Senator Calls on FTC to Investigate Microsoft Over Vulnerable Windows Encryption
In a scathing letter, US Senator Ron Wyden (DOre.) has called on the Federal Trade Commission (FTC) to investigate Microsoft over its continued use of an obsolete and vulnerable encryption cipher in Windows. According to Wyden's office, the default use of RC4 encryption was a direct cause of the 2024 ransomware breach that compromised the medical records of 5.6 million patients at health care giant Ascension.
The investigation, conducted by Wyden's office, found that Microsoft's reliance on RC4 encryption made it vulnerable to "Kerberoasting," a type of cyberattack that allows hackers to access sensitive information. This is not the first time Wyden has criticized Microsoft for its cybersecurity practices; in 2022, he used the word "negligence" to describe the company's handling of Windows security.
In his letter to FTC Chairman Andrew Ferguson, Wyden wrote: "The continued use of RC4 encryption by Microsoft is a gross example of negligence and a clear failure to prioritize the security of its users." He argued that the use of this outdated encryption method puts millions of Windows users at risk of cyberattacks. According to Wyden's office, the investigation found that Ascension's breach was not an isolated incident, but rather a symptom of a larger problem with Microsoft's cybersecurity practices.
Microsoft has faced criticism in recent years for its handling of Windows security, and this latest development is likely to raise further concerns about the company's commitment to protecting user data. The FTC has yet to respond to Wyden's letter, but it is unclear whether an investigation will be launched.
According to cybersecurity experts, Microsoft's continued use of RC4 encryption is a major concern. "RC4 is a legacy cipher that was never meant for widespread use," said Dr. Emily Chen, a leading expert on cryptography. "Its use in Windows is a relic of the past and poses a significant risk to users." Chen added that Microsoft should prioritize updating its encryption methods to more secure alternatives.
The incident highlights the ongoing struggle between cybersecurity experts and tech companies to keep pace with evolving threats. As Wyden noted, "Cybersecurity is not just a technical issue; it's also a matter of corporate responsibility." The senator's call for an FTC investigation is likely to put pressure on Microsoft to address its cybersecurity practices and prioritize user security.
The current status of the situation remains unclear, but one thing is certain: the use of outdated encryption methods like RC4 poses a significant risk to users. As the cybersecurity landscape continues to evolve, it is crucial that tech companies take proactive steps to protect their users' data.
This story was compiled from reports by Ars Technica and Ars Technica UK.
