A US Senator has called for accountability from Microsoft regarding a Chinese cyber campaign that compromised US government emails.
Senator Ron Wyden, a Democrat representing Oregon, issued an open letter insisting that Microsoft should be held "accountable for its negligent cybersecurity practices, which enabled a successful Chinese espionage campaign against the US government."
Dated July 27, 2023, the letter was directed to Jen Easterly, Director of the Cybersecurity and Infrastructure Security Agency (CISA), Lina Khan, Chair of the Federal Trade Commission, and Merrick B. Garland, Attorney General at the US Department of Justice.
The letter pertains to the discovery of a hacking campaign that resulted in the exfiltration of Exchange Online Outlook data. On July 12, CISA and the FBI jointly issued guidance to critical infrastructure organizations on enhancing monitoring of Microsoft Exchange Online environments following this discovery.
Shortly afterward, Microsoft released its own investigation into malicious email activity, revealing that the Chinese threat actor group Storm-0558 had accessed customer email accounts, including those of US government agencies, from May 15.
Storm-0558 is notorious for targeting government agencies in Western Europe and specializing in espionage, data theft, and credential access.
Microsoft explained that the threat actors had gained access to customer email accounts through Outlook Web Access in Exchange Online (OWA) and Outlook.com by forging authentication tokens using an acquired Microsoft encryption key.
It further stated that it had mitigated the issue by blocking the use of tokens signed with the acquired MSA key in OWA, replacing the key to prevent the hackers from forging more tokens and blocking the use of tokens issued with the key for all affected consumer customers.
In his letter, Wyden contended that "government emails were stolen because Microsoft committed another error." He highlighted that although the stolen encryption key was for consumer accounts, "a validation error in Microsoft code" allowed hackers to create fake tokens for Microsoft-hosted accounts for government agencies and other organizations, thereby gaining access to those accounts.
Wyden argued that Microsoft should not have possessed "a single skeleton key" that could enable attackers to access customers' private communications if stolen. He also raised questions about how the encryption key was stored.
Wyden added that Microsoft had not taken responsibility for its role in the SolarWinds supply chain incident in 2020, during which Russian state-sponsored attackers stole encryption keys and forged Microsoft credentials to access sensitive information.
Consequently, Wyden called for a "whole-of-government" effort to hold Microsoft accountable for its "negligence." He requested each agency to scrutinize Microsoft's security and privacy practices to determine if they violated federal law.
On July 26, it was reported that the Wuhan Earthquake Monitoring Center in China experienced a cyber incident carried out by a hacker group with an "overseas government background."