A 16-year-old security researcher named Faav discovered a critical authentication vulnerability in Microsoft's internal Titan analytics platform. The researcher utilized a custom AI bot, Antares, to identify an exposed API endpoint that allowed unauthorized SQL queries. By exploiting a flaw in the JSON Web Token validation process, Faav successfully gained administrative access to the database.
The breach exposed a massive volume of internal data, including approximately 25,000 employee records and various configuration files. The researcher estimated that the total accessible data reached over 17.3 trillion records, covering information related to Bing analytics and internal organizational structures. The vulnerability was identified through an improperly secured API route that lacked signature verification.
Following the discovery on September 5, Faav reported the findings to the Microsoft Security Response Center. The company locked the API interface by September 9 after verifying the researcher's activities. Microsoft confirmed the report and awarded Faav a bounty of $5,000 on September 17. Both parties met on September 22 to coordinate the disclosure of the security flaw.
Microsoft issued a statement acknowledging the researcher's contribution to improving service security. The company collaborated with Faav to review and edit the disclosure details before publication. This incident highlights the ongoing role of independent security researchers in identifying vulnerabilities within large-scale cloud environments and internal corporate platforms.
