Conversation

A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.

They paid him $5000 and told nobody about it.

https://blog.faav.net/how-i-couldve-accessed-17-trillion-microsoft-records