How Adversaries Exploit Weak Authentication