Japan’s GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some of its customers’ accounts to logins leaked from the service.
GMO says the attackers took customer information. It received a demand for about $50 million (about ¥8 billion) on October 21 from people it believes carried out the attack. They have also threatened its customers’ trading accounts and data.
On October 27, the attackers posted material on their website that they say is information about GMO and its customers. The site’s domain, including its mirror sites, was shut down at about 4 a.m. Japan time on October 28, and GMO plans to act against any new site.
How the Reward Works
GMO Internet Group runs and pays for the program, called GMO Cybercrime Bounty. Tips are sent by email to an address listed on a dedicated website, in Japanese, English, or Chinese, and can be anonymous. The program is open until an arrest, an international wanted notice, or October 27, 2027, whichever comes first.
GMO wants information linking people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, extortion, or movement of money, along with evidence of how the crimes were carried out. Guesses, unsupported accusations and reposts of public information generally do not qualify.
A tip earns money only if it leads to an arrest, including one by police outside Japan, or to an international wanted notice, such as an Interpol Red Notice. GMO decides how much each tip helped, and one tipster can receive the full $1 million or the total can be split. Tipsters must prove their identity before payment, and if no tip qualifies, no payment is made.
Some people cannot be paid, including anyone involved in the crime, anyone who got information illegally, such as by buying leaked data, and GMO staff. GMO tells tipsters not to break into systems, negotiate with or pay the attackers, or send leaked data, credentials, or malware.
Tips are shared with police and other authorities in Japan and abroad as needed. GMO has already given police all its evidence on the threats, including communication records.
GMO will never ask tipsters for passwords, authentication codes or fees, and it writes to them only from addresses ending in @cybercrimebounty.gmo.
The Breach and the Trading Accounts
GMO Internet, the subsidiary that runs the service, found on October 20 that a third party had installed malicious programs on some customers’ servers. It shut down the servers on every plan from October 21. It counts 26,739 servers as potentially affected, which is not the number of confirmed break-ins or data thefts.
On October 24, GMO said it had confirmed a security problem in the service’s systems, unauthorized access to the service, and the exfiltration of customer information from the company.
Anything customers stored on the servers may have been viewed, including login credentials saved in trading software such as MetaTrader 4 and 5 (MT4/MT5). GMO does not keep customers’ payment card data on the servers.
Customers began reporting trades they did not recognize on October 21. A broker, OANDA Japan, has confirmed that a third party logged in to and traded on some of its customers’ accounts using ID and password pairs it believes were leaked from the GMO servers. It has restricted trading on accounts that may be affected, and as of October 26 it had not found a break-in or leak in its own core systems.
Another broker, FXTF, warned on October 22 that third parties may have stolen the logins of some customers who use VPS servers, in an attack it believes hit another company’s VPS servers. They may also have used the logins to log in and trade. It told customers who had connected to Desktop Cloud to change their FXTF passwords from a device that had never connected to it.
GMO Internet Group said in a stock exchange filing on October 28 that it had not yet confirmed how many customers its payments will cover, how much information was published, or which trades qualify for compensation. It had not confirmed any impact from the breach on its other services.
The Threats and the Leak
GMO says the attackers threatened to keep manipulating customers’ accounts at more than 70 securities and FX firms, to publish information about the service and about customers’ PCs, to hit those PCs with ransomware, and to publish details of GMO’s systems.
They set noon on October 27 for publishing customer information and launching the ransomware attack. No ransomware attack had been confirmed as of 1:55 p.m. Japan time that day.
The material posted on October 27 was what the attackers called one customer’s personal information, ITmedia NEWS reported that afternoon. GMO was checking it that day.
The attackers collected information about anyone who visited their site, according to GMO, which tells visitors to run a full antivirus scan. It asks people not to visit the site or any new one, and not to repost or link to the material.
How the Attackers Got In
As of October 28, GMO had not said how the attackers got in.
Masatoshi Kumagai, who heads GMO Internet Group, wrote in an October 25 blog post that the group’s own white-hat hackers had warned the team running the service about problems in advance.
The response was neither fast nor thorough enough, he wrote, and the attackers took advantage of the gap.
On their website, the attackers claimed that one administrator account was shared across all the servers and that customers’ PC drives were visible from the servers by default when they connected, ITmedia NEWS reported.
They also claimed they used a flaw in the service to reach customers’ own PCs. GMO had not publicly confirmed these claims either.
By October 26, GMO had collected PCs from customers who offered them for analysis, as of 11:59 a.m. Japan time on October 27, it had found no malware, including ransomware, on the PCs it had finished checking. That does not confirm that every customer’s device is safe, and the analysis is still ongoing.
What Customers Should Do
GMO has told Desktop Cloud customers to take these steps:
- Change trading-account and trading-software passwords from a device not used for FX trading, such as a phone.
- End every logged-in session, through the broker if needed, even after changing the password.
- Check trading history and balances, and report unrecognized trades to the broker first.
- Turn on two-factor authentication where the broker offers it.
- Change passwords reused on other services or saved in the browser.
- Run a full antivirus scan on devices used to connect, and back up data.
- Do not reply to messages from anyone claiming to be behind the attack, or open their links or files.
- Ignore offers to recover lost money for a fee. GMO will never ask for a password or authentication code.
GMO Internet will pay every current user ¥5,000 and cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach. Customers whose information it confirms was published will also get ¥10,000 to ¥25,000 for each type of information exposed.
GMO will not restart the service on the breached systems as they are. Customers who want a Windows desktop will be offered a move to a separate service, free for six months and only with their consent, with details due by October 30.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.