{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Storm-0558: stolen Microsoft signing key used to read government email · updates",
  "home_page_url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023",
  "feed_url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023/feed.json",
  "description": "China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.",
  "language": "en",
  "_pwn": {
    "slug": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
    "severity": "critical",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023/feed.xml",
    "llms": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023/llms.txt",
    "json": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-09-06-5710979f",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-09-06-5710979f",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network",
      "content_text": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network\n\nSource: https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/",
      "date_published": "2023-09-06T00:00:00.000Z",
      "external_url": "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-07-14-5952b64e",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-07-14-5952b64e",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft details how the stolen MSA key was used to forge tokens",
      "content_text": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft details how the stolen MSA key was used to forge tokens\n\nSource: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/",
      "date_published": "2023-07-14T00:00:00.000Z",
      "external_url": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-07-11-48fafade",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-07-11-48fafade",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A",
      "content_text": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A\n\nSource: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a",
      "date_published": "2023-07-11T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-06-16-f5d2dfe3",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-06-16-f5d2dfe3",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft opens an investigation after a customer reports anomalous mail access",
      "content_text": "Storm-0558: stolen Microsoft signing key used to read government email: Microsoft opens an investigation after a customer reports anomalous mail access\n\nSource: https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "date_published": "2023-06-16T00:00:00.000Z",
      "external_url": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-05-15-c7a5fb48",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-05-15-c7a5fb48",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email: Storm-0558 begins accessing customer email with forged tokens",
      "content_text": "Storm-0558: stolen Microsoft signing key used to read government email: Storm-0558 begins accessing customer email with forged tokens\n\nSource: https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "date_published": "2023-05-15T00:00:00.000Z",
      "external_url": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "tags": [
        "critical"
      ]
    }
  ]
}