Replay Attack

A replay attack is a type of man-in-the-middle attack where a hacker intercepts a network session and reuses the legitimate user’s credentials to repeat the session. For example, if an attacker performs packet sniffing or another form of eavesdropping on a user’s Internet session and intercepts their login, the attacker can “replay” that session and log into the user’s account. The replayed session or request appears legitimate because it originally came from the real user. Even encrypted Internet sessions are susceptible to replay attacks because the attacks don’t require decryption: the hacker can simply replay the session, encrypted data and all. This is particularly dangerous for enterprises, which store a wealth of sensitive data within different accounts.

Preventing replay attacks

Because replay attacks depend on reusing the session credentials that an attacker has intercepted, preventing replay attacks often means generating a single-use encryption key or ID for an Internet session. Many network transmissions between two users now use a specific, single-use encryption key, which is only valid for one session and will not allow an attacker to replay the session.

Users may even log into an account with a single-use password, which will have to be reset for every subsequent login. This prevents a replay attacker from submitting another request with the intercepted password; it will no longer be usable.

A virtual private network may protect users from man-in-the-middle attacks: they set up a computer network separate from the standard network, which typically prevents attackers from eavesdropping on the Internet connection. However, VPNs are not perfect, and they’ve occasionally allowed attackers to access the user’s network through endpoint insecurities. Some VPNs actually have flaws that allow attackers to replay Internet sessions, having gained access to their network connection using cookies that weren’t dealt with properly. If you are using a VPN to avoid replay attacks, research different options carefully and watch for security bugs that have come to light in certain VPN products.






Jenna Phipps
Jenna Phipps is a contributor for websites such as Webopedia.com and Enterprise Storage Forum. She writes about information technology security, networking, and data storage. Jenna lives in Nashville, TN.

Top Articles

The Complete List of 1500+ Common Text Abbreviations & Acronyms

From A3 to ZZZ we list 1,559 SMS, online chat, and text abbreviations to help you translate and understand today's texting lingo. Includes Top...

Windows Operating System History & Versions

The Windows operating system (Windows OS) refers to a family of operating systems developed by Microsoft Corporation. We look at the history of Windows...

How to Create a Website Shortcut on Your Desktop

Website Shortcut on Your Desktop reviewed by Web Webster   This Webopedia guide will show you how to create a website shortcut on your desktop using...

Generations of Computers (1st to 5th)

Reviewed by Web Webster Learn about each of the 5 generations of computers and major technology developments that have led to the computing devices that...

Pardot

What is Pardot? Pardot is a B2B marketing automation (MA) solution by Salesforce that...

Veeam

Veeam Software is a global vendor...

Akamai

Akamai Technologies is a global web technology company specializing in content...