Are SSL encrypted requests vulnerable to Replay Attacks?
I have an SSL connection with my bank open from A to B
A -> B
Through that connection I transfer $100 to my friend. However, it just so happens that my friend controls a proxy somewhere between A and B (at say M) and is watching the encrypted packets go by (he can't see them unencrypted, but he is capturing the encrypted contents).
A -> M -> B
Scenario A) The ssl connection is still active, and my friend replays the packet that gave him $100.
Scenario B) I send another request to the bank for something unrelated. But this time my friend, at M, modifies my packet in transit to be the same packet that gave him $100 earlier.
Not sure if these scenarios would be handled differently, so I considered them separately.
What does SSL/TLS do to prevent these type of live replay attacks? I get that SSL generates a nonce during the initial handshake, but that would only prevent replay attacks for another ssl session down the road once new nonces are generated.