Redmond once again made a huge blunder with cloud infrastructure security. A 16-year-old white-hat hacker named Faav discovered an exposed backend of Microsoft’s internal analytics platform, Titan. The outcome: by simply forging a token, the guy gained super-admin rights to 17 ClickHouse databases. 17.3 trillion lines of logs and 25,000 user accounts were at risk.
The Core of the Flaw: Trust-Based Authentication
The Titan platform is used internally at Microsoft for aggregating service telemetry. If you try to access it via a browser, the server will honestly reject you with a stub VPN REQUIRED. The problem was that the API endpoint itself was hosted on public Azure infrastructure and accepted external requests without any network filtering.
The biggest issue lay in the token validation implementation:
- The gateway accepted JSON Web Tokens (JWT) without validating the digital signature (a classic vulnerability
alg: none). - The researcher generated a custom token on the fly, assigned himself the role
admin, and sent a request to the API. - The system accepted the fake and provided a console with rights to execute raw SQL queries.
Scale of the Leak
Through ClickHouse system tables, the hacker estimated the total data volume: the counter showed 17,333,335,124,315 rows.
This was not a leak of user passports, but a gigantic array of replicated logs, Bing system telemetry, and platform service metadata. However, as a bonus, records of 25,000 internal accounts, including 17,990 real Microsoft employee email addresses, were also exposed.
Response and a $5,000 Bounty
The young man proved to be honorable: he didn’t dump terabytes of data, took proof on two test lines, and reported the bug to the Microsoft Security Response Center.
Microsoft reacted within 4 days, completely shutting down the vulnerable endpoint from the network. And for saving them from a grand reputational blow, the corporation paid the researcher… $5,000. Among security professionals, this amount for saving 17 trillion records has already been dubbed a ‘lunch money’ payout.
Conclusion for Sysadmins: Check JWT validation on public gateways right now. If your microservice accepts unsigned tokens, frontend stubs requiring a VPN won’t save you.
Source: Tom’s Hardware / Faav Technical Writeup
Via: softandgadget.com
For homelabs, remote testing, and staging environments, we run NVMe VDS instances on Erahost. Fast provisioning, European routing, and predictable I/O.
View NVMe Plans →
