Replay Attack: Process, Impacts, and Defense

Topics

Security

TL;DR

Replay attacks are a form of network intrusion where a hacker intercepts a legitimate data packet and retransmits it to deceive a server into granting unauthorized access. No advanced technical skills are required, making them a widespread threat. Effective defenses include challenge handshake authentication, one-time passwords, session identifiers, timestamps, and Kerberos — but these must be implemented proactively, as they cannot stop an attack already in progress.

What is a replay attack?

A replay attack involves eavesdropping on a network and intercepting a data packet. After the theft, a hacker can resend the same message. The server, not realizing the problem, does just what the hacker wants.

Understanding replay protection is critical. In 2020, data breaches cost companies an average of $3.86 million. Replay attacks are dangerous, in part, because hackers don't need advanced skills to pull one off.

Devices exchange information via packets. Some contain all of the bits and pieces a hacker needs to pull off a very real and dangerous theft.

For example, your device exchanges passwords and session keys with a server. A hacker listens in and steals that information. Later on, the hacker sends the same information again. The server believes it's speaking with you. The hacker can then do anything you can do on the server.

Researchers tell us a lot about replay attacks. They say companies are vulnerable due to complex network structures. Many agents work together to accomplish seemingly simple tasks. Overtaking just one could lead to a chain reaction of failures.

How do hackers use replay attacks?

A hacker could use a replay attack to:

Steal your car. A recording device steals the communication between your key fob and your vehicle. The hacker then sends the signal again and drives away. In 2016, researchers discovered that several different vehicle types are vulnerable to this form of attack.
Authorize bank transfers. A hacker copies a packet sent between you and your bank. Sending that again could prompt the bank to repeat the action (such as transferring funds again, but this time to a different destination). Researchers say hackers using this approach resend packets very quickly, and they're almost always exactly the same.

How can you protect against wireless replay attacks?

Replay attacks work because hackers can steal something you're using right now and send it again without changing a thing. To block this attack, you must make theft harder, allow packets to expire, or attach some other form of authentication to each packet.

What methods can prevent a replay attack?

Let's dig into specifics. You could try:

Defense Method	How It Works	Key Benefit
Challenge Handshake Authentication	Sender responds to a challenge using a shared secret that is never transmitted	Shared secret cannot be stolen
Kerberos	Runs on timestamps; old messages are automatically discarded	Prevents replayed packets from being accepted after expiry
One-Time Passwords	Each transaction uses a unique, never-reused authentication credential	Captured passwords are immediately useless
Secure Routing	Firewalls and protections prevent packets from being stolen	Stops theft before replay is possible
Session Identifiers	Each message carries a unique session ID and component number	Old session IDs are not accepted even if stolen
Timestamps	Each message has a built-in expiration time	Expired packets are automatically rejected

Know that these steps won't stop a replay attack in progress. Take your system offline, implement these steps, and reboot. That way, an old theft won't result in new losses.

To learn more about the packets discussed in this article, see our overview of the Internet Control Message Protocol (ICMP).

Frequently asked questions

What makes a replay attack different from other cyberattacks?

Unlike attacks that require creating new malicious code, a replay attack simply reuses a legitimate data packet that has already been transmitted. The hacker does not need to decrypt or alter the message — retransmitting it as-is is enough to fool the server into granting access.

Why don't servers automatically detect replay attacks?

Servers process incoming packets based on their content, not their origin or timing. Because the replayed packet is an exact copy of a valid transmission, the server has no built-in way to distinguish it from a genuine request unless specific protections like timestamps or session identifiers are in place.

Can a replay attack be stopped once it has already started?

No — the protective measures described (such as one-time passwords, session identifiers, and timestamps) must be implemented before an attack occurs. If an attack is in progress, the recommended approach is to take the system offline, apply the protections, and then reboot.

What is the role of timestamps in replay attack prevention?

Timestamps assign a built-in expiration time to each message. Authentication protocols like Kerberos use this mechanism to automatically discard messages that are deemed too old, rendering a stolen and replayed packet invalid after a short window.

Are replay attacks only a risk for online banking and financial systems?

No. Replay attacks can target any system that relies on transmitted authentication signals. Real-world examples include vehicle key fob signals, where a recorded transmission can be replayed to unlock and start a car, demonstrating that the threat extends well beyond financial networks.

What is the difference between session identifiers and one-time passwords as replay defenses?

Session identifiers attach a unique ID and component number to each message — even if stolen, the old session ID will not be accepted again. One-time passwords go further by generating a completely new authentication credential for every single transaction, ensuring that a captured password is immediately useless.