Microsoft’s bug bounty: How this Kerala-based security engineer won an undisclosed amount

By: |
New Delhi | Updated: December 15, 2018 12:42:58 PM

Sahad discovered that a Microsoft subdomain, 'success.office.com', had not been properly configured and also found a bug in Microsoft Office, Store and Sway products.

Sahad had also received bug bounty from Facebook last year for discovering a bug in the social networking platform. (Facebook)

In a huge achievement, a Kerala-based application security engineer has won bug bounty from global tech-giant Microsoft for discovering a series of vulnerabilities that left over 400 million Microsoft users’ accounts open to hacking. Reportedly, these accounts were from Office 365 to Outlook emails.

Sahad NK, who works as a security researcher with cyber security portal Safetydetective.com, came across multiple vulnerabilities and reported to Microsoft. Sahad, with the help of fellow security researcher Paulos Yibelo, reported the bug to the company in June and were fixed by November end. This led to Microsoft giving an unspecified amount as bug bounty to Sahad.

Not only this, Sahad had also received bug bounty from Facebook last year for discovering a bug in the social networking platform.

Sahad discovered that a Microsoft subdomain, ‘success.office.com’, had not been properly configured and also found a bug in Microsoft Office, Store and Sway products.

The vulnerabilities when chained together, allow an attacker to take over any Microsoft Outlook, Microsoft Store, or Microsoft Sway account simply via the victim clicking on a link. When a string of bugs is chained together, it created the perfect attack to gain access to someone’s Microsoft account.

Safetydetective contacted Microsoft Immediately after finding these vulnerabilities via their responsible disclosure programme and started working with them.

Sahad told IANS that while the vulnerability proof of concept was only made for Microsoft Outlook and Microsoft Sway, he expects it to affect all Microsoft accounts including Microsoft Store.

The severity of the possibility of any breach can be understood by the fact that the vulnerabilities have the potential to access anyone’s Office account, even enterprise and corporate accounts, including their email, documents and malicious attackers could have easily accessed the data which could make it near-impossible to discern from a legitimate user.

Get live Stock Prices from BSE and NSE and latest NAV, portfolio of Mutual Funds, calculate your tax by Income Tax Calculator, know market’s Top Gainers, Top Losers & Best Equity Funds. Like us on Facebook and follow us on Twitter.

Next Stories
1Supreme Court puts Fortis sale to IHH Healthcare on hold
2RBI Governance: Under discussion – Board for further examination of framework
3Relief to RCom: Supreme Court tells govt to let it sell spectrum to Reliance Jio, but with a condition