Keeping data safe means staying current with the latest in cryptography, and researchers say it may be time to look beyond the RC4 algorithm to secure connections based on transport layer security (TLS).
A paper published by experts from the University of Leuven in Belgium titled “All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS” outlined an attack method they’ve called Numerous Occurrence Monitoring and Recovery Exploit, or NOMORE. It shows how vulnerabilities in RC4 could be exploited via some malicious JavaScript injected in an HTTPS-protected Web cookie. The technique essentially involves conducting a series of tests with a large number of encryption requests to figure out the Web cookie’s value. The researchers said some experiments had a 94 percent success rate and took little more than two days to perform a plaintext recovery attack on TLS.
As SecurityWeek pointed out, RC4 dates back to the late 1980s, but it’s still used by an estimated 30 percent of TLS connections today. While there have been previous experiments that showed the algorithm may be susceptible to cybercriminals, in some cases they took thousands of hours to work. In contrast, the NOMORE man-in-the-middle attacks outlined by the University of Leuven researchers is not only fast, but works on real devices and could potentially be extended to other forms of data that are encrypted on a regular basis.
On the other hand, a blogger on Virus Bulletin suggested that NOMORE would be more difficult to carry out in practice. After all, how many attackers are able to continue injecting JavaScript into a victim’s browser over a three-day period? If they could, they might do a lot worse than break RC4. It’s also unlikely that cybercriminals could make NOMORE run any faster since the attack is dependent on the connection between the website and the victim’s machine.
Although the research may sound the death knell for RC4, getting rid of it won’t happen overnight. ZDNet looked at how Mozilla, Microsoft and others have slowly been moving on to more sophisticated algorithms, but telemetry applications and simple inertia may keep thousands of websites and users hanging on despite the risks. Fortunately, there are many other — and probably better — ways to encrypt data, and hopefully news of NOMORE will prompt firms to give them a closer look.