The Storm-0558 Attack - Inside Microsoft Identity Security's Response
summary
An attacker forges tokens using an acquired signing key and reads mail across 22 organizations, 502 consumer accounts by calling an internal API GetAccessTokensForResource and bypassing OWA refresh logic; the root cause is a validation library that fails to enforce issuer scoping for the combined public-key endpoint. Response rotates and bans the thumbprinted key, updates libraries, deploys new detections, and migrates signing into HSM/Confidential Compute; the forged-token window closes within days.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 3:04Identity architecture basics
- 10:59Threat actor profile
- 14:34Detection and investigation
- 18:49Attack mechanics and response
- 27:48Attack mechanics summary
- 31:39Hypothesis on key loss
- 39:37Future security initiatives
- 43:56Conclusion and moral
related talks
22mSSO Wars: The Token Menace
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
37mPreventing Authentication Bypass: A Tale of Two Researchers
01h 00mDefending Against New Phishing Attacks that Abuse OAuth Authorization Flows
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
55mAzure Attacks Unpacked: Real-World Threats & Lessons
25mIAM Stacks Under Attack! WhyAuthentication is Key to Cyber-Resiliency
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures