12/11/2023 0 Comments Windows security popup outlook 365Microsoft, however, noted in July 2023 that "this threat actor has displayed an interest in OAuth applications, token theft, and token replay against Microsoft accounts since at least August 2021," potentially suggesting that the activity may have been underway for nearly two years. "If we assume that they both happened at the earliest possible point on the timeline - let's say May 2021 - then that would mean that the threat actor might have been in possession of the signing key for over two years prior to being discovered in June 2023." "The report does not explicitly state when the crash dump was transferred to the debugging environment or when the engineer's account was compromised only that each of these events occurred sometime after April 2021," Wiz security researcher Amitai Cohen said. Microsoft's report further alludes to spear-phishing and the deployment of token-stealing malware, but it did not elaborate on the modus operandi of how the engineer's account was breached in the first place, if other corporate accounts were hacked, and when it became aware of the compromise. It's not currently not known if this is the exact mechanism that was adopted by the threat actor since Microsoft noted it does not have logs that offer concrete proof of the exfiltration due to its log retention policies. The Windows maker said the crash dump was moved to a debugging environment on the internet-connected corporate network, from where Storm-0558 is suspected to have acquired the key after infiltrating the engineer's corporate account. The key material's presence in the crash dump was not detected by our systems." In this case, a race condition allowed the key to be present in the crash dump. "The crash dumps, which redact sensitive information, should not include the signing key. "A consumer signing system crash in April of 2021 resulted in a snapshot of the crashed process ('crash dump')," the Microsoft Security Response Center (MSRC) said in a post-mortem report. The system crash took place in April 2021. This enabled the adversary to access a debugging environment that contained information pertaining to a crash of the consumer signing system and steal the key. Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forge tokens and access Outlook by compromising an engineer's corporate account.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |