nimoca: unauthorized access to the public usage-history service

Cause and mitigation hypotheses

These are editorial hypotheses, separate from established causes and reported responses. Supporting and challenging observations are checks to investigate, not collected evidence.

1. Cause hypothesis 1 Unverified

   Abuse of the legitimate input and notification function is a candidate mechanism.

   Primary-source starting point

   The service sent unexpected emails to registered recipients in response to defined input.

   [s1]p.1 §2 概要

   Read assumptions, observations, and limits

   Required assumptions

   • The attacker reached the normal flow and it accepted input associated with another user.

   Observations that would support it

   • Preserved web and application logs link unauthorized activity to normal endpoints and insufficient ownership checks.

   Observations that would challenge it

   • Investigation establishes database access through another path, with email as separate subsequent activity.

   Assessment limits

   • Email proves the function ran, not an authorization flaw; other paths such as SQL injection remain possible.

   Related inspection rules

   • SEC-009
   • SEC-014

2. Mitigation hypothesis 2 Unverified

   Checking ownership before lookup and notification, plus retrieval limits, could curb legitimate-function abuse.

   Primary-source starting point

   The disclosure describes unauthorized public-service access and automated emails containing registration data.

   [s1]p.1 §2 / p.2 §4

   Read assumptions, observations, and limits

   Required assumptions

   • Server-side ownership checks are available on lookup and notification paths.

   Observations that would support it

   • Two synthetic users in an isolated environment cannot trigger each other’s lookup or notification; retrieval limits work.

   Observations that would challenge it

   • Unauthenticated or cross-user input returns data, or bulk lookups and notifications remain unrestricted.

   Assessment limits

   • Server compromise and other paths remain possible despite these controls; the incident’s specific defect is undisclosed.

   Related inspection rules

   • SEC-014

Read this incident’s AI-ready guide ↗