Brief #9: Microsoft's Key Breach, US Military Emails Leak

TL;DR

• Microsoft's Stolen Key: A Skeleton Key to Azure Services
• Top Secret US Military Emails Misdirected to Mali Due to Typo
• Critical Vulnerabilities in Citrix ADC and Gateway Actively Exploited - Immediate Action Required
• Sophos Name Abused by New Ransomware Variant, SophosEncrypt
• AI Titans Pledge for Secure and Transparent AI Development

Microsoft's Stolen Key: A Skeleton Key to Azure Services

• A stolen Microsoft security key, allegedly by Beijing-backed spies, allowed unauthorized access to Microsoft's online services.
• The key was used to craft access tokens, granting access to Microsoft customer's email systems, including those of US government officials.
• Microsoft has revoked the compromised key but is yet to disclose how it was obtained.
• Security researchers from Wiz suggest that the compromised key could have been used to access a wider range of services than initially reported by Microsoft.

In a significant cybersecurity incident, a Microsoft security key was stolen, allegedly by Beijing-backed spies, granting them unauthorized access to Microsoft's online services. The key was used to craft access tokens, allowing the spies to access Microsoft customer's email systems, including those of US government officials. The breach was detected by a federal government agency, which raised the alarm.

Microsoft has since revoked the compromised key but has not publicly disclosed how it was obtained. The incident has raised serious questions about the security of Microsoft's online services, with the potential implications of the breach being far-reaching.

Security researchers from Wiz, an infosec outfit founded by former Microsoft cloud security engineers, have suggested that the compromised key could have been used to access a wider range of services than initially reported by Microsoft. This includes Microsoft applications using OpenID v2.0 access tokens for account authentication, such as Outlook, SharePoint, OneDrive, and Teams, as well as customer's own applications that support the "login with Microsoft" functionality.

Microsoft has pushed back on these claims, stating that many of the claims made are speculative and not evidence-based. The company has also expanded security logging availability, making it free for more customers by default, to help manage an increasingly complex threat landscape.