Yaponiya GMO Internet Group o'zining Onamae.com Desktop Cloud xizmatiga kirgan hujumchilarning qo'lga tushishiga yordam beradigan ma'lumotlar uchun jami 1 million dollargacha mukofot taklif qilmoqda, bu esa tovlamachilik talabini rad etganidan keyin sodir bo'ldi.
Mukofot dasturi 28-oktabrda ochildi va faqat ma'lumot hibsga olish yoki xalqaro qidiruv e'loniga olib kelsa to'lanadi. Xizmat FX savdosi uchun ishlatiladigan Windows ish stollarini joylashtiradi va bir broker o'z mijozlarining ba'zi hisoblaridagi ruxsatsiz savdolarni xizmatdan sizib chiqqan login ma'lumotlari bilan bog'lagan.
GMO hujumchilar mijoz ma'lumotlarini olganini aytadi. U 21-oktabrda hujumni amalga oshirgan deb hisoblagan shaxslardan taxminan 50 million dollar (taxminan 8 milliard yen) talab olgan. Ular shuningdek, mijozlarining savdo hisoblari va ma'lumotlarini tahdid qilgan.
27-oktabrda hujumchilar o'z veb-saytlarida GMO va uning mijozlari haqidagi ma'lumot deb da'vo qilgan materialni joylashtirdilar. Saytning domeni, shu jumladan uning oyna saytlari, 28-oktabrda Yaponiya vaqti bilan taxminan soat 4:00 da yopildi va GMO har qanday yangi saytga qarshi choralar ko'rishni rejalashtirmoqda.
Mukofot qanday ishlaydi
GMO Internet Group GMO Cybercrime Bounty deb nomlangan dasturni boshqaradi va to'laydi. Ma'lumotlar maxsus veb-saytda ko'rsatilgan elektron pochta manziliga yapon, ingliz yoki xitoy tillarida yuboriladi va anonim bo'lishi mumkin. Dastur hibsga olish, xalqaro qidiruv e'loni yoki 2027-yil 27-oktabrgacha, qaysi biri avval kelsa, ochiq qoladi.
GMO hujum, tovlamachilik yoki pul harakatiga bog'liq shaxslar, serverlar, domenlar, IP manzillar, hisoblar yoki kriptovalyuta manzillarini bog'lovchi ma'lumotlarni, shuningdek jinoyatlar qanday amalga oshirilganligi haqidagi dalillarni xohlaydi. Taxminlar, asoslanmagan ayblovlar va ommaviy ma'lumotlarning qayta joylashtirilishi odatda mos kelmaydi.
Ma'lumot faqat hibsga olish, shu jumladan Yaponiya tashqarisidagi politsiya tomonidan, yoki Interpol Red Notice kabi xalqaro qidiruv e'loniga olib kelsa pul oladi. GMO har bir ma'lumot qanchalik yordam berganini hal qiladi va bitta ma'lumot beruvchi to'liq 1 million dollarni olishi yoki jami summa bo'linishi mumkin. Ma'lumot beruvchilar to'lovdan oldin o'z shaxsini isbotlashi kerak va agar hech bir ma'lumot mos kelmasa, hech qanday to'lov amalga oshirilmaydi.
Ba'zi shaxslar to'lanmaydi, shu jumladan jinoyatda ishtirok etgan har kim, ma'lumotni noqonuniy yo'l bilan olgan har kim, masalan sizib chiqqan ma'lumotni sotib olish orqali, va GMO xodimlari. GMO ma'lumot beruvchilarga tizimlarga kirish, hujumchilar bilan muzokara qilish yoki ularga pul to'lash, yoki sizib chiqqan ma'lumotlar, kirish ma'lumotlari yoki zararli dasturlarni yuborishdan qochishni aytadi.
Ma'lumotlar zarur bo'lganda Yaponiya va chet eldagi politsiya va boshqa organlarga ulashiladi. GMO allaqachon politsiyaga tahdidlar haqidagi barcha dalillarni, shu jumladan aloqa yozuvlarini bergan.
GMO hech qachon ma'lumot beruvchilardan parollar, autentifikatsiya kodlari yoki to'lovlar so'ramaydi va ularga faqat @cybercrimebounty.gmo bilan tugaydigan manzillardan yozadi.
