterprise EDRs) is in the hundreds if not thousands. Most of them don't work for governments. Ransomware actors get caught because naturally their attack is meant to be discovered. If they decided to silently drop implants everywhere, how many companies do you think can afford to pay for forensics/IR at a massive scale, even if an intrusion is found? Also, who said it was a hack? It could have been an employee that obtained enough access to get the docs and avoid audit logging.

by mhoad 5y ago

Natsu 5y ago

I do think it is interesting how journalists will alternate between finding severe ethical problems with signal boosting hackers and waving around dirty laundry like a flag.

lelandfe 5y ago

I'm pretty familiar with the Panama Papers, but didn't know much about the underlying exfiltration. Luckily, Wired did an expose of Mossack Fonseca's security lapses in 2018, and yeah, wow – if any of this is evidence of their broader security patterns at the time of the breach, you definitely would not have needed a team of Fancy Bear hackers to pull this one off: > Mossack Fonseca has failed to update its Outlook Web Access login since 2009 > Mossack Fonseca's client portal is also vulnerable to the DROWN attack... The portal, which runs on the Drupal open source CMS, was last updated in August 2013 > The version of Drupal used by the portal has at least 25 vulnerabilities, including a high-risk SQL injection vulnerability that allows anyone to remotely execute arbitrary commands. Areas of the portal's backend can also be accessed by guessing the URL structure > Mossack Fonseca's emails were also not encrypted [and] the company did not use the TLS security protocol https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems https://www.wired.co.uk/article/panama-papers-mossack-fonsec... That all being said, of course none of this means it wasn't a nation state! It definitely could have been – the incentives were certainly there. But to call it "obviously" the job of state-employed hackers seems wrong.

_8j50 5y ago

I second this. As someone who works in infosec, there are ransomware gangs sitting on dozens after dozens companies' networks idle because they can't get enough people to get to them and do the manual work in time. On average it takes them like a day before they start lateral movement. These are not sophisticated elite hackers. If I had to guess the number of individuals that can pull of a sophisticated attack (0 day, at least develop exploit from a cve report/patch, target specific implant/c2, knowledge of how to evade enterprise EDRs) is in the hundreds if not thousands. Most of them don't work for governments. Ransomware actors get caught because naturally their attack is meant to be discovered. If they decided to silently drop implants everywhere, how many companies do you think can afford to pay for forensics/IR at a massive scale, even if an intrusion is found? Also, who said it was a hack? It could have been an employee that obtained enough access to get the docs and avoid audit logging.