Senator Slams Microsoft: When Windows Opens, Hackers Walk In!

Hot Take:

Is it just me, or does Microsoft’s software have the security strength of a wet paper bag? Senator Ron Wyden seems to think so, and he’s asking the FTC to investigate Microsoft for their role in a ransomware attack that made Ascension Hospital play peek-a-boo with 5.6 million patient records. When your software’s security is so bad it makes an ’80s mullet look stylish, it’s time for a serious upgrade!

Key Points:

• Senator Ron Wyden is urging the FTC to investigate Microsoft after a massive ransomware attack on Ascension Hospital.
• The attack exposed 5.6 million patient records, thanks to a contractor’s laptop infected via a malicious Bing search.
• Hackers exploited an old Microsoft encryption vulnerability, allowing them to access Ascension’s network.
• Microsoft has a history of security issues, including a 2023 Chinese hack of US government agencies.
• Wyden claims Microsoft’s market dominance reduces their incentive to improve security measures.

Hackers: 1, Microsoft: 0

In a plot twist straight out of a cyber-thriller, Ascension Hospital found itself at the mercy of hackers when a contractor’s laptop was compromised. All it took was a malicious click on a Bing search, and voilà! The hackers had the keys to the kingdom, thanks to some good ol’ insecure default settings in Microsoft’s software. The hackers, channeling their inner 1980s nostalgia, used a technique called Kerberoasting. This is where things get retro-funky: they exploited the RC4 encryption technique that Microsoft still includes in their default settings. Basically, it’s like leaving your front door wide open because you still think it’s 1985 and the only threat is your nosy neighbor. With access to Ascension’s Active Directory server, the hackers unleashed ransomware on thousands of computers, treating it like a bad Oprah giveaway: “You get ransomware! You get ransomware! Everybody gets ransomware!”

A Pattern Older Than Your Grandma’s Doilies

If you thought this was Microsoft’s first rodeo, think again. Senator Wyden highlighted a history of security faux pas that would make even the clumsiest among us blush. Remember that 2023 Chinese hack of US government agencies? Turns out, it was just another day in the life of Microsoft’s security blunders. A special review board, at Wyden’s behest, concluded that Microsoft’s security culture was in desperate need of a makeover—think extreme home edition, but for cybersecurity. Even after Wyden’s team waved red flags about the Kerberoasting threat in July 2024, Microsoft took their sweet time to respond. It wasn’t until October that they published a technical blog post, which is basically the corporate equivalent of, “Oops, my bad!” A software update to fix the vulnerability? Still waiting for that, like a kid waiting for Santa in July.

The Microsoft Monopoly

Why fix the roof when it’s raining, right? Wyden argues that Microsoft’s market dominance is like a free pass to skip out on fixing security issues. With so many companies and government agencies tethered to Microsoft’s products like a kid to their smartphone, there’s little motivation for Microsoft to patch up their security holes. Wyden’s metaphor about Microsoft being an “arsonist selling firefighting services” paints a vivid picture of the current state of affairs. With national security hanging in the balance, one can’t help but wonder if Microsoft’s security strategy is inspired by a game of Jenga—just waiting for the wrong piece to be pulled.