Buzilish va savdo hisoblari
Xizmatni boshqaradigan GMO Internet sho'ba korxonasi 20-oktabrda uchinchi tomon ba'zi mijozlar serverlariga zararli dasturlar o'rnatganini aniqladi. U 21-oktabrdan boshlab har bir rejadagi serverlarni o'chirdi. U 26 739 ta serverni potentsial ta'sirlangan deb hisoblaydi, bu tasdiqlangan kirishlar yoki ma'lumot o'g'irlanishlari soni emas.
24-oktabrda GMO xizmat tizimlarida xavfsizlik muammosi, xizmatga ruxsatsiz kirish va kompaniyadan mijoz ma'lumotlarining sizib chiqishini tasdiqlaganini aytdi.
Mijozlar serverlarda saqlagan har qanday narsa ko'rilgan bo'lishi mumkin, shu jumladan MetaTrader 4 va 5 (MT4/MT5) kabi savdo dasturlarida saqlangan kirish ma'lumotlari. GMO mijozlarning to'lov kartasi ma'lumotlarini serverlarda saqlamaydi.
Mijozlar 21-oktabrdan boshlab tanimagan savdolar haqida xabar berishni boshladilar. Broker OANDA Japan uchinchi tomon GMO serverlaridan sizib chiqqan deb hisoblagan ID va parol juftliklari yordamida o'z mijozlarining ba'zi hisoblariga kirgan va savdo qilganini tasdiqladi. U ta'sirlangan bo'lishi mumkin bo'lgan hisoblarda savdoni chekladi va 26-oktabr holatiga ko'ra o'zining asosiy tizimlarida kirish yoki sizib chiqish topmagan.
Boshqa broker FXTF 22-oktabrda VPS serverlaridan foydalanadigan ba'zi mijozlarining loginlari o'g'irlangan bo'lishi mumkinligi haqida ogohlantirdi, bu hujum boshqa kompaniyaning VPS serverlariga ta'sir qilgan deb hisoblangan hujumda sodir bo'lgan. Ular shuningdek, loginlardan foydalanib kirgan va savdo qilgan bo'lishi mumkin. U Desktop Cloudga ulangan mijozlarga FXTF parollarini hech qachon unga ulanmagan qurilmadan o'zgartirishni aytdi.
GMO Internet Group 28-oktabrdagi birja faylida o'z to'lovlari qancha mijozni qamrab olishini, qancha ma'lumot e'lon qilinganini yoki qaysi savdolar kompensatsiya uchun mos kelishini hali tasdiqlamaganini aytdi. U buzilishning boshqa xizmatlariga ta'sirini hali tasdiqlamagan.
Tahdidlar va sizib chiqish
GMO hujumchilar 70 dan ortiq qimmatli qog'ozlar va FX firmalaridagi mijozlar hisoblarini manipulyatsiya qilishni davom ettirish, xizmat va mijozlar kompyuterlari haqidagi ma'lumotni e'lon qilish, ushbu kompyuterlarga ransomware bilan hujum qilish va GMO tizimlari tafsilotlarini e'lon qilish bilan tahdid qilganini aytadi.
Ular mijoz ma'lumotlarini e'lon qilish va ransomware hujumini boshlash uchun 27-oktabr tush vaqtini belgiladilar. O'sha kuni Yaponiya vaqti bilan soat 13:55 holatiga ko'ra hech qanday ransomware hujumi tasdiqlanmagan.
27-oktabrda joylashtirilgan material hujumchilar bir mijozning shaxsiy ma'lumoti deb atagan narsasi edi, deb xabar berdi ITmedia NEWS o'sha kuni tushdan keyin. GMO o'sha kuni uni tekshirayotgan edi.
GMO ma'lumotiga ko'ra, hujumchilar o'z saytiga kirgan har kim haqidagi ma'lumotni to'plagan, bu esa tashrif buyuruvchilarga to'liq antivirus tekshiruvini o'tkazishni aytadi. U odamlardan saytga yoki har qanday yangi saytga kirishdan, materialni qayta joylashtirish yoki unga havola qilishdan qochishni so'raydi.
Hujumchilar qanday kirgan
28-oktabr holatiga ko'ra GMO hujumchilar qanday kirganini aytmagan.
GMO Internet Group rahbari Masatoshi Kumagai 25-oktabr blog postida guruhning o'z oq shlyapa xakerlari xizmatni boshqaradigan jamoani oldindan muammolar haqida ogohlantirganini yozdi.
Javob yetarlicha tez ham, to'liq ham emas edi, deb yozdi u va hujumchilar bu bo'shliqdan foydalangan.
