A young hacker was able to gain access to Microsoft's internal analytics platform Titan, revealing a data leak that included 25,000 employee records, as well as Bing's 17 trillion row analytics database.
A young hacker was able to gain access to Microsoft's internal analytics platform Titan, revealing a data leak that included 25,000 employee records, as well as Bing's 17 trillion row analytics database.
According to the young researcher who goes by the nickname Faav, he regularly searches for vulnerabilities in Microsoft, Amazon, Google, and Adobe products in his free time. To automate routine work, the guy created his own AI-bot orchestrator called Antares, reports Tom's Hardware.
The vulnerability discovery process began when the Antares AI bot found a final URL in the Titan platform that was throwing an error about the need for a VPN connection. By directing the bot to scan the associated subdomains, the researcher discovered a host in the Azure Cloud and an OpenAPI/Swagger specification with four routes. It turned out that three of them required authorization through Azure Active Directory, while the fourth — /v2/Query — turned out to be completely open and accepted pure SQL queries.
To perform full-fledged queries, the hacker needed to understand the structure of the system itself. Using the Wayback Machine, he found an archived version of the login page from 2023, which contained an Apache Superset configuration file. This document contained a detailed description of the database schema with 56 tables, which allowed him to form precise SQL queries for further penetration.
The server was rejecting requests due to the lack of a JWT token (JSON Web Token). After 10 days of unsuccessful attempts to automatically select Antares, Faav guessed that the server was not checking the digital signature of the token at all.
He manually generated a token, assuming administrator rights, and the system immediately granted full access. The first SHOW DATABASES query revealed the personal data of 25,000 employees, as well as corporate analytics, dashboards, and charts.
Exploring further, Faav came across the Bing Analytics array. After counting the number of rows in the tables, he realized that he had access to 17 trillion records.
“This is where the synergistic effect of AI and human intuition came into play. Antares did a ten-day routine job that I didn’t have to do manually. Its persistence, combined with my hunch, is what made this leak possible,” Faav concluded.
After submitting a detailed report under the Microsoft Bug Bounty program, the company fixed the vulnerability and paid the researcher a $5,000 bounty.
