Domain Borrowing: Catch My C2 Traffic if You Can
summary
Claim: a technique called domain borrowing lets a C2 use CDN infrastructure with SNI equals Host and a legitimately issued certificate borrowed from other users or obtained via lax HTTP validation, making decrypted traffic appear normal. Demonstrations use CloudFront, StackPath/CDN77 and an open‑source Carbonite implant to register subdomains, upload or borrow wildcard TLS certs, and route C2 through CDN edges to bypass Palo Alto anti‑evasion rules. Detections: compare SNI DNS results to connection IPs, enforce strict custom‑domain validation and revoke abused certs via CT.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:19Outline
- 3:10Domain Fronting - Limitations
- 4:26Domain Hiding - Limitations
- 4:56What we want for an ideal C2
- 5:54The HTTPS CDN workflow
- 7:34Domian Borrowing Basics - Abandon DNS
- 9:55Abusing CDN domain validation
- 10:10When CDN can't find the certificate
- 10:44Borrow arbitrary domain
- 11:21Obtain valid HTTPS certificates
- 12:28CDN domain validation bypass
- 15:09CDN HTTPS certificates distribution
- 18:57Borrow valid HTTPS certificates
- 25:06Domain Borrowing vs. Others
- 26:05Detection
- 27:17Mitigation
- 30:21Bypass Palo Alto Firewall
related talks
20mEnd-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks
47mDNS On Fire
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
55mFlipping Bits: Your Credentials Are Certainly Mine
40mCritical DNS & Domain Name Security Intelligence to Thwart Cyberattacks
26mMisuse of DNS, the Second Most Used Protocol
23mBamboozling Certificate Authorities with BGP
44mFlying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover