This is a reminder that attackers only need a single way in. You need to protect _all_ ways in. 🔒
Intriguing reading. Here is a snippet of what happened 🤯
"Those safeguards broke down in April 2021, more than two years before Storm-0558 gained access to Microsoft’s network. When a workstation in the dedicated production environment crashed, Windows performed a standard “crash dump,” in which all data stored in memory is written to disk so engineers can later diagnose the cause.
The crash dump was later moved into Microsoft’s debugging environment.
The hack of a Microsoft engineer’s corporate account allowed Storm-0558 to access the crash dump and, with it, the expired Exchange signing key.
Normally, crash dumps strip out signing keys and similarly sensitive data.
In this case, however, a previously unknown vulnerability known as a “race condition” prevented that mechanism from working properly."