Breach of Microsoft Engineer’s Account Likely Led to Hack of US Officials

China-linked hackers breached the account of a Microsoft engineer and are suspected of using that access to steal a valuable key that enabled the hack of US officials’ email accounts.

Bloomberg News

September 7, 2023

2 Min Read
Microsoft logo on building
Bloomberg

(Bloomberg) -- China-linked hackers breached the corporate account of a Microsoft Corp. engineer and are suspected of using that access to steal a valuable key that enabled the hack of senior US officials’ email accounts, the company said in a blog post.

The hackers used the key to forge authentication tokens to access email accounts on Microsoft’s cloud servers, including those belonging to Commerce Secretary Gina Raimondo, Representative Don Bacon and State Department officials earlier this year. 

The US Cybersecurity and Infrastructure Security Agency and Microsoft disclosed the breach in June, but it was still unclear at the time exactly how hackers were able to steal the key that allowed them to access the email accounts.

Microsoft said the key had been improperly stored within a “crash dump,” which is data stored after a computer or application unexpectedly crashes. The crash dump was then moved into Microsoft’s production environment, where a compromised account belonging to a Microsoft employee could access it. The key was stolen sometime after April 2021, the company said.

However, because Microsoft didn’t have relevant logs, it didn’t have complete confidence in its assessment of how the key was stolen, according to the blog.

Related:More Than Government Emails Likely Exposed in Hack Tied to China

“Due to log retention policies, we don’t have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key,” Microsoft said in its blog.

The incident has brought fresh scrutiny to Microsoft’s cybersecurity practices. Following a demand by US Senator Ron Wyden, a Democrat from Oregon, for investigations into the incident, Bloomberg News reported that the Cyber Safety Review Board would study the incident, as well as other cloud security vulnerabilities.

In its blog post, Microsoft identified five different errors in how its systems are architected that have “been corrected.”

Read more about:

Microsoft

About the Author(s)

Bloomberg News

The latest technology news from Bloomberg.

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like