5 ms·

How does domain fronting negatively affect microsoft? Why do they care? Is this all just about making peoples lifes worse?

skeeter2020 4y ago
Unfortunately the most common use-case of fronting is phishing and other scams that do make our lives worse. There's a legit anti-censorship angle but it is not the major use-case.
- zhfliz 4y ago
  how would domain fronting help with phishing? your standard user agent (e.g. browser) will not send different values in SNI and HTTP Host header. this is a deliberate action by the user agent to obscure the actual traffic destination. this can of course be used both for censorship circumvention but also misleading corporate traffic inspection when TLS is not broken, though it's debatable whether that should work in the first place.
  - poisonbug 4y ago
    The issue isn't with phishing. The issue is with threat actors using domain fronting as a network masquerading technique when having command and control traffic call back to Cobalt Strike servers. You can use domain fronting look like it's heading back to legitimate sources such as Microsoft, but unless the corporation is doing SSL termination on the endpoints, it's impossible to determine the exact destination. Azure originally started on this path in 2021: https://www.microsoft.com/en-us/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure/ https://www.microsoft.com/en-us/security/blog/2021/03/26/sec... Working in the pentest/red team field, I've seen various providers ban consulting companies and red teams from using domain fronting -- however, this doesn't stop the threat actors.
toast0 4y ago
Domain fronting leads to collateral damage in terms of blocking. If I really want to block X and X is using domain fronting to blend in with traffic on a given CDN, that CDN is going to get blocked. CDN customers that are having their stuff blocked because of that are not going to be happy, in general.
- matheusmoreira 4y ago
  The goal is to get people to stop wanting to block X in the first place. Alternatively, make it so they have to block the entire internet along with X.
  - mindslight 4y ago
    That's your (and my) goal, not corporate America's or totalitarian regimes', which are both different flavors of authoritarianism.
  - andix 4y ago
    That doesn’t seem to match up with reality. A lot of legislations don’t care a lot about collateral damage. They just block. And other customers on the shared IP have to deal with it (move to another IP).
vbezhenar 4y ago
I guess that they're afraid for entire Azure to be blocked by Russia or Kazakhstan. They can't afford such losses.
cryptonym 4y ago
Let's say customer A got a server cert on Azure for bank_example.com and customer B got a cert on Azure for nsfw_example.com With domain fronting you may get 'nsfw_example.com' content from a TLS connection negotiated with 'bank_example.com'. This can be a security threat (not able to properly filter outbound traffic) and customer A may be unhappy about Azure allowing nsfw content to be distributed over a channel secured under the name of their bank.
ebfe1 4y ago
Unfortunately much like every nice thing on the internet, once it is being abused, it gets axed... Domain fronting (having Host header differ to SNI in TLS) is a powerful way a malware author could send payload into organisations.. imagine seeing seemingly legitimate traffic to azure.com but end up with malwaredomain.com/lulz.exe... Unless organisations are peeking into TLS, check Host header, response with MZ file header...There is nothing they can do to stop this.
- SturgeonsLaw 4y ago
  Security teams should be doing DPI, using a corporate controlled CA to decrypt the traffic and then feed it into a SIEM which should start screaming bloody murder when it detects a mismatch between SNI and the requested host
  - ebfe1 4y ago
    big corporation with everyone working in a building, 100% achievable but with everyone working from home these days, it's a big challenge to have all users' internet traffic through a single gateway in some sort of VPN is not scalable. Most corp has to support split tunnel to make it work-able... Lots of IoC base on DNS as well so that is out of the windows since the malicious traffic is inside TLS...:-/
  - cryptonym 4y ago
    It's more about mismatch between host and SAN. Mismatch between SNI and host is quite common with h2 connection coalescing.
Anunayj 4y ago
I know alot of people cite "Security Concerns", but I suspect the problem might be simply a technical reason. I personally have been using nginx's ssl_preread module to reverse proxy my connections without SSL termination, domain fronting would break things in my situation. Having the possibility of domain fronting is just too much to consider in your software stack.

