4 ms·
I thought the issue was that the attackers had an Azure AD signing key.[0] I was under the impression it was an inside job. [0] https://www.bleepingcomputer.co
by nazgulsenpai 3y ago
I thought the issue was that the attackers had an Azure AD signing key.[0] I was under the impression it was an inside job.
[0] https://www.bleepingcomputer.com/news/microsoft/microsoft-still-unsure-how-hackers-stole-azure-ad-signing-key/ https://www.bleepingcomputer.com/news/microsoft/microsoft-st...
- jsnell 3y agoNo, and your own link says otherwise, i.e. that it was an "inactive Microsoft account (MSA) consumer signing key". But in addition to letting the key get compromised, their code for validating the signatures had vulnerabilities and allowed a consumer signing key to be used to sign AD tokens.
- nazgulsenpai 3y agoInactive but not revoked. They revoked it on June 27th. Still I do see there was a flaw in the GetAccessTokenForResource API. > "No key-related actor activity has been observed since Microsoft invalidated the actor-acquired MSA signing key," Microsoft said.
- croes 3y agoYep, MS botched it, again >The actor used an acquired MSA key to forge tokens to access OWA and Outlook.com. MSA (consumer) keys and Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems. The actor exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/ https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-...