16-year-old finds flaw exposing Microsoft system linked to 17 trillion data rows

The researcher, who goes by the name Faav said in an account published on his personal blog Sept. 25 that he has spent the past year finding security vulnerabilities at major technology companies, including Microsoft, Amazon, Google and Adobe, while attending school.

He gained administrator access to Titan, an analytics platform used internally by Microsoft, after discovering a weakness in its login security.

His investigation began in late August with Antares, an artificial intelligence-powered security tool he built to automate repetitive work involved in finding software vulnerabilities.

The AI tool spent about 10 days testing Titan's security checks before Faav discovered the crucial weakness himself.

Titan used digital credentials to determine users' identities and what they were allowed to access. But Faav found that the system was not properly verifying whether those credentials were genuine, allowing him to change the identity information they contained.

A young person uses a personal computer. Illustration photo from Pexels

After Microsoft-style email addresses failed, Faav tried the username "admin," which gave him administrator-level access to Titan.

Once inside, Faav found a directory containing about 25,000 application accounts, including nearly 18,000 Microsoft employee email records.

He also confirmed that data associated with Microsoft's Bing search engine could be reached through the system, but said he retrieved only two individual rows to demonstrate that access was possible.

Further investigation showed that Titan was connected to 17 analytics databases containing more than 17.3 trillion rows in total, he said.

He stressed that the enormous figure did not mean he had downloaded that amount of information. It represented data that could potentially have been reached because of the security flaw.

Faav reported the vulnerability to the Microsoft Security Response Center on Sept. 5 and stopped testing at the company's request. Microsoft locked down the affected API endpoint four days later and awarded him a $5,000 bug bounty on Sept. 17.

"We appreciate the opportunity to investigate the findings reported by Faav. Their submission and coordinated vulnerability disclosure helped us to better protect our customers by hardening our services. We value and appreciate safe security research under the terms of the Microsoft Bug Bounty Program and look forward to continuing to work with Faav in the future," Microsoft said in a statement included in Faav's disclosure.

Faav said Microsoft reviewed his account before publication, with sections and figures removed and descriptions of the vulnerability's potential impact changed.

He said Antares was useful because it could persistently perform repetitive testing, but human judgment ultimately provided the breakthrough.

"Antares wouldn't have gotten here alone, and neither would I. Its persistence, plus one human hunch, is what made this find possible," he wrote.