Knock knock, it’s 1987, and your hospital’s lock still opens with a bobby pin

If your network says be kind, rewind, that is not nostalgia, that is a clue wearing a Blockbuster name tag. Microsoft left an old lock on the back door of modern medicine, the kind you can open with a bobby pin and a bad attitude, and surprise, people who steal for a living noticed. I get it, computers are hard, but this is like serving sushi in August and calling it artisanal, people get sick either way. The vibe is retro, the damage is very right now.

So what’s actually happening, Windows domains try the good stuff first, AES, but if you never touched a knob, a domain controller will still accept an RC4 flavored Kerberos ticket. That means if someone lands on any box inside, they can request a crumb protected the old way, take it home, and smash it later in peace and quiet. The move has a name, kerberoasting, and it has been in the attacker cookbook since 2014. Hospitals do not live inside custom hardening guides, they live inside shift changes and pagers that still beep, so defaults decide their fate. Which is how you get Ascension postponing surgeries while millions of records stroll out a side door because a contractor’s laptop nodded off at the wrong time, attackers hopped into Active Directory, and RC4 turned what should be never into a few hours with a midrange GPU. Patients pay, nurses cry in stairwells, the vendor posts a blog and calls it Tuesday. That is the crisis, not a metaphor, people missed care because a 30 year old cipher still gets a hall pass.

Senator Ron Wyden calls it gross negligence and asks the FTC why the richest software shop on earth keeps shipping brittle security as the default. Microsoft replies with the classic trilogy, we discourage its use, it is a tiny slice of traffic, turning it off breaks customers, and also we promise new domains will be safer in 2026. Translation without glitter, the risky default stays because some legacy accounts might complain, so the rest of you can hold while we decide how brave we feel next fiscal year. Meanwhile, attackers do not open support cases, they cash out, merci pour votre patience. Also, the entrée has been a Kerbe-roast since 2014, in case your palate enjoys gallows humor.

Here is the spicy part you can tell your cousin who mines crypto for fun, Kerberos plus RC4 does not salt or iterate the hash. One MD4 pass, zero seasoning, so guessing screams along at billions per second on a mediocre graphics card. Even passwords that feel heroic in a web form evaporate under that math. So when Microsoft says just use 14 characters, that is not a fix, that is hope in a policy trench coat. Why are we still building systems where any compromised laptop can request a message wrapped under an admin’s password and carry it off site to crack at leisure. RC4 in Kerberos is a lifeboat made of toast, technically buoyant for a moment, then the ocean remembers what bread is. Microsoft could have shut this window years ago by changing the default, shipping a scanner, and walking the handful of truly broken edge cases through a weekend migration, instead we get a quiet deprecation note and a promise to circle back later. Inertia is not neutral when the ER is on the line.

Follow the money, because it always leaves footprints. Microsoft sells the platform with unsafe defaults, then sells premium security toys to detect the fallout. Call it arsonist economics if you like, it only sounds dramatic until you map the timeline game, announce retirement with no hard deadline, tuck it in a technical blog, and promise new domains will be fine next year while existing customers get mitigations later if nothing important breaks. Compatibility with what, exactly, beyond a revenue stream and a fear of call volume. Actual solutions look different from security theater, they change the default, they ship the tooling, they set dates, they own the blast radius, they do not ask trauma wards to carry the risk so a spreadsheet can stay tidy.

Costs are not theoretical. Today it is a hospital delaying chemo, tomorrow it is a city payroll, next week it is a school district calling parents to say their kids’ data is in the wild. When defaults are unsafe, the bill lands on the public, not the executive who hit snooze on the fix. There is an easy, boring, humane path, flip the default to AES only, ship a compatibility scanner, auto quarantine RC4 only accounts, hand admins a short remediation checklist with real deadlines and a rollback if needed. Microsoft has the engineers, the telemetry, and the wallet, choose safety over inertia and treat hospitals like what they are, critical infrastructure, not unpaid beta testers. If that means a loud month of migrations, fine, we can live with extra help desk calls, we should not have to live with preventable data theft. Which brings us to the only part that should be hard, making this someone else’s problem, namely the folks who built it. Flip the switch, ship the tools, pick a date, pas nous.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI