https://pwn.watch/t/exchange-online Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 06 Sep 2023 00:00:00 GMT https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 Wed, 06 Sep 2023 00:00:00 GMT critical <p>China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched</p> <p><strong>Latest updates:</strong></p><ul><li>2023-09-06: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network (<a href="https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/">source</a>)</li><li>2023-07-14: Microsoft details how the stolen MSA key was used to forge tokens (<a href="https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/">source</a>)</li><li>2023-07-11: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A (<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a">source</a>)</li></ul>