Domain Fronting (T1090.004) hides the real destination of web traffic behind a popular service. It is a command and control sub-technique of Proxy and applies to Linux, macOS, Windows and ESXi.
How attackers use it
MITRE explains that adversaries may take advantage of routing in Content Delivery Networks and other services that host multiple domains, to obscure the intended destination of HTTPS traffic or traffic tunneled through HTTPS. Domain fronting uses different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, the CDN may route to the address in the HTTP header after unwrapping the TLS header.
MITRE's example: if domain-x and domain-y are customers of the same CDN, domain-x can go in the TLS header and domain-y in the HTTP header. Traffic appears to go to domain-x, while the CDN may route it to domain-y. A variation called domainless fronting leaves the SNI field blank, which may work even when the CDN checks that SNI and Host match, if blank SNI fields are ignored.
How to detect it
MITRE's strategy (DET0196) centers on the mismatch:
- Outbound HTTPS connections where the TLS Server Name Indication does not match the HTTP Host header.
- Applications such as curl, wget or custom binaries making HTTPS connections with a mismatched or absent SNI while the HTTP Host targets CDN hosted endpoints.
- Unsigned or user space apps that open TLS with one hostname and request a different domain in HTTP headers.
- Traffic from ESXi hosts or management interfaces showing SNI to Host mismatch, which is unusual for typical infrastructure communication.
Seeing the mismatch requires visibility into the decrypted HTTP layer, which is why the main mitigation is inspection.
How to reduce the risk
MITRE lists SSL/TLS Inspection: where HTTPS traffic can be inspected, analyze captures for connections that appear to be domain fronting. Inspection has costs for privacy and certificate handling, so scope it to the egress paths where you accept that trade. Also limit which processes may use the network from servers and hypervisors, since those should rarely talk to arbitrary CDN hosted sites.
Quick check
Which two fields mismatch in domain fronting?
The SNI field in the TLS header and the Host field in the HTTP header.
Sources
- MITRE ATT&CK, T1090.004 Domain Fronting: https://attack.mitre.org/techniques/T1090/004/
