Microsoft has successfully addressed a security breach that made internal business information and credentials accessible to the public internet.

Researchers Can Yoleri, Murat Özfidan, and Egemen Koçhisarlı from SOCRadar, a cybersecurity firm specializing in identifying security vulnerabilities, have uncovered an accessible and publicly available storage server on Microsoft’s Azure cloud service. This server was found to contain confidential internal data pertaining to Microsoft’s Bing search engine.

The Azure storage server had code, scripts, and configuration files that stored passwords, keys, and credentials used by Microsoft workers to access internal databases and systems.

However, the storage server lacked password protection, rendering it accessible to everyone on the internet.

According to Yoleri’s statement to , the data that was leaked has the potential to assist unscrupulous individuals in identifying or gaining access to other locations where Microsoft keeps its confidential information. According to Yoleri, if the storage sites are identified, it might lead to more serious data leaks and potentially endanger the services being used.

The researchers reported the security breach to Microsoft on February 6, and Microsoft took measures to protect the leaked files on March 5.

The duration of the cloud server’s exposure to the internet is unknown, as is whether anyone other than SOCRadar found the exposed data. Upon receiving an email, a representative from Microsoft declined to make a comment at the time of publishing. Microsoft did not provide information regarding whether it has reset or altered any of the compromised internal credentials.

This incident represents the most recent security lapse at Microsoft as the corporation endeavors to regain the confidence of its customers following a sequence of cloud security breaches in recent times. Last year, researchers discovered a security breach where Microsoft employees were inadvertently revealing their own corporate network login credentials in code that was made public on GitHub.

Last year, Microsoft faced criticism when it acknowledged its lack of knowledge of the methods used by China-backed hackers to get an internal email signature key. This key granted the hackers extensive access to the Microsoft-hosted inboxes of high-ranking U.S. government officials. An independent panel of cyber experts tasked with looking into the email breach came to the conclusion last week that a number of security flaws at Microsoft allowed the hackers to succeed.

Microsoft declared in March that it was actively defending against a persistent cyberattack by Russian state-sponsored hackers. These hackers managed to pilfer sections of Microsoft’s source code and internal communications belonging to the company’s executives.

Telegram, with 800 million monthly users, is launching a self-custodial crypto wallet. The move will solidify its presence in the vibrant crypto community that has grown from its chat platform and may attract more people to crypto.

Telegram and TON Foundation announced TON Space, a self-custodial wallet, on Wednesday at Singapore’s Token2049 crypto conference, which draws over 10,000 attendees.

Telegram has a complicated blockchain relationship. After the SEC sued Telegram over a massive initial coin offering, the chat app abandoned its Telegram Open Network (TON) blockchain project in 2020. The Open Network Foundation (TON Foundation), founded by open-source developers and blockchain enthusiasts, supports the development of The Open Network (TON), the blockchain powering a growing number of Telegram applications, including the wallet.

The Open Platform (TOP) and TOP Labs, a venture-building division, created the TON-based wallet.

TON Space will be available to Telegram users worldwide without wallet registration in November. The U.S., which has cracked down on the crypto industry and promoted many crypto apps to geofence users, is currently excluded from the feature.

China-backed hackers stole a digital skeleton key to access US government emails.

A China-backed hacking group stole one of Microsoft’s email keys, allowing near-unfettered access to U.S. government inboxes, due to a series of unfortunate and cascading mistakes. Microsoft revealed how the hackers pulled off the heist in a long-awaited blog post this week. Although one mystery was solved, several crucial details remain unknown.

In July, Microsoft disclosed that Storm-0558 hackers, which it believes are backed by China, “acquired” an email signing key used to secure Outlook.com accounts. The hackers broke into government officials’ Microsoft-hosted personal and enterprise email accounts using that digital skeleton key. The hack targeted unclassified emails of U.S. government officials and diplomats, including Commerce Secretary Gina Raimondo and Ambassador to China Nicholas Burns.

The hackers’ source of that consumer email signing key was unknown until this week, when Microsoft revealed the five issues that led to its leak.

Microsoft reported in its blog that a consumer key signing system crashed in April 2021. The crash created a system snapshot for analysis. This consumer key signing system is “highly isolated and restricted” from the internet to prevent cyberattacks. Microsoft was unaware that the system crash resulted in a snapshot image containing the consumer signing key #1, which they failed to detect in snapshot#2 .

The snapshot image was “subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network” to determine the system crash. Microsoft confirmed its standard debugging process, but credential scanning did not detect the key in snapshot image#3.

After the snapshot image was moved to Microsoft’s corporate network in April 2021, Microsoft said the Storm-0558 hackers were able to “successfully compromise” a Microsoft engineer’s corporate account, which had access to the snapshot image’s debugging environment, which contained the consumer signing key. Microsoft said “we don’t have logs with specific evidence of this exfiltration,” but this was the “most probable mechanism by which the actor acquired the key.”

Microsoft stated that its email systems were not properly validating the consumer signing key#4, allowing access to enterprise and corporate email accounts of various organizations and government departments. The company stated that its email system would accept a request for enterprise email using a security token signed with the consumer key#5.

Mystery solved? Not quite

Microsoft’s admission that the consumer signing key was likely stolen from its systems ends the speculation that it was obtained elsewhere.

How the intruders hacked Microsoft is unknown. Jeff Jones, senior director at Microsoft, told that “token-stealing malware” compromised the engineer’s account but declined to comment.

Phishing and malicious links can spread token-stealing malware that steals session tokens. Session tokens are small files that keep users logged in without having to re-enter a password or two-factor authentication. Thus, stolen session tokens can give an attacker full access without the user’s password or two-factor code.

Last year, a teenage hacking team called Lapsus$ used malware to steal Uber employee passwords and session tokens. CircleCi was compromised in January after its antivirus software missed token-stealing malware on an engineer’s laptop. After hackers broke into LastPass’s cloud storage via a compromised developer’s computer, customers’ password vaults were breached.

How the Microsoft engineer’s account was compromised could help network defenders prevent future incidents. The engineer’s work computer or a personal device Microsoft allowed on its network may have been compromised. The real culprits for the compromise are the network security policies that failed to block the (albeit highly skilled) intruder, so focusing on an engineer seems unfair.

Cybersecurity is difficult even for corporate mega-giants with nearly unlimited cash and resources. Even if they failed, Microsoft engineers considered a wide range of complex threats and cyberattacks when designing protections and defenses for the company’s most sensitive and critical systems. Storm-0558 hacked into Microsoft’s network by chance or knowing it would find the keys to its email kingdom. It’s a reminder that cybercriminals only need to succeed once.

No analogy fits this unique breach or circumstances. It’s possible to admire a bank’s vault security while acknowledging the robbers who stole the loot inside.

It will be some time before the full extent of the espionage campaign is known, and the remaining victims whose emails were accessed are unknown. The Cyber Security Review Board, a group of security experts that analyzes major cybersecurity incidents, will investigate the Microsoft email breach and other issues “relating to cloud-based identity and authentication infrastructure.”