Home »  Website »  National »  Kerala-Based Engineer Spots Bug In Microsoft Software, Gets Bounty

Kerala-Based Engineer Spots Bug In Microsoft Software, Gets Bounty

The Kerala-based security engineer also received bug bounty from Facebook last year for discovering a bug in the social networking platform.

Kerala-Based Engineer Spots Bug In Microsoft Software, Gets Bounty
Sahad NK, the Kerala-based security engineer.
Kerala-Based Engineer Spots Bug In Microsoft Software, Gets Bounty
outlookindia.com
2018-12-12T14:24:10+0530

After discovering vulnerabilities in the products of Microsoft, that could affect over 400 million users as it left them open to hacking, a Kerala-based application security engineer has won bug bounty from the tech giant.

Sahad NK, who works as a security researcher with cybersecurity portal Safetydetective.com, came across multiple vulnerabilities that, when chained together, allow an attacker to take over any Microsoft Outlook, Microsoft Store, or Microsoft Sway account simply via the victim clicking on a link.

A bug bounty is an incentive offered by many tech companies, websites and software developers for finding and reporting bugs pertaining to exploits and vulnerabilities.

"Immediately after finding these vulnerabilities, we contacted Microsoft via their responsible disclosure programme and started working with them," said Safetydetective on Tuesday.

The vulnerabilities were reported to Microsoft in June and fixed by November end.

"While the vulnerability proof of concept was only made for Microsoft Outlook and Microsoft Sway, we expect it to affect all Microsoft accounts including Microsoft Store," said Sahad.

Sahad discovered that a Microsoft subdomain, "success.office.com", had not been properly configured. He also found bugs in Microsoft Office, Store and Sway products.

A string of bugs when chained together created the perfect attack to gain access to someone's Microsoft account -- simply by tricking a user into clicking a link.

"Anyone's Office account, even enterprise and corporate accounts, including their email, documents and other files, could have been easily accessed by a malicious attacker, and it would have been near-impossible to discern from a legitimate user," said TechCrunch.

Sahad, with the help of fellow security researcher Paulos Yibelo, reported the bug to Microsoft, which fixed the vulnerability and gave an unspecified amount as bug bounty to Sahad.

Several tech companies offer bug bounty incentives. Sahad also received bug bounty from Facebook last year for discovering a bug in the social networking platform.

IANS

Post a Comment


You are not logged in, To comment please / Register
or use
Next Story : J&K: 86 Security Men, 37 Civilians Killed In Terror Incidents In 2018
Download the Outlook ​Magazines App. Six magazines, wherever you go! Play Store and App Store
THE LATEST ISSUE
CLICK IMAGE FOR CONTENTS
Advertisement

OUTLOOK TOPICS :

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 0 1 2 3 4 5 6 7 8 9

or just type initial letters