\n<\/p>\n
In the first half of July, Microsoft disclosed<\/a> that the Chinese hacking group Storm-0558 had gained access to emails from around 25 organizations, including agencies in the US government. Today, the company is explaining how<\/a> that happened thanks to a series of internal errors while sharply underscoring just how serious a responsibility it is to maintain massive, growing software infrastructure in an increasingly digitally insecure world.<\/p>\n<\/div>\n According to Microsoft\u2019s investigation summary, Storm-0558 was able to gain access to corporate and government emails by obtaining a \u201cMicrosoft account consumer key,\u201d which let them create access tokens to their targets\u2019 accounts.<\/p>\n<\/div>\n Storm-0558 obtained the key after a Rube Goldberg machine-style series of events put the key somewhere it should never have been in the first place. The company writes that when the system made a debugging snapshot of a process that had crashed, it didn\u2019t strip, as it should have, the so-called \u201ccrash dump\u201d of all sensitive information, leaving the key in.<\/p>\n<\/div>\n Microsoft\u2019s systems still should have detected the \u201ckey material\u201d in the crash dump, but apparently, they didn\u2019t. So when company engineers found the dump, they assumed it was free of sensitive data and transferred it, key and all, from the \u201cisolated production network\u201d to the company\u2019s debugging environment.<\/p>\n<\/div>\n Then another fail-safe \u2014 a credential scan that should have also caught the key \u2014 missed that the key was there. The final gate fell when Storm-0558 managed to compromise a Microsoft engineer\u2019s corporate account, giving the hackers access to the very debugging environment that never should have had the key to begin with. <\/p>\n<\/div>\n Microsoft writes that it has no logs showing evidence this is how the key was shuffled out of its systems but says it\u2019s the \u201cmost probable\u201d <\/em>route the hackers took.<\/p>\n<\/div>\n There\u2019s one final kicker: this was a consumer<\/em> key, but it let threat actors get into enterprise Microsoft accounts. Microsoft says it began using common key metadata publishing in 2018 in response to demand for support software that worked across both consumer and enterprise accounts. <\/p>\n<\/div>\n The company added that support, but it failed to make the proper updates to the systems used to authenticate keys \u2014 that is, determine whether they\u2019re consumer or enterprise keys. Mail system engineers, assuming the updates had been made, built in no additional authentication, leaving the mail system blind to what sort of key was used.<\/p>\n<\/div>\n In short, had those libraries been updated properly, even given all the other failure points<\/em>, Storm-0558 hackers might not have been able to access the enterprise email accounts used by the corporations they targeted.<\/p>\n<\/div>\n Microsoft says it has corrected all of the issues above, including the error that sent the signing key to the crash dump in the first place. The company adds in its post that it is \u201ccontinuously hardening systems.\u201d Microsoft has increasingly come under fire for its security practices, which both Senator Ron Wyden (D-OR) and Tenable CEO Amit Yoran have called \u201cnegligent,\u201d with Yoran accusing Microsoft of being too slow<\/a> to react to its security flaws.<\/p>\n<\/div>\n