Facebook Twitter Instagram
    Goobuntu
    • Home
    • Linux
    • Windows
    • Mobile
    • News
    Goobuntu
    Home»News»Hacked Microsoft Keys Access a Wide Range of Azure Applications

    Hacked Microsoft Keys Access a Wide Range of Azure Applications

    0
    By Goobuntu on July 24, 2023 News
    Share
    Facebook Twitter LinkedIn Pinterest Email

    The China-linked threat actors who stole the US State Department and other Microsoft customer emails may have acquired access to apps other than Exchange Online and Outlook.com.

    According to Wiz Researchers, the compromised signing key was more potent than it first appeared to be and was not restricted to just those two services.

    The threat actor may have been able to forge access tokens for a variety of Azure Active Directory applications, including any that supports personal account authentication, such as SharePoint, Teams, or OneDrive, as well as customer applications that support the “login with Microsoft” feature and multi-tenant applications under specific circumstances.

    It is advised to organizations look for instances of forged token usage on any potentially compromised apps.

    Overview of the Hack

    Microsoft issued a warning earlier this month after an advanced persistent threat group it refers to as Storm-0558 breached the systems of around 25 customers globally, including several government clients.

    The hackers purportedly obtained access to private emails from U.S. Commerce Secretary Gina Raimondo and other high-profile individuals.

    The Cybersecurity and Infrastructure Security Agency (CISA) collaborated with Microsoft on efforts to mitigate the damage and further examine how the hackers initially got access after government authorities informed Microsoft about the incident.

    According to a statement by Microsoft earlier this month, the threat actor created access tokens for Exchange Online and Outlook.com after gaining access to an MSA consumer signing key.

    The Wiz study reveals that the key gives users access to a significantly larger range of applications.

    The signing keys used by identity providers are among the most potent trade secrets today. They are far more potent than TLS keys, for instance.

    To have a major impact, an attacker would still need to impersonate a google.com server even if they had access to the google.com TLS key. One may instantly and directly access any email box, file service, or cloud account using identity provider keys.

    To secure important keys like this one, our industry, notably cloud service providers, must commit to higher security and transparency.

    The risks of compromised OpenID signing key

    Which Applications Are Affected?

    The analysis says the problem only affected Azure Active Directory applications that use Microsoft’s OpenID v2.0. Applications running on version 1.0 were unaffected since the token validation process did not use the compromised key.

    Recommendation

    • Search for the use of forged tokens and use the Indicators of Compromise (IoCs) published by Microsoft to look for any activity that originates from the IP addresses provided by Microsoft.
    • Verify that no apps are using the cached version of the Microsoft OpenID public certificates, and clear the cache if they are.
    • Microsoft has introduced extra verifications to the official Azure SDK to prevent the use of MSA keys to authenticate organization accounts. The most recent version of the package should be updated by users.
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

    Related Posts

    Forever 21 Systems Hacked: 500,000+ Users Affected

    September 1, 2023

    Hackers Exploit Openfire Vulnerability To Deploy Kinsing Malware

    September 1, 2023

    BadBazaar Malware Attacking Users Via Weaponized Apps

    September 1, 2023

    Leave A Reply Cancel Reply

    Popular Posts
    Forever 21 Systems Hacked: 500,000+ Users Affected
    By GoobuntuSeptember 1, 20230
    How to Fix the Action Center Not Opening in Windows
    By GoobuntuSeptember 1, 20230
    Hackers Exploit Openfire Vulnerability To Deploy Kinsing Malware
    By GoobuntuSeptember 1, 20230
    BadBazaar Malware Attacking Users Via Weaponized Apps
    By GoobuntuSeptember 1, 20230
    © 2023 Goobuntu. All Rights Reserved Goobuntu.
    • Contact Us
    • Privacy Policy
    • DMCA
    • Sitemap

    Type above and press Enter to search. Press Esc to cancel.