Microsoft Under Fire: Calls for FTC Investigation Over Cybersecurity Risks

A significant controversy has emerged regarding Microsoft’s approach to cybersecurity vulnerabilities, prompting U.S. Senator Ron Wyden (D-OR) to urge the Federal Trade Commission (FTC) to investigate what he describes as “gross cybersecurity negligence.” Wyden claims that the company’s practices have led to ransomware attacks that jeopardize critical infrastructure, notably in the healthcare sector.

Accusations of Insecure Software Defaults

In a formal letter sent to FTC Chair Andrew Ferguson, Wyden detailed his concerns about Microsoft’s software defaults, which he believes leave essential institutions—hospitals, government agencies, and corporations—open to hacking threats, specifically techniques such as Kerberoasting. He highlighted the 2024 ransomware breach at Ascension, one of the largest nonprofit health systems in the U.S., as a case in point.

The predicament at Ascension reportedly began when a contractor fell victim to a malicious link while using the Microsoft Edge browser. This seemingly small misstep was exacerbated as hackers took advantage of Microsoft Active Directory, a fundamental identity management system, to gain administrative access. The consequences were severe: ransomware spread across thousands of devices, resulting in compromised data for 5.6 million patients.

The Role of Kerberoasting

In his letter, Wyden explained that the attackers exploited a method known as Kerberoasting. This technique allows them to crack weakly secured service account credentials within Active Directory. Particularly troubling is Microsoft’s ongoing default support for RC4, an outdated encryption algorithm associated with numerous security risks. Despite warnings voiced by federal entities and cybersecurity experts, Microsoft has yet to disable RC4, compelling system administrators to manually implement stronger encryption practices, such as AES.

A Lack of Prompt Action

Concerned staff from Wyden’s office reached out to Microsoft in mid-2024, requesting clear guidance about disabling RC4. While the company did respond with a blog post outlining mitigation strategies, it was primarily obscured in a technical section of their website, resulting in minimal visibility among users. A year later, the anticipated patch to address these concerns has still not been made available.

Wyden emphasized the gravity of Microsoft’s decisions, pointing out that a single click on a malicious link could lead to a vast ransomware infection, jeopardizing entire organizations.

A History of Security Compromises

The senator’s letter further illustrated a disturbing pattern of security blunders associated with Microsoft. In 2023, hackers backed by the Chinese government exploited vulnerabilities within Microsoft’s cloud services, accessing U.S. government email accounts. This prompted the Cyber Safety Review Board to classify Microsoft’s security culture as “inadequate.” Just recently, another flaw in Microsoft’s SharePoint software was reported to have been utilized by Beijing-linked cybercriminals.

Wyden suggested that this trend reflects a more significant issue inherent to Microsoft’s business model. He argued that instead of prioritizing the delivery of secure software, Microsoft profits from selling additional security features once clients have already experienced breaches. “Microsoft has become like an arsonist selling firefighting services to their victims,” Wyden remarked.

Concerns Over Monopoly Power and National Security

Wyden’s assessment casts light on Microsoft’s dominant position in the market. Given the widespread reliance on Windows and Active Directory, organizations often feel compelled to utilize these products, even if the defaults expose them to extensive cybersecurity risks. Consequently, Wyden has called on the FTC to take action, citing its responsibility to address unfair business practices.

National security agencies have echoed these worries. In a guide released in September 2024, CISA and NSA, along with Australian security authorities, spotlighted Active Directory exploitation as a top concern, identifying Kerberoasting as one of the primary threats. Despite these growing alarm signals, Wyden contends that Microsoft has not pursued meaningful remediation efforts.

The repercussions of the 2024 attack were undeniable, disrupting hospital services across several states and delaying critical patient treatments. With ransomware incidents on the rise—15% in the past year—especially within healthcare, Wyden argues that Microsoft’s adherence to outdated encryption practices exacerbates the systemic risks faced by such vital services.

An Urgent Call for Action

In closing, Wyden stressed the urgent need for Microsoft to rectify its cybersecurity protocols. “Without timely action, Microsoft’s culture of negligent cybersecurity poses a serious national security threat and makes additional hacks inevitable,” he cautioned, reflecting the growing concern over the ramifications of inadequate cybersecurity measures in today’s interconnected world.