4 ms·
Inactive but not revoked. They revoked it on June 27th. Still I do see there was a flaw in the GetAccessTokenForResource API. > "No key-related actor activity
by nazgulsenpai 3y ago
Inactive but not revoked. They revoked it on June 27th. Still I do see there was a flaw in the GetAccessTokenForResource API.
> "No key-related actor activity has been observed since Microsoft invalidated the actor-acquired MSA signing key," Microsoft said.
- croes 3y agoYep, MS botched it, again >The actor used an acquired MSA key to forge tokens to access OWA and Outlook.com. MSA (consumer) keys and Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems. The actor exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/ https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-...