- Senator Ron Wyden has asked for a probe into Microsoft
- This comes after ransomware attacks, particularly on Ascension Healthcare
- Microsoft is accused of ‘gross cybersecurity negligence.’
US Senator Ron Wyden has written a letter to the FTC Chairman to urge them to open an investigation into Microsoft over the company’s ‘negligent cybersecurity’ in relation to ransomware attacks against US critical infrastructure;
“I urge the FTC to investigate Microsoft and hold the company responsible for the serious harm it has caused by delivering dangerous, insecure software to the U.S. government and to critical infrastructure entities, such as those in the U.S. health care sector,” Wyden wrote in a letter to FTC Chairman Andrew Ferguson.
Earlier this year, millions were left at risk after Ascension Healthcare revealed a data breach, most likely at the hands of C10p ransomware.
Karberoasting attacks
Senator Wyden’s office has reportedly obtained new information – “the hack began when a contractor clicked on a malicious link after conducting a web search on Microsoft’s Bing search engine.”
Following this, a contractor’s laptop was infected with malware, which the letter claims was due to “dangerously insecure default settings on Microsoft software allowed the hackers to ultimately gain highly privileged access to the most sensitive parts of Ascension’s network.”
“Without timely action, Microsoft’s culture of negligent cybersecurity, combined with its de facto monopolization of the enterprise operating system market, poses a serious national security threat and makes additional hacks inevitable.”
The attacks reportedly used something called ‘Kerberoasting’ – a technique which exploits insecure encryption technologies from all the way back in the 1980’s known as ‘RC4’. These are still supported by Microsoft software, and Wyden argues Microsoft should warn customers about such dangers.
Microsoft has, as yet, not released a patch or update for the vulnerability, nor has the firm reached out to warn customers.
“RC4 is an old standard, and we discourage its use both in how we engineer our software and in our documentation to customers – which is why it makes up less than .1% of our traffic,” a Microsoft spokesperson told TechRadar Pro.
“However, disabling its use completely would break many customer systems. For this reason, we’re on a path to gradually reduce the extent to which customers can use it, while providing strong warnings against it and advice for using it in the safest ways possible. We have it on our roadmap to ultimately disable its use. We’ve engaged with The Senator’s office on this issue and will continue to listen and answer questions from them or others in government.”
