Wednesday, December 6, 2023

Hacked Microsoft Keys Let Attackers Access a Wide Range of Azure Applications

The China-linked threat actors who stole the US State Department and other Microsoft customer emails may have acquired access to apps other than Exchange Online and Outlook.com.

According to Wiz Researchers, the compromised signing key was more potent than it first appeared to be and was not restricted to just those two services.

The threat actor may have been able to forge access tokens for a variety of Azure Active Directory applications, including any that supports personal account authentication, such as SharePoint, Teams, or OneDrive, as well as customer applications that support the “login with Microsoft” feature and multi-tenant applications under specific circumstances.

It is advised to organizations look for instances of forged token usage on any potentially compromised apps.

Overview of the Hack

Microsoft issued a warning earlier this month after an advanced persistent threat group it refers to as Storm-0558 breached the systems of around 25 customers globally, including several government clients.

The hackers purportedly obtained access to private emails from U.S. Commerce Secretary Gina Raimondo and other high-profile individuals.

The Cybersecurity and Infrastructure Security Agency (CISA) collaborated with Microsoft on efforts to mitigate the damage and further examine how the hackers initially got access after government authorities informed Microsoft about the incident.

According to a statement by Microsoft earlier this month, the threat actor created access tokens for Exchange Online and Outlook.com after gaining access to an MSA consumer signing key.

The Wiz study reveals that the key gives users access to a significantly larger range of applications.

The signing keys used by identity providers are among the most potent trade secrets today. They are far more potent than TLS keys, for instance.

To have a major impact, an attacker would still need to impersonate a google.com server even if they had access to the google.com TLS key. One may instantly and directly access any email box, file service, or cloud account using identity provider keys.

To secure important keys like this one, our industry, notably cloud service providers, must commit to higher security and transparency.

The risks of compromised OpenID signing key

Which Applications Are Affected?

The analysis says the problem only affected Azure Active Directory applications that use Microsoft’s OpenID v2.0. Applications running on version 1.0 were unaffected since the token validation process did not use the compromised key.

Recommendation

  • Search for the use of forged tokens and use the Indicators of Compromise (IoCs) published by Microsoft to look for any activity that originates from the IP addresses provided by Microsoft.
  • Verify that no apps are using the cached version of the Microsoft OpenID public certificates, and clear the cache if they are.
  • Microsoft has introduced extra verifications to the official Azure SDK to prevent the use of MSA keys to authenticate organization accounts. The most recent version of the package should be updated by users.

Stay up-to-date with the latest Cyber Security News; follow us on GoogleNewsLinkedinTwitterand Facebook.

Website

Latest articles

BlueNoroff: New Malware Attacking MacOS Users

Researchers have uncovered a new Trojan-attacking macOS user that is associated with the BlueNoroff APT...

Serpent Stealer Acquires Browser Passwords and Erases Intrusion Logs

Beneath the surface of the cyber realm, a silent menace emerges—crafted with the precision...

Doppelgänger: Hackers Employ AI to Launch Highly sophistication Attacks

It has been observed that threat actors are using AI technology to conduct illicit...

Kali Linux 2023.4 Released – What’s New!

Kali Linux 2023.4, the latest version of Offensive Security's renowned operating system, has been...

Trickbot Malware Developer Pleads Guilty & Faces 35 Years in Prison

A 40-year-old Russian national, Vladimir Dunaev, pleaded guilty for developing and deploying Trickbot malware....

ICANN Launches RDRS to Assist Law Enforcement Agencies to Discover Private Info

ICANN is a non-profit organization that is responsible for coordinating the global internet's-DNSIP address...

Hackers Use Weaponized Documents to Attack U.S. Aerospace Industry

An American aerospace company has been the target of a commercial cyberespionage campaign dubbed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles