[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

3 clusters · 7 sources · 8 days · First seen · Last updated

Microsoft Titan platform security vulnerability

Overview

A 16-year-old security researcher, known as Faav, discovered a vulnerability in Microsoft’s internal Titan analytics platform using an AI-based orchestration tool called Antares. The flaw involved the platform’s failure to properly validate cryptographic signatures on JSON Web Tokens (JWT), which allowed for unauthorized access to a public API via a virtual private network (VPN).

By exploiting an unsigned authentication token and using the username ‘admin’, the researcher was able to execute SQL queries with administrative privileges. While the vulnerability theoretically provided access to databases containing approximately 17.3 trillion rows of data, the researcher reported that no customer data was stolen or downloaded. The exposure included metadata from approximately 25,000 accounts, 17,990 employee emails, and 24,569 internal dashboards.

Faav reported the finding to the Microsoft Security Response Center on September 5. Microsoft closed the access point on September 9 and subsequently rewarded the researcher with a $5,000 bug bounty on September 17.

Entities

Antares · Microsoft · Faav · Azure · Titan

Timeline

  1. [TECHNOLOGY] 3 sources
    Microsoft security flaw exposed by 16-year-old researcher

    A 16-year-old researcher discovered a Microsoft security flaw in its Titan analytics service, exposing 17.3 trillion rows of metadata and thousands of employee accounts via an authentication bypass.

  2. [TECHNOLOGY] 2 sources
    Microsoft Titan platform vulnerability exposed by teenage researcher

    A 16-year-old researcher used an AI tool to find a security flaw in Microsoft’s Titan platform, exposing a database containing an estimated 17.3 trillion rows of data.

  3. [TECHNOLOGY] 2 sources
    Microsoft pays $5,000 bounty to teen researcher for Titan vulnerability

    A 16-year-old researcher used an AI tool called Antares to bypass authentication on Microsoft’s Titan analytics platform, earning a $5,000 bug bounty.

Sources

cybernoz.com · ilsoftware.it · itnews.com.au · merca2.es · nouvelles-du-monde.com · que.es · tecnoandroid.it

This summary has been updated 1 time: see revision history