Science & Tech · Cybersecurity · 1 hr ago
IDCF Cloud attack exploited open-source flaw; no server data was found leaked
IDCF Frontier says attackers exploited a flaw in open-source software used by IDCF Cloud’s customer portal to break into the service.
They used the portal to reach management systems, gain administrator access and stop and encrypt customer virtual servers.
The attack affected 495 companies and local governments, and IDCF says restoring the servers in their previous state is difficult.
The company found no evidence that data stored on the virtual servers was taken, but registration information for up to 71 customers was improperly viewed; some records included personal details, and up to four passwords were changed and reset.
IDCF says backup data can be retrieved for 206 customers, up from an earlier figure of 194.
To prevent another attack, it plans to centrally track software components, check them automatically for known vulnerabilities and expand security testing to open-source software.
IDCF is rebuilding the portal with a new identity provider, restricted access and required multi-factor authentication, then plans to restore customer access in stages after confirming it is safe; no reopening date was given.
IDCF Frontier said an open-source software vulnerability in the IDCF Cloud Portal’s authentication system was exploited to gain access to the service.
The attack disrupted and encrypted virtual servers affecting 495 companies and municipalities.
The company said it found no evidence that data stored on virtual servers had been leaked.
Information belonging to as many as 71 customers was improperly queried through the portal.
IDCF Frontier plans to rebuild the portal and introduce measures including software component tracking and stronger authentication.
- Who
- IDCF Frontier, the provider of IDCF Cloud, disclosed the findings.
- What
- Attackers exploited an open-source software vulnerability in the cloud portal’s authentication system, then gained unauthorized administrator access and encrypted virtual servers.
- When
- IDCF Frontier detected the incident in the early hours of October 7 and announced its findings on October 27.
- Where
- The attack affected four zones in the East Japan Region 1 of IDCF Cloud. The compromised entry point was the IDCF Cloud Portal.
- Why
- Attackers exploited a vulnerability in open-source software used by the portal’s authentication system.
This story does not have two clearly opposing sides.
IDCF Frontier detected the disruption and stopped the portal in East Japan Region 1, including the four affected zones.
The company also stopped the portal in other regions and disconnected the portals in all regions from external networks.
IDCF Frontier announced that attackers had exploited an open-source software vulnerability and said its investigation found no evidence of virtual-server data being leaked.
- Affected organizations
- 495 companies and municipalities
- Customers’ registration information queried
- Up to 71 customers
- Customer records potentially including personal names
- Up to 31
- Virtual-server data leakage
- No evidence found
- Backups retrievable
- 206 customers
- Portal security changes
- External identity provider, customer-IP restrictions and mandatory multi-factor authentication
What people are saying
We plan to resume the service after sufficiently confirming its safety.