An investigation into an attack on Microsoft’s Exchange Online hosted email service that occurred in June 2023, in which accounts used by senior U.S. officials were compromised by a Chinese-affiliated group called “Storm-0558,” found that this It turns out the incident was avoidable except for Microsoft’s negligence in its infosec culture and substandard cloud security precautions.
The review, conducted by the U.S. government’s Cybersecurity and Infrastructure Security Agency’s Cyber Safety Review Board (CSRB), calls for “rapid cultural change” at Microsoft. The board’s recommendations include:
- Microsoft customers need their CEO and Board of Directors to focus directly on their security culture and develop a plan with a concrete timeline for fundamental security-focused changes across their entire business and product suite. You will benefit from developing and publishing it.
- The CEO must hold senior executives accountable for executing this plan.
- Microsoft leaders should consider directing internal teams to deprioritize feature development across cloud infrastructure and product suites until significant security improvements are made to eliminate competition for resources. there is.
- Security risks must be fully and appropriately assessed and addressed before introducing new functionality.
This strong language was presented in consideration of the attack, which was attributed to a “chain of avoidable errors by Microsoft.”
CSRB report [PDF] Identify attacks against key rotation techniques used to protect Microsoft service accounts (MSAs). MSA is the identity management system that powers the software giant’s consumer cloud services.
MSA was designed in the early 2000s without an automatic signing key rotation or deactivation process. As a result, Microsoft used to manually manage keys, but stopped doing so in 2021 after this caused massive cloud outages.
Between 2021 and the 2023 breach, Microsoft did not employ any tools to alert you to keys that should be retired.
As a result, Storm-0558 was able to obtain a key created in 2016, which was supposed to be retired, and was able to access the version of Outlook Web Access available to consumers.
Things escalated from there, due to a flaw in Microsoft’s systems that caused the 2016 MSA keys to become tokens that granted access to corporate email accounts as well as the consumer services the MSA was created to manage. Because there was a possibility that it would be created.
Thus, Storm-0558 was able to create tokens that granted access to Microsoft clients such as the US Department of State. The gang did just that, stealing approximately 60,000 emails from the department and a list of all employees’ email addresses. The stolen emails contained details of diplomatic negotiations, but the large number of addresses clearly indicated the potential for future phishing attacks.
Other cloud providers are better at key rotation and implement other security controls that Microsoft doesn’t, according to the report.
The report therefore criticizes Microsoft for failing to detect the key compromise. Slack’s security, including allowing laptops now owned by Microsoft to be compromised and connected to the software giant’s network after the acquisition, has also been cited as a failure.
slow to fail
Microsoft also came under fire for its slow efforts to correct public records.
The city of Redmond claims the attack was possible because a golden encryption key was present in a crash dump that was compromised in an internet-connected debugging environment.
However, as the report explains, Microsoft has not proven that theory or any of the 46 hypotheses it investigated. That includes “an adversary with the theoretical quantum computing power to break public-key cryptography, as well as an insider who stole the key during its creation.”
In fact, the report concludes that Microsoft still does not know how Storm-0558 obtained the keys. However, in September 2023, he developed a theory that the keys were in the crash dump, and continued posting it online for months after learning the details. The hypothesis may not be true.
Microsoft finally amended this post on March 12, 2024, acknowledging that no crash dump containing the key could be found.
failed customer
Another theme of the report is that Microsoft “failed to prioritize security risk management at a level commensurate with the critical importance of threats and Microsoft technology to more than 1 billion customers worldwide.” .
Investigators looked at Microsoft’s cloudy peers and found they were more cautious than the Windows giant.
“Microsoft did not prioritize redesigning its legacy infrastructure sufficiently to address the current threat landscape,” the authors found.
This situation suggests that Microsoft has forgotten the lessons its founding CEO Bill Gates conveyed about Trustworthy Computing in a 2002 company-wide memo, the report said. In the memo, he told developers: “When faced with a choice between adding a feature or solving a security problem, choose security. If we identify a risk, that issue is addressed first.”
The CSRB report suggests that Microsoft will no longer do that, at least not in its own cloud.
It also found that Microsoft’s response to the incident, the Secure Future Initiative, required oversight from the company’s most senior executives.
as register Despite the fact that when the initiative was announced, Microsoft’s human researchers could not pinpoint the cause of an incident that may have exposed their country’s national secrets, the initiative harnesses the magical power of AI. It was pointed out that security has been improved. ®