Microsoft's report further alludes to spear-phishing and the deployment of token-stealing malware, but it did not elaborate on the modus operandi of how the engineer's account was breached in the first place, if other corporate accounts were hacked, and when it became aware of the compromise. It's not currently not known if this is the exact mechanism that was adopted by the threat actor since Microsoft noted it does not have logs that offer concrete proof of the exfiltration due to its log retention policies. The Windows maker said the crash dump was moved to a debugging environment on the internet-connected corporate network, from where Storm-0558 is suspected to have acquired the key after infiltrating the engineer's corporate account. The key material's presence in the crash dump was not detected by our systems." In this case, a race condition allowed the key to be present in the crash dump. "The crash dumps, which redact sensitive information, should not include the signing key. "A consumer signing system crash in April of 2021 resulted in a snapshot of the crashed process ('crash dump')," the Microsoft Security Response Center (MSRC) said in a post-mortem report. The system crash took place in April 2021. This enabled the adversary to access a debugging environment that contained information pertaining to a crash of the consumer signing system and steal the key. Microsoft on Wednesday revealed that a China-based threat actor known as Storm-0558 acquired the inactive consumer signing key to forge tokens and access Outlook by compromising an engineer's corporate account.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |