While Microsoft pulled the compromised key, meaning it can no longer be used to forge tokens and access AAD applications, there's a chance that during previously established sessions attackers could have used this access to deploy backdoors or otherwise establish persistence. Azure issues not adequately fixed for months, complain bug huntersĪccording to the Wiz security team, the China-based crew looks to have obtained one of several keys used for verifying Azure Active Directory (AAD) access tokens, allowing them to sign as Microsoft any OpenID v2.0 access token for personal accounts along with multi-tenant and personal-account AAD applications.Azure blunder left Bing results editable, MS 365 accounts potentially exposed.
Google veep calls out Microsoft's cloud software licensing 'tax'.It's still unclear how the spies obtained the private encryption key in the first place. At the time, and in a July 14 update, the Azure titan said the spies used forged authentication tokens to access email accounts for government agencies for espionage purposes.Īccording to a Thursday report in the Wall Street Journal, Chinese snoops also accessed inboxes belonging to the US ambassador to China, Nicholas Burns, and Daniel Kritenbrink, the assistant secretary of state for East Asia. Microsoft disclosed the attack on July 11. We've also recently expanded security logging availability, making it free for more customers by default, to help enterprises manage an increasingly complex threat landscape. We recommend that customers review our blogs, specifically our Microsoft Threat Intelligence blog, to learn more about this incident and investigate their own environments using the Indicators of Compromise (IOCs) that we've made public. Many of the claims made in this blog are speculative and not evidence-based.
0 kommentar(er)
