security1 publisher
Missing token signature check gave a 16-year-old admin SQL on a Microsoft analytics service
Faav, a 16-year-old researcher, reached admin SQL over 17.3 trillion rows on Microsoft's Titan service because it never checked login-token signatures. Microsoft locked the endpoint four days after his report and paid a $5,000 bounty.
Publishers:helpnetsecurity.com
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+35
- Incentives55
- Confidence55