Researcher finds unsigned-token flaw exposing 17.3 trillion Microsoft data rows: the jokes
What happened
A security researcher reported that a Microsoft internal analytics service did not check the signature on login tokens. The flaw let them impersonate an administrator and run unauthorized SQL queries. They estimate 17.3 trillion stored rows across many datasets were reachable. The researcher says they reported the bug and describes the impact as hypothetical.
- I Could've Accessed 17T Microsoft Records (blog.faav.net)
- 16-year-old found Microsoft bug, got admin access to 17.3T-row databases (theregister.com)
13 private thoughts from Satya Nadella, ranked by readers
Satya Nadella, internallyMicrosoft CEOPhoto: Brian Smale and Microsoft, CC BY-SA 4.0- 1
“Users need three sign-ins to open Word, while our admin login only needed someone to claim to be admin.”
Needs votesShare - 2
“He got in through Azure, so technically that's one new Azure customer this quarter.”
Needs votesShare - 3
“Half our staff can't find that internal dashboard, and an outsider found it, now that's discoverability.”
Needs votesShare - 4
“A teenager built his own AI to break into Microsoft and still didn't think to use Copilot.”
Needs votesShare - 5
“A 16-year-old's homemade bot got admin on our data, and Copilot can't even get admin on my calendar.”
Needs votesShare - 6
“Terrible breach, sure, but 17.3 trillion rows is a number I'd love to say on an earnings call.”
Needs votesShare - 7
“Everyone's upset a kid could reach 17.3 trillion rows, and nobody's impressed that we have 17.3 trillion rows.”
Needs votesShare - 8
“We won't let you set up Windows without an account, but our admin login took a kid's word for it.”
Needs votesShare - 9
“A teenager ran admin queries on our data through Azure, and nobody has sent him an invoice?”
Needs votesShare - 10
“Our employee-only tool was so easy a kid got in without working here, that's adoption.”
Needs votesShare - 11
“We built our defenses for foreign governments, not for someone who has school in the morning.”
Needs votesShare - 12
“Our login checked everything except whether it was real, and a 16-year-old noticed before we did.”
Needs votesShare - 13
“Losing admin to hackers is a crisis, but losing it to a high-schooler is a parent-teacher conference.”
Needs votesShare