Researcher finds unsigned-token flaw exposing 17.3 trillion Microsoft data rows: the jokes

Windows 11 setup: Please sign in with a Microsoft account to use the laptop you paid for. Microsoft analytics service holding an estimated 17.3 trillion rows: Token says "administrator"? Didn't check the signature. Come on in.

Microsoft Clarifies Mandatory Account Sign-In Applies to Your Personal Laptop, Not to Its Own Service Holding an Estimated 17.3 Trillion Rows

Microsoft makes you sign in with an account to open Notepad on your own laptop, but let an unsigned login token into a service with an estimated 17.3 trillion rows of its data. Turns out the account requirement was always about you.

KB5061730 release notes: - Fixed an issue where an internal analytics service read the name on login tokens but not the signature. - Tokens claiming to be an administrator must now also be one. Rows affected: est. 17.3 trillion. Your PC will restart in 10 minutes. It was not involved.

Known issues: Some users could run SQL as an administrator without credentials. Workaround: Be honest about who you are. Status: Fixed. Signatures are now checked on the service holding an estimated 17.3 trillion rows. Your PC will restart in 10 minutes to celebrate.

Microsoft clarifies that login token signature verification is included in Microsoft 365 E5 Security with the Copilot add-on. The internal service holding an estimated 17.3 trillion rows was on a tier where tokens are accepted on trust.

IT admin: Why did the service run SQL for an unsigned token? Microsoft licensing: Signature checks require E5. IT admin: The token claimed to be an administrator. Microsoft licensing: Then it qualifies for administrator pricing.

Clippy, appearing in the SQL console of a Microsoft analytics service: "It looks like you're trying to become an administrator with a token nobody signed. Would you like help? Never mind. The server already said yes."

Clippy was retired for being too eager to help strangers. At least he never ran their SQL as an administrator because they typed the word into a login token.

Credentials required: 0. Rows reachable: an estimated 17.3 trillion. Microsoft's best return on zero investment this year, Copilot included.

Microsoft Internal Analytics Service Achieves Record Efficiency, Serving an Estimated 17.3 Trillion Rows With Zero Credentials Required

The most security-conscious party in Microsoft's 17.3-trillion-row exposure was the person breaking in. Handed admin SQL, they read table descriptions, took small samples and filed a report. Microsoft's contribution was not checking the signature.

Researcher Granted Administrator Access to an Estimated 17.3 Trillion Microsoft Rows Uses It Mainly to Read the Labels and Email Microsoft