Thread

I could've accessed 17T Microsoft records

318 points · 128 comments · luispa

Loading the complete thread in the background. This saved snapshot is available now. Refresh

ltbarcly3 · 1790781698 · focus · HN ↗
> Two quick notes first. The impact I describe is hypothetical. It’s what an attacker could have done with this access, but luckily I found the bug instead, reported it, and never touched any customer data or PII.
I am the last person to judge someone for using AI to help them write a blog post, but what I wonder is: Do people not read what the AI produces before putting their name on it, or is the AI writing style not obvious to some people, or do they just not care that it's obviously AI and bad style?
1. t-writescode · 1790782078 · focus · HN ↗
  That.. looks like a normal sentence to me, and very probably one of the ones Microsoft required they add.
  Did you give the article a once-over beyond that? It’s one of the decidedly not-AI lines.
  1. ltbarcly3 · 1790782225 · focus · HN ↗
    Prefixing saying something with "Two quick notes first" is extremely common AI meta commentary.
    functionmouse · 1790783099 · focus · HN ↗
    From where do you think AI learned that?
    Forgeties79 · 1790783233 · focus · HN ↗
    All AI semantic tendencies were “learned” from us. That doesn’t change anything.
    vonneumannstan · 1790783447 · focus · HN ↗
    Weird user preferences during RLHF. Also how we got bulleted lists and emojis everywhere.
    ltbarcly3 · 1790791365 · focus · HN ↗
    Learning a phrase from humans doesn’t prevent a model from overusing it or making it a recognizable stylistic habit.
  2. 0x_rs · 1790783396 · focus · HN ↗
    It's not a "normal" sentence and is quite clearly produced by an LLM, it's a typical Claudeism so probably that. The entire post is also flagged by Pangram, so OP is correct.
    encom · 1790805293 · focus · HN ↗
    > microsoft authored post > clickbait headline > slop writing > some kid
    Yea it's another bullshit post on the front page.
2. gosub100 · 1790784837 · focus · HN ↗
  Explain why easily 40% of HN posts are about AI, and when people actually _use_ AI for this task, they are vilified for (allegedly) using it.
  1. bix6 · 1790785378 · focus · HN ↗
    He’s fine to use the AI for bug hunting but nobody wants to read AI’s bullshit slop and tone
    icantevenhold · 1790787301 · focus · HN ↗
    I’m as tired of slopped up text as the next person but the example OP gave really isn’t that bad
    applfanboysbgon · 1790787997 · focus · HN ↗
    It really is. I stopped reading immediately at the quoted sentence.
    ltbarcly3 · 1790791259 · focus · HN ↗
    [dead]
  2. ltbarcly3 · 1790791092 · focus · HN ↗
    I pasted the thread into ChatGPT and here is what it would like to tell you:
    The comment explicitly says, “I am the last person to judge someone for using AI to help them write a blog post.” The criticism is about the quality of the published prose and whether anyone reviewed it before putting their name on it.
    You can dispute whether that sentence is bad or whether it indicates AI authorship. But “why criticize unedited AI prose when HN talks about AI so much?” doesn’t identify a contradiction. Discussing a technology doesn’t imply endorsing every use of it, and criticizing its output isn’t the same as vilifying someone for using it.
    — GPT-6.1 Sol
3. eviks · 1790786092 · focus · HN ↗
  All of the above, though mostly the last one.
f311a · 1790781998 · focus · HN ↗
What is Antares? Can't find anything related to it except for the 1B model, which does not seem to be capable of autoresearch.
1. Alifatisk · 1790784161 · focus · HN ↗
  > I also started building AI into how I hunt, which led me to develop Antares, my personal AI hackbot.
  1. hackernudes · 1790798051 · focus · HN ↗
    Pretty confusing, there is a Cisco Antares small language model... <a href="https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization" rel="nofollow">https://blogs.cisco.com/ai/introducing-antares-the-most-effi...
    Guess everything is just going to be named after stars for awhile.
