Japanese virtual desktop cloud hacked so hard it asks to be banned
Japanese internet provider GMO Internet has admitted that security weaknesses in its Onamae.com Desktop Cloud service allowed attackers to gain unauthorised access and remove custo
By The Register
Japanese internet provider GMO Internet has admitted that security weaknesses in its Onamae.com Desktop Cloud service allowed attackers to gain unauthorised access and remove customer information from the company’s systems.
The cloud-based service provides remote Windows environments and is used by some customers to run foreign exchange trading tools. GMO said the incident also led to unauthorised activity involving trading accounts connected to more than 70 securities and foreign exchange firms.
The company confirmed on 20 October that malicious software had been installed in some customer server environments. It suspended new applications and access to the service’s control panel before shutting down all servers the following day.
The incident potentially affected 26,739 servers. Customers were advised to change passwords for trading tools and accounts, enable two-factor authentication and end active sessions.
GMO Group chief executive Masatoshi Kumagai apologised for the breach in a blog post on 25 October. He said internal security specialists had previously identified issues that needed improvement, but the company’s response had not been sufficiently thorough or quick, allowing attackers to exploit the gap.
GMO said it would pay a ¥5,000 goodwill payment to each active user of the affected service. It also said it would compensate confirmed losses from fraudulent trades where those losses were shown to have resulted from the unauthorised access.
The company’s investigation into the route used by the attackers and the full extent of the impact was continuing with the help of security specialists. The service remained suspended, with no reopening date confirmed.