Question

If the attacker performs a replay attack on the TCP exchange, replaying the messages without any modification, then will the server (node3) know that an attack may have occurred? Explain why or why not.

Answer 1

networks and computers subject to replay attack would see the attack process as legitimate messages. One example of a replay attack is to replay the message sent to a network by an attacker, which was earlier sent by an authorized user. Although the messages might be encrypted and the attacker may not get the actual keys, retransmission of valid data or login messages could help them gain sufficient access to the network. A replay attack can gain access to the resources by replaying an authentication message and can confuse the destination host.

One of the best techniques to avert replay attacks is by using strong digital signatures with timestamps. Another technique that could be used to avoid a replay attack is by creating random session keys which are time bound and process bound. A one-time password for each request also helps in preventing replay attacks and is frequently used in banking operations. Other techniques used against replay attacks include the sequencing of messages and non-acceptance of duplicated messages.

Consider this real-world example of an attack. A staff member at a company asks for a financial transfer by sending an encrypted message to the company's financial administrator. An attacker eavesdrops on this message, captures it, and is now in a position to resend it. Because it's an authentic message that has simply been resent, the message is already correctly encrypted and looks legitimate to the financial administrator.

In this scenario, the financial administrator is likely to respond to this new request unless he or she has a good reason to be suspicious. That response could include sending a large sum of money to the attacker's bank account.

I think the network will not know.