宅ふぁいる便 (Takufile-bin)

» see filesend.to as it lived, on the wayback machine

~ the obituary ~

It started as an internal tool. Osaka Gas, the utility, needed to move large files back and forth with its suppliers in 1999, and built something to do it. The suppliers then asked whether they could use it for their own work. The answer was yes, and from there it spread the way useful internal tools sometimes do, by people telling other people. By October 2014 it had 2.8 million members.

The product itself was the plainest thing imaginable. You uploaded a file too big to email and the service mailed a link to whoever you named, who clicked it and got the file. Fifty megabytes without an account and three hundred if you registered, with more available on the paid tiers. Every country had a version of this problem and most of them solved it with whatever service happened to be in the local language, which is why I have never once typed this address and why almost everyone working in a Japanese office had.

Ownership drifted without the name changing. Osaka Gas ran it directly at the start, then a group company called L-Net, which was renamed in 2014 and folded into OGIS-RI, the group's IT arm, in July 2015. So OGIS-RI, the name on the gravestone, had only owned it since July 2015.

~ the case file ~

~ the goat that eats the letter ~

The oldest surviving copy of the site is from 21 January 2000, in Shift_JIS, with a cartoon delivery truck at the top and a copyright line reading Osaka Gas. The header image is captioned 宅ふぁいる便2, so by the start of 2000 it was already on a second version.

The contact address on that page is [email protected]. Shiroyagi is the white goat from やぎさんゆうびん, a Japanese children's song every schoolchild knows, in which the white goat receives a letter from the black goat and eats it before reading it, then writes to ask what it said, and the black goat eats that letter too, and so on forever. Somebody at a gas utility in 1999 chose, as the support address for a service that delivers things, the name of a goat famous for destroying the mail. That address was still the one printed on the site twenty years later.

~ 10:50 on a Wednesday ~

On 22 January 2019 at 09:38 staff noticed a file on a server that nobody had put there. They widened the investigation to the hosting partner at 11:00 and blocked the attacking address at 19:45. The next morning, Wednesday 23 January, at 10:50, they stopped the service. The first public notice went up on the 24th at 20:10 and said there was no prospect yet of resuming. Exfiltration was confirmed on the 25th, and at 03:22 on the 26th an apology went out to every member they could still reach.

The count was 4,815,399 records: 4,750,329 free accounts, 22,569 paid ones, and 42,501 people who had already left. The fields included email addresses and dates of birth. They also included the login passwords, which were not hashed. Then the figure that is worse than the headline one. For 1,348,361 of those accounts the registered address no longer worked, so over a quarter of the victims were unreachable, and most of them presumably still do not know.

Files that were mid-flight when the shutters came down, uploaded between 13 and 23 January, were simply never delivered. Nobody got them back either. The service had no function for downloading your own upload, because the only way it had ever handed you a file was the mail link it could no longer send.

~ twenty years of meaning to ~

FNN asked the company in January 2019 why the passwords were in the clear, and the answer is the whole obituary in one paragraph. The service had been running for about twenty years and had never been encrypted from the beginning. There was a plan to encrypt it eventually. Because the service was large and resources were short, the plan was still a plan when the leak happened.

Two further answers from the same interview finish the picture. Asked whether the business product, オフィス宅ふぁいる便, hashed its passwords, the company said yes, it did. Asked why it still held data on people who had quit, it said that those people sometimes write in with questions, so the old data was kept on hand. The business sibling ran on a different system and was never taken offline. It is still selling today.

~ a site for reading your own password ~

On 14 March 2019 OGIS-RI said publicly that the service was suspended for the time being. On 8 April it opened something stranger: a separate website, on separate servers, whose purpose was to let you look up the password that had been stolen from you. You could also use it to resign your membership and cash in any points you were holding. It was open from nine in the morning until a quarter to six, and it had taken two and a half months to build.

The termination notice came on 14 January 2020 and set the end at 31 March. The stated reason was that restoring a service people could trust would need a substantial rebuild, and that the time and the cost of that rebuild had been weighed and found too high. Reputation is not mentioned anywhere in it. On 31 March 2020 the lookup site shut when the service did, and everybody still registered was deemed to have resigned. A tool built so that suppliers could send each other things was finally undone by the one thing it had kept and never needed to.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »