Emerging Researcher Employs AI Hackbot to Unlock Microsoft’s Titan Analytics

Quick Overview

• A 16-year-old investigator, referred to as Faav, secured a US$5000 ($7126) bug bounty from Microsoft.
• Faav utilized an AI hackbot called Antares to circumvent authentication barriers on Microsoft’s Titan analytics platform.
• The vulnerability was detected in a public API that was accessible solely through VPN.
• Faav’s AI tool pinpointed a significant issue in how Titan managed JSON Web Tokens (JWT).
• Microsoft quickly recognized the vulnerability and provided the bounty.

AI Hackbot Achievement in Titan Analytics

Exploiting Public API with AI Support

The young investigator, known as Faav, dedicated ten days to observing how his custom-built Antares AI hacking tool tackled authentication obstacles. The venture began with the identification of a public API, accessible only through a virtual private network (VPN), that circumvented Titan’s frontend.

Grasping the JWT Vulnerability

Of the four routes within the API, three required Azure Active Directory authentication. However, the fourth route, which enabled direct SQL database queries, merely needed a seemingly legitimate JSON Web Token (JWT). JWTs are commonly used for validating user identity, comprising a header, payload, and signature. The header and payload are easily interpretable, making the signature essential for verification.

Faav’s Systematic Method

To initiate Antares, Faav sourced 56 historical table names from Titan’s 2023 login page snapshots through the Wayback Machine. During the subsequent ten days, Antares carefully maneuvered through Titan’s JWT procedures, overcoming challenges like tenant mismatches and application allowlist denials until it reached the user lookup phase.

Revealing the Signature Flaw

Faav found that Titan accepted JWT claims as long as they seemed structurally intact, ignoring the validity of the signature. This lapse enabled Antares to alter the payload without changing the signature.

Admin Rights and Data Exploration

With the “admin” username, Faav obtained administrative access to Titan. He navigated through a test database filled with dummy data and uncovered a route to 17 interconnected analytics databases containing roughly 17 trillion rows of information. However, data retrieval was restricted to metadata and sample queries.

AI-Enhanced Security Research Yields Bounty

Faav alerted Microsoft’s Security Response Centre regarding the vulnerability in early September and was quickly instructed to cease testing. Microsoft recognized the flaw and granted a US$5000 bug bounty two weeks later. While Microsoft influenced some aspects of the disclosed information, Faav acknowledged the collective contributions of AI and human acumen in this revelation.

Conclusion

This instance underscores the potential of AI in cybersecurity research and the necessity for robust authentication protocols. The synergy between AI innovation and human insight can uncover critical vulnerabilities, prompting technology leaders like Microsoft to consistently improve their security frameworks.