An Introduction to Recognizing and Decoding RC4 Encryption in Malware
Summary: Cisco Talos describes RC4 as an algorithm its vulnerability research team encounters almost daily in malware, including the CVE-2014-1776 sample it walks through, which uses RC4 to obfuscate what it is doing. The article breaks RC4 into a Key Scheduling Algorithm that builds a 256-byte SBox and a pseudo-random generation phase that XORs a keystream against plaintext, noting Microsoft recommended last Fall that customers disable RC4 by enabling TLS 1.2 and AES-GCM.
Key Takeaway: The sample encodes data about the victim's machine, including a hash of a system file, and sends it RC4-encrypted to its command and control server, so network inspection that cannot decode RC4 sees only ciphertext leaving the host.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2014-1776
- Related