Replay attack (Replay Attacks)

Replay attack (Replay Attacks)
1. What is replay attack
As the name implies, repeated session requests are replay attacks.
It may be because the user has repeatedly initiated the request, or because the request was fetched by the attacker and then sent back to the server.

2. Damage to replay attacks
The request is obtained by the attacker and re-sent to the authentication server to achieve the purpose of authentication.
We can prevent information disclosure by encrypting and signing, and the session is hijacked and modified. But this approach prevents replay attacks.

3. Defense of replay attacks
1) Timestamp verification
The request is accompanied by the client's current timestamp, signed (the signature is to prevent the session from hijacking, timestamp is modified), the service side of the request timestamp, such as more than 5 minutes, identified as replay attacks, the request is invalid.
Timestamps do not completely prevent replay attacks.

2) Serial number
As the name implies, when communicating with the client and the server, first define an initial ordinal number, incremented each time. This allows the server to know if it is a duplicate request.

3) How to challenge and answer
We generally use this approach to defend against replay attacks.
When the client requests the server, the server first generates a random number and then returns it to the client, with the random number on the client, the server, and the server, which is the same as the client's parameter, if it is the same, it is correct, not a replay attack.
In this way, each time the client requests, the server will be a challenge code, the client with the answer code access, the service side of the match, if the challenge code and answer code does not correspond, as replay attack.

4) HTTPS anti-replay attack
For HTTPS, each socket connection verifies the certificate, exchanging the key. The attacker intercepts the request, resend, because the socket is different, the key is also different, the background decryption is a heap of garbled characters, so HTTPS itself is to prevent replay attacks, unless the socket can be copied, or a man-in-the-middle attack.

Replay attack (Replay Attacks)