The part of Japan’s Active Cyber Defense law that lets police and the Self-Defense Forces get into attackers’ servers and disable them has been in effect for a little over three weeks, and GMO Internet already wants it used on its behalf. The Tokyo internet infrastructure company said Saturday, Tokyo time, that it had sent the government an urgent request to apply “Active Cyber Defense” against whoever broke into Onamae.com Desktop Cloud, a hosted Windows desktop service that NHK described as used by investors for foreign exchange trading.
GMO framed the case as a “first case of ‘activation'” for the law in its English disclosure to investors. Its argument rests on what happened after the break-in. Customers have reported trades in their brokerage and FX accounts that they didn’t make, and logins saved in trading tools such as MT4 and MT5 may have been lifted from the hosted machines, which GMO says puts the attack beyond ordinary encryption or data theft. “It is difficult for a private business operator alone, through defense and post-incident response alone, to eradicate the plundering of citizens’ assets by sophisticated cybercriminal groups operating across national borders,” the company wrote.
It started with one customer’s question
A customer inquiry on Monday started the investigation. By Tuesday GMO had found a malicious program installed in some customers’ server environments, and early Wednesday Tokyo time it began shutting down every plan. Its first notice put the number of servers that could be affected at 26,739. After customers reported unauthorized operations in their trading accounts, a second report on Thursday said passwords for trading tools and accounts used on those machines may have been viewed by a third party, and told users to change them from a different device.
The company now says its own system had a security problem and that customer information left its environment. Someone believed to be the attacker has demanded money, GMO said. If it isn’t paid, the sender threatened to keep manipulating customer accounts held at more than 70 securities and FX firms in Japan and abroad, to publish information about GMO and its customers, and to launch a ransomware attack. GMO won’t pay, and it has handed the threat messages to the police’s cybercrime unit.
The service is not coming back on its old infrastructure. Customers who still want a Windows desktop will be offered a replacement on an independent cloud platform, free for six months. Every current user will get a flat 5,000 yen, and GMO will cover realized trading losses from orders it confirms were unauthorized, though not market swings or lost profits. It said it can’t yet estimate the cost.
Tokyo says the law doesn’t take requests
Government officials pushed back the same day. There’s no mechanism for accepting requests from individual companies, an official at the National Cybersecurity Office told the Nikkei, while a senior official said Tokyo would support GMO’s defense but still had to analyze the attack before knowing whether it would lead to neutralization. Another senior official handling cyber policy told the paper the law covers serious cases such as national security threats and that the situation doesn’t yet call for using it. Another official told the Yomiuri Shimbun the request had no legal basis. The powers are meant to catch the signs of an attack and head off damage in advance, the paper said, and a second official said they mean little once the damage is done. As a rule, the government won’t say case by case whether it used them. Neutralization also generally needs prior approval from an independent oversight commission, and a separate provision letting the government collect communications data without company consent isn’t due to take effect until fall 2027, according to the Nikkei.
Keio University professor Motohiro Tsuchiya told the Nikkei the request doesn’t match the kind of neutralization the system was designed for. The aim is for the government to identify attackers and head off attacks itself, he said, not to respond to companies’ requests.
The breach adds to a run of Japanese incidents this fall that had the National Cybersecurity Office telling ministries to warn companies earlier this month. For Desktop Cloud customers, the next date to watch is Oct. 30, when GMO has promised to email details on the goodwill payment and the replacement service.
from WebProNews https://ift.tt/Z2FlGUE
No comments:
Post a Comment