Wiz Examines Microsoft’s New Findings on Storm-0558 Signing-Key Theft
Summary
Wiz reviews Microsoft’s update on how Storm-0558 may have obtained an MSA signing key, discusses authentication flaws and unanswered questions, and recommends steps organizations can take to reduce similar risks.
Key points
- Microsoft said a compromised engineer account likely gave Storm-0558 access to a debugging server containing a crash dump with an MSA signing key; the dump included the key because of a bug.
- Microsoft linked an Exchange authentication vulnerability to missing issuer validation in the Azure AD SDK and a development team’s assumption that validation happened by default.
- Microsoft’s available logs only partially cover activity from April 2021 to May 2023. Wiz says the timing of the account compromise and crash-dump transfer remains unclear.
- Possession of the key could have enabled forged tokens for consumer or mixed-audience applications and for enterprise applications with incorrect validation, according to Wiz.
- Wiz recommends reviewing logs for April 2021 through June 2023, protecting and regularly purging crash dumps, restricting access to debugging assets, and isolating production environments.
- Other recommendations include storing keys in hardware security modules where possible, rotating signing keys regularly, testing secret-scanning controls, and making critical SDK security functions default or clearly flagged.
Article Details
- Event Type
- Microsoft's follow-up investigation into the Storm-0558 signing-key compromise and related forged-token activity.
- Impact
- Microsoft concluded that Storm-0558 most likely obtained an MSA signing key by using a compromised engineer account to access a debugging server and exfiltrate a crash dump containing the key. The key enabled forged authentication tokens and illicit access to Exchange and Outlook accounts; the article says it could also have enabled access to other consumer or enterprise accounts, though such broader use is not confirmed. Microsoft could only partially account for activity from April 2021 to May 2023, and the exact compromise timeline remains uncertain.
Threat Actors
Vendors
Products
Azure AD SDKPrior to the discovery of this threat actor in June 2023, the Azure AD SDK (described in the report as a “library of documentation and helper APIs”) did not include functionality to properly validate an authenticationMicrosoft Exchange Serverattributed to China who managed to acquire a signing key that allowed them to gain illicit access to Exchange and Outlook accounts.Microsoft SharePointin a position to gain access to a wide range of accounts in applications operated by Microsoft (such as SharePoint) or their customers. As we explained in our previous blog post, this was a very powerful key.Outlookto China who managed to acquire a signing key that allowed them to gain illicit access to Exchange and Outlook accounts.