Mark Karpelès, the former CEO of Mt. Gox, the bitcoin exchange that collapsed in 2014, says GMO Internet has turned the investigation of a major breach into a circus, warning that public claims of progress may push the attacker into silence.
GMO Internet's president, Masakazu Kumagai, 63, held a press conference on November 2 to explain the breach. Karpelès, 41, examined the known facts and the attacker's profile in an article for Daily Shincho.
The target was a cloud service for foreign-exchange trading offered by GMO Internet through its Onamae.com domain service. According to the attacker's own account, the intruder first rented a server as an ordinary user and entered GMO's service from there.
How the intrusion unfolded
At the November 2 press conference, GMO said the attacker broke into a customer's remote-desktop server on August 5. The attacker then stole an administrator account and used it to enter GMO's management server on August 17.
Between September 20 and October 14, the attacker used that management server to distribute malicious programs to as many as 26,739 customer servers. GMO noticed on October 20, the day after a customer inquiry.
GMO had configured the service so that the contents of a user's computer could be viewed from the server side when the user connected. The attacker posed as an administrator and exploited that setting, taking information from inside customers' computers.
On October 27, the attacker posted what was said to be one person's personal data on an extortion site. The same day, the attacker claimed to be under a distributed denial-of-service attack, in which a flood of traffic is sent to knock a site offline, and the site briefly went dark.
An identical site then appeared on the dark web, the heavily anonymized part of the internet that ordinary search engines do not index. It closed a few hours later, and the reason is not known.
During those hours, the attacker left a trace. The server was misconfigured, leaving the site's information exposed, and Karpelès said his analysis turned up connection logs. Those logs may include the attacker's own connections, though every entry looks the same and cannot be tied to an individual. Dark-web logs do not show IP addresses either, so reaching the culprit that way is difficult.
The misconfiguration may still reveal the attacker's online habits. Karpelès said the attacker appears to have been careless when setting up the site.
Clues that point everywhere
The Japanese on the extortion site is fluent in places and unnatural in others. An Excel-format file the attacker left on the site was created with Chinese software, and a threatening email used a name common in Russia.
Those details have fed theories that the attacker is Japanese, Chinese or Russian. Karpelès argues each can be faked. The attacker may have deliberately hinted at Chinese or Russian involvement to steer suspicion, and evidence that looks too convenient is itself suspicious.
The attacker's own account, meanwhile, says the intrusion began by renting an ordinary server and working inward, a method that leaves little that points decisively to one culprit.
A bounty and a claim of "powerful information"
On October 29, before the press conference, Kumagai said on social media that he had obtained "powerful information that could lead to the culprit's identification" and would give it to police. GMO has offered a $1 million bounty.
Reports say the attacker's extortion site on the ordinary web, rather than the dark web, left users' IP addresses exposed. Karpelès believes the "powerful information" probably refers to those addresses.
Attention has focused on an address recorded just after the site was set up, which may well be the attacker's connection. The address appears to belong to a commercial VPN, a virtual private network that hides where a connection comes from, and many people use the same service at once. Finding the address's owner would not solve the case.
Karpelès calls it hasty to treat the IP addresses as "powerful information." Such posts can also obstruct the police investigation, whatever the poster intends.
If the attacker does not realize the investigation is advancing, the attacker is more likely to act again and make a mistake. As things stand, the attacker may instead fear that the information has reached investigators and stop moving altogether.
“GMO is turning the investigation into a circus-like spectacle with its $1 million bounty and flashy announcements.”Mark Karpelès, former CEO of Mt. Gox
What GMO should disclose
At the November 2 press conference, GMO explained only the dates of the intrusion and the broad sequence of events. It withheld how the attacker obtained administrator privileges, citing the risk of inviting a similar attack.
Karpelès says a company hit by a serious breach should give customers an objective account of what happened. It should also set out its own response and what customers should do.
That means publishing how the intrusion was carried out and why security measures stayed inadequate after problems were flagged. GMO should also show customers clearly that the service they are migrating to will not repeat the same failure.
Such technical, patient measures draw little public attention, Karpelès writes, but they are what is needed now. He hopes the case becomes a chance for Japan to catch up with international security standards rather than a show.