Keeping data safe means staying current with the latest in cryptography, and researchers say it may be time to look beyond the RC4 algorithm to secure connections based on transport layer security (TLS).

A paper published by experts from the University of Leuven in Belgium titled “All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS” outlined an attack method they’ve called Numerous Occurrence Monitoring and Recovery Exploit, or NOMORE. It shows how vulnerabilities in RC4 could be exploited via some malicious JavaScript injected in an HTTPS-protected Web cookie. The technique essentially involves conducting a series of tests with a large number of encryption requests to figure out the Web cookie’s value. The researchers said some experiments had a 94 percent success rate and took little more than two days to perform a plaintext recovery attack on TLS.

As SecurityWeek pointed out, RC4 dates back to the late 1980s, but it’s still used by an estimated 30 percent of TLS connections today. While there have been previous experiments that showed the algorithm may be susceptible to cybercriminals, in some cases they took thousands of hours to work. In contrast, the NOMORE man-in-the-middle attacks outlined by the University of Leuven researchers is not only fast, but works on real devices and could potentially be extended to other forms of data that are encrypted on a regular basis.

On the other hand, a blogger on Virus Bulletin suggested that NOMORE would be more difficult to carry out in practice. After all, how many attackers are able to continue injecting JavaScript into a victim’s browser over a three-day period? If they could, they might do a lot worse than break RC4. It’s also unlikely that cybercriminals could make NOMORE run any faster since the attack is dependent on the connection between the website and the victim’s machine.

Although the research may sound the death knell for RC4, getting rid of it won’t happen overnight. ZDNet looked at how Mozilla, Microsoft and others have slowly been moving on to more sophisticated algorithms, but telemetry applications and simple inertia may keep thousands of websites and users hanging on despite the risks. Fortunately, there are many other — and probably better — ways to encrypt data, and hopefully news of NOMORE will prompt firms to give them a closer look.

More from

How the Silk Road Affair Changed Law Enforcement

The Silk Road was the first modern dark web marketplace, an online place for anonymously buying and selling illegal products and services using Bitcoin. Ross Ulbricht created The Silk Road in 2011 and operated it until 2013 when the FBI shut it down. Its creator was eventually arrested and sentenced to life in prison.But in a plot twist right out of a spy novel, a cyber attacker stole thousands of bitcoins from Silk Road and hid them away. It took law…

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…