Home / Technology / Teen Hacker Breaches Microsoft Titan Analytics
Teen Hacker Breaches Microsoft Titan Analytics
6 Oct
Summary
- A 16-year-old gained admin access to Microsoft's analytics service.
- An unsigned token allowed access to 17.3 trillion stored rows.
- Microsoft paid a $5,000 bounty and has since secured the vulnerability.
A 16-year-old security researcher, operating under the alias 'Faav,' recently uncovered a significant vulnerability within Microsoft's internal Titan analytics platform. The exploit involved leveraging an unsigned login token, bypassing crucial authentication checks. This allowed Faav to gain administrator privileges, theoretically providing access to an estimated 17.3 trillion rows of data.
Faav detailed the breach, noting that the service accepted raw SQL queries via an unsecured API endpoint and failed to validate the signature of JSON Web Tokens. This allowed the submission of an unsigned token, which was then manipulated to grant local administrator access. The researcher's AI-powered bot, Antares, assisted in identifying subdomains and mapping the attack surface.
Following the discovery, Microsoft issued a $5,000 bug bounty to Faav. The company has since implemented security enhancements to the Titan service to prevent future exploitation. While Faav sampled data, he stated that no customer data was dumped or accessed inappropriately. Microsoft clarified that the trillion-row figure represented theoretical storage capacity rather than actual exposed customer information.
