Facebook twitter, Social media service

Chennai, March 3 Microsoft has awarded a Chennai-based security researcher $50,000 (approximately Rs 36 lakh) for spotting vulnerability on the company's online services that "might have allowed anyone to takeover any Microsoft account without consent".After assessing his report, the Microsoft security team patched the issue and rewarded him $50,000 as a part of their Identity Bounty Program, security researcher Laxman Muthiyah wrote in a blog post on Tuesday.Muthiyah earlier won bug bounty from Facebook for finding a similar account takeover vulnerability in Instagram."I found Microsoft is also using the similar technique to reset user's password so I decided to test them for any rate limiting vulnerability," he said.Muthiyah explained that to reset a Microsoft account's password, users need to enter email address or phone number in their forgot password page. After that they will be asked to select the email or mobile number that can be used to receive the security code.Once they receive the 7-digit security code, they will have to enter it to reset the password."Here, if we can bruteforce all the combination of 7 digit code, we will be able to reset any user's password without permission. But, obviously, there will be some rate limits that will prevent us from making a large number of attempts," he said.After several days of efforts, he was able to spot the account takeover flaw."Immediately, I recorded a video of all the bypasses and submitted it to Microsoft along with detailed steps to reproduce the vulnerability. They were quick in acknowledging the issue," Muthiyah said.( With inputs from IANS )Disclaimer: This post has been auto-published from an agency feed without any modifications to the text and has not been reviewed by an editor

Facebook TwitterFOLLOW

Facebook twitter, Latest News

New Delhi, March 12 Facebook has allowed content creators to now monetise and earn from all video types, ... ...

The Odisha CB-CID on Thursday informed the NHRC that it has asked the law enforcement response team, Facebook Security, California for the production of documents with respect to the Facebook account of Aditya Dash, a whistleblower who was allegedly ...

Bengaluru, March 10 Bengaluru police on Wednesday arrested three computer programmers from Nagaland who allegedly hacked former Karnataka ... ...

Aurangabad, March 8: Cidco MIDC police have registered an offence against Malegaon's youth on the charge of physically exploiting ... ...

A new study has found that pandemic-related anxiety, boredom, and irregular routines were cited as major drivers of increased nicotine and tobacco use during the initial COVID-19 lockdown. ...

The growing prowess of India in the field of economy, as well as technology, has garnered the attention of tech giants across the world. ...

Nagpur, Mar 3 A police inspector working in the city police department has been absconding after marrying a widow. ... ...

Chennai, March 3 Microsoft has awarded a Chennai-based security researcher $50,000 (approximately Rs 36 lakh) for spotting vulnerability on ... ...