    DaiPlusPlus · 1790829747 · focus · HN ↗
    Antares is also the internal name of Azure App Services platform/infra.
sdfhbdf · 1790783073 · focus · HN ↗
> awarded $5000
It's a little perplexing. Of course it's always a controversial topic since it's difficult to value an exploit, but whenever we read about these online, which probably goes through some survivorship bias, they seem pretty low.
On <a href="https://www.microsoft.com/en-us/msrc/bounty" rel="nofollow">https://www.microsoft.com/en-us/msrc/bounty it seems the top is $100,000 or $250,000 depending which program this counts under.
What does HN think? Why would it be only $5000?
1. muglug · 1790783793 · focus · HN ↗
  As I understand it, bug bounty awards are a rough proxy for "would nation-state actors be able to exploit this for operational purposes without getting caught".
  Zero-click iPhone exploits that affect the current OS and also previous ones are worth hundreds of thousands.
  1. buckle8017 · 1790785259 · focus · HN ↗
    Try 10-20 million USD for a zero click iPhone exploit.
  2. yieldcrv · 1790789318 · focus · HN ↗
    thats the true market value of bug bounty awards
    the unilaterally set awards by the affected corporation are far lower and based on the price of the researcher’s liability
2. Perz1val · 1790784449 · focus · HN ↗
  Microsoft's bounty program and payouts are known to be pathetic, see that nightmare eclipse situation
3. bix6 · 1790784875 · focus · HN ↗
  $5k is a literal penny for Microsoft. Give the kid $100k.
  1. k2xl · 1790786675 · focus · HN ↗
    Per their market cap...
    3.85 billion is actually closer to a "penny" for Microsoft.
    poly2it · 1790786916 · focus · HN ↗
    Operating income for Microsoft was $128.5 billion in 2025.
    <a href="https://www.microsoft.com/investor/reports/ar25/index.html" rel="nofollow">https://www.microsoft.com/investor/reports/ar25/index.html
4. TeMPOraL · 1790790947 · focus · HN ↗
  I think HN, like a lot of people in this industry, have strongly skewed perception of the actual importance of these bugs.
  You could view the bounty prices as market evidence that most of this is rightfully treated as nothingburgers. I.e. the alternative to paying $5000 to some random person for this class of vulnerability research is not risking a trillion dollar hack the next day - it's just risking shmaybe some kerfuffle down the line, followed by fixing it through normal triage process. The process is as much marketing as security, and $5000 is probably about the right price for marginal effort into sustaining the "we are treating security seriously" message.
  In a way, the very existence of those bug bounty programs in large companies is evidence they don't see a reason to treat vulnerabilities seriously enough to proactively find and fix them in-house.
  If security vulnerabilities would be anywhere serious as most commenters on-line seem to think, companies would pay hundreds of thousands for serious vulnerabilities, just to save a day before they get hit by them - on top of spending millions in-house to try and stay ahead of the attackers.
  But they don't. Because most exploits are inconsequential and/or aren't being exploited much.
  1. TedDoesntTalk · 1790816933 · focus · HN ↗
    Some do pay that. You just don’t hear about those, and there’s certainly no blog posts about them.
    TeMPOraL · 1790837679 · focus · HN ↗
    Right. That's how it goes when vulnerabilities are seen as really serious.
5. giancarlostoro · 1790791190 · focus · HN ↗
  What's worse is the alternative is winding up like Aaron Swartz... (all he did was scrape PDFs for mostly public funded / tax funded papers) Which is even worse, I think I'd be glad to receive $20 for Starbucks instead of being legally chased for showing them they messed up.
  There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued.
  1. elmer2 · 1790793159 · focus · HN ↗
    "all he did was scrape PDFs for mostly public funded / tax funded papers"
    He wasn't a security researcher. He broke into a room and used equipment to steal information. It wasn't just 'tax funded papers'. Companies invested millions of dollars into some of this research.
