CISA scorches Microsoft in Exchange Online hack investigation

Welcome to the latest issue of The Breach Report, a cybersecurity newsletter from the creators of the Cybersecurity Careers Blog. Be sure to subscribe via email or RSS.

CISA scorches Microsoft in Exchange Online hack investigation

The Department of Homeland Security (DHS) and the CISA Cyber Safety Review Board (CSRB) released a scathing report against Microsoft yesterday. The independent investigation focused on Microsoft’s failings from the Microsoft Exchange Online hacks in the summer of 2023, attributed to Storm-0558, a China-linked hacking group.

The report from CSRB highlights the level of access China was able to obtain after exploiting multiple vulnerable Microsoft Exchange systems:

According to the report, Storm-0558 downloaded over 60,000 emails from the State Department alone. Researchers were able to link Storm-0558 members to the 2009 Operation Aurora hacking campaigns, which targeted dozens of private companies, such as Google, Adobe, Juniper, Yahoo, and Northrup Grumman.

While Storm-0558 has overlapping tactics, techniques, and procedures (TTPs) as other Chinese hacking groups (e.g., VIOLET TYPHOON, ZIRCONIUM, and APT-31), Microsoft determines the group operates independently. Storm-0558 has targeted U.S. and European diplomatic, economic, and governing bodies. It also includes Taiwan and Uyghur ethnic groups among its geopolitical targets.

Revisiting the Storm-0558 Exchange Online Hack

Microsoft investigations determined that Storm-0558 accessed customer email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com by forging authentication tokens to access user email.

Further research by Microsoft confirmed that Storm-0558 used an acquired MSA key to forge tokens to access OWA and Outlook.com MSA (consumer) keys. Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems.

Storm-0558 then exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail.

The breaches were so publicly embarrassing that U.S. Senator Ron Wyden (D-OR) sent a letter to Microsoft CEO Satya Nadella proclaiming that the company was “responsible” for the breach and should be “held accountable.”

Latest Cybersecurity News

What we’re reading across the wire about the latest cybersecurity hacks, breaches, industry news, and more.

New from our favorite blogs and journalists:

• Fighting cookie theft using device bound sessions (Google)

• APT29 Uses WINELOADER to Target German Political Parties (Mandiant)

• CISA releases draft rule for cyber incident reporting (CyberScoop)

• Federal government affected by Russian breach of Microsoft (CyberScoop)

• Chinese hackers turn to AI to meddle in elections (CyberScoop)

• Chinese hackers target family members to surveil hard targets (CyberScoop)

• With 2027 deadline looming, DOD moves into implementation phase of zero trust transformation (DefenseScoop)

• Panera Bread Fuels Ransomware Suspicions With Silence (DarkReading)

• US State Department investigates alleged theft of government data (BleepingComputer)

• New Ivanti RCE flaw may impact 16,000 exposed VPN gateways (BleepingComputer)

• US cancer center data breach exposes info of 827,000 patients (BleepingComputer)

Cybersecurity Job Openings

Are you looking for a new job or trying to get started in cybersecurity? We’ll post notable new openings across the industry here.

Google / Mandiant

Google and Mandiant (Google acquired Mandiant in September 2022) are aggressively hiring for numerous cybersecurity roles across the United States.

• Strategic Cybersecurity Consultant, Mandiant

• General Manager Cybersecurity, Google Public Sector

• Security Consultant, Mandiant, Google Cloud

• Senior Incident Response Consultant, Mandiant, Google Cloud

• Senior Analyst, Strategic Intelligence and Government

• Head of Content Adversarial Red Team

• Content Adversarial Red Team Analyst, Trust and Safety

• Risk Operations Analyst, Play and Android, Trust and Safety

• Security Sales Specialist, VirusTotal, Google Cloud

• Incident Response Consultant, Mandiant, Google Cloud

• Data Scientist, Mandiant

• Emerging Technology Cybersecurity Consultant, Public Sector

For a complete listing of all open cybersecurity roles hiring at Google + Mandiant, visit careers.google.com.

Until next time…

Rob Waters
Founder, The Breach Report + Cybersecurity Careers Blog