Teenager hacks 17 trillion row Microsoft database
What happens when a bored teenager with exceptional computer skills teams up with cutting-edge artificial intelligence? The result is a digital legend.
This is the story of Faav, a hacker who spent a year exploring the digital frontiers of giants like Microsoft, Amazon, and Google. Armed with a unique blend of free time and sophisticated tools, Faav didn’t just poke around; he meticulously dissected security systems to uncover hidden truths.
His arsenal wasn’t just clever coding; it included his own creation, Antares—an AI orchestrator bot designed to automate the tedious work of scanning and security legwork. Antares proved to be an invaluable partner, orchestrating complex searches that human intuition alone might have missed.
The investigation began by exploring Microsoft’s supposedly internal Titan analytics platform. Antares quickly zeroed in on an endpoint that initially displayed a virtual padlock, signaling the presence of a VPN requirement. This subtle flag was the opening Faav needed.
Using Antares to scan for related subdomains, the hacker discovered an Azure Cloud host and a corresponding instruction file, which mapped out the API routes. Among these routes, one stood out: /v2/Query. While most routes demanded complex authentication, this particular endpoint allowed raw SQL queries, prompting a collective digital groan from security experts.
Faav then leveraged the Wayback Machine to find an older version of the login page, which included a helpful configuration file detailing the database schema—a roadmap of 56 tables waiting to be explored. The real challenge, however, was bypassing the authentication. The endpoint refused access due to a missing JSON Web Token (JWT).
For ten days, Antares relentlessly pursued the flaw. Faav realized the server wasn’t properly checking the token’s digital signature. With a moment of inspired genius, he pretended his access token belonged to an administrator and gained entry.
Suddenly, the vault opened. Faav accessed dashboards, organization records, and a trove of 25,000 employee data points. Deeper exploration revealed an astonishing scale: by aggregating data across various sources, he uncovered access to a total of 17 trillion records.
Faav didn’t stop there. After reporting his findings to Microsoft’s bug bounty program, he was awarded $5,000 for his discovery. His success story highlights the power of combining cutting-edge AI and human intuition, proving that sometimes the most complex security puzzles are solved not just by code, but by inspired thought.
Credit
