Senator Urges FTC to Investigate Microsoft Product Security

Sen. Ron Wyden, D-Oregon, is urging the Federal Trade Commission to investigate Microsoft over the software giant’s alleged “negligent cybersecurity” that he says contributed to ransomware attacks on critical infrastructure sector organizations, including last year’s attack on Ascension Health.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Wyden’s letter on Wednesday to FTC Chair Andrew Ferguson called for regulatory scrutiny over Microsoft’s security practices, citing inquiries made to his office after the 2024 ransomware attack on Ascension.

That hack disrupted Ascension’s IT systems for weeks and also included the theft of data, compromising 5.6 million individuals’ personal and health information (see: Ascension Notifying 5.6 Million Affected by Ransomware Hack).

Missouri-based Ascension – one of the largest Catholic hospital chains in the United States – operates 140 hospitals and 30 senior care centers and other facilities in 16 states, plus the District of Columbia.

The hackers exploited a privilege escalation technique called Kerberoasting to gain access to privileged accounts on Ascension’s Microsoft Active Directory server, Wyden told the FTC.

Attackers target the Kerberos authentication protocol to steal Active Directory credentials.

Kerberoasting has long been a problem involving Microsoft’s Active Directory (see: Why Hackers Abuse Active Directory).

“This incident perfectly illustrates the problem caused by Microsoft,” the senator told the FTC.

Wyden said Ascension told his staff that in February 2024 that a contractor using an Ascension laptop conducted a search using Microsoft’s Bing search engine, which Microsoft’s Edge web browser uses by default.

“The contractor clicked on a malicious link from one of the search results, which resulted in them inadvertently downloading and opening malware,” Wyden wrote. “After infecting that contractor’s laptop, the hackers were able to move laterally within Ascension’s network and gain administrative privileges to accounts on the organization’s Microsoft Active Directory server,” he said.

Active Directory “is one of the crown jewels of an organization’s network because it is used to manage user accounts,” he noted.

The hackers used this privileged access to push ransomware to thousands of other computers in the organization, he said. This “created challenges to Ascension’s ability to serve its patients and communities. The hackers were also able to use this privileged access to steal sensitive data” of millions of patients.

The FTC confirmed to Information Security Media Group that it had received Wyden’s letter, but declined further comment.

Ascension did not immediately respond to ISMG’s request for comment on Wyden’s account of Ascension’s attack.

Multiple Warnings

The Kerberoasting hacking technique “leverages Microsoft’s continued support by default for an insecure encryption technology from the 1980s called RC4 that federal agencies and cybersecurity experts, including experts working for Microsoft, have for more than a decade warned is dangerous,” Wyden told the FTC.

“Although Microsoft’s software also supports a secure encryption technology approved and recommended by the U.S. government, known as the Advanced Encryption Standard, this vastly superior encryption technology is not required by default in Windows,” he said.

“Microsoft’s continued support for the ancient, insecure RC4 encryption technology needlessly exposes its customers to ransomware and other cyberthreats by enabling hackers that have gained access to any computer on a corporate network to crack the passwords of privileged accounts used by administrators.”

Microsoft had said that these threats can be mitigated by setting long passwords that include at least 14 characters, “but Microsoft’s software does not require such a password length for privileged accounts,” Wyden wrote.

The Cybersecurity and Infrastructure Security Agency and other government agencies have warned healthcare sector and other critical infrastructure sectors about Kerberoasting threats several times within the last few years.

That includes a CISA bulletin issued on Dec. 13, 2023, urging technology manufacturers to proactively take steps to eliminate the risk of default password exploitation.

Then, on Oct. 16, 2024, in a joint bulletin, CISA, the FBI, the National Security Agency and several foreign agencies warned about Iranian threat actors using Kerberoasting techniques in targeting organizations’ Active Directory.

Days earlier, Microsoft also warned about Kerberoasting threats in a blog post by Microsoft Vice President of Enterprise and OS security David Weston. He described the method as a post-exploitation technique (see: Breach Roundup: Brazilian Police Arrest USDoD).

After gaining access to a network, attackers request service tickets tied to Active Directory accounts. Hackers then crack the tickets – encrypted with an NTLM hash – offline to reveal passwords, Weston wrote.

Weston in the blog described Kerberoasting as “a low-tech, high-impact attack” that can be executed using open-source tools to query target accounts, retrieve service tickets and crack passwords. Once attackers obtain valid credentials, they can swiftly move through compromised networks, he said.

But Wyden also told the FTC that Kerberoasting is not Microsoft’s only security weakness putting organizations in jeopardy of major cyber incidents.

“In July 2023, I asked the FTC, CISA and the Department of Justice to hold Microsoft responsible for another cybersecurity lapse that enabled a major hack of U.S. government agencies by China,” Wyden wrote.

“A subsequent review of that incident by the Cyber Safety Review Board, which I requested, assessed that ‘Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations,'” Wyden wrote.

Wyden noted that more recently, in July, hackers in China were targeting zero-day vulnerabilities in Microsoft SharePoint to steal cryptographic data and facilitate long-term, post-patch access to servers (see: Microsoft Traces on Premises SharePoint Exploits to China).

Wyden urged the FTC to intervene to stop “Microsoft’s dangerous software engineering practices and the company’s refusal to inform its customers about the pressing need to adopt important cybersecurity safeguards.”

“Without timely action, Microsoft’s culture of negligent cybersecurity, combined with its de facto monopolization of the enterprise operating system market, poses a serious national security threat and makes additional hacks inevitable.”

Microsoft did not immediately respond to ISMG’s request for comment on Wyden’s allegations and his letter urging the FTC to investigate the software company.