This seems overly hyperbolic and alarmist. I do not think the sources prove the scope of breach the post asserts ("all of Microsoft"), seems more like a temporary key leak that was subsequently revoked.
2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry [1], Source[2], German source)
Also the following:
https://infosec.exchange/@briankrebs/110820474957163710
Quite damning if true.
[1]: https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... [2]: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...
This is not to downplay how bad Microsoft's security lapses were, and how bad their announcements were. The most horrifying part to me, besides the need for "premium" logs to detect a breach which I'd been complaining about before this, was how PR seemed to blame the Exchange Online team for misusing the authentication libraries, but later they updated the libraries and said the token validation issue was "corrected using the updated libraries". That feels like internal blame shifting out in public.
[1] https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...
Which has these among a long list (retaining the reverse order from link above). NB I have just copied and pasted for convenience; neither removed text which refers to links nor added the actual links. You can click through yourself if you want to follow the links.
8<---
023-08: Again Microsoft, again Azure: "unauthorized access to cross-tenant applications and sensitive data (including but not limited to authentication secrets)". If you aren't tech-savvy: this is very bad. (Source)
A reoccuring pattern emerges more and more: Microsoft didn't fix the issue in months and as of 2023-08-03 it is still an open vulnerability in Azure, risking the data of all Azure customers. related:
Microsoft comes under blistering criticism for “grossly irresponsible” security | Ars Technica
BrianKrebs: "The CEO of Tenable just ripped Microsoft a new on…" - Infosec Exchange
2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry, Source, German source)
With the default logs, customers could not even detect intruders as you would need to pay extra to get access to those log files.
Microsoft did not communicate which services were affected and which not. Any Microsoft cloud service was potentially compromised.
Most probably, the usual "any compromised system needs to be thrown away and re-created from scratch will not be applied here. As a consequence, you can't trust any data from Microsoft services any more.
Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised.
According to this German source, Microsoft is still refusing to tell what happened and which systems are affected to what extend.
2023-08-18: German comment: Many similar comments like that underline that Microsoft disqualifies as a trustworthy partner.
2023-09-06: first public explanation by MS: Microsoft: Results of Major Technical Investigations for Storm-0558 Key Acquisition Press reactions: heise (German), fefe (German)
> 2023-09-29: My Mastodon message about the latest news was posted on Hacker News and its discussion reached number one worldwide.
The circle is complete.
In the very same link he posts: https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... "Post-compromise activity
Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users."
So it's not "all Microsoft".
It's the usual exaggerated headline, but this time it draws attention on a person's post on Mastodon.
This platform is really no different from Twitter.