Teenager hacks open Microsoft database with 17 trillion total rows and 25,000 user accounts

What do you get when you cross a bored teenager with free time and excellent computer skills? A hack of a Microsoft database with trillions of records on hand and 25,000 records of employee data, of course. Future legend hacker Faav poked around Microsoft's supposedly internal Titan analytics platform, eventually finding that its user validation was... sub-optimal.

According to Faav, he's "spent the year hacking Microsoft off and on around school," digging up bugs on the Redmond firm's wares as well as Amazon, Google, Adobe, and others. Much like other hackers, he has his own set of tools, and predictably in this day and age, his sonic screwdriver is Antares, an AI orchestrator bot he concocted for the purpose of scanning and automating boring security legwork.

Antares found an endpoint URL in Titan that brought up an error message saying that a VPN was required. Just like a virtual pspspsps, this was enough to get Faav's attention. He got Antares to look for subdomains around this endpoint, coming up with one belonging to an Azure Cloud host, along with a corresponding Swagger/OpenAPI file listing four routes (Swagger is an industry-standard machine-readable instruction on how an API works, for easier third-party integration).

While three of those routes needed Azure Active Directory authentication, one did not, and its name was inspiring: /v2/Query. It also accepted raw SQL queries, prompting a collective facepalm from the audience. Faav still needed to know what to query for, and after clever usage of the Wayback Machine, he found a 2023 version of this login page, complete with a helpful Apache Superset configuration file describing the database schema, showing 56 table definitions.

He also found that this endpoint refused his queries due to the lack of a JWT (JSON Web Token) authentication, so he sicced Antares on it again for 10 days, with no success. Eventually, Faav had a flash of inspiration and realized that the way the server was responding implied that the token's digital signature wasn't being checked. So he just pretended his access token was for an administrator and was promptly let in. One handy "SHOW DATABASES" later, he was staring at 25,000 records of employee data, along with organization records, dashboards, and charts.

After exploring the database a little more, he found a particular data source for Bing analytics. Digging there and tallying up rows across tables, Faav saw he had access to a total of 17 trillion records total, and had to double-check this number and stop himself from yelling out and waking his parents at 2 am.

After reporting the problem to Microsoft's bug bounty program, he was awarded with $5,000 for his findings. In his blog post, he also points out that "AI and human intuition compounded here. Antares did ten days of work I didn’t have to [...] Its persistence, plus one human hunch, is what made this find possible."

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.