    We shouldn't support theft and he should have gotten some jail time/punishment for it.
    "There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued."
    Too many 'security researchers' demand money or threaten to release the vulnerabilities.
    I don't know anyone that got into trouble going through a legit bug bounty program.
    thereader12 · 1790793718 · focus · HN ↗
    [dead]
    mosseater · 1790812982 · focus · HN ↗
    It was a protest against the monetization of academic knowledge.
    You can call that "theft" as much as you want. There are lots of people like Aaron out there that think this sort of information should be freely available.
    Just because there is a law doesn't mean that that law is just and correct. Saying we "shouldn't support theft" is an over-simplification of the situation.
    latexr · 1790832662 · focus · HN ↗
    > he should have gotten some jail time/punishment for it.
    He was intimidated to the point of suicide, and somehow you don’t think that’s punishment enough?
6. omoikane · 1790792315 · focus · HN ↗
  Every HN post regarding security exploits inevitably results in some comment saying the bounty is too low. I find it helpful to read previous comments by tptacek regarding bug bounties and market values:
  <a href="https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=tptacek%20bounty%20market&sort=byDate&type=comment" rel="nofollow">https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
  This one probably has the best summary:
  <a href="https://news.ycombinator.com/item?id=43025038">https://news.ycombinator.com/item?id=43025038
  1. elmer2 · 1790792841 · focus · HN ↗
    This is correct. I've made well over six figures over the last couple of years through bug bounty programs. I wouldn't spend months finding one bug. It's usually days or a week or two max.
    $5,000 is actually pretty normal for a critical. I think the most I received for one bug was around $10,000, but this is the exception.
    AI has also ruined the market. I'm a security consultant (where I make most of my money) and stopped bug bounty once AI slop reports made it impossible to actually get anything triaged in a timely manner.
    Something else many don't know is that with all of the major platforms, customers can see the bugs before they are even triaged by the platform team. Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.
    physicallyIllfr · 1790796826 · focus · HN ↗
    [dead]
    msdz · 1790799604 · focus · HN ↗
    > Many companies are now taking advantage of the long triage times and fixing the bugs before the researcher can get paid. It's then marked as a duplicate and the researcher gets nothing.
    Isn’t that just a speedrun-encouragement for selling the exploit not to the one offering the product, but an attacker offering more (in this case, >$0 is not difficult to exceed) instead?
    dfxm12 · 1790801060 · focus · HN ↗
    If money is your motivation, you probably wouldn't consider disclosing the bugs in the first place.
    xnickb · 1790808178 · focus · HN ↗
    If there was an easy way to extract value out of any particular kind of a vulnerability, it'd cost much more and thus the bounty would've been higher.
    rnxrx · 1790822009 · focus · HN ↗
    $5K seems like an absolute steal compared to paying contracted security experts to find such bugs. I'm surprised these programs aren't pushed harder, as the potential ROI seems fantastic.
    Aurornis · 1790902106 · focus · HN ↗
    > $5K seems like an absolute steal compared to paying contracted security experts to find such bugs.
    Big companies who run these programs don’t use them as their only security. It’s a bonus program. They have internal employees and often third parties doing testing too.
    > I'm surprised these programs aren't pushed harder, as the potential ROI seems fantastic.
    I have some exposure to managing one of these programs, which was started by someone who left the company abruptly (right after it went on their resume as an achievement).
    It’s a huge amount of work. We got an unbelievable number of bad reports before AI was available. Now it’s just a nightmare. The ratio of bad reports to actual payout-worthy reports was out of control.
    Most submitters also tried to inflate the severity of their submission to get to the higher tiers. This created a problem where people were withholding small bugs while they’d try to find a way to chain it or elevate privileges. You could tell because as soon as you detected and closed their exploit, they would hurriedly submit a rushed report to try to claim it and then argue with you for not paying out because it was fixed before they submitted it.
    We had payouts that went to larger numbers, but honestly I think it would have been better off if we didn’t. This makes bystanders irate, but honestly the incentives get bad when the payouts are large and everyone is spamming LLM bots at your service.
