Managed Service Accounts Archives

Winsage

September 12, 2025

Senator Wyden Urges FTC to Probe Microsoft for Ransomware-Linked Cybersecurity Negligence

U.S. Senator Ron Wyden has urged the Federal Trade Commission (FTC) to investigate Microsoft for "gross cybersecurity negligence" linked to ransomware attacks on critical U.S. infrastructure, particularly in healthcare. Wyden's concerns were highlighted in a letter to FTC Chairman Andrew Ferguson, referencing a ransomware attack on Ascension that compromised personal and medical information of approximately 5.6 million individuals. The breach was initiated by a contractor clicking a malicious link on Microsoft's Bing, leading to exploitation of insecure default settings in Microsoft software. Wyden criticized Microsoft's use of the outdated RC4 encryption technology, which is vulnerable to attacks, and noted that Microsoft's software does not enforce a minimum password length for privileged accounts. Microsoft plans to phase out support for RC4 and implement additional security measures in future updates. The scrutiny follows previous criticisms of Microsoft's cybersecurity practices, including a report from the U.S. Cyber Safety Review Board.

Winsage

September 12, 2025

Senator Wyden Urges FTC to Probe Microsoft for Ransomware-Linked Cybersecurity Negligence

U.S. Senator Ron Wyden has called on the Federal Trade Commission (FTC) to investigate Microsoft for "gross cybersecurity negligence" linked to ransomware attacks on U.S. healthcare networks. In a letter to FTC Chairman Andrew Ferguson, Wyden expressed concerns about Microsoft's cybersecurity practices and its dominant market position, which he believes pose a national security risk. He referenced a ransomware attack on the healthcare system Ascension that affected 5.6 million individuals, attributed to the Black Basta group, and noted that the breach was initiated by a contractor clicking a malicious link on Microsoft's Bing search engine. The attackers exploited insecure default settings in Microsoft software, using a method called Kerberoasting that targets the Kerberos authentication protocol. This method takes advantage of the outdated RC4 encryption technology, which Microsoft still supports. Wyden criticized Microsoft's lack of adequate warnings about the risks associated with RC4 and pointed out that the software does not enforce a minimum password length of 14 characters for privileged accounts. Microsoft plans to phase out RC4 in future updates, with new installations of Active Directory Domains using Windows Server 2025 set to have RC4 disabled by default starting in Q1 of 2026. Additionally, a report from the U.S. Cyber Safety Review Board highlighted preventable errors that allowed Chinese threat actors to compromise Microsoft Exchange Online mailboxes. Despite these cybersecurity issues, Microsoft continues to secure lucrative federal contracts.

Winsage

July 17, 2025

Semperis Research Uncovers Critical Flaw in Windows Server 2025 Exposing Managed Service Accounts to Golden DMSA Attack

Semperis has identified a vulnerability in Windows Server 2025, termed Golden dMSA, which allows for high-impact attacks that enable cross-domain lateral movement and persistent access to managed service accounts in Active Directory. The vulnerability exploits a cryptographic flaw in the ManagedPasswordId structure, which has predictable components and limited combinations, making brute-force attacks feasible. Semperis researcher Adi Malyanker developed a tool named GoldenDMSA to help cybersecurity professionals understand and simulate this attack. Additionally, Semperis has uncovered other vulnerabilities, such as nOauth in Microsoft's Entra ID and BadSuccessor, a privilege escalation technique in Windows Server 2025. The company focuses on protecting enterprise identity services and offers various resources for the cybersecurity community.

Winsage

July 17, 2025

Semperis discovers critical flaw in Windows Server 2025

Researchers from Semperis have identified a significant design flaw in Windows Server 2025 that affects managed service accounts, allowing potential high-impact attacks and cross-domain lateral movement. The vulnerability is linked to a cryptographic weakness in the ManagedPasswordId structure, which has predictable components leading to only 1024 possible password combinations. Adi Malyanker developed a tool called GoldenDMSA to exploit this flaw, enabling exploration and simulation of the attack. Detecting related activities requires careful manual log configuration, and while attackers need a KDS root key to exploit the vulnerability, it is accessible only to highly privileged accounts. Semperis has classified this vulnerability as a moderate risk, urging organizations to conduct proactive security assessments.

Winsage

July 17, 2025

Windows Server 2025 Golden dMSA Attack Enables Authentication Bypass and Password Generation

A design flaw in Microsoft’s Windows Server 2025, known as “Golden dMSA,” allows attackers to bypass authentication and generate passwords for all managed service accounts across enterprise networks. This vulnerability exploits a weakness in delegated Managed Service Accounts (dMSAs), reducing cryptographic protections to a brute-force attack requiring only 1,024 attempts. Discovered by Semperis Security Researcher Adi Malyanker, the attack involves extracting cryptographic material from the Key Distribution Services (KDS) root key, enumerating dMSA accounts, guessing ManagedPasswordId attributes, and generating passwords. The KDS root keys do not expire, potentially granting indefinite access. The vulnerability is classified as moderate risk, requiring possession of a KDS root key, accessible only to privileged accounts. Detection of the attack is challenging, as no security events are logged by default when KDS root keys are compromised. Microsoft acknowledged the vulnerability on May 27, 2025, and stated that the features were not intended to protect against domain controller compromises.

Winsage

July 17, 2025

Windows Server 2025 flaw lets attackers persist in Active Directory

Semperis researchers have identified a significant design flaw in Windows Server 2025, known as 'Golden dMSA', which affects delegated Managed Service Accounts (dMSAs) and poses a risk of undetected attacks. This vulnerability allows attackers to gain persistent access to these accounts, facilitating cross-domain lateral movement and compromising resources within Active Directory. The flaw is rooted in a cryptographic issue related to the predictability of the ManagedPasswordId structure, which can be brute-forced due to its limited combinations. To help address this threat, a tool called GoldenDMSA has been developed to simulate the attack's logic for security professionals. Semperis recommends organizations using Windows Server 2025 to proactively assess their managed service accounts and identity infrastructure to mitigate the risks associated with this vulnerability.