skeeter2020 4y ago

Unfortunately the most common use-case of fronting is phishing and other scams that do make our lives worse. There's a legit anti-censorship angle but it is not the major use-case.

zhfliz 4y ago
how would domain fronting help with phishing? your standard user agent (e.g. browser) will not send different values in SNI and HTTP Host header. this is a deliberate action by the user agent to obscure the actual traffic destination. this can of course be used both for censorship circumvention but also misleading corporate traffic inspection when TLS is not broken, though it's debatable whether that should work in the first place.
- poisonbug 4y ago
  The issue isn't with phishing. The issue is with threat actors using domain fronting as a network masquerading technique when having command and control traffic call back to Cobalt Strike servers. You can use domain fronting look like it's heading back to legitimate sources such as Microsoft, but unless the corporation is doing SSL termination on the endpoints, it's impossible to determine the exact destination. Azure originally started on this path in 2021: https://www.microsoft.com/en-us/security/blog/2021/03/26/securing-our-approach-to-domain-fronting-within-azure/ https://www.microsoft.com/en-us/security/blog/2021/03/26/sec... Working in the pentest/red team field, I've seen various providers ban consulting companies and red teams from using domain fronting -- however, this doesn't stop the threat actors.

toast0 4y ago

Domain fronting leads to collateral damage in terms of blocking. If I really want to block X and X is using domain fronting to blend in with traffic on a given CDN, that CDN is going to get blocked. CDN customers that are having their stuff blocked because of that are not going to be happy, in general.

matheusmoreira 4y ago
The goal is to get people to stop wanting to block X in the first place. Alternatively, make it so they have to block the entire internet along with X.
- mindslight 4y ago
  That's your (and my) goal, not corporate America's or totalitarian regimes', which are both different flavors of authoritarianism.
- andix 4y ago
  That doesn’t seem to match up with reality. A lot of legislations don’t care a lot about collateral damage. They just block. And other customers on the shared IP have to deal with it (move to another IP).

vbezhenar 4y ago

I guess that they're afraid for entire Azure to be blocked by Russia or Kazakhstan. They can't afford such losses.

cryptonym 4y ago

Let's say customer A got a server cert on Azure for bank_example.com and customer B got a cert on Azure for nsfw_example.com With domain fronting you may get 'nsfw_example.com' content from a TLS connection negotiated with 'bank_example.com'. This can be a security threat (not able to properly filter outbound traffic) and customer A may be unhappy about Azure allowing nsfw content to be distributed over a channel secured under the name of their bank.

ebfe1 4y ago

Unfortunately much like every nice thing on the internet, once it is being abused, it gets axed... Domain fronting (having Host header differ to SNI in TLS) is a powerful way a malware author could send payload into organisations.. imagine seeing seemingly legitimate traffic to azure.com but end up with malwaredomain.com/lulz.exe... Unless organisations are peeking into TLS, check Host header, response with MZ file header...There is nothing they can do to stop this.

SturgeonsLaw 4y ago
Security teams should be doing DPI, using a corporate controlled CA to decrypt the traffic and then feed it into a SIEM which should start screaming bloody murder when it detects a mismatch between SNI and the requested host
- ebfe1 4y ago
  big corporation with everyone working in a building, 100% achievable but with everyone working from home these days, it's a big challenge to have all users' internet traffic through a single gateway in some sort of VPN is not scalable. Most corp has to support split tunnel to make it work-able... Lots of IoC base on DNS as well so that is out of the windows since the malicious traffic is inside TLS...:-/
- cryptonym 4y ago
  It's more about mismatch between host and SAN. Mismatch between SNI and host is quite common with h2 connection coalescing.

Anunayj 4y ago

I know alot of people cite "Security Concerns", but I suspect the problem might be simply a technical reason. I personally have been using nginx's ssl_preread module to reverse proxy my connections without SSL termination, domain fronting would break things in my situation. Having the possibility of domain fronting is just too much to consider in your software stack.