6 ms·
It is not just used for censorship. When I was working as a pentester and domain fronting was still allowed on AWS, it became our method of choice for establish
by sylens 4y ago
It is not just used for censorship. When I was working as a pentester and domain fronting was still allowed on AWS, it became our method of choice for establishing C2 because it camouflaged so well with regular organizational outbound that it will bypass any egress filtering and restrictions.
If we were using it on a pentest, you'd best believe there are actors using it for far more nefarious purposes.
- zimbatm 4y agoIt's not possible to block C2 without also helping censorship on the Internet. Whatever mechanism is used to hide one traffic is going to be used by the other one, and reversely. Morally, the question is which one is the most important?
- sylens 4y agoThe question for cloud providers is not which one is morally more important, but which one is better for their shareholders. It seems like creating a situation where organizations move their workloads off your public cloud because they have to blacklist your entire domain to stop an attack would be bad for their shareholders.
- hedora 4y agoCan’t they use almost any read-write service for C2 though? “Because Security” arguments like this are increasingly used in place of “think of the children”.
- sylens 4y agoHow many read-write services can you use to redirect traffic to your C2 infrastructure while almost guaranteeing organizations will allow outbound connections to it and not look too closely at it?
- easrng 4y agoGoogle Docs/Forms/Sheets/etc, anything with an image proxy, probably Microsoft's Office Online stuff tho I personally haven't used it, webpush connections, the possibilities are endless.
- jiggawatts 4y agoDNS…
- sylens 4y agoGoogle and now Microsoft are also blocking domain fronting. The other 'possibilities' are not necessarily guaranteed to be allowed for egress traffic out of an organization. That's why the cloud providers blocking it is a big deal - most orgs WILL allow outbound traffic on more than a few ports to these platforms
- mindslight 4y agoUnless corporate firewalls have advanced to the point where they're DNS aware (eg the client queries www.microsoft.com and only then is allowed to contact those IPs), can one not just direct domain-fronting-style traffic to any VPS?
- ShowalkKama 4y agooh well, you could use a document on google suite to implement the communication. I guess google.com is next.