5 ms·
The app uses the same technology as some trojans: it connects to different pseudorandomly-generated domain names under Cloudflare protection, changing at least
by patrakov 5y ago
The app uses the same technology as some trojans: it connects to different pseudorandomly-generated domain names under Cloudflare protection, changing at least several times per day.
- maccard 5y agoThe client still needs to receive those domains somehow though, and that's the tricky bit. Unless the domains are unique per user, the blocker can just install the app and block the domains as they change.
- vadfa 5y agoYou can embed the domains in the app, obfuscated. It's not foolproof but as long as they can't crack it in the few days that are left until the election...
- aasasd 5y agoIs there a name for this technique, or a thorough description of it somewhere? So that I could put it in my bookmarks & notes.
- patrakov 5y agoDomain Generating Algorithm. https://blog.malwarebytes.com/security-world/2016/12/explained-domain-generating-algorithm/ https://blog.malwarebytes.com/security-world/2016/12/explain... Although in this case, the generated domains are all under global.ssl.fastly.net and similar CDNs, not traditional TLDs.
- aasasd 5y agoThanks!