CDNs (T1596.004) is a reconnaissance sub-technique under Search Open Technical Databases. Its platform is PRE.
A content delivery network lets an organization host content from a distributed, load balanced array of servers. CDNs may also customize delivery based on the requester's geographic region.
How attackers use it
MITRE says adversaries search CDN data for information about content servers in a CDN, using online resources and lookup tools. They may also look for CDN misconfigurations that leak sensitive information not meant to be hosted, or that lack the protection mechanisms, such as login portals, found on the organization's own website.
That is the part to take seriously. A file placed on a CDN host can be reachable without the authentication that guards the same file on your main site.
MITRE says the results can lead to Active Scanning or Search Open Websites/Domains, to acquiring or compromising infrastructure, and to initial access through Drive-by Compromise.
How to detect it
This lookup happens off your network. MITRE notes a high occurrence and false positive rate and low visibility, so focus on related stages such as Initial Access. Your CDN's own logs are a useful place to notice requests for objects that should not be public.
How to reduce the risk
MITRE's mitigation is Pre-compromise: reduce the amount and sensitivity of data available externally.
- List what your CDN serves and confirm each object is meant to be public.
- Make sure authentication and access rules applied on the origin also apply at the edge.
- Remove old assets, backups and staging files from CDN-backed storage.
- Review the configuration of any storage that feeds the CDN.
Quick check
What CDN weakness does MITRE highlight?
Misconfigurations that expose sensitive content lacking the protections, such as login portals, that the main website has.
