LINE: a password list attack hit the login page of its inquiry form, and phone numbers, user identifiers and mail addresses could be obtained for 3,035 accounts

1. 2020-10-03

   From this day, there were login attempts on the login page of the LINE inquiry form. [1] [2]

2. 2021-01-19

   Internal fraud monitoring detected login attempts against a specific service. [1] [3]

3. 2021-01-21 18:40

   It reset the passwords of users whose accounts were actually logged into. [1] [3]

4. 2021-01-22

   In the evening it blocked the IP addresses thought to be the source. [1] [3]

5. 2021-01-23 10:00

   It reset passwords a second time and, in the morning, removed the phone numbers and mail addresses embedded in the form. [1] [3]

6. 2021-02-08 11:00

   Around this time it began applying two-step verification to the inquiry form and finished the same day. [2] [3]

7. 2021-02-09

   The company disclosed the case. [1] [3]

As of February 8, the company confirmed 3,035 unauthorized logins: 2,888 in Japan, 21 in Taiwan, 3 in Thailand and 123 in other countries and regions. The inquiry form embedded the phone number, user identifier and mail address in its HTML form so that inquirers could be identified, and a successful login let an attacker read them. [2] [3]

The form had no two-step verification and could be logged into with only a mail address and password. The company said it would review other services that accept LINE accounts and still lack two-step verification, and add it one by one. [1] [2] [3]