Absent either customers paying for it, or regulations requiring it, Microsoft certainly won't sink money out of the goodness of their heart. I don't believe there are a lot of regulations for this — and how many customers do you think would pay for something like this? Realistically? :-(
If you have immutable, permanent audit logs, you can go through all actions authenticated with something directly or indirectly signed by the leaked key. However, building such an audit log in a way that someone with maximum permissions still can't tamper with it is not easy — and not cheap. (And, worst case, the audit log may not have the necessary detail; e.g. just listing an authenticated identity, but not the way authentication was established — thus not allowing easy identification of possibly compromised access.)
As such, the hole in the strategy is that it doesn't account for other persistent backdoors that may have been added while access using this leaked key was possible. It only prevents further exploitation of the issue. But depending on the sophistication level of the attackers — which seems extremely high considering how the key was apparently stolen — it's nigh impossible to figure out how many secondary avenues of access they have established.
* We already have confirmation that the US government has been tapping internet infrastructure, accessing back doors in BigTech backends, and compromising industry-wide encryption and RNG standards.
So there is no way to prove that SOMEONE at the NSA doesn't have the ability to access all of the information on the internet.
And, since the NSA is just more humans, that means there's no way to prove that someone else hasn't sold that ability or specific subsets of the data to malicious actors.
Post Snowden revelations, you have to do risk analysis. Is some US or Five Eyes Government Agency able to access all your personal information or business competitive secrets? Probably Yes. Can one of your competitors? Probably Not. Can a malicious neighbor or drug cartel that would then use it to extort you for money? Probably not.
So even in this hypothetical example where everything authenticated by Microsoft is tainted, it's not clear if it actually changes this equation significantly.
- On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused.
- On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity.
- On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key:
- On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens.I’m not a security expert. What are the holes in this strategy?