RC4 cipher enabled
Related warning
"This server uses the RC4 cipher algorithm which is not secure. Disable the RC4 cipher suite and update the web server or appliance to support the Advanced Encryption Standard (AES) cipher algorithm.”
Problem
RC4 is a stream cipher designed by Ron Rivest in 1987. The BEAST attack was discovered in 2011. The solution to mitigating the attack is to enable TLS 1.1 and TLS 1.2 on servers and in browsers.
However, if you were unable to enable TLS 1.1 and TLS 1.2, a workaround is provided: configure SSL to prioritize RC4 ciphers over block-based ciphers. This workaround doesn’t eliminate exposure to the BEAST attack but does “limit” exposure to the BEAST attack.
Because RC4 is easy to implement and because of the BEAST attack workaround, the RC4 stream cipher’s use is widespread.
A group of researchers (Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering, and Jacob Schuldt) discovered a new attack against TLS where an attacker uses a browser to make numerous connections while watching and recording the traffic of these connections.
Solution
Enable TLS 1.2 or TLS 1.3 on servers that support these protocols and switch to AEAD cipher suites (AES-GCM).
Enable TLS 1.2 or TLS 1.1 in browsers that support these protocols.
Workaround
Disable all RC4-based cipher suites in your server’s SSL configuration. Only use this workaround if you can't enable TLS 1.2 or TLS 1.3 on servers and in browsers.