Threats Addressed by Secure Shell (continued)

Insertion and Replay Attacks
Secure Shell's implementation of Message Authentication Code algorithms prevents the threat of a "replay" or "insertion" attack. In this type of attack, the attacker is not only monitoring your Secure Shell session but is also observing your keystrokes (either physically, as in looking over your shoulder or by monitoring your terminal's keyboard with software). By comparing what you type with the traffic in the SSH stream, an attacker can deduce the packet containing a particular command (delete all files, for example) and "replay" that command at a particularly inappropriate time during your session.