What is credential forwarding attack? Does this happen only when the client connects to two servers with same credentials?
3
-
Do you have link where you heard the reference?– Neil SmithlineMar 15, 2016 at 4:26
-
@NeilSmithline In FAQ section of technet.microsoft.com/en-us/library/security/974926.aspx– KumarMar 15, 2016 at 8:00
-
The Microsoft description suggests that they're talking about an attack more commonly called pass-the-hash - not sure why they used a strange name though...– MatthewMar 16, 2016 at 9:13
Add a comment
|
1 Answer
Generally, and from what I've personally encountered in the wild / in my job, a "Credential Forwarding Attack" is form of attack that occurs when an end user attempts to connect to a legitimate service / website, but instead connects to a site owned by an attacker. The user then enters their valid credentials into the fake website, which is then both stored by the attack for future impersonation of the end user, and then "forwarded" to the real website so that the end user is able to access the website so as to not raise suspicion from the end user.
For example, say I own www.bankofammerica.com (note the typo), and I send you some phishing email asking you to review potentially unwanted purchases from your account. You click on my legitimate looking link, enter your info into my fraudulent "Bank of America" homepage and login panel, while my sites scripting forwards that info into a real BoA login in the background. Now you click "login" and I get your online banking creds, and you get forwarded to the real Bank Of America page, none the wiser.
