16-year-old researcher found a Microsoft bug, got admin access to databases with 17.3 trillion rows

A 16-year-old security researcher named Faav found an authentication flaw in Microsoft’s Titan analytics service that allowed him to gain administrator access, submit unauthorized SQL queries with no valid credentials, and potentially reach analytics databases containing an estimated 17.3 trillion stored rows. Titan is an …

[elsergiovolador]

Rows

Imagine how many rows a 17-year-old researcher could find.

[af108]

A 5k reward?!

Don’t give him a 5k reward. Give him a job, and a 6 figure salary!

[jake]

Re: A 5k reward?!

Better this way.

He's got some exposure as a youngster ... and learned that Microsoft is run by money-grubbing shysters.

[Dan 55]

Re: A 5k reward?!

Money-grubbing shysters who censored his write-up too.

[Elongated Muskrat]

Re: A 5k reward?!

Yeah, my thoughts were immediately that this would be worth way more than $5k to a black hat, and if Microsoft were serious about security, and saving money in the long run, they would make reporting bugs to them much more attractive.

The next teenage wunderkind that finds a honking great vulnerability like this (and ther undoubtable are others out there waiting to be found) is likely to read about this and think, "well, I guess I could get $5k and a mid-range holiday out of this, or I could see how much it's worth on the dark web". Teenagers are notorious for not always making good decisions, so there's a very good chance that this won't end well for MS in the long run.

In other words, their rewards should be commensurate with the risk that has been mitigated, or they'll find that those risks get exploited instead.

[Paul Herber]

Microsoft: In order for our admin team to pay your bounty you need to put all the data on a floppy disk and put it in the post to us.

[Fruit and Nutcase]

It's 2 am. Do you know what your teen is doing?

Do you know what your teen[man in the Oval Office] is doing?

https://www.theregister.com/ai-and-ml/2026/09/30/trump-decrees-era-of-super-intelligence-upon-us/5300213

[Snowy]

I'm quite sure

At my age I shouold not know what a teen is doing at 2AM, let alone thinking about it!!

[jake]

Re: I'm quite sure

Not even your own kids?

[the Jim bloke]

You forgot the air-quotes

Calling a 16 year old a 'security researcher', is as valid as calling someone browsing porn an 'anatomy researcher', or an onlyfans poster, an 'influencer'.

As a juvenile, I didnt have much respect for the law, and did not think it applied to me.

As an adult, I dont have much respect for the implementation of the law, and hope it does not get applied to me.

[simonlb]

Re: You forgot the air-quotes

"As an adult, I dont have much respect for the implementation of the law, and hope it does not get applied to me."

Yeah, when I was 16 I could hold up a blank piece of paper and people would just look and shrug. Now I'd get put away for 18 months.

[jake]

Re: You forgot the air-quotes

Not too long ago at least some of the adults would have paid attention ...

In 1977, I was talking to a hippy kid at Berkeley who was holding up a blank sheet of cardboard. A guy I knew, Korean War veteran who was finally resuming his post-grad engineering studies a couple decades late, slammed on the brakes of his bike and skidded to a halt. He looked at the sign, and the kid, and asked a one word question: "Hell?" The kid nodded in the affirmative. "Right on", said the Vet, and added "Enjoy the music, bur don't go there, trust me." and then continued on his way.

The kid told us us both years later that if it wasn't for that chance meeting, he probably would have turned to drugs ... he was right on that edge.

[jake]

Re: You forgot the air-quotes

Oh, I dunno ... My granddaughter is finding (and reporting, and patching) bugs in perl and C and the Linux kernel.

Nobody knows, or cares, how old she is.

She is all of 14.

[Bebu sa Ware]

How long does it take to DELETE 17 trillion rows ?

Would have been interesting to find out. Perhaps next time.

[Elongated Muskrat]

Re: How long does it take to DELETE 17 trillion rows ?

TRUNCATE TABLE is nice and quick. Let's hope Microsoft have better database backups than they have for people's 365 accounts.

[Stephen7Eastern]

Re: How long does it take to DELETE 17 trillion rows ?

Unlike delete, truncate is not logged. So the destruction is instant and the data is gone with zero recourse other than restore from backup.

[Elongated Muskrat]

Re: How long does it take to DELETE 17 trillion rows ?

I somehow doubt a database with 17 trillion rows would have a recovery model that included full logging anyway, simpley because of the storage requirements this would entail, but yes. That's exactly why it's quick.

[John_Ericsson]

"17.3 trillion rows"

... this feeds into my theory that databases are just one big spreadsheet. So why are we paying DB admins so much???

[Anonymous Coward]

Give your users a 17.3 trillion row spreadsheet and see how well they get on with it.

[Adrian Richards]

To be fair...

To be fair, 17.3 trillion rows isn't a low these days.

[Randy Hudson]

The first rule of server-side security is "never trust the client" (aka "never trust the input"). Unfortunately this is too common. There are MANY more services out there that blindly allow the client to tell the server who the user is, without any checks in place.

[Anonymous Coward]

The only thing that could be better is if he'd asked "copilot"

Micro$oft do claim it can solve all your problems

[Tim99]

17.3 trillion rows

Back in the days of SQL Server 6, a 17 *million* row database was considered a pretty respectable size by many...