5 ms·

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud servic

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

denysvitali 4y ago
Fixed: "Many large cloud service providers, including Amazon, Microsoft, and Google, actively prohibit domain fronting, which has limited it as a censorship bypass technique."
- throwaway0x7E6 4y ago
  sure, it was merely a coincedence that they've started doing it after russian minitrue telegram fiasco. our venerable corporations would never bend to the will of foreign dictators.
  - 616c 4y ago
    Separate of whether the correlation is correct do you or anyone have info on the Telegram minitrue issue? I was unaware and don't really use Telegram.
    - throwaway0x7E6 4y ago
      they've attempted to block it several years ago, likely due to its popularity among dissidents and/or refusal to cooperate with russian Disinformation Governance Board. they've botched it and a lot of unrelated services got blocked as well. they gave up and stopped trying.
      - 5e92cb50239222b 4y ago
        They went one step further after that fiasco — it's heavily used these days to spread pro-Kremlin propaganda (definitely automated — very similar messages get posted to thousands of channels pretty much simultaneously⁰). Comment sections on other channels are filled with bots (you can see them a mile away — the nicknames are generated using the same pattern, the names don't feel right if you intimately know how Russian names are supposed to look, and the message style is obvious once you get to know it). 0: https://twitter.com/sobollubov/status/1567152744812740610 https://twitter.com/sobollubov/status/1567152744812740610
lzooz 4y ago
Well if they didn't do this the entire Azure would get banned which is even worse.
- remram 4y ago
  Banned by whom and why do you think that?
  - dilyevsky 4y ago
    Spanish isps for example. Did you know that in Spain there’s a deal between rightholders and isps to block any domains/IPs they don’t like? See: https://torrentfreak.com/spanish-isps-blocked-869-domains-subdomains-in-2021-to-prevent-piracy-220130/amp/ https://torrentfreak.com/spanish-isps-blocked-869-domains-su... I’ve personally seen domains on a shared provider banned without notice even though alleged pirate content was taken down within minutes. Very difficult to unban
svnpenn 4y ago
non crappy link: https://wikipedia.org/wiki/Domain_fronting https://wikipedia.org/wiki/Domain_fronting
sylens 4y ago
It is not just used for censorship. When I was working as a pentester and domain fronting was still allowed on AWS, it became our method of choice for establishing C2 because it camouflaged so well with regular organizational outbound that it will bypass any egress filtering and restrictions. If we were using it on a pentest, you'd best believe there are actors using it for far more nefarious purposes.
- zimbatm 4y ago
  It's not possible to block C2 without also helping censorship on the Internet. Whatever mechanism is used to hide one traffic is going to be used by the other one, and reversely. Morally, the question is which one is the most important?
  - sylens 4y ago
    The question for cloud providers is not which one is morally more important, but which one is better for their shareholders. It seems like creating a situation where organizations move their workloads off your public cloud because they have to blacklist your entire domain to stop an attack would be bad for their shareholders.
- hedora 4y ago
  Can’t they use almost any read-write service for C2 though? “Because Security” arguments like this are increasingly used in place of “think of the children”.
  - sylens 4y ago
    How many read-write services can you use to redirect traffic to your C2 infrastructure while almost guaranteeing organizations will allow outbound connections to it and not look too closely at it?
    - easrng 4y ago
      Google Docs/Forms/Sheets/etc, anything with an image proxy, probably Microsoft's Office Online stuff tho I personally haven't used it, webpush connections, the possibilities are endless.

denysvitali 4y ago

Fixed: "Many large cloud service providers, including Amazon, Microsoft, and Google, actively prohibit domain fronting, which has limited it as a censorship bypass technique."

throwaway0x7E6 4y ago
sure, it was merely a coincedence that they've started doing it after russian minitrue telegram fiasco. our venerable corporations would never bend to the will of foreign dictators.
- 616c 4y ago
  Separate of whether the correlation is correct do you or anyone have info on the Telegram minitrue issue? I was unaware and don't really use Telegram.
  - throwaway0x7E6 4y ago
    they've attempted to block it several years ago, likely due to its popularity among dissidents and/or refusal to cooperate with russian Disinformation Governance Board. they've botched it and a lot of unrelated services got blocked as well. they gave up and stopped trying.
    - 5e92cb50239222b 4y ago
      They went one step further after that fiasco — it's heavily used these days to spread pro-Kremlin propaganda (definitely automated — very similar messages get posted to thousands of channels pretty much simultaneously⁰). Comment sections on other channels are filled with bots (you can see them a mile away — the nicknames are generated using the same pattern, the names don't feel right if you intimately know how Russian names are supposed to look, and the message style is obvious once you get to know it). 0: https://twitter.com/sobollubov/status/1567152744812740610 https://twitter.com/sobollubov/status/1567152744812740610

lzooz 4y ago

Well if they didn't do this the entire Azure would get banned which is even worse.

remram 4y ago
Banned by whom and why do you think that?
- dilyevsky 4y ago
  Spanish isps for example. Did you know that in Spain there’s a deal between rightholders and isps to block any domains/IPs they don’t like? See: https://torrentfreak.com/spanish-isps-blocked-869-domains-subdomains-in-2021-to-prevent-piracy-220130/amp/ https://torrentfreak.com/spanish-isps-blocked-869-domains-su... I’ve personally seen domains on a shared provider banned without notice even though alleged pirate content was taken down within minutes. Very difficult to unban

svnpenn 4y ago

non crappy link: https://wikipedia.org/wiki/Domain_fronting https://wikipedia.org/wiki/Domain_fronting

sylens 4y ago

It is not just used for censorship. When I was working as a pentester and domain fronting was still allowed on AWS, it became our method of choice for establishing C2 because it camouflaged so well with regular organizational outbound that it will bypass any egress filtering and restrictions. If we were using it on a pentest, you'd best believe there are actors using it for far more nefarious purposes.

zimbatm 4y ago
It's not possible to block C2 without also helping censorship on the Internet. Whatever mechanism is used to hide one traffic is going to be used by the other one, and reversely. Morally, the question is which one is the most important?
- sylens 4y ago
  The question for cloud providers is not which one is morally more important, but which one is better for their shareholders. It seems like creating a situation where organizations move their workloads off your public cloud because they have to blacklist your entire domain to stop an attack would be bad for their shareholders.
hedora 4y ago
Can’t they use almost any read-write service for C2 though? “Because Security” arguments like this are increasingly used in place of “think of the children”.
- sylens 4y ago
  How many read-write services can you use to redirect traffic to your C2 infrastructure while almost guaranteeing organizations will allow outbound connections to it and not look too closely at it?
  - easrng 4y ago
    Google Docs/Forms/Sheets/etc, anything with an image proxy, probably Microsoft's Office Online stuff tho I personally haven't used it, webpush connections, the possibilities are endless.