Hi all, I'm tryng to understand Kerberos strenghts and flaws, I would like to know your opinion about the feasibility of the attack described below. Here it is: An attacker puts his machine A between the legitimate client C and an application server AS using an ARP spoofing attack, and then transparently forwards network traffic between C and AS until C sends the KRB_AP_REQ message. Once KRB_AP_REQ is captured, the attacker launchs a Denial Of Service attack on C, and forwards KRB_AP_REQ to AS. Is the attacker able to succesfully authenticate to AS? For my level of knowledge, the response is yes, but the attacker probably must spoof IP address of C, and his possibilities are limited from the missing knowledge of session keys included in KRB_AP_REQ. something wrong? thanks in advance
mark ________________________________________________ Kerberos mailing list [EMAIL PROTECTED] https://mailman.mit.edu/mailman/listinfo/kerberos
