Architecture Post-Mortem: How an OSS Auth Flaw Nuked 4 Availability Zones at IDCF Japan

kako1talk

Security Post-Mortem: IDC Frontier (SoftBank) published their final Report #7 on the Oct 7th cloud ransomware incident today (Oct 27 at 16:00 JST):
🔗 https://www.idcf.jp/news/topics/20261027001/?bid=gtop

The report provides rare transparency into how control-plane privilege escalation can take down physical infrastructure at scale.

Anatomy of the Attack

• Entry: Attackers leveraged an unpatched OSS vulnerability in the customer-facing Cloud Portal authentication stack.
• Lateral Movement: The breach jumped from the web layer into the internal management console, subsequently accessing virtualization backplanes.
• Execution: Storage encryption routines triggered. To halt lateral spread, IDCF physically severed storage across 4 availability zones in East Japan 1 (tesla, henry, pascal, joule).

The Impact

• 495 enterprise/government tenants suffered catastrophic volume loss, with original infrastructure declared unrecoverable.
• 206 clients had salvageable snapshots currently being extracted to replacement hardware.
• No ransom was paid, and VM storage payloads were not exfiltrated.
• Portal shutdown: Management planes across all regions were severed from the public internet. Basic hypervisor operations are currently performed manually by on-call engineers.
• Architectural Redesign: The entire management portal is being rebuilt with a decoupled third-party IdP, mandatory MFA, IP-based network filtering, and continuous SBOM automated scanning.

Key Lessons

• Hard isolation of control planes: Customer portals must never have direct lateral network paths into the underlying storage controller fabric.
• True 3-2-1 backups: If your snapshots reside on the provider's native control plane, you don't have a backup—you have shared exposure.

dbadude

Klaus Schwaab accent: 'cyberwar is zee future. We need zoo prepare!'