7. xyst · 1790801037 · focus · HN ↗
  The young researcher is a teenager. Getting your name out there, clout/influence/fame, is worth $1M to them.
  It’s almost like most of you people have already forgotten your teenage years. And it shows. Doesn’t matter the decade or generation. A teenager , likely living with parents or grandparents, will always prioritize intangibles.
  A mere 5 bands for full editorial control is quite literally peanuts for M$. It’s yet another case of abusing free labor, unfortunately.
  1. xnyan · 1790806385 · focus · HN ↗
    > quite literally peanuts
    If I have an income of $250k/yr and a pack of peanuts costs $2 or very roughly 0.001% of my annual income, the equivalent peanut money for ~$130 billion a year microsoft would be more like $2 million.
8. julianeon · 1790802547 · focus · HN ↗
  I personally think it sets a bad precedent: you want to broadcast that valuable info will be treated as such. A hacker in the future will see this, compare the "precedent" price to the black market, and not even ask Microsoft the next time.
  1. keithnz · 1790816774 · focus · HN ↗
    many of these people want to work in security, selling to the black market will legally and professionally screw you.
    skeptic_ai · 1790833820 · focus · HN ↗
    If you sell for crypto how will ruin your reputation? I doubt anyone using real names and bank accounts
9. asaddhamani · 1790833989 · focus · HN ↗
  I find it perplexing and stingy. Such a bug would likely fetch tens, hundreds of times more on the grey market. Why would anyone not just sell it there? $5000 for trillions of exposed records with PII from Microsoft is a joke.
Kuyawa · 1790783307 · focus · HN ↗
Next time you find a bug like that, offer it to the black market, you could make millions instead of measly salty peanuts
1. sdcfgy · 1790783762 · focus · HN ↗
  I bet someone already did that and didn't disclose it.
  1. arm32 · 1790784055 · focus · HN ↗
    Now some blackhat somewhere can't afford their monthly Lamborghini payment.
khalic · 1790783366 · focus · HN ↗
You’re going places kid :) keep up the good work
1. matroxmemories · 1790783668 · focus · HN ↗
  Possibly jail if the wrong people get upset.
  1. Waterluvian · 1790783996 · focus · HN ↗
    Great way to use up that 6-10 years of vacation and sabbatical time.
  2. bix6 · 1790785104 · focus · HN ↗
    Well college isn’t worth it according to the Thiel crowd so maybe this will be better.
er0k · 1790783588 · focus · HN ↗
wow I am so surprised to hear once again how JWTs are terrible
<a href="https://www.howmanydayssinceajwtalgnonevuln.com/" rel="nofollow">https://www.howmanydayssinceajwtalgnonevuln.com/
1. fabian2k · 1790784307 · focus · HN ↗
  Someone not verifying the signature at all is not a mistake where you can blame the JWT spec itself.
  1. buckle8017 · 1790785509 · focus · HN ↗
    JWT is complicated.
    Complexity is a spec failure in security issues.
    It's that simple.
  2. meindnoch · 1790786943 · focus · HN ↗
    They did verify the signature, and it was correct according to the "none" algorithm.
    alex_suzuki · 1790787305 · focus · HN ↗
    “Works as designed.”
    fabian2k · 1790788148 · focus · HN ↗
    Argh, I missed that it actually uses the "none" algorithm. Yeah, the existence of that option is extremely dumb and it shouldn't be possible to use that. I misread the post and thought it was a regular JWT, but they simply didn't validate it.
    teamolHuang · 1790842897 · focus · HN ↗
    They edited the payload first but signature was never changed. A JWT's signature changes if payload changes; so it was never about the "none" algo, it was that Microsoft never validated the JWT with their signing key.
    JWT is a great tool, Microsoft just failed to use it correctly.
2. Perz1val · 1790784631 · focus · HN ↗
  Idk if that's not too much of an oversimplification, maybe more like JWTs are an indicator/enabler of architecture level bugs?
