BSI ID: G 0.43

In this type of attack, attackers send specially prepared messages to systems or individuals with the aim of gaining an advantage for themselves or causing harm to the victim. To construct the messages appropriately, attackers use interface descriptions, protocol specifications or records of past communication behaviour, for example.

There are two special cases of message injection that are important in practice:

• In a ‘replay attack’ (replaying messages), attackers record valid messages and replay this information at a later point in time (almost) unchanged. It may also be sufficient to use only parts of a message, such as a password, to gain unauthorised access to an IT system.

• In a ‘man-in-the-middle attack’, the attacker secretly takes up a position between the communication channels of different participants. To do this, they usually pretend to be the sender of a message to the recipient and pretend to be the recipient to the sender. If successful, the attacker can receive messages that are not intended for them and evaluate and manipulate them before forwarding them to the actual recipient.

Encrypting communication does not provide protection against man-in-the-middle attacks if there is no secure authentication of the communication partners.

Examples:

• An attacker records the authentication data (e.g. user ID and password) during a user's login process and uses this information to gain access to a system. With purely static authentication protocols, this can also be used to gain unauthorised access to a foreign system using an encrypted password.

• To cause financial damage to their employer (company or public authority), an employee places an approved order multiple times.