Nexus information on: Azure Key Leakage - Storm-0558

Latest update:

2023-09-12

General information

This article contains information related to Azure Key Leakage - Storm-0558. As described by the press and Microsoft, through a leaked OpenID signing key, it was possible for hackers to steal customer data of "approximately 25 organizations, including government agencies and related consumer accounts in the public cloud." Microsoft assures that no other customers are affected. Due to the severity of the incident and the possibility that this vulnerability affected other Azure customers, we decided to start our own investigations in the Azure services used by Nexus.

Impact

The impact is being investigated by Nexus, but at this moment we have not found any irregularities. Also, as stated in Microsoft's blog, they have already contacted all affected customers; Nexus not being one of them.

Further information

Further information will be available when the analysis is complete.

Official Microsoft information

Analysis of Storm-0558 techniques for unauthorized email access