How weak passwords and other failings led to catastrophic breach of Ascension

"Last week, a prominent US senator called on the Federal Trade Commission to investigate Microsoft for cybersecurity negligence over the role it played last year in health giant Ascension's ransomware breach, which caused life-threatening disruptions at 140 hospitals and put the medical records of 5.6 million patients into the hands of the attackers. Lost in the focus on Microsoft was something as, or more, urgent: never-before-revealed details that now invite scrutiny of Ascension's own security failings."

"In a letter sent last week to FTC Chairman Andrew Ferguson, Sen. Ron Wyden (D-Ore.) said an investigation by his office determined that the hack began in February 2024 with the infection of a contractor's laptop after they downloaded malware from a link returned by Microsoft's Bing search engine. The attackers then pivoted from the contractor device to Ascension's most valuable network asset: the Windows Active Directory, a tool administrators use to create and delete user accounts and manage system privileges to them."

"Wyden blasted Microsoft for its continued support of its three-decades-old implementation of the Kerberos authentication protocol that uses an insecure cipher and, as the senator noted, exposes customers to precisely the type of breach Ascension suffered. Although modern versions of Active Directory by default will use a more secure authentication mechanism, it will by default fall back to the weaker one in the event a device on the network-including one that has been infected with malware-sends an authentication request that uses it."

Sen. Ron Wyden requested an FTC investigation into Microsoft for alleged cybersecurity negligence related to Ascension's ransomware breach. The breach began in February 2024 when a contractor's laptop downloaded malware from a link returned by Microsoft's Bing search engine. Attackers pivoted from the contractor device to Ascension's Windows Active Directory, which functions as a master key to network resources. Microsoft continues to support a decades-old Kerberos implementation that uses an insecure cipher. Modern Active Directory defaults to a more secure mechanism but can fall back to the weaker one when a device requests it, enabling Kerberoasting attacks.

Read at Ars Technica