From Tom's Hardware: What do you get when you cross a bored teenager with free time and excellent computer skills? A hack of a Microsoft database with trillions of records on hand and 25,000 records of employee data, of course. Future legend hacker Faav poked around Microsoft's supposedly internal Titan analytics platform, eventually finding that its user validation was... sub-optimal.
According to Faav, he's "spent the year hacking Microsoft off and on around school," digging up bugs on the Redmond firm's wares as well as Amazon, Google, Adobe, and others. Much like other hackers, he has his own set of tools, and predictably in this day and age, his sonic screwdriver is Antares, an AI orchestrator bot he concocted for the purpose of scanning and automating boring security legwork.
Antares found an endpoint URL in Titan that brought up an error message saying that a VPN was required. Just like a virtual pspspsps, this was enough to get Faav's attention. He got Antares to look for subdomains around this endpoint, coming up with one belonging to an Azure Cloud host, along with a corresponding Swagger/OpenAPI file listing four routes (Swagger is an industry-standard machine-readable instruction on how an API works, for easier third-party integration).
View: Full Article
