Microsoft still unsure how hackers stole Azure AD signing key | Hacker News Reader

Microsoft still unsure how hackers stole Azure AD signing key

bleepingcomputer.com

25 pointsnazgulsenpai9 comments

My bet is on this being an inside job.

Depending on what data the CCP was able to obtain from these state agencies, the bribe they paid or the leverage they held over them was probably a bargain.

This tracks. We also saw trade secrets stealing from Apple recently [1].

[1] May 2023: https://www.theguardian.com/technology/2023/may/16/apple-emp...

This coupled with the “police stations” revelations earlier this year, sheds a light on how compromised some engineers may be…

While I understand that Azure AD signing keys are used in a completely different context, would something like Certificate Transparency lower the impact of this if it had been part of Azure AD architecture?

Unfortunately not. Certificate Transparency in this case wouldn’t provide any real benefit.

If your private key is compromised then any access the key provides is also compromised. The main problem here is that the key was able to be used outside of its intended scope and that MS don’t seem to have the systems in place to detect inappropriate key use in a proactive manner

>MS don’t seem to have the systems in place to detect inappropriate key use in a proactive manner

I'm sorry, I thought this was the point of CT... Although I guess it depends on how one defines "proactive" in this context.

They didn't use a HSM?? I know keys can be exported even from those but they are built for lots of money to prevent exactly that.

Right? They even sell dedicated HSM through Azure with their partner Thales.

https://azure.microsoft.com/en-us/products/azure-dedicated-h...

A very small number of people should have access to their HSMs. This shouldn’t be too hard to figure out.

Perhaps they got their HSM on a good deal from Aliexpress. https://www.aliexpress.com/w/wholesale-hardware-security-mod...

Reply on news.ycombinator.com