Replay attacks (2.4)

replay attack

useful info that is transmitted over the network that a attacker can be replayed to appear as someone else

what are some ways a attacker can get the info required for a replay attack?

physical network tap, ARP poisoning, malware on the victim computer

Pass the hash

victim sends a normal authentication request to a server < attacker captures the info (user and hashed password) < attacker replays the authentication to the server < grants them access

How to stop a replay attack?

by using a salt or encryption

Session hijacking (sidejacking)

a user authenticates with a web server which creates a session ID. If an attacker gets this session ID this allows them to constantly be able to rejoin the session because the server thinks it comes from the victims computer

how to prevent session hijacking

by simply encrypting everything