American Senator Ron Widen has sent a letter to the Federal Trade Commission (FTC), requesting the agency to check Microsoft to fail to provide adequate protection in its products, which led to ransomware attacks against healthcare organizations.
The senator began to formally ask, saying that Microsoft should be “held responsible for his gross cyber security negligence, resulting in ransom attacks against important infrastructure including US health care organizations.”
The Senator highlighted the long failure of Microsoft to take decisive action to effectively reduce the well -written safety risks in its products, resulting in an agreement with 5.6 million patients in attacks such as the 2024 Escation Health Restoware Breech.
The incident in May 2024, when a contractor clicked on a malicious bing discovery result in Microsoft Edge, the hackers were allowed to attack “Kerbrosting”.
Kerberos is a network certification protocol that provides access to network resources by verifying their identity without password exchange to users and services.
Kerberoasting is a post-compromise technique that steals the encrypted service account credentials from the Microsoft active directory to the attackers.
It takes advantage of a weak or easy-to-appearance password, sometimes encrypted with unsafe and designated RC4 algorithm, which can be easily dec
After decrying the password, the attacker can use it to enhance the privileges and later transfer to the compromised network, as ascending in the case of ascending health violations.
The senator says that his team spoke with Microsoft in July 2024, urged the tech veteran to warn customers of dangers of using RC4 instead of more strong options like AES 128/256, and to create a default setting.
Microsoft responded with one blog post Published in October, which the senator said that was highly technical and failed to clearly warn the decision making within companies.
The RC4 Encryption algorithm is still an option in cage, despite being a weak cipher with weaknesses, which allows to recover the plaintext information.
It is worth noting that Microsoft pledged to strengthen safety in its products. The RC4 continues to be present for the old systems in Cerberos that do not accept new, safe algorithms.
Wyden clearly frames the practices of Microsoft as a serious national security risk, it certainly expresses that there are more high-effect events until FTC intervenes.
“Without time action, Microsoft’s careless cyber security culture, the enterprise operating system combined with its real monopoly, is a serious national security threat and makes the additional hack inevitable” – – – – – Senator Ron Widen
Bleepingcomputer has contacted Microsoft with a request for a comment on this development, and a spokesman sent us the following statements:
“RC4 is an old standard, and we discourage its use how we are engineers in our documents for our software and customers – that’s why it makes less than our traffic.
The company is actively working to remove the algorithm without causing any disruption to customers, and warning against it and also providing advice to use the algorithm “the safest manner.”
A Microsoft spokesperson told BlappingCopper, “We finally have to disable its use on our roadmap. We are associated with the Senator’s office on the issue and will keep listening and answering questions in the government or in the government.”
The FTC has not yet publicly responded to Wyden’s request.
The passwords broke in 46% of the atmosphere, almost doubled by 25% last year.
Picus Blue Report 2025 Now get a wider look at more conclusions on prevention, detection and data exfIs.
