GMO Internet: a flaw in Onamae.com Navi let attackers rewrite the domain settings of Coincheck and bitbank

The attacker used an account ID and a flaw in the Onamae.com Navi management tool that let its traffic be tampered with to change the registered email address. With that address the attacker reset the password, logged in and rewrote the domain records. [1] [3] [10]

1. 2020-05-27 01:55

   The records of bitcoinbank.co.jp, the domain of bitbank's corporate site, were rewritten. [6]

2. 2020-05-29 20:40

   bitbank recovered the account and fixed the records. [6] [9]

3. 2020-05-31 00:05

   Changes to the domain records in Coincheck's account began. [5]

4. 2020-06-01 12:00

   Coincheck's monitoring noticed slow responses, and it began to investigate. [5]

5. 2020-06-01 19:10

   Coincheck confirmed that a third party had changed the records. [5]

6. 2020-06-01 19:36

   Coincheck asked GMO Internet for help. [5]

7. 2020-06-01 20:52

   GMO Internet fixed the records. [5] [11]

8. 2020-06-01 22:00

   Coincheck found that some customer inquiry mail could have been received by the third party. [5]

9. 2020-06-02

   Coincheck disclosed the incident and stopped crypto asset transfers. GMO Internet fixed the flaw. [1] [4]

10. 2020-06-03

    GMO Internet published an outline of the flaw and told bitbank about it. Coincheck began moving its domain to another registrar. [1] [5] [6]

11. 2020-06-04

    Coincheck issued its final report and widened the count to about 300 customers. It finished the move and resumed transfers. bitbank also disclosed its case. [3] [6] [8]

At Coincheck, mail from about 200 customers who wrote between about 00:05 on May 31 and 20:52 on June 1, and about 100 who wrote just before, about 300 people in all, may have been taken. Besides addresses and message text, it may include names, registered addresses, birth dates, phone numbers and selfies holding ID documents. [3] [5]

At bitbank only the corporate site domain was changed. The exchange at bitbank.cc and customer support mail use other domains, so customer assets and data were not affected. GMO Internet said no other customers were affected. [1] [6]

Coincheck moved its domain to another registrar and asked customers not to write to its old support address. [5] [8]