1
00:00:00,000 --> 00:00:00,833
In this lesson,

2
00:00:00,833 --> 00:00:03,450
we're going to cover replay attacks.

3
00:00:03,450 --> 00:00:05,909
Replay attacks are a type of network-based attack

4
00:00:05,909 --> 00:00:08,790
where valid data transmissions are maliciously

5
00:00:08,790 --> 00:00:12,900
or fraudulently rebroadcasted, repeated or delayed.

6
00:00:12,900 --> 00:00:16,050
This type of attack can be likened to a session hijack

7
00:00:16,050 --> 00:00:17,970
but with a slight difference.

8
00:00:17,970 --> 00:00:20,100
In a session hijack the attacker aims

9
00:00:20,100 --> 00:00:21,840
to modify the information being sent

10
00:00:21,840 --> 00:00:23,430
and received in real time.

11
00:00:23,430 --> 00:00:25,140
However, in a replay attack

12
00:00:25,140 --> 00:00:27,150
the attacker's goal is to intercept the data,

13
00:00:27,150 --> 00:00:31,200
analyze it and decide whether or not to retransmit it later.

14
00:00:31,200 --> 00:00:32,759
To better understand replay attacks,

15
00:00:32,759 --> 00:00:34,440
consider the following example.

16
00:00:34,440 --> 00:00:37,260
Let's pretend that an attacker's able to capture the session

17
00:00:37,260 --> 00:00:39,480
that occurs when you log into your bank

18
00:00:39,480 --> 00:00:41,190
with your username and password.

19
00:00:41,190 --> 00:00:43,350
Now, they could then replay that session

20
00:00:43,350 --> 00:00:44,880
to the bank at a later time

21
00:00:44,880 --> 00:00:46,740
and attempt to log in as you.

22
00:00:46,740 --> 00:00:48,960
This is the basic premise of a replay attack.

23
00:00:48,960 --> 00:00:51,840
And then reuse them to gain unauthorized access

24
00:00:51,840 --> 00:00:52,950
to the system.

25
00:00:52,950 --> 00:00:54,240
For example, if you just logged

26
00:00:54,240 --> 00:00:55,647
into an online shopping website

27
00:00:55,647 --> 00:00:56,760
but the attacker was able

28
00:00:56,760 --> 00:00:58,530
to capture your login session details,

29
00:00:58,530 --> 00:01:00,390
like your username and password,

30
00:01:00,390 --> 00:01:03,000
that attacker could then use these captured credentials

31
00:01:03,000 --> 00:01:05,640
to log into your account anytime they want

32
00:01:05,640 --> 00:01:07,440
and then they can make unauthorized purchases

33
00:01:07,440 --> 00:01:08,490
as if they were you

34
00:01:08,490 --> 00:01:10,500
or even change the account's password

35
00:01:10,500 --> 00:01:12,327
to effectively lock you out of your own account

36
00:01:12,327 --> 00:01:14,400
and try to take over your account fully.

37
00:01:14,400 --> 00:01:16,410
To combat replay attacks it's crucial

38
00:01:16,410 --> 00:01:17,580
to ensure that the websites

39
00:01:17,580 --> 00:01:20,580
and devices use session tokens to uniquely identify

40
00:01:20,580 --> 00:01:22,890
when the authentication session is occurring.

41
00:01:22,890 --> 00:01:25,290
Session tokens are unique pieces of data

42
00:01:25,290 --> 00:01:26,970
that are generated for each session,

43
00:01:26,970 --> 00:01:28,530
and these tokens make it difficult

44
00:01:28,530 --> 00:01:30,600
for an attacker to replay a session.

45
00:01:30,600 --> 00:01:33,480
Multi-factor authentication can also prevent the attacker

46
00:01:33,480 --> 00:01:35,850
from capturing and replaying a login session,

47
00:01:35,850 --> 00:01:38,100
since the attacker would not have the additional piece

48
00:01:38,100 --> 00:01:40,020
of information required for authentication,

49
00:01:40,020 --> 00:01:43,380
such as one-time use passwords that change every 30

50
00:01:43,380 --> 00:01:46,710
to 60 seconds on your smartphone's authenticated app.

51
00:01:46,710 --> 00:01:48,570
By using multi-factor authentication

52
00:01:48,570 --> 00:01:50,520
it becomes nearly impossible for an attacker

53
00:01:50,520 --> 00:01:52,530
to capture and replay a session in order

54
00:01:52,530 --> 00:01:54,390
to gain access to your account.

55
00:01:54,390 --> 00:01:56,610
To minimize the risk of such attacks,

56
00:01:56,610 --> 00:01:57,870
it is highly recommended

57
00:01:57,870 --> 00:01:59,880
that you use the latest security protocols

58
00:01:59,880 --> 00:02:01,530
like Wi-Fi Protected Access 3,

59
00:02:01,530 --> 00:02:03,900
known more commonly as WPA3,

60
00:02:03,900 --> 00:02:06,090
in order to avoid the threat of a replay attack.

61
00:02:06,090 --> 00:02:09,060
So remember, replay attacks involve the fraudulent

62
00:02:09,060 --> 00:02:12,630
or malicious rebroadcasting, repetition or delay

63
00:02:12,630 --> 00:02:14,580
of valid data transmissions.

64
00:02:14,580 --> 00:02:16,740
Credential replay attacks specifically target

65
00:02:16,740 --> 00:02:18,090
a user's logging credentials

66
00:02:18,090 --> 00:02:20,730
to gain unauthorized access to the system.

67
00:02:20,730 --> 00:02:23,370
Mitigation strategies include the use of session tokens

68
00:02:23,370 --> 00:02:25,410
and multi-factor authentication.

69
00:02:25,410 --> 00:02:27,420
Your understanding and awareness of these kinds

70
00:02:27,420 --> 00:02:29,010
of replay attacks is an important step

71
00:02:29,010 --> 00:02:31,320
towards securing your data and protecting yourself

72
00:02:31,320 --> 00:02:32,823
from potential cyber threats.