Twenty-Six Thousand Rented Servers Went Quiet in One Weekend, and the Attackers' Reach Ran to More Than Seventy Brokerages
For a few days in late October, twenty-six thousand seven hundred and thirty-nine rented Windows servers stopped doing the one thing they were paid to do. They belonged to Onamae.com Desktop Cloud, a GMO Internet product that leases virtual private servers by the month to people who need a machine that never sleeps. Retail currency traders form the natural market: the foreign-exchange market runs around the clock five days a week, humans do not, and software such as MetaTrader 4 and MetaTrader 5 will keep placing orders all night on its owner’s behalf. Doing that requires the program to store the customer’s brokerage credentials on the rented machine — login ID, password, frequently a PIN — and to read them again at every reconnect. Break into the host, and those credentials become readable at scale. The accounts under attack were not GMO’s; they belonged to customers and were held at dozens of separate brokers. An intruder sitting inside the host could therefore reach past GMO’s o...