3. skhameneh · 1790785268 · focus · HN ↗
  Other commenters are suggesting you can’t blame the spec for end implementation mistakes, except that’s one of the many issues - JWT being so error-prone is a problem.
  I use JWT just for handling of tokens, because it’s so well supported, but I won’t use it for anything more than token storage _because_ it is so vulnerable to mistakes.
  The fact that mistakes are so easy to make is indicative of poor design in the spec itself.
4. talon8635 · 1790786318 · focus · HN ↗
  Does this extend to OIDC? I’m not knowledgeable on the topic but it uses JWT right? Is it also prone to poor implementation? If you just error on alg=none does that solve it?
sdcfgy · 1790783717 · focus · HN ↗
Wait until someone does that to your favourite cloud provider's customer data.
1. ocdtrekkie · 1790798724 · focus · HN ↗
  Entra has already had vulnerabilities where a user in one tenant could access global admin of every other tenant. Somehow everyone didn't immediately move off Microsoft's cloud platforms.
john_strinlai · 1790784441 · focus · HN ↗
>Microsoft had editorial control over this post, cutting sections and figures and reshaping how the impact is described before publication.
that is... not great. shame on microsoft.
its actions like that which shed light on why we get the nighmare eclipses of the world. pressuring a kid into handing over full editorial control of a disclosure is gross.
1. igleria · 1790785605 · focus · HN ↗
  reminds me of a former job in which my goodbye letter was heavily editorialized...
  1. the__alchemist · 1790790330 · focus · HN ↗
    Would love to hear more.
    ceroxylon · 1790791708 · focus · HN ↗
    I will tell my story: I found a huge accounting error that allowed for several employees to embezzle funds. I disclosed it to the main stakeholders and some people went to jail. The accounting team still refused to acknowledge that the mistake was theirs, so I left on principle.
    A few weeks later, I was talking to an old colleague and they revealed that the story that came from stakeholders was that the accounting team found the error, and I left in disgrace (despite that not being my department?).
    So if you find an embarrassing mistake and you do not control the narrative, you have to proceed very carefully.
    sdcfgy · 1790795035 · focus · HN ↗
    Had one like that. I quit and they blamed me for a project failure after the fact. That pissed off a couple of colleagues who thought it might happen to them. They also quit leaving them entirely without a software team. Set them back ten years because they didn’t make the market in time.
    Write everything down and make sure everyone knows you’re writing it down. Saves a lot of hassle like that.
    itslennysfault · 1790796982 · focus · HN ↗
    > the story that came from stakeholders was that the accounting team found the error, and I left in disgrace (despite that not being my department?).
    That sounds like defamation to me.
    igleria · 1790931691 · focus · HN ↗
    I don't have the full letter at hand, but basically: - new job paid almost 3x than this one - I was the sole maintainer of an important project and they had no one else
    so they made me not tell anyone I was leaving, and the letter was edited to make it less obvious how much of a better opportunity the new job was.
2. rkagerer · 1790785640 · focus · HN ↗
  Love to hear more on the motivation for agreeing to this.
  e.g. The $5000? Amnesty from being sued?
  1. srdjanr · 1790786121 · focus · HN ↗
    Also he's 16. I'd definitely be less willing to push back (especially on something like this) at his age
    p-e-w · 1790790526 · focus · HN ↗
    Of course not. You don’t push back on something like that. You hire a lawyer and let them do the pushing for you. If you contact the right NGO, they might even give you one for free.
