The IT Nerd

Japanese internet provider GMO Internet warned customers to disconnect their computers and back up their data after hackers threatened to launch a ransomware attack and publish stolen customer information on October 27, according to official company advisories: https://internet.gmo/en/news/article/255/ and https://internet.gmo/en/news/article/256/.

The warning follows a cyberattack on its Onamae.com Desktop Cloud service that exposed customer information and enabled unauthorized financial transactions.

GMO confirmed that attackers exploited vulnerabilities in its remote desktop service and accessed customers’ trading accounts. The company received a ransom demand of approximately $50 million and refused to pay. It has pledged to reimburse verified losses from unauthorized transactions and provide affected customers with compensation.

In a subsequent update, GMO confirmed that attackers published information purportedly belonging to the company and its customers. The company was still verifying the material and said it had not confirmed a ransomware attack as of 1:55 p.m. Japan time on October 27. Investigators continue examining customer devices for malware.

John Strand, Owner, Black Hills Information Security:

“The GMO attack looks like one of the worst-case scenarios for a company like GMO. Right now, though, all of us have very little technical information to actually go on. GMO has been good about notifying customers and telling people to shut things down, but the rest of the security community has basically been holding its breath waiting to find out what the initial attack vector actually was.

“Was this a vulnerability in GMO’s infrastructure? Was it credential harvesting that allowed the attackers to gain access? Was it something else entirely? We honestly do not know yet.

“But when you reach the point where you’re telling customers to back up their data and then shut their computers down, that is absolutely horrific. It becomes even more concerning when you consider how many people are using this service for financial trading applications. The potential impact goes far beyond simply compromising a server.

“In that regard, I give GMO definite credit for taking responsibility and telling customers, under no uncertain terms, to shut these systems down. At the same time, there is a huge responsibility to their customers and the broader security community in Japan to release the indicators of compromise associated with this attack as quickly as possible.

“There is also concern about whether this could be connected to the AI-assisted Artex activity that has been reported in Japan. We do not have enough evidence right now to say that it is. But if that connection is established, then it is time to start pulling fire alarms everywhere.

“This is one more incident making October absolutely miserable for information security professionals around the world. There simply aren’t enough technical details available yet to draw firm conclusions. We need to watch this very closely, get the indicators of compromise out to defenders, figure out exactly how the attackers initially got in, and see where the investigation takes us.”

ㅤ

Phillip Wylie, Chief Security Evangelist, Suzu Labs:

“What stands out about the GMO Internet incident is that attackers reportedly went beyond stealing customer information and gained access to trading accounts, enabling unauthorized financial transactions. This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system.

“Attackers don’t necessarily need to deploy ransomware to cause significant damage. If they can steal sensitive information, compromise accounts, and threaten to publicly release data, they already have multiple ways to pressure an organization.

“The reported $50 million ransom demand also highlights how extortion tactics continue to evolve. Organizations need to prepare for more than traditional ransomware attacks involving encrypted files. Data theft, financial fraud, and threats of public disclosure can be just as disruptive.

“From an offensive security perspective, this is why testing systems from an attacker’s point of view is so important. Organizations need to understand not only whether a vulnerability exists, but what an attacker could accomplish by exploiting it. Remote access services are particularly attractive targets because they can provide a pathway to sensitive systems and customer environments.

“Organizations should prioritize securing remote access infrastructure, implementing multifactor authentication, monitoring for suspicious account activity, and regularly conducting penetration tests that evaluate potential attack paths.

“The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical.

“One important distinction: GMO’s October 27 update had not confirmed ransomware deployment as of 1:55 p.m. Japan time. The reported data publication and unauthorized transactions are serious developments, but they should not be presented as confirmation that ransomware was executed.”

I guess that “Black October” is the gift that keeps on giving. Which is very sad.

A ransomware attack against a SoftBank-owned cloud provider in Japan has affected 495 companies and local governments, and the impact is expanding beyond the original infrastructure outage.

JR East has now disclosed approximately 6.09 million potentially exposed customer records across its group. Nissui, which operates major U.S. seafood businesses including Gorton’s, has confirmed disruptions to its Japanese logistics subsidiary. No direct U.S. disruption has been established.

The next development to watch is which additional customers disclose incidents as investigations continue.

John Watters, Founder & CEO, iCOUNTER | Former President & COO, Mandiant Said This:

“One ransomware attack against a cloud provider in Japan has put 495 companies and local governments at risk, with JR East already reporting approximately 6.09 million potentially exposed customer records. And this story is far from over. As more organizations investigate their exposure, we should expect additional disclosures that reveal just how far a single attack can reach.

This isn’t just a Japan problem. It’s a warning to American businesses about the dependencies hiding inside their supply chains. Nissui, one of the affected organizations, has significant U.S. operations, illustrating how interconnected these ecosystems have become, even though no impact on its American operations has been confirmed.

What concerns me most is that many organizations won’t know they’re exposed until a vendor tells them. By then, critical decisions about data protection, business continuity, and recovery may already be overdue.

