The Microsoft Titan Database Breach

What do you get when you cross a teenager with free time and excellent computer skills? A hack of a Microsoft database with trillions of records on hand and 25,000 records of employee data, of course. A hacker known as Faav poked around Microsoft's supposedly internal Titan analytics platform, eventually finding that its user validation was sub-optimal.

The Hacker and AI Automation

According to Faav, he spent the year hacking Microsoft off and on around school, digging up bugs on the Redmond firm's wares as well as other major technology platforms. He utilized a custom AI orchestrator bot named Antares, which he concocted for the purpose of scanning and automating security reconnaissance legwork.

Antares found an endpoint URL in Titan that brought up an error message stating that a VPN was required. He then directed the bot to look for subdomains around this endpoint, uncovering one belonging to an Azure Cloud host, along with a corresponding Swagger file listing four routes.

Exploiting SQL and Schema Details

While three of those routes needed Azure Active Directory authentication, one did not, named /v2/Query. It also accepted raw SQL queries. Using the Wayback Machine, an older version of the login page was found complete with a configuration file describing the database schema and showing 56 table definitions.

The endpoint initially refused queries due to the lack of JWT authentication, prompting further analysis. The server responses implied that the token's digital signature was not being checked, allowing access by pretending the token belonged to an administrator. This yielded 25,000 records of employee data along with organization records and dashboards.

Uncovering Trillions of Records

Further exploration revealed a data source for Bing analytics. Tallying up rows across tables, access was secured to a total of 17 trillion records.

Bug Bounty Reward

After reporting the problem to Microsoft's bug bounty program, an award of $5,000 was issued for the findings. The researcher noted that AI automation and human intuition compounded to make the discovery possible.