A New Technique called ” Domain Fronting “ allow cybercriminals to hide the command & control Networks Traffic within a CDN. It acts as a mask for C&C networks and widely used advanced Technique for Malware Evasion.
“A content delivery network (CDN) is a system of distributed servers (network) that deliver pages and other Web content to a user, based on the geographic locations of the user, the origin of the web page and the content delivery server.”
There are many CND’s performing this content Delivery operation including CloudFlare, Akamai, Azure, Amazon.
This Method Affected by Many CND’s and major impact has been Identified in Akamai Technologies which carried the highly significant amount of traffic of various HIgh reputation domains through which we can mask our traffic.
According to Akamai, their CDN carries 15-30% of the world’s web traffic, and it is extremely common to see outbound traffic to Akamai’s network from almost any potential target. This makes Akamai’s CDN a prime target for this new approach to domain fronting.
Domain Fronting Working Method
Also Read Using n1n3 to Simulate an evasive “Fileless” Malware – Proof Of Concept
TOR Project used For Domain Fronting
Tor Project used to implement the Domain Fronting to evade censorship in Different Countries where the internet Restriction that denies accessing the Particular Website which serves under the Content Delivery Networks.
One specific Akamai domain (a248.e.akamai.net) was in use by the Tor project to bypass China’s internet restrictions and was later blocked in China, as it was used bypass the country’s content filtering controls.Cyber Ark said.
Few months before CyberArk explained about this Domain Fronting says, There are 1000 of Domains are affected by this Domain Fronting Method includes domains for Fortune 100 companies.
Two Requirements of Domain Fronting
As an Attacker, you need two Requirements for Successfully implementing the DF For Evade the Traffic of Command & Control.
- A two-way, persistent read-write mechanism (system or application) must be hosted by the CDN. Which means to utilize the list of an application hosted by the CDN to exchange instructions and data with Attacker.
- Malware must be specially crafted to use this C2 channel, and users’ machines must be infected with this malware.
Implementing Malware Command and Control
Also Read Hackers Increasing the use of “Command Line Evasion and obfuscation” to Spread Advance Level Threats
