Teen Security Researcher Finds Authentication Flaw in Microsoft Analytics Platform

A 16-year-old security researcher known as Faav discovered an authentication vulnerability in Microsoft's internal Titan analytics platform that potentially exposed access to databases containing an estimated 17 trillion rows of data, Bruno Ferreira reported for Tom's Hardware.

A teenage security researcher known as Faav discovered an authentication vulnerability in Microsoft's internal Titan analytics platform and reported it through the company's bug-bounty program. [Photo: Microsoft X]

Faav said he had spent much of the year researching vulnerabilities in products and services operated by Microsoft and other technology companies.

He used a custom artificial-intelligence tool called Antares to automate parts of his security research.

According to reporting on his disclosure, Faav discovered an exposed application-programming interface (API) associated with Titan. The system had authentication controls, but one route did not properly validate the authenticity of the security token presented to it.

Faav eventually obtained administrator-level access by exploiting that authentication weakness.

The access allowed him to inspect information associated with Titan's analytics environment, including application-account and employee information.

Reporting indicates that he accessed approximately 25,000 application-account records and around 17,990 employee email records while testing the vulnerability. He also confirmed access to information associated with Bing analytics.

The figure of roughly 17 trillion rows refers to the estimated amount of data contained across connected analytics databases that could potentially have been reachable through the vulnerability.

It does not mean that Faav downloaded or extracted 17 trillion individual records. He limited his testing and reported the vulnerability to Microsoft's security-response program.

Microsoft subsequently fixed the vulnerability and awarded Faav a $5,000 bug bounty, according to reporting on the disclosure.

Faav said the discovery resulted from a combination of automated work by Antares and a human insight that allowed him to identify the authentication weakness.