Piggybacking

Summary

Piggybacking is a type of application attack where an unauthorized user gains access to a system or network by exploiting an active session or connection established by an authorized user. This attack often involves intercepting or following legitimate user activity to bypass authentication controls and gain unauthorized privileges.

Key Characteristics

• Exploitation of an active session or authenticated connection
• Bypasses standard authentication mechanisms without direct credential theft
• Commonly occurs in wireless networks, shared terminals, or unsecured physical environments
• May involve social engineering or physical proximity to the authorized user
• Often difficult to detect due to the attacker leveraging legitimate user sessions

Defensive Controls

• Implement session timeouts and automatic logoff for inactive users
• Use multi-factor authentication to strengthen user verification
• Deploy network access controls and monitor for unusual session activity
• Educate users on physical security and the risks of allowing others to use their sessions
• Utilize encryption and secure communication protocols to protect session data

Related Security Solutions

Security Information and Event Management (SIEM) systems, endpoint protection platforms, network access control (NAC), multi-factor authentication (MFA) solutions, and user behavior analytics (UBA) tools are commonly employed to detect and prevent piggybacking attacks.