<![CDATA[A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.]]>A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.

They paid him $5000 and told nobody about it.

https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records

]]>https://forum.fedi.dk/topic/4e29708d-913e-4658-80d3-4a0e8c342895/a-16-year-old-boy-hacked-an-internal-microsoft-system-called-titan-with-17-trillion-records-as-it-didn-t-validate-jwt-signatures-at-all-accepted-admin-as-authentication-without-a-password-and-was-internet-facing.RSS for NodeSun, 11 Oct 2026 13:57:30 GMTSat, 10 Oct 2026 23:44:48 GMT60<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 06:59:54 GMT]]>@GossiTheDog

“Shall we play a game?”

]]>https://forum.fedi.dk/post/https://mastodon.social/users/xs4me2/statuses/117420981934834362https://forum.fedi.dk/post/https://mastodon.social/users/xs4me2/statuses/117420981934834362Sun, 11 Oct 2026 06:59:54 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 03:08:15 GMT]]>@GossiTheDog

]]>https://forum.fedi.dk/post/https://mstdn.social/users/BassRck5000/statuses/117420071008605074https://forum.fedi.dk/post/https://mstdn.social/users/BassRck5000/statuses/117420071008605074Sun, 11 Oct 2026 03:08:15 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 03:03:04 GMT]]>@GossiTheDog Why do they need to.keep 17 trillion records?

]]>https://forum.fedi.dk/post/https://mastodon.world/users/Luna/statuses/117420050627970476https://forum.fedi.dk/post/https://mastodon.world/users/Luna/statuses/117420050627970476Sun, 11 Oct 2026 03:03:04 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 03:02:52 GMT]]>@Spartan_1986 @GossiTheDog Paying next months rent vs. Paying next year’s rent.

]]>https://forum.fedi.dk/post/https://mstdn.ca/users/JustinDerrick/statuses/117420049883072194https://forum.fedi.dk/post/https://mstdn.ca/users/JustinDerrick/statuses/117420049883072194Sun, 11 Oct 2026 03:02:52 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 02:49:56 GMT]]>@GossiTheDog
This clever hacker also leverage Codex and Claude during hacking, orchestrated by a customised AI Antares.
if this guy call LLM and refused to use, the good thing probably won't happen

]]>https://forum.fedi.dk/post/https://mastodon.social/users/Pouakai/statuses/117419999022566283https://forum.fedi.dk/post/https://mastodon.social/users/Pouakai/statuses/117419999022566283Sun, 11 Oct 2026 02:49:56 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 01:44:51 GMT]]>@GossiTheDog

I'd guess that _all_ the "AI agent hacks computer system" instances were exactly and only incompetent security on the part of the hacked system.

When "Internet of things" was a thing, I was terrified, because you can't make and sell an internet-connected thing at a price such that you can afford to implement decent security in it.

]]>https://forum.fedi.dk/post/https://mastodon.mit.edu/users/djl/statuses/117419743113544577https://forum.fedi.dk/post/https://mastodon.mit.edu/users/djl/statuses/117419743113544577Sun, 11 Oct 2026 01:44:51 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 01:44:35 GMT]]>@GossiTheDog good thing they didn't give him a mcdonalds voucher

]]>https://forum.fedi.dk/post/https://chx.contact/users/chx/statuses/117419742046766605https://forum.fedi.dk/post/https://chx.contact/users/chx/statuses/117419742046766605Sun, 11 Oct 2026 01:44:35 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 01:28:31 GMT]]>@GossiTheDog

]]>https://forum.fedi.dk/post/https://social.vivaldi.net/ap/users/117364219173231882/statuses/117419678856229750https://forum.fedi.dk/post/https://social.vivaldi.net/ap/users/117364219173231882/statuses/117419678856229750Sun, 11 Oct 2026 01:28:31 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 00:50:56 GMT]]>@GossiTheDog

Copilot should have found this. /s

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/SpaceLifeForm/statuses/117419531102140828https://forum.fedi.dk/post/https://infosec.exchange/users/SpaceLifeForm/statuses/117419531102140828Sun, 11 Oct 2026 00:50:56 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 00:50:19 GMT]]>@GossiTheDog @gooser3000 Isn’t that “special”.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/donhawkins/statuses/117419528629785748https://forum.fedi.dk/post/https://mastodon.social/users/donhawkins/statuses/117419528629785748Sun, 11 Oct 2026 00:50:19 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 00:27:15 GMT]]>@GossiTheDog
And the most egregious error:

The frontend had a scary "VPN REQUIRED" page to keep out the hackers.

Seems it was only a recommendation.

]]>https://forum.fedi.dk/post/https://freeradical.zone/users/generalx/statuses/117419437976659813https://forum.fedi.dk/post/https://freeradical.zone/users/generalx/statuses/117419437976659813Sun, 11 Oct 2026 00:27:15 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 00:06:32 GMT]]>@GossiTheDog Irresponsible non disclosure.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/Spartan_1986/statuses/117419356474639659https://forum.fedi.dk/post/https://infosec.exchange/users/Spartan_1986/statuses/117419356474639659Sun, 11 Oct 2026 00:06:32 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 00:03:36 GMT]]>@GossiTheDog sounds like the dark web would pay better.

]]>https://forum.fedi.dk/post/https://unsociable.lowkey.party/users/nigel/statuses/01M4M4BABM3XZEWPZYSF6A3KMThttps://forum.fedi.dk/post/https://unsociable.lowkey.party/users/nigel/statuses/01M4M4BABM3XZEWPZYSF6A3KMTSun, 11 Oct 2026 00:03:36 GMT<![CDATA[Reply to A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing. on Sun, 11 Oct 2026 00:03:30 GMT]]>@GossiTheDog they are some real scum bags with their bug bounty program. Trying to give him the run around with that finding and some chump change

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/rtificial/statuses/117419344557119921https://forum.fedi.dk/post/https://infosec.exchange/users/rtificial/statuses/117419344557119921Sun, 11 Oct 2026 00:03:30 GMT