\n<\/p>\n
A series of unfortunate<\/span> and cascading mistakes allowed a China-backed hacking group to steal one of the keys to Microsoft\u2019s email kingdom that granted near unfettered access to U.S. government inboxes<\/a>. Microsoft explained in a long-awaited blog post this week how the hackers pulled off the heist. But while one mystery was solved, several important details remain unknown.<\/p>\n To recap, Microsoft disclosed in July that hackers it calls Storm-0558, which it believes are backed by China, \u201cacquired\u201d an email signing key<\/a> that Microsoft uses to secure consumer email accounts like Outlook.com. The hackers used that digital skeleton key to break into both the personal and enterprise email accounts of government officials hosted by Microsoft. The hack is seen as a targeted espionage campaign aimed at snooping on the unclassified emails of U.S. government officials and diplomats, reportedly including U.S. Commerce Secretary Gina Raimondo and U.S. Ambassador to China Nicholas Burns.<\/p>\n How the hackers obtained that consumer email signing key was a mystery \u2014 even to Microsoft<\/a> \u2014 until this week when the technology giant belatedly laid out the five separate issues that led to the eventual leak of the key.<\/p>\n Microsoft said in its blog post<\/a> that in April 2021, a system used as part of the consumer key signing process crashed. The crash produced a snapshot image of the system for later analysis. This consumer key signing system is kept in a \u201chighly isolated and restricted\u201d environment where internet access is blocked to defend against a range of cyberattacks. Unbeknownst to Microsoft, when the system crashed, the snapshot image inadvertently included a copy of the consumer signing key 1\ufe0f\u20e3 but Microsoft\u2019s systems failed to detect the key in the snapshot 2\ufe0f\u20e3.<\/p>\n The snapshot image was \u201csubsequently moved from the isolated production network into our debugging environment on the internet connected corporate network\u201d to understand why the system crashed. Microsoft said this was consistent with its standard debugging process, but that the company\u2019s credential scanning methods also did not detect the key\u2019s presence in the snapshot image 3\ufe0f\u20e3.<\/p>\n Then, at some point after the snapshot image was moved to Microsoft\u2019s corporate network in April 2021, Microsoft said that the Storm-0558 hackers were able to \u201csuccessfully compromise\u201d a Microsoft engineer\u2019s corporate account, which had access to the debugging environment where the snapshot image containing the consumer signing key was stored. Microsoft said it cannot be completely certain this was how the key was stolen because \u201cwe don\u2019t have logs with specific evidence of this exfiltration,\u201d but said this was the \u201cmost probable mechanism by which the actor acquired the key.\u201d<\/p>\n As for how the consumer signing key granted access to enterprise and corporate email accounts of several organizations and government departments, Microsoft said its email systems were not automatically or properly performing key validation 4\ufe0f\u20e3, which meant that Microsoft\u2019s email system would \u201caccept a request for enterprise email using a security token signed with the consumer key,\u201d 5\ufe0f\u20e3 the company said.<\/p>\n Microsoft\u2019s admission that the consumer signing key was probably stolen from its own systems ends a theory that the key may have been obtained elsewhere.<\/p>\n But the circumstances of how exactly the intruders hacked into Microsoft remains an open question. When reached for comment, Jeff Jones, senior director at Microsoft, told TechCrunch that the engineer\u2019s account was compromised using \u201ctoken-stealing malware,\u201d but declined to comment further.<\/p>\n Token-stealing malware, which can be delivered by phishing or malicious links, seek out session tokens on a victim\u2019s computer. Session tokens are small files that allow users to stay persistently logged-in without having to constantly re-enter a password or re-authorize with two-factor authentication. As such, stolen session tokens can grant an attacker the same access as the user without needing the user\u2019s password or two-factor code.<\/p>\n It\u2019s a similar attack method<\/a> to how Uber was breached last year by a teenage hacking crew called Lapsus$, which relied on malware to steal Uber employee passwords or session tokens. Software company CircleCi was also similarly compromised in January<\/a> after the antivirus software the company was using failed to detect token-stealing malware on an engineer\u2019s laptop. LastPass, too, had a major data breach of customers\u2019 password vaults<\/a> after hackers broke into the company\u2019s cloud storage by way of a compromised LastPass developer\u2019s computer.<\/p>\n How the Microsoft engineer\u2019s account was compromised is an important detail that could help network defenders prevent a similar incident in the future. It\u2019s not clear if the engineer\u2019s work-issued computer was compromised, or if it was a personal device that Microsoft allowed on its network. In any case, the focus on an individual engineer seems unfair given the real culprits for the compromise are the network security policies that failed to block the (albeit highly skilled) intruder.<\/p>\n What is clear is that cybersecurity is incredibly difficult, even for corporate mega-giants with near-limitless cash and resources. Microsoft engineers imagined and considered a wide range of the most complex threats and cyberattacks in designing protections and defenses for the company\u2019s most sensitive and critical systems, even if those defenses ultimately failed. Whether Storm-0558 knew it would find the keys to Microsoft\u2019s email kingdom when it hacked into the company\u2019s network or it was pure chance and sheer timing, it\u2019s a stark reminder that cybercriminals often only need to be successful once.<\/p>\n There seems to be no apt analogy to describe this unique breach or circumstances. It\u2019s both possible to be impressed by the security of a bank\u2019s vault and still acknowledge the efforts by the robbers who stealthily stole the loot inside.<\/p>\n It\u2019s going to be some time before the full scale of the espionage campaign becomes clear, and the remaining victims whose emails were accessed have yet to be publicly disclosed. The Cyber Security Review Board, a body of security experts tasked with understanding the lessons learned from major cybersecurity incidents, said it will investigate<\/a> the Microsoft email breach and conduct a broader review of issues \u201crelating to cloud-based identity and authentication infrastructure.\u201d<\/p>\n<\/p><\/div>\nMystery solved? Not quite<\/h2>\n