imported>CortexFiend: /* growthexperiments-addlink-summary-summary:1|1|0 */

2025-08-12T22:26:07Z

growthexperiments-addlink-summary-summary:1|1|0

New page

{{about|the attack on authentication systems|the denial of service attack|Distributed Reflection Denial of Service}}

In [[computer security]], a '''reflection attack''' is a method of attacking a [[challenge–response authentication]] system that uses the same [[Protocol (computing)|protocol]] in both directions. That is, the same challenge–response protocol is used by each side to [[Authentication|authenticate]] the other side. The essential idea of the attack is to trick the target into providing the answer to its own challenge.<ref>''Computer Networks'' by [[Andrew S. Tanenbaum]], 4th edition, {{ISBN|0-13-038488-7}}, pages 787-790.</ref>

== Attack ==
The general attack outline is as follows:

# The attacker initiates a connection to a target.
# The target attempts to authenticate the attacker by sending it a challenge.
# The attacker opens another connection to the target, and sends the target this challenge as its own.
# The target responds to the challenge.
# The attacker sends that response back to the target on the original connection.

If the [[authentication protocol]] is not carefully designed, the target will accept that response as valid, thereby leaving the attacker with one fully authenticated channel connection (the other one is simply abandoned).

== Solution ==
Some of the most common solutions to this attack are described below:

* The responder sends its identifier within the response so, if it receives a response that has its identifier in it, it can reject it.<ref>[[Ross J. Anderson]]: <cite>[http://www.cl.cam.ac.uk/~rja14/book.html Security Engineering: A Guide to Building Dependable Distributed Systems]</cite>, 1st edition, page 21, {{ISBN|0-471-38922-6}}</ref>
# Alice initiates a connection to Bob.
# Bob challenges Alice by sending a [[cryptographic nonce|nonce]] ''N''. {{nowrap|B → A: ''N''}}
# Alice responds by sending back the MAC calculated on her identifier and the nonce using the shared key ''K''ab. {{nowrap|A → B: MAC''K''ab{{mset|A, ''N''}}}}
# Bob checks the message and verifies the MAC, making sure it is from Alice and not a message he had sent in the past by making sure that it verifies with A and not B, and on the nonce which is the same as the one he sent in his challenge, then he accepts the message.
* Require the initiating party to first respond to challenges before the target party responds to its challenges.
* Require the key or protocol to be different between the two directions.

==See also==
* [[Replay attack]]
* [[Man-in-the-middle attack]]
* [[Pass the hash]]

== References ==
{{reflist}}

[[Category:Computer security exploits]]
[[Category:Computer access control protocols]]

Reflection attack - Revision history

imported>CortexFiend: /* growthexperiments-addlink-summary-summary:1|1|0 */