Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
To enhance performance for resumed TLS connections, TLS 1.3 enables clients to send requests with early data, also known as zero round trip time (0-RTT). Early data includes a pre-shared key (PSK) from a previous TLS 1.3 connection. An attacker that intercepts HTTPS traffic can replay a request with early data if anti-replay attack techniques are not enabled on the web server. A successful replay attack can resume an unauthorized TLS session with the web server.
Kill Chain
Risk Score
67
Implement anti-replay techniques, such as delaying early data processing until after the TLS handshake completes or responding with the 425 (Too Early) status code, which forces a client to resubmit individual requests
If unable to implement anti-replay techniques, disable support for TLS early data, which blocks all requests with early data
