Contents
What is Kerberos replay attack?
Q: What is a replay attack and how does the Kerberos authentication protocol protect against it? A: A replay attack occurs when an intruder steals a packet from the network and forwards that packet to a service or application as if the intruder was the user who originally sent the packet.
What prevents Kerberos?
Kerberos prevents malicious attempts to intercept your password by encrypting your password before transmitting it. In addition, once you and the server have proved your identities to each other, Kerberos uses secret-key cryptography to secure the rest of your communications.
How does Kerberos Protect against replay attacks?
If the timestamp in the authenticator isn’t within five minutes of the time on the server, it will also reject the packet. The five minutes is the maximum difference it can tolerate between client and server, but you can change this value in windows through group policy. In a nutshell, the crucial part is the ‘authenticator’ time validation.
What happens when a Kerberos authentication message is rejected?
When Server-Side Kerberos validates an authentication message, it will check the authenticator’s timestamp. If the timestamp is earlier or the same as a previous authenticators received within the five minutes, it will reject the packet because it treats it as a replay attack and user authentication will fail.
What do I need to know about replay attacks?
Required Server Roles: Active Directory domain controller. Minimum OS Version: Windows Server 2008. Event Versions: 0. For 4649 (S): A replay attack was detected. This event can be a sign of Kerberos replay attack or, among other things, network device configuration or routing problems.
Why was a replay attack detected in 4649?
For 4649 (S): A replay attack was detected. This event can be a sign of Kerberos replay attack or, among other things, network device configuration or routing problems. In both cases, we recommend triggering an alert and investigating the reason the event was generated.