O'z veb-saytlarida hujumchilar bitta administrator hisobi barcha serverlar bo'ylab ulashilganini va mijozlar kompyuter disklari ulanishda serverlardan odatda ko'rinadiganini da'vo qildilar, deb xabar berdi ITmedia NEWS.
Ular shuningdek, xizmatdagi kamchilikdan foydalanib mijozlarning o'z kompyuterlariga yetib borishganini da'vo qildilar. GMO bu da'volarni ham ommaviy tasdiqlamagan.
26-oktabrga kelib GMO tahlil uchun taklif qilgan mijozlardan kompyuterlarni to'plagan, 27-oktabr soat 11:59 Yaponiya vaqti holatiga ko'ra u tekshirishni tugatgan kompyuterlarda hech qanday zararli dastur, shu jumladan ransomware topmagan. Bu har bir mijoz qurilmasi xavfsiz ekanligini tasdiqlamaydi va tahlil hali davom etmoqda.
Mijozlar nima qilishi kerak
GMO Desktop Cloud mijozlariga quyidagi choralarni ko'rishni aytdi:
- Savdo hisobi va savdo dasturi parollarini FX savdosi uchun ishlatilmagan qurilmadan, masalan telefondan o'zgartiring.
- Har bir kirgan sessiyani, zarur bo'lsa broker orqali, hatto parolni o'zgartirgandan keyin ham tugating.
- Savdo tarixi va balanslarini tekshiring va tanimagan savdolar haqida avval brokerga xabar bering.
- Broker taklif qilgan joyda ikki faktorli autentifikatsiyani yoqing.
- Boshqa xizmatlarda qayta ishlatilgan yoki brauzerda saqlangan parollarni o'zgartiring.
- Ulanish uchun ishlatilgan qurilmalarda to'liq antivirus tekshiruvini o'tkazing va ma'lumotlarni zaxiralang.
- Hujum ortida turgan deb da'vo qilgan har kimdan kelgan xabarlarga javob bermang yoki ularning havolalari yoki fayllarini ochmang.
- Yo'qotilgan pulni to'lov evaziga tiklash takliflarini e'tiborsiz qoldiring. GMO hech qachon parol yoki autentifikatsiya kodini so'ramaydi.
GMO Internet har bir joriy foydalanuvchiga 5000 yen to'laydi va buzilish natijasida ruxsatsiz va tasdiqlangan savdolardan kelib chiqqan haqiqiy savdo yo'qotishlari va to'lovlarini qoplaydi. Ma'lumotlari e'lon qilingan deb tasdiqlangan mijozlar har bir ochilgan ma'lumot turi uchun 10 000 dan 25 000 yengacha ham oladilar.
GMO buzilgan tizimlarda xizmatni qayta boshlamaydi. Windows ish stolini xohlagan mijozlarga alohida xizmatga o'tish taklif qilinadi, bu olti oy bepul va faqat ularning roziligi bilan, tafsilotlar 30-oktabrgacha kutilmoqda.
Japan's GMO Internet Group is offering up to $1 million in total for tips that help catch the attackers who breached its Onamae.com Desktop Cloud service, after refusing to pay an extortion demand.
The reward program opened on October 28 and pays only if a tip helps lead to an arrest or an international wanted notice. The service hosts Windows desktops used for FX trading, and a broker has linked unauthorized trades on some of its customers' accounts to logins leaked from the service.
GMO says the attackers took customer information. It received a demand for about $50 million (about ¥8 billion) on October 21 from people it believes carried out the attack. They have also threatened its customers' trading accounts and data.
On October 27, the attackers posted material on their website that they say is information about GMO and its customers. The site's domain, including its mirror sites, was shut down at about 4 a.m. Japan time on October 28, and GMO plans to act against any new site.
How the Reward Works
GMO Internet Group runs and pays for the program, called GMO Cybercrime Bounty. Tips are sent by email to an address listed on a dedicated website, in Japanese, English, or Chinese, and can be anonymous. The program is open until an arrest, an international wanted notice, or October 27, 2027, whichever comes first.
GMO wants information linking people, servers, domains, IP addresses, accounts, or cryptocurrency addresses to the attack, extortion, or movement of money, along with evidence of how the crimes were carried out. Guesses, unsupported accusations and reposts of public information generally do not qualify.
A tip earns money only if it leads to an arrest, including one by police outside Japan, or to an international wanted notice, such as an Interpol Red Notice. GMO decides how much each tip helped, and one tipster can receive the full $1 million or the total can be split. Tipsters must prove their identity before payment, and if no tip qualifies, no payment is made.
