Breach of Microsoft Engineer’s Account Likely Led to Hack of US Officials

(Bloomberg) -- China-linked hackers breached the corporate account of a Microsoft Corp. engineer and are suspected of using that access to steal a valuable key that enabled the hack of senior US officials’ email accounts, the company said in a blog post.

The hackers used the key to forge authentication tokens to access email accounts on Microsoft’s cloud servers, including those belonging to Commerce Secretary Gina Raimondo, Representative Don Bacon and State Department officials earlier this year. 

The US Cybersecurity and Infrastructure Security Agency and Microsoft disclosed the breach in June, but it was still unclear at the time exactly how hackers were able to steal the key that allowed them to access the email accounts.

Microsoft said the key had been improperly stored within a “crash dump,” which is data stored after a computer or application unexpectedly crashes. The crash dump was then moved into Microsoft’s production environment, where a compromised account belonging to a Microsoft employee could access it. The key was stolen sometime after April 2021, the company said.

However, because Microsoft didn’t have relevant logs, it didn’t have complete confidence in its assessment of how the key was stolen, according to the blog.

Related:More Than Government Emails Likely Exposed in Hack Tied to China

“Due to log retention policies, we don’t have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key,” Microsoft said in its blog.

The incident has brought fresh scrutiny to Microsoft’s cybersecurity practices. Following a demand by US Senator Ron Wyden, a Democrat from Oregon, for investigations into the incident, Bloomberg News reported that the Cyber Safety Review Board would study the incident, as well as other cloud security vulnerabilities.

In its blog post, Microsoft identified five different errors in how its systems are architected that have “been corrected.”