Something’s off.A report says a 16-year-old security researcher found that Microsoft’s internal Titan analytics service accepted a login token without verifying its signature. After changing the token’s user name to “admin,” he reportedly reached a local administrator account and could run SQL queries.
Titan was said to perform several other checks on the token, but the missing signature check allegedly made those checks ineffective. The researcher estimated, from database metadata, that connected analytics databases represented about 17.3 trillion rows; he said that estimate could include historical, duplicated, and derived data.
According to the report, Microsoft locked down the endpoint after the disclosure and awarded the researcher a $5,000 bug bounty.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This is a source-attributed report whose underlying claims have not been independently verified.
