July 22, 2015 By Shane Schick 2 min read

Keeping data safe means staying current with the latest in cryptography, and researchers say it may be time to look beyond the RC4 algorithm to secure connections based on transport layer security (TLS).

A paper published by experts from the University of Leuven in Belgium titled “All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS” outlined an attack method they’ve called Numerous Occurrence Monitoring and Recovery Exploit, or NOMORE. It shows how vulnerabilities in RC4 could be exploited via some malicious JavaScript injected in an HTTPS-protected Web cookie. The technique essentially involves conducting a series of tests with a large number of encryption requests to figure out the Web cookie’s value. The researchers said some experiments had a 94 percent success rate and took little more than two days to perform a plaintext recovery attack on TLS.

As SecurityWeek pointed out, RC4 dates back to the late 1980s, but it’s still used by an estimated 30 percent of TLS connections today. While there have been previous experiments that showed the algorithm may be susceptible to cybercriminals, in some cases they took thousands of hours to work. In contrast, the NOMORE man-in-the-middle attacks outlined by the University of Leuven researchers is not only fast, but works on real devices and could potentially be extended to other forms of data that are encrypted on a regular basis.

On the other hand, a blogger on Virus Bulletin suggested that NOMORE would be more difficult to carry out in practice. After all, how many attackers are able to continue injecting JavaScript into a victim’s browser over a three-day period? If they could, they might do a lot worse than break RC4. It’s also unlikely that cybercriminals could make NOMORE run any faster since the attack is dependent on the connection between the website and the victim’s machine.

Although the research may sound the death knell for RC4, getting rid of it won’t happen overnight. ZDNet looked at how Mozilla, Microsoft and others have slowly been moving on to more sophisticated algorithms, but telemetry applications and simple inertia may keep thousands of websites and users hanging on despite the risks. Fortunately, there are many other — and probably better — ways to encrypt data, and hopefully news of NOMORE will prompt firms to give them a closer look.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today