日本互联网服务提供商 GMO Internet 警告客户，其作为理想外汇交易环境推出的云桌面服务遭到攻击者入侵，且公司在提升该服务安全性方面行动迟缓。GMO 运营一项名为“Onamae.com Desktop Cloud”（Onamae.com 桌面云）的服务，上周承认“第三方在部分客户的服务器环境中安装了恶意程序”。这本身就是坏消息，但后果尤为严重，因为这些服务器托管的是云端 Windows 桌面，而 GMO 推荐客户用其运行外汇交易应用程序。
Japanese ISP GMO Internet has warned customers the cloudy desktop service it offers as an ideal foreign exchange trading environment was compromised by an attacker, and that it had been slow to improve the service's security. GMO runs a service called Onamae.com Desktop Cloud and last week admitted “a third party had installed malicious programs in the server environments of some customers.”That’s never welcome news but is an especially poor outcome because the servers host cloudy Windows desktops that GMO recommends customers use to host foreign exchange trading applications.
在后续更新中，公司透露部分客户报告“其交易账户上发生了未经授权的操作”，并建议第三方很可能已窃取用户的交易服务密码。第二天，公司建议用户立即更改交易账户密码，并使用不用于交易的设备进行操作。此后公司承认，其 Onamae.com 桌面云服务“系统存在安全漏洞，其环境遭到未经授权的访问，且客户信息被带出公司外部”。
In later updates the company revealed that some customers reported “unauthorized operations were performed on their trading accounts” and advised that third parties had probably seen users’ passwords for trading services. The next day, the company advised users to immediately change passwords for their trading accounts, and to do so using a device that they don’t use for trading. The company has since admitted that its Onamae.com Desktop Cloud service’s “systems had security vulnerabilities, that its environment was accessed without authorization, and that customer information was taken outside the Company.”
“部分客户还报告其交易账户中出现了无法识别的交易。”这些交易令 GMO 十分担忧，促使其联系主要交易服务商，要求其强制终止所有活跃会话、监控未经授权的交易，并阻止来自 Onamae.com 桌面云的交易请求。不支付赎金，或提出投诉GMO 表示，已“收到一名被认为是攻击者的人提出的金钱要求。我们还被告知，如果我们拒绝，攻击者将采取公开公司及客户信息等行动。”攻击者索要 5000 万美元。
“Some customers have also reported transactions in their trading accounts that they do not recognize.”Those transactions have GMO sufficiently worried that it contacted major trading services, asked them to forcibly terminate all active sessions, monitor for unauthorized transactions, and to block trade requests coming from the Onamae.com Desktop Cloud. Not paying, or complaining GMO said it has “received a demand for money from a person believed to be the attacker. We have also been told that, if we refuse, the attacker will take actions such as publishing information about the Company and our customers.”The attacker wants $50 million.
该公司拒绝支付赎金，因为它认为“遵从要求并不能保证所获取的信息会被删除，也无法防止其被滥用”。调查仍在继续，GMO 警告称，可能有 26,739 台 VDI 服务器遭到攻击，用户的个人设备也可能面临风险。公司向所有用户提供 5,000 日元（约合 32 美元）的慰问金，并承诺赔偿因攻击导致的任何交易损失。此次事件的影响范围可能相当大，因为 GMO 警告称，某些交易应用程序可能会在密码更改后仍保持会话处于活动状态。
The company won’t pay because it feels “complying would not guarantee that the obtained information is deleted or that its misuse is prevented.”Investigations into the incident continue, with GMO warning that 26,739 VDI servers may have been hit by the attack, and that users’ personal devices may be at risk. The company is offering all users a ¥5,000 ($32) condolence payment and promised to make good on any trading losses caused by the attack. This incident may have quite a blast radius, as GMO has warned that some trading apps may keep sessions alive even after passwords change.