    There’s no way I’d sign any agreement with a company like Microsoft regarding an issue like that without a lawyer. I’d rather not disclose at all if those were the only options.
    saghm · 1790791260 · focus · HN ↗
    I don't know about you, but when I was 16, I never hired a lawyer, and none of the other 16 year olds I knew had either
    snapplebobapple · 1790791679 · focus · HN ↗
    I've seen hackers. Even if you do it right you're still going to get banned from the internet till you are 18 and dating Angelina Jolie is not the draw it was 20 years ago....
    stronglikedan · 1790796909 · focus · HN ↗
    > dating Angelina Jolie is not the draw it was 20 years ago....
    not not either. where do I sign up?
    eecc · 1790800314 · focus · HN ↗
    She’s glorious in the movie, though she does play the part of an extremely high maintenance woman uncannily well…
    dfxm12 · 1790800848 · focus · HN ↗
    There are so many great one liners in that move. An underrated one is when Dade's mom opens the door, sees Acid Burn and says "now I see what all the fuss is about".
    patmorgan23 · 1790803380 · focus · HN ↗
    I mean when you're sixteen, you can sign a legally binding contract (might depend on the jurisdiction). Usually you have to be above the age of majority (18) or be emancipated before you can enter into a binding contract.
    0x1ch · 1790794686 · focus · HN ↗
    At that age in the mid 2000s, I would be foaming at the mouth to tell a FANG company to eat dirt over something like a disclosure + unpaid bounty. But if he got the money and didn't negotiate... You live and you learn.
    xeromal · 1790806673 · focus · HN ↗
    iamverybadass
    0x1ch · 1790810444 · focus · HN ↗
    Well yeah. Why else would you tell off a massive company in the FANG circle as a budding security researcher in their teens.
    drfloyd51 · 1790810997 · focus · HN ↗
    A good move is to negotiate in good faith. You show you can’t be pushed around and you are able to be civil. And most importantly, you know your worth.
    mulmen · 1790831708 · focus · HN ↗
    [delayed]
  2. icantevenhold · 1790786966 · focus · HN ↗
    Not getting your life ruined by getting sued by a trillion dollar company sounds like a pretty good motivation
    whatsdowndog · 1790814306 · focus · HN ↗
    [dead]
  3. john_strinlai · 1790792904 · focus · HN ↗
    i think the answer is simple: they're a kid, and microsoft bullied them.
  4. menomatter · 1790795396 · focus · HN ↗
    Speaking of being sue, I once found a hole in a healthcare system. I solicited legal advice and the response was overwhelmingly against reporting. The company didn’t not have a bounty program. So I shut up knowing my info is sitting there exposed. I wonder what’s the consensus on this? Do people normally report it or not?
    On some forms I was advised to report hippa complaint. I can’t remember if I did. This was 10 or more years ago.
    john_strinlai · 1790795705 · focus · HN ↗
    >Do people normally report it or not?
    if you are reporting it for moral/ethical reasons, but are worried that the company will have a shitty response, report it anonymously to the company and any relevant regulatory bodies.
    but most companies, even without a bounty program, are happy to receive reports. a lack of a bounty program isn't really an indicator of how they will treat reporters, as most companies are ill-equipped to have a proper bounty program.
    otherwise, and i know this is an unpopular opinion here, but i'm a big advocate of just posting the exploit publicly when a company makes it hard/scary to report it to them.
    Computer0 · 1790796379 · focus · HN ↗
    don't worry you are popular with me
    menomatter · 1790797840 · focus · HN ↗
    My issue was knowing that reporting would allow them to possibly discover my identity. Discovering the vul in itself may instead be considered unauthorized access.
    SahAssar · 1790796179 · focus · HN ↗
    I think my take would be to report it anonymously (via support/marketing/etc.) and in the report strongly encourage them to create a path for security reports (either via a bounty or just a security email). When fixed or actually dismissed post publicly on anonymous channels, with a section saying how they could have created a channel for these reports.
  5. mikeryan · 1790798858 · focus · HN ↗
    Sounds like he’s gotten bug bounties from MS in the past. Might be forward thinking to keep the relationship amicable going forward.
    Giving the benefit of the doubt to Microsoft it seems like a pretty complete write up. If the changes weren’t material that might have been part of it too.
    And he’s 16. Parents might have had a say.
