https://bit.ly/3RbZEaD - π In the first half of July, Microsoft revealed that Chinese hacking group, Storm-0558, accessed emails from approximately 25 entities, some of which were US government agencies. The breach was a result of a series of internal mishaps. The gravity of safeguarding extensive software infrastructure, especially in today's digitally vulnerable age, cannot be overemphasized. #Cybersecurity #MicrosoftBreach π‘ Microsoft's probe discovered that Storm-0558 infiltrated corporate and government emails using a "Microsoft account consumer key," granting them permission to generate access tokens to their victim's accounts. #Storm0558 #DigitalSecurity π This key was inadvertently left in a system "crash dump" due to a cascade of errors reminiscent of a Rube Goldberg machine. Though Microsoftβs systems should've identified the sensitive "key material" in the crash dump, they failed to do so. As a result, engineers mistakenly believed the dump was devoid of sensitive data, leading to its transfer from a protected network to the company's debugging environment. #TechMishap #DataBreach π« In a following misstep, a credential scan that should've identified the key's presence overlooked it. Storm-0558 later breached a Microsoft engineer's corporate account, gaining access to the debugging environment, which improperly contained the key. Although Microsoft can't definitively confirm this sequence, they believe it's the likely path taken by the hackers. #HackerAccess #SystemVulnerability π Interestingly, the exploited key was intended for consumer use, yet it allowed intruders entry into Microsoft's enterprise accounts. Microsoft started using common key metadata publishing in 2018, but failed to update authentication systems. Consequently, mail system engineers, believing the updates were in place, didnβt implement extra authentication, causing the system to be oblivious to the key type used. Had the updates been applied, Storm-0558 might not have accessed the enterprise accounts. #KeyAuthentication #EnterpriseSecurity β Microsoft claims to have resolved these issues and is perpetually enhancing its systems. Despite these affirmations, critics, including Senator Ron Wyden and Tenable CEO Amit Yoran, have censured Microsoft's security methods, with some labeling them as "negligent" and others suggesting the company's sluggish response to security vulnerabilities.
