Japanese ISP GMO Internet has warned its customers that the cloud desktop service it offers as an ideal environment for foreign exchange trading was compromised by an attacker and that it was slow to improve the security of the service.
GMO runs a service called Onamae.com Desktop Cloud and admitted last week that “a third party installed malware into some customers’ server environments.” This is never good news, but it’s a particularly poor result because the servers host cloudy Windows desktops that GMO recommends its clients use to host currency trading applications.
In subsequent updates, the company revealed that some customers had reported that “unauthorized trades had been made on their trading accounts” and indicated that third parties had likely seen users’ passwords for trading services.
The next day, the company advised users to immediately change their trading account passwords and to do so using a device they do not use for trading.
The company has since admitted that “its Onamae.com Desktop Cloud service systems had security vulnerabilities, its environment was accessed without authorization, and customer information was taken outside the company.”
“Some customers have also reported transactions on their trading accounts that they do not recognize.”
These trades worried GMO so much that it contacted major trading services, asked them to forcibly terminate all active sessions, monitor unauthorized trades, and block trading requests coming from Onamae.com’s Desktop Cloud.
Don’t pay or complain
GMO said it “received a request for money from someone believed to be the attacker. We were also told that if we refuse, the attacker will take actions such as publishing information about the company and our customers.”
The attacker wants $50 million.
The company will not pay because it believes that “complying would not ensure that the information obtained is deleted or that its misuse is prevented.”
Investigations into the incident continue, with GMO warning that 26,739 VDI servers may have been affected by the attack and users’ personal devices may be at risk.
The company is offering all users a ¥5,000 ($32) condolence payment and has promised to compensate for any business losses caused by the attack.
This incident could be far-reaching, as GMO warned that some trading applications could keep sessions alive even after a password change. “Check your securities or exchange company’s guidance or account page, and disconnect all active sessions or ask the company’s help desk to disconnect them,” GMO advised.
Our response lacked depth and speed, which allowed attackers to exploit the vulnerability.
This ¥5,000 won’t be enough to pay for the work customers will do to resolve this issue.
GMO CEO Masatoshi Kumagai acknowledged this in a blog post in which he described the payment as “a token of our initial sincerity to our customers who have experienced inconvenience and concern.”
“We will devote all our group resources to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, conducting a thorough investigation into the cause and preventing a recurrence with the help of external experts,” he added.
But he also admitted that GMO knew the security of the service could be improved.
“Our internal white hat hackers had already flagged areas for improvement to the team,” he wrote. “The team took these points to heart and worked on countermeasures. »
“However, while we proceeded cautiously, considering the impact on service availability and prioritizing other issues, our response was not sufficiently thorough and timely, allowing attackers to exploit the vulnerability. I deeply regret that, despite having professionals on staff, we failed to fully translate their expertise into effective defenses as an organization.”
The CEO also said that GMOs cannot protect themselves without government help.
“I have been involved in this world for 31 years, since the dawn of the Internet industry,” he wrote. “The cyberspace that I built with my colleagues, thinking it would make people smile, is now on the verge of being completely destroyed by malicious actors.”
“The ease with which open AI models can be combined and distributed across countless attack tools has transformed cyberattacks, which once required advanced skills, to an era where anyone can easily carry them out,” he added, before saying that GMO Group’s cybersecurity operation “confirmed that the source of an unauthorized access attack targeting around 20 Japanese companies was the misuse of ARTEX, a standalone penetration testing tool of AI initially intended for defense. »
Kumagai believes public/private partnerships are necessary to improve information security in Japan.
“Yesterday we submitted a proposal to the government to ‘apply proactive cyber defense,'” he wrote.
“We are in no way trying to blame the government for our company’s actions and ask for a bailout,” he wrote, but he argued that unless Japan implemented defenses domestically, more such incidents would be inevitable. ®
Gn bussni
