Microsoft will finally kill obsolete cipher that has wreaked decades of havoc

In a significant move, Microsoft has announced the discontinuation of the outdated RC4 encryption cipher, which has been a part of Windows for 26 years. This decision comes in the wake of numerous high-profile hacks that have exploited its weaknesses, as well as intense scrutiny from U.S. lawmakers. Originally implemented with the launch of Active Directory in 2000, RC4, or Rivest Cipher 4, was designed by cryptographer Ron Rivest in 1987. However, its security was compromised shortly after its introduction, with a researcher demonstrating vulnerabilities just days after the algorithm was leaked in 1994. Despite these known flaws, RC4 remained integral to various encryption protocols, including SSL and TLS, until it was largely phased out about ten years ago. Microsoft was one of the last major holdouts still supporting RC4, allowing Windows servers to respond to authentication requests using this outdated method. This legacy support has made it a target for hackers, contributing to significant breaches, including a major incident involving health care provider Ascension. This breach affected 140 hospitals and exposed the sensitive medical records of approximately 5.6 million patients. In response to the growing concerns over cybersecurity, U.S. Senator Ron Wyden criticized Microsoft for its failure to retire RC4 sooner and urged the Federal Trade Commission to investigate the company for negligence. Following this pressure, Microsoft has finally decided to deprecate RC4, acknowledging its vulnerability to Kerberoasting attacks, a method known since 2014 that was instrumental in the Ascension breach. As the technology landscape evolves and cybersecurity threats grow increasingly sophisticated, this decision marks an important step toward enhancing the security posture of enterprise networks.