Earlier this year, Microsoft suffered a security exposure when a security key was inadvertently included in a “crash dump” and subsequently accessed through a compromised engineer account. The incident post-mortem revealed that this error allowed a Chinese threat actor known as Storm-0558 to obtain a Microsoft account (MSA) consumer key, providing them the ability to forge tokens for Outlook.com and Outlook Web Access (OWA). Additionally, access to the Microsoft account consumer signing key allowed Storm-0558 to create consumer keys signed with a token that could be accepted by enterprise systems.
Microsoft acknowledged that key material is not intended to leave its production environment. However, in April 2021, a consumer signing system crash led to a snapshot of the crashed process, including the signing key, being included in the crash dump. A race condition allowed the key to be present in the dump, a critical oversight that Microsoft has since corrected.
Furthermore, Microsoft’s systems failed to detect the presence of the key material in the crash dump, another issue that has been addressed. The crash dump, which should not have contained sensitive information like the signing key, was inadvertently moved from the isolated production network to a debugging environment on the internet-connected corporate network as part of standard debugging processes. Microsoft’s credential scanning methods also did not initially detect the key’s presence, a flaw that has been rectified.
While Microsoft was unable to determine precisely how Storm-0558 gained access to the key, it suspects that it occurred through a compromised Microsoft engineer’s corporate account. This account had access to the debugging environment containing the crash dump.
In response to this incident, Microsoft has updated its libraries to prevent similar occurrences in the future and emphasized the importance of safeguarding key material within its production environment.
