From our other sites
The story
Over the unauthorized access incident affecting GMO Internet’s cloud service for FX trading, Finance Minister Katayama revealed at his October 27 post-cabinet-meeting press conference that customer damage believed to be linked to GMO has also been reported by five other firms: Goldenway Japan, OANDA Securities, AvaTrade Japan, Gaitame Finest, and Dukascopy Japan. The amount of damage has not been disclosed. On 5ch, commenters raised a string of concerns about phishing techniques that slip past two-factor and biometric authentication, and about the structural flaw whereby, during 24-hour automated trading, user-side countermeasures become meaningless once the server itself is compromised.
FX Trading Unauthorized Access: Five Firms Besides GMO Report Customer Damage… Finance Minister Katayama: “We’ll Respond with a Sense of Urgency” : The Yomiuri Shimbun
Regarding the unauthorized access to GMO Internet’s cloud service for FX (foreign exchange margin) trading, Finance Minister Katayama revealed at a press conference after the cabinet meeting on the 27th that five FX brokers have reported customer damage believed to be related to GMO.
The five firms are Goldenway Japan, OANDA Securities, AvaTrade Japan, Gaitame Finest, and Dukascopy Japan. The amount of damage was not disclosed. (Omitted)
Source: yomiuri.co.jp / Original article here
What people said
Even with it enabled, it gets breached with ease. That's the root problem right there.
Normally there's authentication required for every single buy/sell order, but people use virtual desktop environments to run FX trading automatically 24/7. To make the automation work, the login session is just kept authenticated the whole time.
The operator's own servers got compromised — at that point it doesn't matter one bit what countermeasures the user has in place.
OANDA Securities
AvaTrade Japan
Gaitame Finest
Dukascopy Japan
…pretty low name recognition compared to GMO.
Honestly the only one I even recognize is 'Onanda' (a jokey mangling of OANDA's name).
There aren't many FX brokers in Japan that even support MetaTrader to begin with.
Seriously? Maybe they just never turned it on.
These days, fake sites grab the password and the 2FA code you type in and instantly use them to log into the real site — so having two-factor authentication doesn't save you if you fall for the phishing scam in the first place.
With passkeys, that fake-site problem can't happen, so you're safe unless the broker itself gets directly attacked and its servers breached.
But even with passkeys, couldn't they still pull it off by exploiting a password manager vulnerability to rip out the credentials?
How the hell would you even get past biometric authentication?
Even if the front door's locked tight, they probably got in through an open back door or side entrance.
My guess is if they can hijack the authentication system itself, they can proceed with essentially zero authentication at all.
Is it China, or Russia, or North Korea? Or are they all working together? I'd really like someone to pin down who's actually behind this first — though Japan probably can't even manage that…
The National Police Agency already named them on the 9th this month —
"Integrity Technology Group (ITG)," a China-based company tied to the Chinese government.
https://www.npa.go.jp/bureau/cyber/koho/caution/caution202610_itg.html
You guys should go check your online banking and brokerage accounts right now.
Re: #69
These are the FX brokers that got dragged in when GMO's cloud server was breached. Users were using GMO's servers to run the 24/7 automated trading their brokers permit. Since it's round-the-clock auto-trading, once the server is accessed there's no feature that stops the FX trades (the MetaTrader software they use has no setting that blocks only manual trades).
Finance Minister Katayama: "I think this is partly the result of us pushing hard to get [the request] handled with a sense of speed."
– On the FX unauthorized access:
"We'll respond with a sense of urgency."
He clearly has no idea what to actually do.
Honestly there's nothing the government can actually do about this right now lol
Laptops have had fingerprint sensors for ages now though.
Sure — if a customer doesn't even set up biometric auth and falls for a phishing email.
There's already a thread up about it.
But it's automated trading in the first place — everything's pre-approved so it can trade around the clock.
So true. My workload has shot up massively.
AI-generated videos are creepy as hell too.
Background and Key Points of This Topic
This breach appears to have spread to other firms via the FX trading cloud environment provided by GMO Internet. Because users typically run 24-hour automated trading through software like MetaTrader, their login sessions are often kept continuously authenticated — a structural weakness meaning that even when individual users set up two-factor or biometric authentication, none of it helps once the server side itself is attacked. The National Police Agency had already issued a warning on October 9 about a China-based group tied to related cyberattacks, and that official announcement was cited within the thread. While many posts in the thread focused on how the authentication gets bypassed and on the point that ‘once the server is hijacked, nothing the user does matters,’ some comments also stated the attacker’s identity as settled fact, so this article omits speculative posts whose facts could not be confirmed.
*This article is compiled from excerpts and a summary of the 5ch (News Flash+) thread “FX Trading Unauthorized Access: Five Firms Besides GMO Report Customer Damage… Finance Minister Katayama: “We’ll Respond with a Sense of Urgency”.”
Leave a Reply