A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
@GossiTheDog
And the most egregious error:The frontend had a scary "VPN REQUIRED" page to keep out the hackers.
Seems it was only a recommendation.
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
@GossiTheDog @gooser3000 Isn’t that “special”.
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
Copilot should have found this. /s
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
@GossiTheDog good thing they didn't give him a mcdonalds voucher
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
I'd guess that _all_ the "AI agent hacks computer system" instances were exactly and only incompetent security on the part of the hacked system.
When "Internet of things" was a thing, I was terrified, because you can't make and sell an internet-connected thing at a price such that you can afford to implement decent security in it.
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
@GossiTheDog
This clever hacker also leverage Codex and Claude during hacking, orchestrated by a customised AI Antares.
if this guy call LLM #aislop and refused to use, the good thing probably won't happen -
@GossiTheDog Irresponsible non disclosure.
@Spartan_1986 @GossiTheDog Paying next months rent vs. Paying next year’s rent.
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
@GossiTheDog Why do they need to.keep 17 trillion records?
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
-
A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records
“Shall we play a game?”
-
P pelle@veganism.social shared this topic
