Wiz Finds Storm-0558 Key Could Have Forged Tokens for More Microsoft Apps

Jul 21, 2023 · Original article ↗

Summary

Wiz researchers found Storm-0558’s compromised Microsoft key could have enabled forged tokens for more Azure applications than initially disclosed. Microsoft revoked the key, but detection remains difficult because many applications lack detailed logs.

Key points

Wiz matched a replaced public key’s certificate thumbprint to the key Microsoft identified as acquired by Storm-0558.
The researchers said the key could have enabled token forgery against Microsoft v2.0 applications supporting personal accounts and some mixed-audience applications; single-tenant and v1.0 applications were not affected.
They explained that applications with inadequate issuer validation could potentially accept forged tokens impersonating users, including organizational accounts under certain conditions.
Microsoft revoked the key and added issuer checks to its Azure SDK; applications retaining cached copies of the compromised public key may still need to refresh them.
Wiz said offline token forgery leaves no Azure portal issuance trail, and many application logs lack the token details needed to identify use of the key.
The article recommends updating the Azure SDK, refreshing cached certificates, identifying potentially affected applications, and checking application logs and Microsoft’s published indicators.

Article Details

Attack Vectors: Microsoft reported that Storm-0558 obtained an MSA consumer signing key and used it to forge access tokens for Exchange Online and Outlook.com.
Forged OpenID v2.0 tokens signed with the compromised key could impersonate users in affected applications that trusted the relevant personal-account or mixed-audience key lists. The article describes impact beyond Exchange Online and Outlook.com as potential, dependent on application configuration and token validation.
The article reports that the threat actor also exploited two issues in Microsoft's token verification process, but does not provide technical details for those issues.
Defensive Notes: Update the Azure SDK to the latest version to obtain Microsoft's added issuer-validation checks.
Refresh cached Microsoft OpenID public certificates and ensure applications no longer trust the revoked key; Microsoft advises refreshing local certificate caches at least daily.
Identify potentially affected Azure AD applications, then review their application-specific authentication logs for the compromised key ID in the JWT header's kid field and for the MSA tenant ID in iss or tid claims.
Where HTTP logs are enabled, check application access records against Microsoft's listed Storm-0558-associated IP addresses.
Review potentially affected applications for persistence established during earlier sessions, including application-specific access keys or backdoors.

Indicators of compromise

Type	Indicator	Context
IPV4	`116[.]202[.]251[.]8`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`131[.]153[.]78[.]188`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`146[.]0[.]74[.]16`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`146[.]70[.]121[.]44`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`146[.]70[.]157[.]213`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`146[.]70[.]157[.]45`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`146[.]70[.]35[.]168`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`173[.]44[.]226[.]70`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`176[.]31[.]90[.]129`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`185[.]158[.]248[.]159`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`185[.]195[.]200[.]39`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`185[.]236[.]228[.]183`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`185[.]236[.]231[.]109`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`185[.]38[.]142[.]249`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`185[.]51[.]134[.]52`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`193[.]149[.]129[.]88`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`193[.]36[.]119[.]45`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`195[.]26[.]87[.]219`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`31[.]42[.]177[.]181`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`31[.]42[.]177[.]201`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`37[.]143[.]130[.]146`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`45[.]14[.]227[.]212`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`45[.]14[.]227[.]233`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`5[.]252[.]176[.]8`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`5[.]252[.]178[.]68`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`51[.]89[.]156[.]153`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`85[.]239[.]63[.]160`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`91[.]222[.]173[.]225`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`91[.]222[.]174[.]41`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.
IPV4	`91[.]231[.]186[.]226`	IP address Microsoft identified as associated with Storm-0558; the article recommends checking WebApp logs for activity from it.