[Resolved][Severity: Major][Web app exploit]

LINE: all streamed videos of its ticketed live service LINE Face2Face were open to unauthorized access, and online handshake event videos were re-uploaded to a video sharing site

Streamed videos could be obtained without authorization, and 132 handshake event videos were uploaded to a video site. The case was announced about nine months after it was found.

Disclosed

2021-07-21

Organizations involved

Leaked or at risk

4.1K

4,133

Downtime

Unknown

What happened

2020-09-12
From this day until October 28, all videos streamed on the service were in a state that allowed unauthorized access. [1]
2020-10-17
Online handshake event videos were downloaded without authorization and uploaded to a video sharing site. The same happened on the 24th. [1]
2020-10-25
It came to light through a report from a user. [1]
2020-10-28
The videos on the video sharing site were deleted. [1]
2021-07-21
It explained that it had not announced the case in 2020 because its internal check was insufficient, and announced it. It began contacting the people concerned individually from this day. [1]

Impact

The files uploaded to the video sharing site numbered 132, involving 35 streamers and 282 users. The files that may have been obtained without authorization number up to 1,515, involving up to 100 streamers and 4,133 users. [1]

Timeline

Started 2020-09-12
Detected 2020-10-25
Disclosed 2021-07-21
312 days

Attack or cause

Method: [Web app exploit]
Impact: [Data leak]
Entry point: API

Data exposed or at risk

–

Organizations involved

[Breached][Major]Tokyo, ChiyodaInformation and communications
LY Corporation
The operator at the time was LINE Corporation.

						Note
LY Corporation	[Breached]	[Major]	Tokyo, Chiyoda	Information and communications	Unknown	The operator at the time was LINE Corporation.

Open in organization search

Sources

[1][News]ライブサービス「LINE Face2Face」に不正アクセス、オンライン握手会動画が動画共有サイトへアップロードScanNetSecurity · 2021-07-28 08:00