3. xyst · 1790800253 · focus · HN ↗
  _I am jack's complete lack of surprise_
  This is a company that has engaged in heavy monopolistic behavior and violating US anti-trust laws with reckless abandon. They have even pioneered the infamous "embrace, extend, extinguish" strategy.
  M$ will never change. The modus operandi is always the same, regardless of which ever lame MBA douchebag is running the shit show.
  If we want to actually care , rather than spew off platitudes, break up big tech.
  1. iwontberude · 1790808025 · focus · HN ↗
    [dead]
4. aw4rzs · 1790801751 · focus · HN ↗
  They should have paid him at least a $1 million bounty if they're going to ask for editorial control of the disclosure.
5. saidnooneever · 1790866233 · focus · HN ↗
  this is normal for responsible disclosure. its how u can keep to post about such things. if they paid out a bounty i see no issue. its a collaboration between 2 parties.
verst · 1790784470 · focus · HN ↗
There is an internal library at Microsoft that reliably avoids all these JWT problems - Microsoft Identity Service Essentials (MISE). Adopting MISE and upgrading to the latest versions of it have been part of the Secure Future Initiative (SFI) that can be read about in the news of previous years. Unfortunately it sounds like the service team intentionally deferred the compliance alerts they will have received.
1. jhfdbkofdchk · 1790785586 · focus · HN ↗
  There is so much work to do for SFI that is still being ignored. The only way that some of these services will update is by being the target of the red team, security researcher, or threat actor.
  1. verst · 1790786058 · focus · HN ↗
    And all of that is definitely happening.
    That being said, just last night I observed that the identity team is now opening up agent-assisted PRs against individual service team repos to force MISE adoption and upgrade to the latest version and best practices. I think that's a great thing because many individual service teams simply lack the bandwidth or knowledge. Prior to GenAI availability I wasted many cycles on this kind of work. While GenAI made it easier - internal source documentation still does not unambiguously address every use case. So having the identity team drive this now with the help of agent sessions initiated by them is great.
throwaway2037 · 1790784510 · focus · HN ↗
```
    &gt; Hey! I’m Faav. A little over a year ago, when I was 15, I published Break into any Microsoft building: Leaking PII in Microsoft Guest Check-In, my first Microsoft write-up. I’m 16 now, and this one is a little bigger.
```
Damn, these guys got schooled by a 15 year old! Say less...
1. bsoqk · 1790785849 · focus · HN ↗
  You assume that whoever was responsible for the implementation of this feature cares in the slightest beyond “it seems to work”.
  1. lurk2 · 1790789313 · focus · HN ↗
    His comment didn’t assume that at all.
    bsoqk · 1790811083 · focus · HN ↗
    It’s the way I interpreted the “got schooled” part. If you don’t try your best, or in fact do the bare minimum, if someone beats you they can’t say they “schooled” you.
  2. ToucanLoucan · 1790789356 · focus · HN ↗
    Honestly that series of blog posts that came across here semi-recently about what an utter disaster the Azure team is (through little fault of their own, mind you), combined with a lot of things I've read about the development behind Halo Infinite, have convinced me Microsoft is to avoided whenever possible. It's not even that they're too big to care, though that is an issue. It's that organizationally they are SO reliant on short-term contractors and junior devs plugging away with copilot, along with an ever more exhausted group of seniors who actually work for them but are continually disempowered, that I think it's safe to say anything they manage to ship is a minor miracle if it works at all, and it's certainly not going to have any guarantee at all of solid software engineering fundamentals.
    And to be clear, this is not an issue with them using contractors, overseas or otherwise, or with their senior dev staff, or even with AI really. It's an issue with them organizationally being so incredibly penny-pinching, and so dedicated to shipping new shit versus fixing anything long term, constantly chasing new revenue and letting their existing offerings rot.
    If a Microsoft product is good nowadays, it is literally a miracle.
  3. TeMPOraL · 1790791182 · focus · HN ↗
    You assume there is any actual reason to care more than that in this case.
