Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Disables RC4 In Internet Explorer 11 and Edge (winbeta.org)

Posted by BeauHD on from the decades-later dept.

An anonymous reader quotes a report from WinBeta: Microsoft released KB3151631 as part of today's Patch Tuesday set of updates that will disable RC4 in both Internet Explorer 11 on Windows 7 and later and in the Edge browser on Windows 10. As the company describes things: "RC4 is a stream cipher that was first described in 1987, and has been widely supported across web browsers and online services. Modern attacks have demonstrated that RC4 can be broken within hours or days. The typical attacks on RC4 exploit biases in the RC4 keystream to recover repeatedly encrypted plaintexts. In February 2015, these new attacks prompted the Internet Engineering Task Force to prohibit the use of RC4 with TLS. Previously, Microsoft Edge and Internet Explorer 11 allowed RC4 during a fallback from TLS 1.2 or 1.1 to TLS 1.0. A fallback to TLS 1.0 with RC4 is most often the result of an innocent error, but this is indistinguishable from a man-in-the-middle attack. For this reason, RC4 is now entirely disabled by default for Microsoft Edge and Internet Explorer users on Windows 7, Windows 8.1 and Windows 10."

23 of 40 comments (clear)

  1. Disable Edge and IE by Anonymous Coward · · Score: 2, Insightful

    If you want security, only use open source browsers on an open source OS like Linux. Disable Edge and IE. And disable Windows. Only an open source browser on Firefox running on an open source OS like Linux can truly be secure. All the millions of people looking over the source code ensures bugs are discovered and fixeded quickly. I mean, it's great that Microsoft removes insecure ciphers, but open source is much faster to disable insecure ciphers like RC4.

    1. Re:Disable Edge and IE by Anonymous Coward · · Score: 1, Interesting

      perhaps you might want to go and look at the security vulnerabilities reports for the past few years. IE and Edge suck, but chrome, firefox etc suck even worse.

    2. Re:Disable Edge and IE by BradMajors · · Score: 4, Informative

      All the millions of people looking over the source code ensures bugs are discovered and fixeded quickly.

      Nope. There are many open source projects that have known security bugs which remain unfixed after as long as ten years.

    3. Re:Disable Edge and IE by Narcocide · · Score: 1, Insightful

      Yea, but nobody who knows what they're talking about takes noob complaints about BASH vulnerabilities seriously. Sometimes you simply ARE using the wrong tool for the job. I know you Windows users hate being told that though.

    4. Re:Disable Edge and IE by WaffleMonster · · Score: 2, Informative

      Only an open source browser on Firefox running on an open source OS like Linux can truly be secure. All the millions of people looking over the source code ensures bugs are discovered and fixeded quickly.

      You mean this Firefox or a different one?

      https://it.slashdot.org/story/...

    5. Re:Disable Edge and IE by Rick+Zeman · · Score: 2

      All the millions of people looking over the source code ensures bugs are discovered and fixeded quickly.

      Nope. There are many open source projects that have known security bugs which remain unfixed after as long as ten years.

      OpenSSL being case in point.

    6. Re:Disable Edge and IE by EndlessNameless · · Score: 1

      What about Heartbleed? That was pretty bad.

      I mean, it's not like OpenSSL had a serious vulnerability in its production codebase for years that affected the numerous applications dependent on it.

      It's not like major enterprise vendors such as Cisco and VMware included that code as part of their products.

      --

      ---
      According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
    7. Re: Disable Edge and IE by hackwrench · · Score: 1

      No, I just like the originator's sense of humor. I on the other hand don't post anonymously except for once on a phone where the anonymous checkbox was easy to hit and I posted a follow-up later. I'm flatteted you think I did the original justice though. So... Maybe sexconker isn't the originator of the Moo cow bit?

    8. Re:Disable Edge and IE by Narcocide · · Score: 1

      Heartbleed was vulnerable upstream for a very long time. It didn't survive very long after being pushed to Debian stable before it was noticed though. You are probably vastly mistaken about the percentage of critical systems running bleeding-edge builds of stuff in the real world.

