An 18-year-old white hat — a security researcher who hacks with permission — told FNN Prime Online that the attacker behind the breach at GMO Internet Group is likely in Asia, judging from the hours the intruder was active. The researcher traced the attacker by IP address but said the trail stops there.
The case has exposed how far a private investigation can go when the suspect sits outside Japan. The researcher said investigators could move quickly if law enforcement used the information, but that the case would drag on if the culprit is abroad.
GMO Internet Group president Masatoshi Kumagai held the company's first news conference since the incident on November 2. "We were unable to protect our customers, and I am truly sorry," he said.
How the intruders got in
The attackers demanded money and threatened to publish personal information every day if GMO did not comply. GMO has offered a bounty of about ¥150 million, and more than 700 tips have come in, according to the report. Theories about the culprit's identity have ranged from Osaka to North Korea.
GMO discovered in October that a service used for FX trading had been compromised, and users have reported unexplained losses. One victim said about ¥3 million disappeared in roughly four seconds after dozens of trades were repeated on the account. On October 22 the person checked the account and found trades made without authorization.
The same victim received a claim of responsibility by email from someone claiming to be the hacker. The message said the hacking team had broken in and had gone ahead because GMO would not negotiate, the victim said.
At the news conference, GMO described how the breach unfolded. On August 5 this year an attacker entered a GMO server, reached a server reserved for users by some means and took over an administrator account. On August 17 the attacker used that account to seize an FX trading server and reach users' computers, then sent in malware and made unauthorized trades on user accounts.
GMO also disclosed that a subsidiary had flagged a system vulnerability two years ago and that sufficient countermeasures were not taken. Asked about his future at the company, Kumagai said he could not leave the internet, which he described as polluted by malice, in its current state. He asked to be allowed to spend his life turning it into a tool that serves people's happiness.