78
How I Could’ve Accessed 17 Trillion Microsoft Records (blog.faav.net)
submitted 2 weeks ago by to c/cybersecurity@infosec.pub
4 comments fedilink hide all child comments
 

A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.

They paid him $5000 and told nobody about it.

all 4 comments

sorted by: hot top controversial new old
[–] 37 points 2 weeks ago (1 child)

Once a-fucking-gain I am imploring you, hat in hand, on bended knee. Compensate security researchers.

When we pull shit like this, we kill the golden goose, but even worse. We won't get our payday, an adversary will.

God dammit.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 7 points 2 weeks ago

    Especially now that AI is incredibly capable of security... "research"... literally any skiddie with a bit of money can "pentest" systems.

    It's no longer "if" a system gets hacked but "when".

    Prior to this, all the knowledge and skills and thought processes were limited to a small fraction of a percentage of the population, most of whom ended up selling out, thus limiting the potential damage.

    But today? Any skiddie with a grudge can get their hands on an abliterated model, spend a bit of money on hardware to run it (if power consumption isn't a limit, a handful of 3090s will do, which you can get relatively cheap), and just run attacks against any server their fridge is against.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 24 points 2 weeks ago (1 child)

    5k 😭

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •