Security News > 2023 > July > Stolen Microsoft key may have opened up a lot more than US govt email inboxes

A stolen Microsoft security key may have allowed Beijing-backed spies to break into a lot more than just Outlook and Exchange Online email accounts.

Microsoft still, to the best of our knowledge, does not know how this incredibly powerful private signing key was obtained, and has revoked that key.

Now, it turns out that private key "Was more powerful than it may have seemed," according to Shir Tamari, research boss at Wiz, an infosec outfit founded by former Microsoft cloud security engineers.

We're told the private key could have been used to access way more than people's Outlook and Exchange Online accounts.

Still, while Microsoft revoked the compromised encryption key and published a list of indicators-of-compromise for those wondering if they've also been hit by Storm-0558, the Wiz kids said it may be difficult for Redmond's customers to know if miscreants used forged tokens to steal data from their applications.

Microsoft admits unauthorized access to Exchange Online, blames Chinese gang Under CISA pressure collaboration, Microsoft makes cloud security logs available for free Azure blunder left Bing results editable, MS 365 accounts potentially exposed Azure issues not adequately fixed for months, complain bug hunters.

News URL

https://go.theregister.com/feed/www.theregister.com/2023/07/21/microsoft_key_skeleton/