  2. Hours or days vs. nanoseconds to spy by Impy+the+Impiuos+Imp · · Score: 2, Insightful

    It was pointless at this point. Security agencies don't need to waste "hours or days" decrypting weak schemes when they can just use provided backdoors anyway.

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
    1. Re:Hours or days vs. nanoseconds to spy by cryptizard · · Score: 4, Insightful

      Pretty sure most people are worried about attackers other than the government.

    2. Re:Hours or days vs. nanoseconds to spy by SeaFox · · Score: 1

      Pretty sure most people are worried about attackers other than the government.

      Well thank goodness those backdoors only work for the government, and only when the government is doing the "right" thing, and nobody who knows about the backdoors has ever left the government and joined a criminal organization, and the criminals haven't managed to into government jobs ever.

  3. Disabled by Anonymous Coward · · Score: 1

    Dump-a-Drumpf 2016/Forever

  4. Microsoft Hypocrisy by Anonymous Coward · · Score: 4, Informative

    Disables old insecure cipher, while riddling Windows 10 full of spyware.

    1. Re:Microsoft Hypocrisy by thegarbz · · Score: 1

      There's nothing hypocritical about it. They are two different things with two different implications. One is about giving the parent entity customer data, the other is preventing other unauthorised people from accessing encrypted data.

  5. ancient management consoles by Anonymous Coward · · Score: 2, Insightful

    Someone may want to notify HP, Dell and Sun Micro...whoops! Oracle.

    There is a lot of old console interface hardware with baked in low-grade self-signed SSL certs that may never go away.

    Between that and servers using old Java-base consoles some technologies never seem to die.

    It's not like the vendors couldn't patch them. There is just no money in it. Or to be precise current TLS support in your hardware console is another feature to "encourage" an upgrade.

    1. Re:ancient management consoles by darkain · · Score: 1

      And just for this, is EXACTLY why I still have a Windows XP virtual machine with IE6 and Java 6 on it just to handle administration tasks on legacy equipment. But that VM is locked down to just those tasks on that private network, and never powered on otherwise.

      The hardware in question? Ancient laser printers from the 1990's, more specifically the HP 2100 LaserJet series. They may be a little slow and clunky, but they NEVER fail! And they still have driver support on Windows 10. Can't even tell ya how many other printers I've serviced and watch die over the years in the same businesses that also have these things deployed, and I've yet to see a single 2100 die.

  6. More eyeballs is a myth by Anonymous Coward · · Score: 3, Informative

    Yes, Eric Raymond's Cathedral Bazaar assumed just because source is available people will read it. Just because people can do something doesn't mean they will. They need incentive. Around major open source projects there are enough numbers and focus to allow this, but most open source software has a very small number of people supporting it, if any. Why would I waste my time reading someone else's source code looking for bugs which might be there, or might not be? Even security holes, which I'm not likely to find anyway? Bug bounties are a poor incentive too: you might work your guts out on a piece of code, find nothing, and not be able to pay the rent. You're right not to trust Microsoft at all, but open source has a serious problem with the economics of lack of incentive.

    1. Re:More eyeballs is a myth by Narcocide · · Score: 1

      Yea but just imagine what they could accomplish if they were funded even half as well as your average Microsoft product.

    2. Re:More eyeballs is a myth by Narcocide · · Score: 1

      Back when that was true, that they were receiving that much money from Google, it was well before they had slumped in security, and you know it very well. Besides which, most the "Firefox vulnerabilities" were actually vulnerabilities in 3rd party plugins or extensions that only supported Firefox.

  7. Both users will never notice by kimvette · · Score: 2

    Both remaining MSIE users will never notice the difference.

    --
    The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
    1. Re:Both users will never notice by thegarbz · · Score: 1

      +5 funny
      -1 sadly not reflecting reality

      There are many people still forced to use IE.

  8. Not just Microsoft, also Apple by SuperKendall · · Score: 2

    Apple is dropping RC4 support in iOS10.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley