Common Attack Pattern Enumeration and Classification
A Community Resource for Identifying and Understanding Attacks
An attacker can abuse an authentication protocol susceptible to reflection attack in order to defeat it. Doing so allows the attacker illegitimate access to the target system, without possessing the requisite credentials.
Reflection attacks are of great concern to authentication protocols that rely on a challenge-handshake or similar mechanism. An attacker can impersonate a legitimate user and can gain illegitimate access to the system by successfully mounting a reflection attack during authentication.
Authentication is usually used as a means to identify and grant access to the user. If the authentication protocol can be defeated, in this instance by a reflection attack, authentication serves no purpose in identifying the legitimate users of the system from the illegitimate ones
A single sign-on solution for a network uses a fixed pre-shared key with its clients to initiate the sign-on process in order to avoid eavesdropping on the initial exchanges.
An attacker can use a reflection attack to mimic a trusted client on the network to participate in the sign-on exchange.
Skill or Knowledge Level: Medium
The attacker needs to have knowledge of observing the protocol exchange and managing the required connections in order to issue and respond to challenges
All that the attacker requires is a means to observe and understand the protocol exchanges in order to reflect the challenges appropriately.
The server must initiate the handshake by issuing the challenge. This ensures that the client has to respond before the exchange can move any further
The use of HMAC to hash the response from the server can also be used to thwart reflection. The server responds by returning its own challenge as well as hashing the client's challenge, its own challenge and the pre-shared secret. Requiring the client to respond with the HMAC of the two challenges ensures that only the possessor of a valid pre-shared secret can successfully hash in the two values.
Introducing a random nonce with each new connection ensures that the attacker cannot employ two connections to attack the authentication protocol
More information is available — Please select a different filter.