“请查看您的证券公司或外汇公司的指引或您的账户页面，断开所有活动会话，或要求公司的支持部门为您断开会话，”GMO 建议道。那 5,000 日元远不足以覆盖客户为解决此事所付出的精力。GMO 首席执行官熊谷正寿在一篇博客文章中承认了这一点，他将这笔款项描述为“向经历不便和担忧的客户表达的最初诚意”。他补充道：“我们将投入集团全部资源，提供为期六个月的免费替代环境，从根本上彻底改造系统基础设施，并在外部专家的协助下，彻查原因并防止再次发生。”
“Check your securities or FX company's guidance or your account page, and either disconnect all active sessions or ask the company's support desk to disconnect them,” GMO advised. That ¥5,000 isn’t going to get anywhere near paying for the work customers will do to sort this out. GMO CEO Masatoshi Kumagai acknowledged that in a blog post in which he described the payment as “a token of our initial sincerity towards our customers who have experienced inconvenience and worry.”“We will dedicate the full resources of our group to providing a free alternative environment for six months, fundamentally overhauling our system infrastructure, and conducting a thorough investigation into the cause and preventing recurrence with the help of external experts,” he added.
但他也承认，GMO 早知该服务的安全性有待提高。“我们内部的白帽黑客此前曾向团队指出了需改进之处，”他写道。“团队铭记在心，并正在着手应对措施。”他表示：“然而，在我们谨慎推进、考虑对服务可用性的影响并优先处理其他问题的过程中，我们的应对缺乏足够的深度和速度，导致攻击者得以利用该漏洞。”
But he also admitted that GMO knew the service’s security could be improved. “Our in-house white-hat hackers had previously pointed out areas for improvement to the team,” he wrote. “The team took these points to heart and was working on countermeasures.”“However, while we proceeded cautiously, considering the impact on service availability and prioritizing other issues, our response lacked sufficient depth and speed, allowing the attackers to exploit the vulnerability. I deeply regret that, despite having professionals on staff, we failed to fully translate their expertise into effective defenses as an organization.”
我深感遗憾的是，尽管公司内部有专业人员，但我们未能将他们的专业知识充分转化为组织层面的有效防御。该首席执行官还表示，GMO 没有政府帮助无法保障自身安全。“我在这个行业已有31年，从互联网行业的黎明期开始，”他写道。“我和同事们共同构建的、本应让人们露出笑容的网络空间，如今正面临被恶意行为者彻底摧毁的边缘。”
The CEO also said GMO can’t secure itself without government help. “I've been involved in this world for 31 years, since the dawn of the internet industry,” he wrote. “The cyberspace that I built with my colleagues, believing it would bring smiles to people's faces, is now on the verge of being completely destroyed by malicious actors.”
他补充道，“开放权重AI模型可以轻易组合并传播为无数攻击工具，这使得曾经需要高超技能的网络攻击，变成了任何人都能轻易实施的时代。”随后他声称，GMO集团的网络安全运营“已确认，针对约20家日本公司的未经授权的访问攻击源头，是滥用‘ARTEX’——一种原本用于防御的自主AI渗透测试工具。”熊谷认为，需要公私合作伙伴关系来提升日本整体的信息安全。
“The ease with which open weight AI models can be combined and spread into countless attack tools has transformed cyberattacks, which once required advanced skills, into an era where anyone can easily carry them out,” he added, before claiming that GMO Group’s cybersecurity operation “has confirmed that the source of an unauthorized access attack targeting approximately 20 Japanese companies was the misuse of ‘ARTEX,’ an autonomous AI penetration testing tool originally intended for defense.”Kumagai thinks public/private partnerships are needed to improve infosec across Japan.
“昨天，我们向政府提交了一份关于‘实施主动网络防御’的建议书，”他写道。“我们绝非试图将公司行为的责任推卸给政府并寻求救助，”他写道，但他主张，除非日本实施国家级防御，否则此类事件将不可避免地增多。®
“Yesterday, we submitted a proposal to the government to ‘apply proactive cyber defense,’” he wrote. “We are by no means trying to shift the blame for our company's actions onto the government and beg for a bailout,” he wrote, but argued that unless Japan implements national-level defenses, more such incidents are unavoidable. ®