Every CISO should be asking three questions right now: Which of our vendors and their suppliers depend on the affected infrastructure? Is our data exposed? And what is our response plan if those services go down?

Traditional third-party risk assessments tell you whether a vendor met security requirements at a point in time. They don’t tell you when that vendor, or a supplier behind it, is actively under attack.

The next breach notification shouldn’t be the first time you discover your organization was at risk. Security teams need to identify threats across their extended ecosystem, determine what matters to their business, and act before a supplier’s incident becomes their own.”

With everything being interdependent on everything else, you’re only as secure as the guy next to you. Thus need to make sure that the guy next to you is secure to your standards and not theirs.

Japan’s nationwide J-Alert emergency warning system lacks encryption and a mechanism to authenticate the source of data transmitted via satellite, creating the potential for specially crafted fake data to trigger false emergency alerts, according to a Kyodo News report.

Yudai Kirishiki of Tokyo-based cybersecurity firm Unknown Technologies identified the issue after analyzing a J-Alert receiver previously used by a local government that was sold on the secondhand market. Testing found that the receiver could not distinguish fake information formatted like legitimate J-Alert data, demonstrating that a third party could potentially transmit a false warning.

J-Alert distributes urgent information about earthquakes, tsunamis, ballistic missile launches and other emergencies from government agencies via satellite to receivers operated by municipalities and other public organizations.

A source at Japan’s Ministry of Internal Affairs and Communications acknowledged the security issue, while an official said the government continues to work to ensure stable operation of the system.

ㅤLarry Pesce, VP of Services, Finite State:

“Two things in this J-Alert story jump out. First, the claim that satellite attacks “weren’t considered a real threat” in 2007. Brazilian pirates had been hijacking US Navy satellite transponders for decades by then, and Captain Midnight took over HBO’s satellite feed in 1986. Unauthenticated satellite traffic being spoofable was not a new idea.

“Second, and more important: the researcher got a decommissioned receiver off the secondhand market. Disposal instructions went out after the fact. Once an adversary has the hardware, “we can’t share details for security reasons” stops being a control. They can pull the firmware, reverse the protocol, and test spoofed alerts against the real parser until it works. This is supply chain and lifecycle risk in its plainest form: sensitive hardware will leave your control, so design as if it already has.

“The fix here isn’t exotic. Public alerts don’t need to be secret, they need to be signed. Receivers that verify the source would make a drone and a stolen receiver far less useful. For a system that can move an entire population, that should have been in the original design.

“Once a decommissioned receiver shows up for sale, the government’s decision not to share details ‘from a security standpoint’ stops meaning much. An attacker with the hardware in hand can extract the firmware, reverse engineer the protocol, and test fake alerts against the real thing until one works. Sensitive hardware will eventually leave your control, so you have to design as if it already has.”

“Re authentication: public emergency alerts don’t need to be secret, they need to be trustworthy. A receiver that can’t verify who sent a message will believe anyone with a transmitter. Digital signatures are a well-understood fix. Leaving them out of a system that can move an entire population was a design choice, not a technical limitation.

“The problem isn’t that J-Alert is unencrypted. It’s that it can’t tell the government’s warning from anyone else’s.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“A satellite link delivers data. It does not prove who sent it. If a receiver validates only the packet format, an attacker can impersonate the system from the ground.

“Japan’s J-Alert system exposes that gap. Kyodo reported that data sent through its satellite channel is unencrypted, and the receiver has no way to verify its source. Yudai Kirishiki of Unknown Technologies tested a receiver formerly used by a local government and found no electronic signature checks. The receiver accepted J-Alert-formatted data transmitted from an elevated location, such as a drone.

“Brazil had its own emergency-alert failure in June, when credentials tied to two Pará Civil Defense agents were used to send false alerts through the national platform to areas those accounts were not authorized to reach.

ㅤJapan and the rest of the world needs to figure this out. Unencrypted communications in 2026 are bad and need to be killed off quickly. Because this is a horrible place to be in.

The Japanese government on Tuesday urged companies to recommend telecommuting and staggered shifts for workers in a bid to curb the spread of the new coronavirus:

The plan, approved at a cabinet meeting on Tuesday, also urged people with symptoms of cold or fever to stay at home and asked event organizers to carefully consider whether to proceed with their plans. Japan has 159 cases of infections from the flu-like coronavirus, apart from 691 on a cruise ship docked south of Tokyo. On Tuesday, broadcaster NHK reported a fourth death among passengers. Rather than trying to contain the disease outright, authorities are seeking to slow its expansion and minimize deaths. Telecommuting, or working online or from home, would reduce the infection risk from people gathered in one place.

This seems like a very good idea that perhaps other countries should look at seeing as from what I am reading, the coronavirus is potentially on the cusp of being a pandemic. Assuming that companies have the technology in place, and it is secure, this should be an option for workers who are concerned about this virus. After all, these are unique times that require a unique response.