---
id: 8589
title: "RC4 Is Still Considered Harmful"
source_domain: projectzero.google
source_url: "https://projectzero.google/2022/10/rc4-is-still-considered-harmful.html"
published_at: "2022-10-27T00:00:00Z"
tags: ["exploit", "vulnerability", "security-research"]
phying_url: "https://phying.com/item/8589"
lang: en
---

# RC4 Is Still Considered Harmful

## Summary

I've been spending a lot of time researching Windows authentication implementations, specifically Kerberos. In June 2022 I found an interesting issue number 2310 with the handling of RC4 encryption that allowed you to authenticate as another user if you could either interpose on the Kerberos network traffic to and from the KDC or directly if the user was configured to disable typical pre-authentication requirements.

## Intelligence Metadata

- **Sources:** projectzero.google
- **Published:** 2022-10-27T00:00:00Z
- **Original:** https://projectzero.google/2022/10/rc4-is-still-considered-harmful.html
- **Phying News:** https://phying.com/item/8589