Chennai researcher awarded ₹36 lakh from Microsoft
Microsoft has awarded a Chennai-based security researcher approximately Rs 36 lakh for spotting vulnerability on the company’s online services that “might have allowed anyone to takeover any Microsoft account without consent.
The bug would "have allowed anyone to takeover any Microsoft account without consent permission", Laxman Muthiyah wrote in a blog. Microsoft patched the issue after Muthiyah reported it and awarded him as part of their Identity Bounty Program.
After assessing his report, the Microsoft security team patched the issue and rewarded him $50,000 as a part of their Identity Bounty Program, security researcher Laxman Muthiyah wrote in a blog post on Tuesday. Muthiyah earlier won bug bounty from Facebook for finding a similar account takeover vulnerability in Instagram.
Muthiyah said that to reset a Microsoft account’s password, users need to enter email address or phone number in their forgot password page. After that they will be asked to select the email or mobile number that can be used to receive the security code.
Once they receive the 7-digit security code, they will have to enter it to reset the password. “Here, if we can bruteforce all the combination of 7 digit code, we will be able to reset any user’s password without permission. But, obviously, there will be some rate limits that will prevent us from making a large number of attempts,” he said. After several days of efforts, he was able to spot the account takeover flaw.
“Immediately, I recorded a video of all the bypasses and submitted it to Microsoft along with detailed steps to reproduce the vulnerability. They were quick in acknowledging the issue,” Muthiyah said.
SBS Corp with Dassault Systemes to deliver digital transformation solutions
SBS Corp and a value-added reseller for Dassault Systèmes will provide Dassault Sys...
Qlik with AWS to boost Cloud Analytics with SAP Data
Qlik has announced a further expansion of its relationship with Amazon Web Services (AWS)...
Oracle teams up with HackMakers to help incubate data driven ideas for a better world
Oracle is collaborating with virtual hackathon specialists, HackMakers, for two virtual ha...
Industry 4.0 is an important transition in the manufacturing sector: Dr VK Saraswat
Dr V K Saraswat, Member, NITI Aayog today said that there is a need to push the Make...
Global Cloud Experts Gather to Address Roadmap for Cloud-First Approach in the Kingdom
Endorsed by Saudi Cloud Computing Association, World Cloud Show is gearing up to virtually...