New tool brings back 'domain fronting' as 'domain hiding'

guest · Aug 8, 2020

DEF CON: New tool brings back 'domain fronting' as 'domain hiding'
August 8, 2020
https://www.zdnet.com/article/def-con-new-tool-brings-back-domain-fronting-as-domain-hiding/

At the DEF CON 28 security conference this week, a security researcher has released a new tool that can help the makers of sensitive applications evade censorship and bypass firewalls to keep services up inside problematic areas of the globe.

The new tool, named Noctilucent, was developed by Erik Hunstad, Chief Technical Officer at cyber-security firm SixGen.
Hunstad said he used the new TLS 1.3 protocol to revive domain fronting (sort of) as an anti-censorship technique, but in a new format, the researcher calls "domain hiding."
WHAT IS DOMAIN FRONTING
Domain fronting is a technique that has been made popular by mobile app developers in the 2010s and has been used to allow apps to bypass censorship attempts in oppressive countries.
Click to expand...

WHAT IS DOMAIN HIDING
But since 2018, new technologies have had a chance to grow. TLS 1.3, which was barely a few weeks old in its life as a stable protocol at the time domain fronting was banned, is now widely used across the internet.

"This new technique, which I'm calling domain hiding, accomplishes the same goals as domain fronting, but uses different technologies," Hunstad said in his DEF CON talk.
For example, in a "domain hiding" connection, an app might appear that it's initiating an HTTPS connection to firefox.com, but behind the scene, it's actually connecting to desired-site.com.
Click to expand...

Hunstad's new Noctilucent tool, open-sourced on GitHub this week, automates the process of hiding domains with the researcher's new technique.
The tool was built to use Cloudflare as a host for "front" domains.

However, just like most tools, Noctilucent has its good and bad sides.
Click to expand...

Noctilucent

Description
This is the code developed and presented as part of the DEF CON 28 (Safe Mode) talk "Domain Fronting is Dead, Long Live Domain Fronting: Using TLS 1.3 to evade censors, bypass network defenses, and blend in with the noise."

Domain fronting, the technique of circumventing internet censorship and monitoring by obfuscating the domain of an HTTPS connection was killed by major cloud providers in April of 2018. However, with the arrival of TLS 1.3, new technologies enable a new kind of domain fronting. This time, network monitoring and internet censorship tools are able to be fooled on multiple levels.
Click to expand...

Log in or Sign up

New tool brings back 'domain fronting' as 'domain hiding'

guest Guest

Log in or Sign up

New tool brings back 'domain fronting' as 'domain hiding'

guest Guest

Useful Searches