September 3, 2015 By Shane Schick 2 min read

Twenty-eight years is an incredible run for any kind of technology, but in the case of RC4, increased security concerns have convinced some of the industry’s biggest companies that it’s time to retire the stream cipher in their browsers.

By next year, computer users can expect RC4 to disappear from Firefox, Chrome and Edge (the successor to Internet Explorer), VentureBeat reported. Although it’s been widely adopted since 1987, companies such as Google, Microsoft and Mozilla all announced their plans to focus on more advanced forms of data encryption.

The vendors’ decision comes not long after the Internet Engineering Task Force (IETF) decided to prohibit the use of RC4 in the TLS protocol, Softpedia pointed out. At its peak, however, the technology was also used to support encryption across a wide range of other protocols, including WEP, BitTorrent, Skype and SSH, among others.

Although many users may not even be aware of how RC4 works in their browsers, recent studies have demonstrated how easily attackers could exploit the technology to steal data. Back in March, for example, Dark Reading posted details about a presentation at Black Hat Asia where researchers demonstrated something they called a “Bar Mitzvah attack,” alluding to some flaws in the technology that dated back some 13 years. The technique could be used to spy on SSL browsing sessions, an organization or a particular application, and it could even be exploited to conduct e-commerce transactions.

More recently, The Register showed that it took researchers little more than three days to decrypt cookies using the streaming cipher, and they could execute potential attacks in even less time. Making matters worse, an estimated 30 percent of traffic running across TLS was running on the crypto algorithm until recently. No wonder they dubbed their exploit RC4NOMORE.

Though many of the vendors’ announcements indicate RC4 will fade away by next February, there may be some implications for companies and their IT security teams trying to ensure visitors to their websites don’t get a bad experience. SC Magazine suggested that any portals relying on the streaming cipher to perform certain functions should think about moving as quickly as possible to TLS 1.2.

More from

Airplane cybersecurity: Past, present, future

4 min read - With most aviation processes now digitized, airlines and the aviation industry as a whole must prioritize cybersecurity. If a cyber criminal launches an attack that affects a system involved in aviation — either an airline’s system or a third-party vendor — the entire process, from safety to passenger comfort, may be impacted.To improve security in the aviation industry, the FAA recently proposed new rules to tighten cybersecurity on airplanes. These rules would “protect the equipment, systems and networks of transport…

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today