How Storm-0558 hackers stole an MSA key from Microsoft

After weeks of uncertainty, Microsoft confirmed the consumer signing key used to breach email accounts in May was stolen from the software giant's own network.

In July, Microsoft disclosed a China-based threat actor it tracks as Storm-0558 compromised customer email accounts at approximately 25 organizations that included U.S. federal agencies. The threat actors used a stolen Microsoft account (MSA) consumer signing key to forge authentication tokens for Outlook Web Access and Outlook.com. The attackers also exploited a token validation issue to impersonate Azure Active Directory users and gain access to their email.

Fallout from the month-long attacks that began in May included criticism over Microsoft's response to the attacks, specifically a lack of information about how the MSA key was stolen. The company also faced criticism over limited logging features that hindered detection of the Storm-0558 attacks.

Nearly two months after first disclosing the attacks, Microsoft on Wednesday announced the investigation determined the key was stolen from its corporate environment thanks to a series of errors. Storm-0558 compromised a Microsoft engineer's account and then gained access to the Microsoft network and the debugging environment where the MSA key was accidentally lurking.

The MSA key ended up in the debugging environment due to several Microsoft errors. In total, there were six security mistakes Microsoft addressed in the blog that resulted in Storm-0558 gaining such privileged access.

"Our investigation found that a consumer signing system crash in April of 2021 resulted in a snapshot of the cashed process ('crash dump'). The crash dumps, which redacts sensitive information should not include the signing key," Microsoft wrote in the blog. "In this case, a race condition allowed the key to be present in the crash dump (this issue has been corrected). The key material's presence in the crash dump was not detected by our systems (this issue has been corrected)."

Update: On March 12, 2024, Microsoft added an addendum to the blog post that said the investigation did not find the impacted key material in a crash dump. On April 2, 2024, the Department of Homeland Security's Cyber Safety Review Board issued a report on its investigation into the Storm-0558 attack. The report noted that Microsoft had no evidence that the MSA key was contained in or exfiltrated from a crash dump. Despite informing the CSRB of this in November 2023, Microsoft did not correct the inaccurate blog post until March 12, 2024.

TechTarget Editorial asked Microsoft if the race condition issue was caused by a vulnerability within a Microsoft product. A Microsoft spokesperson said this was not the case. "Vulnerability is a specific term, and we would use the term vulnerability if it was appropriate. 'Issue' in the blog refers to things such as misconfiguration, operator errors or unintended byproducts of other actions," the spokesperson said.

Because Microsoft did not believe the crash dump contained any key material, it was moved from an isolated production network into Microsoft's debugging environment, which was on the internet-connected corporate network. While the vendor's scanning methods did not detect any signing keys, Microsoft said the mistake has been corrected.

"After April 2021, when the key was leaked to the corporate environment in the crash dump, the Storm-0558 actor was able to successfully compromise a Microsoft engineer's corporate account," the blog post said.

The Microsoft spokesperson said the engineer's account was compromised through token-stealing malware but did not provide further details about the credential theft. The attackers used the account to access the debugging environment, which included the crash dump with the MSA key.

However, Microsoft acknowledged some uncertainty with its investigation. "Due to log retention policies, we don't have logs with specific evidence of this exfiltration by this actor. But this was the most probable mechanism by which the actor acquired the key," the company said.

TechTarget Editorial asked Microsoft if the Storm-0558 attackers may have obtained other sensitive information from the debugging environment or other parts of the network that the engineer account had access to. The company declined to comment further.