China read the State Department's email with a key Microsoft lost in a crash dump
Storm-0558 forged Azure AD tokens with a stolen signing key, reading US government email
The market's verdict: +4.2% on MSFT in the week after.
What actually happened
In July 2023, Microsoft disclosed that Chinese state actors had used a stolen consumer signing key to forge Azure AD tokens and read email at around twenty five organizations, including the State Department, some sixty thousand emails' worth, and the Commerce Secretary's account. The initial disclosure blamed the hackers' sophistication; the quieter truth, admitted later, was that the key had been sitting inside a crash dump moved to an internet connected debug network from a compromised engineer's machine. The DHS review board later called the whole thing a cascade of avoidable security failures and pinned it on culture. A master key, a crash dump, and a culture.
This one is officially acknowledged.
They did it more than once
Nation-state email raids: 2023 and 2024 editions, same shelf.
Links
-
Impact
- Ars Technica (publication)
-
Context
- Ars Technica (publication)
↳ caused by Storm-0558 forged token attacks (2023)
Timeline
- Jul 11, 2023 Fixed Microsoft shipped a fix.