After leaving many questions unanswered, a new post mortem from Microsoft explains the series of slip-ups that allowed attackers to steal and abuse a valuable cryptographic key.
“All the best hacks are deaths by 1,000 paper cuts, not something where you exploit a single vulnerability and then get all the goods,” says Jake Williams, a former US National Security Agency hacker who is now on the faculty of the Institute for Applied Network Security.
After the fateful crash of a consumer signing system, the cryptographic key ended up in an automatically generated “crash dump” of data about what had happened. Microsoft's systems are meant to be designed so signing keys and other sensitive data doesn't end up in crash dumps, but this key slipped through because of a bug. Worse still, the systems built to detect errant data in crash dumps failed to flag the cryptographic key. With the crash dump seemingly vetted and cleared, it was moved from the production environment to a Microsoft “debugging environment,” a sort of triage and review area connected to the company's regular corporate network. Once again though, a scan designed to spot the accidental inclusion of credentials failed to detect the key's presence in the data. Sometime after all of this occurred in April 2021, the Chinese espionage group, which Microsoft calls Storm-0558, compromised the corporate account of a Microsoft engineer. With this account, the attackers could access the debugging environment where the ill-fated crash dump and key were stored. Microsoft says it no longer has logs from this era that directly show the compromised account exfiltrating the crash dump, “but this was the most probable mechanism by which the actor acquired the key.” Armed with this crucial discovery, the attackers were able to start generating legitimate Microsoft account access tokens. Another unanswered question about the incident had been how the attackers used a cryptographic key from the crash log of a consumer signing system to infiltrate the enterprise email accounts of organizations like government agencies. Microsoft said on Wednesday that this was possible because of a flaw related to an application programming interface that the company had provided to help customer systems cryptographically validate signatures. The API had not been fully updated with libraries that would validate whether a system should accept tokens signed with consumer keys or enterprise keys, and as a result, many systems could be tricked into accepting either.
Please follow us on Google to support us United States Latest News, United States Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Nate Bargatze: 'The Be Funny' TourHailed this year as “The Nicest Man in Stand-Up,” by The Atlantic Magazine and a “Rising Star,” by CBS Morning, 2021 Grammy nominated comedian and podcaster Nate Bargatze is selling out shows across the world.An Old Hickory, Tennessee native, Bargatze followed in the showbiz footsteps of his father, a former clown turned world class magician, who’s influence is seen on his’s 2015 debut Comedy Central special, Full Time Magic and his debut album, Yelled at By a Clown, which reached 1 on the iTunes Comedy Charts and remained on Billboard’s Top Ten Comedy Charts for weeks.Bargatze’s half-hour Netflix Special The Standups, premiered in 2017 and his first solo one-hour Netflix special, The Tennessee Kid, premiered globally with rave reviews in 2019. In 2021, he released his highly anticipated second Netflix special, The Greatest Average American, which received a Grammy nomination for Best Comedy Album.In July 2020, the comedian teamed up with All Things Comedy to release his weekly podcast, Nateland. Nateland tackles the meaningless issues that we face day to day to give listeners a much-needed mental break from fighting the good fight. New episodes release Wednesdays, with video available on Nate’s YouTube channel and audio available everywhere you get podcasts.Bargatze’s comedy is both clean and relatable, evident in his ten appearances on The Tonight Show Starring Jimmy Fallon. He also appeared on Conan four times, was a recurring guest on midnight, and had his own Comedy Central Presents in 2011. Off-screen, Bargatze was part of Jimmy Fallon's Clean-Cut Comedy Tour, and has performed live shows for the troops in Iraq and Kuwait five times. In addition to touring the country as a headliner, Nate toured arenas with Chris Rock on his 2017 Total Blackout Tour. He regularly performs at Bonnaroo, SXSW, Oddball Comedy Festival, Sasquatch, Clusterfest, and the JFL Montreal Comedy Festival, where he’s received critical acclaim multiple years in a row.Nate was featured as o
Read more »
Russell Crowe & Ryan Gosling's Underrated Comedy Prompts Sequel Demands 7 Years LaterThe Nice Guys is finally getting its due.
Read more »
Professor Caught Using ChatGPT When Scientific Paper Was Full of ErrorsA biologist was shocked to find his name was mentioned several times in a scientific paper, which references papers that simply don't exist.
Read more »
MSI fixes Windows 11 BSOD “unsupported processor” errors with new BIOS updatesThe issue affects the latest Intel components.
Read more »
USA Today Updates Every AI-Generated Sports Article to Correct “Errors”Rather than simply scrub its many pages of Lede AI-generated content clean, Gannett is updating the articles to correct their many 'errors.'
Read more »
14 Plot Holes, Continuity Errors, And Movie Mistakes That Have Had Fans Arguing For YearsIf I was George McFly, I'd be 100% convinced that that baby was Calvin Klein's...
Read more »