Some people cannot be paid, including anyone involved in the crime, anyone who got information illegally, such as by buying leaked data, and GMO staff. GMO tells tipsters not to break into systems, negotiate with or pay the attackers, or send leaked data, credentials, or malware.
Tips are shared with police and other authorities in Japan and abroad as needed. GMO has already given police all its evidence on the threats, including communication records.
GMO will never ask tipsters for passwords, authentication codes or fees, and it writes to them only from addresses ending in @cybercrimebounty.gmo.
The Breach and the Trading Accounts
GMO Internet, the subsidiary that runs the service, found on October 20 that a third party had installed malicious programs on some customers' servers. It shut down the servers on every plan from October 21. It counts 26,739 servers as potentially affected, which is not the number of confirmed break-ins or data thefts.
On October 24, GMO said it had confirmed a security problem in the service's systems, unauthorized access to the service, and the exfiltration of customer information from the company.
Anything customers stored on the servers may have been viewed, including login credentials saved in trading software such as MetaTrader 4 and 5 (MT4/MT5). GMO does not keep customers' payment card data on the servers.
Customers began reporting trades they did not recognize on October 21. A broker, OANDA Japan, has confirmed that a third party logged in to and traded on some of its customers' accounts using ID and password pairs it believes were leaked from the GMO servers. It has restricted trading on accounts that may be affected, and as of October 26 it had not found a break-in or leak in its own core systems.
Another broker, FXTF, warned on October 22 that third parties may have stolen the logins of some customers who use VPS servers, in an attack it believes hit another company's VPS servers. They may also have used the logins to log in and trade. It told customers who had connected to Desktop Cloud to change their FXTF passwords from a device that had never connected to it.
GMO Internet Group said in a stock exchange filing on October 28 that it had not yet confirmed how many customers its payments will cover, how much information was published, or which trades qualify for compensation. It had not confirmed any impact from the breach on its other services.
The Threats and the Leak
GMO says the attackers threatened to keep manipulating customers' accounts at more than 70 securities and FX firms, to publish information about the service and about customers' PCs, to hit those PCs with ransomware, and to publish details of GMO's systems.
They set noon on October 27 for publishing customer information and launching the ransomware attack. No ransomware attack had been confirmed as of 1:55 p.m. Japan time that day.
The material posted on October 27 was what the attackers called one customer's personal information, ITmedia NEWS reported that afternoon. GMO was checking it that day.
The attackers collected information about anyone who visited their site, according to GMO, which tells visitors to run a full antivirus scan. It asks people not to visit the site or any new one, and not to repost or link to the material.
How the Attackers Got In
As of October 28, GMO had not said how the attackers got in.
Masatoshi Kumagai, who heads GMO Internet Group, wrote in an October 25 blog post that the group's own white-hat hackers had warned the team running the service about problems in advance.
The response was neither fast nor thorough enough, he wrote, and the attackers took advantage of the gap.
On their website, the attackers claimed that one administrator account was shared across all the servers and that customers' PC drives were visible from the servers by default when they connected, ITmedia NEWS reported.
They also claimed they used a flaw in the service to reach customers' own PCs. GMO had not publicly confirmed these claims either.
By October 26, GMO had collected PCs from customers who offered them for analysis, as of 11:59 a.m. Japan time on October 27, it had found no malware, including ransomware, on the PCs it had finished checking. That does not confirm that every customer's device is safe, and the analysis is still ongoing.
What Customers Should Do
GMO has told Desktop Cloud customers to take these steps:
- Change trading-account and trading-software passwords from a device not used for FX trading, such as a phone.
- End every logged-in session, through the broker if needed, even after changing the password.
- Check trading history and balances, and report unrecognized trades to the broker first.
- Turn on two-factor authentication where the broker offers it.
- Change passwords reused on other services or saved in the browser.
- Run a full antivirus scan on devices used to connect, and back up data.
- Do not reply to messages from anyone claiming to be behind the attack, or open their links or files.
- Ignore offers to recover lost money for a fee. GMO will never ask for a password or authentication code.
GMO Internet will pay every current user ¥5,000 and cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach. Customers whose information it confirms was published will also get ¥10,000 to ¥25,000 for each type of information exposed.
GMO will not restart the service on the breached systems as they are. Customers who want a Windows desktop will be offered a move to a separate service, free for six months and only with their consent, with details due by October 30.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.