CasesS=1:500S=1:100
Port of Nagoya ransomware attack: the way in and timeline
The unauthorized access is believed to have come through a remote connection device with a confirmed vulnerability.
1 Summary
At about 06:30 on July 4, 2023, the terminal system that runs all container terminals at the Port of Nagoya stopped. An hour later the system printer printed a ransom note. Every NUTS server in the data center had been encrypted. Terminals resumed work at 18:15 on July 6. The association reported that the access is believed to have come through a remote connection device with a confirmed vulnerability. A government committee later wrote that it is "appropriate" to regard the maintenance VPN appliance as the route, while stating it could not conclude definitively.
Probable cause: The unauthorized access is believed to have come through a remote connection device with a confirmed vulnerability.
Source: Nagoya Harbor Transportation Association 「NUTS システム障害の経緯報告」 (pp.1–2)
The association said only "remote connection device". The MLIT committee wrote that it is "appropriate" to regard the maintenance VPN device as the route, but could not conclude definitively because the logs were encrypted, and it also listed USB media and the network link with port transport operators as candidates.
S=1:100 2 Factual information
2.1 The way in
The association: "a vulnerability has been confirmed in a remote connection device, and the unauthorized access is believed to have come from there."
Source: Nagoya Harbor Transportation Association 「NUTS システム障害の経緯報告」 (pp.1–2)
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
The physical server base and all virtual servers in the data center were encrypted. Malware was also detected in the backup data, which pushed recovery back by a day. The ransom note named no amount and the association did not contact the attacker. No sign of data leaking outside was found.
2.3 Damage
All terminals at the Port of Nagoya stopped from about 06:30 on July 4 until 18:15 on July 6, and container gate-in and gate-out stopped for about three days.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| c. 2023-07-04 06:30 | Terminal operators | NUTS stops working. | Nagoya Harbor Transportation Association |
| c. 2023-07-04 07:15 | Association | Asks the maintenance and development companies to restore the system. | Nagoya Harbor Transportation Association |
| c. 2023-07-04 07:30 | Intruder | Ransom note prints on the system printer. | Nagoya Harbor Transportation Association |
| c. 2023-07-04 09:00 | Association | Reports to Aichi Prefectural Police. | Nagoya Harbor Transportation Association |
| c. 2023-07-04 14:00 | Association | Finds the physical server base and all virtual servers encrypted. | Nagoya Harbor Transportation Association |
| c. 2023-07-05 12:00 | Association | Press release: ransomware infection. | Nagoya Harbor Transportation Association |
| c. 2023-07-05 21:00 | Association | Malware detected in the backup data; recovery slips to the next day. | Nagoya Harbor Transportation Association |
| c. 2023-07-06 07:15 | Association | Backup restored; a network fault follows. | Nagoya Harbor Transportation Association |
| 2023-07-06 18:15 | Terminal operators | Work resumes at all terminals. | Nagoya Harbor Transportation Association |
| 2023-07-26 | Association | Written account published. | Nagoya Harbor Transportation Association |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| The maintenance VPN had no source-IP restriction, so anyone on the internet could connect if the ID and password matched. | Stated | Ministry of Land, Infrastructure, Transport and Tourism |
| The VPN appliance's logs were not being collected. | Stated | Ministry of Land, Infrastructure, Transport and Tourism |
| The MLIT committee's reading: "it is appropriate to regard the intrusion as having come through the VPN device." The logs that could prove it were encrypted, so this is the committee's reading, not a finding. | Presumed | Ministry of Land, Infrastructure, Transport and Tourism |
| When the attacker first got in. | Unknown | Nagoya Harbor Transportation Association |
S=1:100 4 Conclusions
The association reported that the access is believed to have come through a remote connection device with a confirmed vulnerability, and that every NUTS server was encrypted. The MLIT committee wrote that it is "appropriate" to regard the maintenance VPN appliance as the route, without concluding definitively, and listed the missing IP restriction and the uncollected VPN logs as problems.
S=1:100 5 Recommendations
Recommended or carried out by: MLIT committee
- Limit who can connect by specifying source IP addresses.
- Require more than one authentication factor; where passwords are used, make them complex, 12 or more characters.
- Implement account lockout.
- Detect unauthorized login attempts, such as access from an unusual IP address.
- Check the software on network devices regularly and keep it updated.
- Collect network-device logs regularly and back them up outside the system.
- Replace a network device with a new one after it has been attacked.
Source: Ministry of Land, Infrastructure, Transport and Tourism 「コンテナターミナルにおける情報セキュリティ対策等検討委員会 中間取りまとめ① 名古屋港のコンテナターミナルにおけるシステム障害を踏まえ緊急に実施すべき対応策について（案）」 (pp.1, 3–4, 7–8)
Sources
Source: Nagoya Harbor Transportation Association 「NUTS システム障害の経緯報告」 (pp.1–2)Ministry of Land, Infrastructure, Transport and Tourism 「コンテナターミナルにおける情報セキュリティ対策等検討委員会 中間取りまとめ① 名古屋港のコンテナターミナルにおけるシステム障害を踏まえ緊急に実施すべき対応策について（案）」 (pp.1, 3–4, 7–8)