5 ms·
Microsoft still unsure how hackers stole Azure AD signing key
- lockhouse 3y agoMy bet is on this being an inside job. Depending on what data the CCP was able to obtain from these state agencies, the bribe they paid or the leverage they held over them was probably a bargain.
- scrum-treats 3y agoThis tracks. We also saw trade secrets stealing from Apple recently [1]. [1] May 2023: https://www.theguardian.com/technology/2023/may/16/apple-employee-charged-stolen-self-driving-car-tech-china https://www.theguardian.com/technology/2023/may/16/apple-emp...
- rayrey 3y agoThis coupled with the “police stations” revelations earlier this year, sheds a light on how compromised some engineers may be…
- wkat4242 3y agoThey didn't use a HSM?? I know keys can be exported even from those but they are built for lots of money to prevent exactly that.
- beams_of_light 3y agoRight? They even sell dedicated HSM through Azure with their partner Thales. https://azure.microsoft.com/en-us/products/azure-dedicated-hsm/ https://azure.microsoft.com/en-us/products/azure-dedicated-h... A very small number of people should have access to their HSMs. This shouldn’t be too hard to figure out.
- freedude 3y agoPerhaps they got their HSM on a good deal from Aliexpress. https://www.aliexpress.com/w/wholesale-hardware-security-module.html?catId=0&initiative_id=SB_20230718094415&SearchText=hardware+security+module&spm=a2g0o.productlist.1000002.0 https://www.aliexpress.com/w/wholesale-hardware-security-mod...
- 1MachineElf 3y agoWhile I understand that Azure AD signing keys are used in a completely different context, would something like Certificate Transparency lower the impact of this if it had been part of Azure AD architecture?
- mvandermeulen 3y agoUnfortunately not. Certificate Transparency in this case wouldn’t provide any real benefit. If your private key is compromised then any access the key provides is also compromised. The main problem here is that the key was able to be used outside of its intended scope and that MS don’t seem to have the systems in place to detect inappropriate key use in a proactive manner
- 1MachineElf 3y ago>MS don’t seem to have the systems in place to detect inappropriate key use in a proactive manner I'm sorry, I thought this was the point of CT... Although I guess it depends on how one defines "proactive" in this context.