Glossary
Replay Attack
Imagine recording someone unlocking a door with their voice command, then playing that recording to unlock it yourself. A replay attack captures legitimate network traffic and plays it back to trick systems into doing something again - like re-authorizing a payment.
What is Replay Attack?
An attack in which valid data transmission is maliciously repeated or delayed, typically to fraudulently impersonate a legitimate user.
Why Should You Care?
Replay attacks bypass traditional authentication systems by reusing valid credentials or session tokens, allowing attackers to impersonate users and execute unauthorized actions without needing to break encryption or guess passwords. In financial systems, a single intercepted transaction can be replayed multiple times to drain accounts; in web applications, captured session tokens grant full account access. Organizations that rely solely on encryption without replay protection—timestamps, nonces, or one-time tokens—remain vulnerable even with strong cryptography.
Is your business exposed?
Real-World Example
If an attacker captures a valid session token—for example, by intercepting traffic or stealing it from a vulnerable application—they can replay that token to access the victim's account without ever knowing the password, until the session expires or is revoked. The same principle applies to keyless car entry systems: attackers use radio-frequency capture devices to record the unlock signal and replay it later to gain physical access. In both cases, defenses like one-time nonces, short-lived tokens, and rolling codes are what break the replay.
How to Protect Against Replay Attack
- 1.
Use timestamps and nonces in authentication
- 2.
Implement one-time passwords or tokens
- 3.
Use TLS/SSL for all communications
Related Terms
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required