hackers stole a digital consumer key from Microsoft to gain unfettered access to US government emails and the tech giant has detailed how the cyber criminals pulled off one of the biggest heists in the corporate and government circles.
China-based threat actor, Storm-0558, used an acquired Microsoft account (MSA) consumer key to forge tokens to access OWA (Outlook Web App) and Outlook.com.
“Our investigation found that a consumer signing system crash in April of 2021 resulted in a snapshot of the crashed process (crash dump). The crash dumps, which redact sensitive information, should not include the signing key,” the company said after a technical investigation.
In this case, a race condition allowed the key to be present in the crash dump (this issue has been corrected).
“The key material’s presence in the crash dump was not detected by our systems (this issue has been corrected),” said Microsoft.
The hackers used that digital skeleton key to break into both the personal and enterprise email accounts of government officials hosted by Microsoft.
“We found that this crash dump, believed at the time not to contain key material, was subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network,” explained the company.
After April 2021, when the key was leaked to the corporate environment in the crash dump, the Storm-0558 actor was able to successfully compromise a Microsoft engineer’s corporate account.
This account had access to the debugging environment containing the crash dump which incorrectly contained the key.
“Due to log retention policies, we don’t have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key,” Microsoft added.
