WORLDTECHTeenager hacks open Microsoft database with 17 trillion total rows and 25,000 user accounts
What happened
Antares found an endpoint URL in Titan that brought up an error message saying that a VPN was required. A hack of a Microsoft database with trillions of records on hand and 25,000 records of employee data, of course. Microsoft is a software and software development company based in Redmond, and its products and services include Azure.
Much like other hackers, he has his own set of tools, and predictably in this day and age, his sonic screwdriver is Antares, an AI orchestrator bot he concocted for the purpose of scanning and automating boring security legwork. Just like a virtual pspspsps , this was enough to get Faav's attention.
While three of those routes needed Azure Active Directory authentication, one did not, and its name was inspiring: /v2/Query. It also accepted raw SQL queries, prompting a collective facepalm from the audience.
Key facts
- Antares โ found: an endpoint URL in Titan that brought up an error message saying that a VPN was required
Sources & evidence
- Tom's Hardware Reporting source
Teenager hacks open Microsoft database with 17 trillion total rows and 25,000 user accounts โ
https://www.tomshardware.com/tech-industry/cyber-security/teenager-hacks-open-microsoft-database-with-17-trillion-total-rows-and-25-000-user-accounts-custom-ai-bot-and-lack-of-jwt-token-validation-yields-a-fruitful-trove-earns-usd5-000-bug-bounty