Difference between masquerading and replay attacks?

Question

I know that masquerading is to impersonate a false identity and replaying is the same wherein unauthorized person uses the credentials of the authorized one to have the privileges.Then what is the difference between the two terms?

Answer 1

These two terms do not have meanings at the same level. Masquerading (or impersonation; the two terms are equivalent) is any attack wherein the attackers acts (emits data packets or the like) as if he was some other user or entity in the system. Replay attacks are attacks where the attacker simply sends a data element (e.g. a data packet) which was previously sent by some other user, in the hope of reproducing the effect.

Thus, a "replay attack" is often a specific kind of impersonation; or you can consider replay attacks to be a tool used to implement an impersonation attack.

Answer 2

To try to answer your question more directly, an impersonation attack may be a replay or may be some other type of attack. (For example a man in the middle could impersonate the client by getting the legitimate information rather than simply replaying a previously recorded session.)

Similarly, a replay attack may or may not have anything to do with impersonation. While many replay attacks may be based on trying to impersonate a previous request, if proper IVs aren't being used on cryptographic communications, a replay attack could be used to inject incorrect information in to a stream as well without actually impersonating the user. It would instead simply be hijacking a legitimate action.

So in short, you are correct that the two terms are often related since replay may be used to impersonate in certain situations, but those aren't the only uses of the two concepts.

Answer 3

In STRIDE(security threats) :

"Spoofing is attempting to gain access to a system by using a false identity. This can be accomplished using stolen user credentials or a false IP address".[1] Is referred to attacks on authentication.

So masquerading as someone with privileges would be a type of Spoofing in my opinion while reply attack refers to Tampering(affects Integrity).

"Tampering. Tampering is the unauthorized modification of data, for example as it flows over a network between two computers."[1]

[1] https://msdn.microsoft.com/en-us/library/ff648641.aspx

Answer 4

A masquerade attack is an attack that uses a fake identity, such as a network identity, to gain unauthorized access to personal computer information through legitimate access identification. If an authorization process is not fully protected, it can become extremely vulnerable to a masquerade attack.

Masquerade attacks can be perpetrated using stolen passwords and logons, by locating gaps in programs, or by finding a way around the authentication process,

Replay attack is a network attack in which a malicious node may repeat the data or delayed the data. This can be done by originator who intercept the data and re transmit it.

Suppose node S want to send some data to R. For this S has to prove his identity to R. This way S sends his password to R for identification. At that time, an attacker an intercept the password of S and a presenting itself as S, when asked for the proof of identity. A sends S password read from the last session, which R accepts