  4. ocdtrekkie · 1790791521 · focus · HN ↗
    Physical security vendors usually stop exactly there. I can't count how many vendors responsible for badge systems shut off the Windows Firewall just because it’s easier than adding a rule.
sophietaylor · 1790784869 · focus · HN ↗
[dead]
rdtsc · 1790785405 · focus · HN ↗
> {"alg":"none","typ":"JWT"}
I don't know how this ever became a thing that was allowed into the spec and then picked from the spec and implemented in various implementations.
1. flowerlad · 1790789214 · focus · HN ↗
  It should be retroactively removed the spec, and all implementations should remove the "none" algorithm. It is a huge security hole.
2. pixl97 · 1790789851 · focus · HN ↗
  Yea, and it was a big issue years ago. I can't believe there is any modern implementation that has it.... or another way to put this is, how old is this damned implementation they are using?
3. huflungdung · 1790794937 · focus · HN ↗
  [dead]
nenadg · 1790787774 · focus · HN ↗
You should have.
gnarlouse · 1790788394 · focus · HN ↗
If a 15yo can find it
advael · 1790789084 · focus · HN ↗
This is a pretty typical example of the security posture of microsoft, and yet people continually buy their arguments that open-source and therefore auditable alternatives are inherently less secure than their "trust me bro"
moat · 1790790544 · focus · HN ↗
This kid is 16?
Can’t wait to see what he’s up to in 10 years.
1. Ylpertnodi · 1790817879 · focus · HN ↗
  Ai. Saving us from.
starkeeper · 1790793726 · focus · HN ↗
Only $5K when you saved them millions. Pretty cheap!
huflungdung · 1790794808 · focus · HN ↗
[dead]
froggertoaster · 1790796217 · focus · HN ↗
Geohot vibes
charcircuit · 1790800906 · focus · HN ↗
Seriously, who is responsible for "none" JWT tokens. It has caused so many critical security bugs over the years.
RajT88 · 1790801991 · focus · HN ↗
Microsoft? Antares?
<.<
>.>
waws!
zk · 1790805066 · focus · HN ↗
The kicker... only 5k reward for this is insane. That said probably the attacker didn't need to run as many queries as they did...
09/17/26 - Awarded $5,000
darepublic · 1790806251 · focus · HN ↗
> I’m 16 now, and this one is a little bigger.
Holy! Child prodigy
jdw64 · 1790808143 · focus · HN ↗
I wish I had that kind of talent at 16 too... I'm jealous.
hmokiguess · 1790819952 · focus · HN ↗
How many times has Microsoft gone through this? I feel like I remember a similar one with Active Directory a few years back.
Sytten · 1790826750 · focus · HN ↗
Always happy when I see software I built being used to hack cool targets. Very nice finding!
FlameWolf · 1790827032 · focus · HN ↗
> I pulled 2023 snapshots of Titan’s login and privacy pages from the Wayback Machine
Great, give them one more reason to attack WBM.
kmoser · 1790828869 · focus · HN ↗
Even more impressive to me than finding the bug is the clear way the article was written. Even if they used AI to write it (which I don't think they did), it reveals an incredible maturity and ability to communicate a complex topic.
1. breakingcups · 1790854060 · focus · HN ↗
  There are enough tells in there that I'd definitely wager it was co-written by AI
aghuang · 1790833706 · focus · HN ↗
What was the process in this?
Amekedl · 1790850060 · focus · HN ↗
Any APT group would have spent enormous time on securing this treasure trove, and moved to extortion.
Corporations, like Microsoft, offering 5 grand to that in comparison seems just lackluster.
Relationship and whatnot, pay that teenager 100k is what I'd say, really.
Offering him a job, that would be cool too.
In any case, I'm hoping stuff like this really remains a "once in a lifetime" opportunity for pen-testers and whatnot.
Having the planet hacked twice a day makes for a stressful future for everyone.
jakedata · 1790871769 · focus · HN ↗
He could have protected that data by dropping all the tables.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.