Senator Ron Wyden calls for an investigation into Microsoft
The request stems from ransomware incidents affecting Ascension Healthcare
Microsoft faces allegations of ‘serious cybersecurity negligence.’
U.S. Senator Ron Wyden has formally urged the Federal Trade Commission (FTC) to initiate an investigation into Microsoft, highlighting what he describes as the company’s ‘negligent cybersecurity’ practices linked to ransomware attacks that threaten critical infrastructures across the nation.
In a letter directed to FTC Chairman Andrew Ferguson, Wyden asserted, “I implore the FTC to scrutinize Microsoft and hold the company accountable for the considerable damage incurred by supplying perilous, insecure software to the U.S. government and essential services providers, notably within the healthcare sector.”
Earlier in the year, millions of individuals were left vulnerable when Ascension Healthcare disclosed a data breach, likely orchestrated by the notorious Cl0p ransomware.
Kerberoasting Attacks
Wyden’s office has purportedly acquired fresh intel indicating that the breach was initiated when a contractor inadvertently clicked on a malicious link after a search on Microsoft’s Bing search engine.
This action led to the contractor’s laptop becoming infected with malware, which the letter attributes to “alarmingly insecure default configurations on Microsoft software that enabled hackers to secure high-level access to the most sensitive segments of Ascension’s network.”
Wyden cautioned, “Absent immediate intervention, Microsoft’s culture of cybersecurity negligence, compounded by its effective monopolization of the enterprise operating system sector, endangers national security and makes additional breaches inevitable.”
The assailants allegedly employed a technique termed ‘Kerberoasting,’ which exploits antiquated encryption standards such as ‘RC4’, dating back to the 1980s. This method remains supported by Microsoft software, and Wyden contends the company must alert customers regarding such vulnerabilities.
As of now, Microsoft has not issued a patch or update addressing the vulnerability, nor has it reached out to inform its clientele.
A Microsoft spokesperson commented, “RC4 is an outdated standard, and we actively dissuade its utilization both in our software engineering and customer communication—hence it comprises less than 0.1% of our traffic. However, a complete cessation of its use could disrupt numerous customer systems.
Consequently, we are working towards a gradual reduction in its application while offering robust warnings against its use and guidance on safer alternatives. We are committed to ultimately phasing it out and have collaborated with the Senator’s office on this matter, maintaining open lines of communication to address further inquiries from governmental representatives.”
Source link: Techradar.com.
