Japanese virtual desktop cloud hacked so hard it asks to be banned

Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service's security.

GMO runs a service called Onamae.com Desktop Cloud and last week admitted “a third party had installed malicious programs in the server environments of some customers.” That’s never welcome news but is an especially poor outcome because the servers host cloudy Windows desktops that GMO recommends customers use to host foreign exchange trading applications.

In later updates the company revealed that some customers reported “unauthorized operations were performed on their trading accounts” and advised that third parties had probably seen users’ passwords for trading services.

The next day, the company advised users to immediately change passwords for their trading accounts, and to do so using a device that they don’t use for trading.

The company has since admitted that its Onamae.com Desktop Cloud service’s “systems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company.”

“Some customers have also reported transactions in their trading accounts that they do not recognize.”

Those transactions have GMO sufficiently worried that it contacted major trading services, asked them to forcibly terminate all active sessions, monitor for unauthorized transactions, and to block trade requests coming from the Onamae.com Desktop Cloud.

Not paying, or complaining

GMO said it has “received a demand for money from a person believed to be the attacker. We have also been told that, if we refuse, the attacker will take actions such as publishing information about the Company and our customers.”

The attacker wants $50 million.

The company won’t pay because it feels “complying would not guarantee that the obtained information is deleted or that its misuse is prevented.”

Investigations into the incident continue, with GMO warning that 26,739 VDI servers may have been hit by the attack, and that users’ personal devices may be at risk.

The company is offering all users a ¥5,000 ($32) condolence payment and promised to make good on any trading losses caused by the attack.

This incident may have quite a blast radius, as GMO has warned that some trading apps may keep sessions alive even after passwords change. “Check your securities or FX company's guidance or your account page, and either disconnect all active sessions or ask the company's support desk to disconnect them,” GMO advised.

That ¥5,000 isn’t going to get anywhere near paying for the work customers will do to sort this out.

GMO CEO Masatoshi Kumagai acknowledged that in a blog post in which he described the payment as “a token of our initial sincerity towards our customers who have experienced inconvenience and worry.”

“We will dedicate the full resources of our group to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, and conducting a thorough investigation into the cause and preventing recurrence with the help of external experts,” he added.

But he also admitted that GMO knew the service’s security could be improved.

“Our in-house white-hat hackers had previously pointed out areas for improvement to the team,” he wrote. “The team took these points to heart and was working on countermeasures.”

“However, while we proceeded cautiously, considering the impact on service availability and prioritizing other issues, our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability. I deeply regret that, despite having professionals on staff, we failed to fully translate their expertise into effective defenses as an organization.”

The CEO also said GMO can’t secure itself without government help.

“I've been involved in this world for 31 years, since the dawn of the internet industry,” he wrote. “The cyberspace that I built with my colleagues, believing it would bring smiles to people's faces, is now on the verge of being completely destroyed by malicious actors.”

“The ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out,” he added, before claiming that GMO Group’s cybersecurity operation “has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of ‘ARTEX,’ an autonomous AI penetration testing tool originally intended for defense.”

Kumagai thinks public/private partnerships are needed to improve infosec across Japan.

“Yesterday, we submitted a proposal to the government to ‘apply proactive cyber defense,’” he wrote.

“We are by no means trying to shift the blame for our company's actions onto the government and beg for a bailout,” he wrote, but argued that unless Japan implements national-level defenses, more such incidents are unavoidable. ®