Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Domain fronting to be blocked on Azure

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 132 posts

Tell HN: Domain fronting to be blocked on Azure

#1

Post by wicroshoff »

I recently received the following email from Microsoft, with hard deadlines for banning domain fronting on existing and new Azure CDN services:

"Action required: Azure Front Door/Azure CDN blocking domain fronting

Please take action to stop domain fronting on your application before 8 November 2023 You're receiving this email because you currently use Azure Front Door or Azure CDN Standard from Microsoft (classic).

Since 29 April 2022, we've changed the behavior of Azure Front Door and Azure CDN from Microsoft to align with our commitment to stop allowing domain fronting behavior on our platform. With that change, we offered the option to enable blocking domain fronting for existing or newly created Azure Front Door, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources, through opening a support request. See details in https://azure.microsoft.com/updates/blocking-domain-fronting....

To continue our commitment, we're making changes in two phases to stop allowing domain fronting behavior on our platform.

1. Beginning 8 November 2022, all the newly created Azure Front Door, Azure Front Door (classic) or Azure CDN Standard from Microsoft (classic) resources will block any HTTP request that exhibits domain fronting behavior. Previously existing Front Door, Front Door (classic) and CDN from Microsoft (classic) resources aren't affected by these changes.

2. Beginning 8 November 2023, all existing Azure Front Door, Azure Front Door (classic) and Azure CDN Standard from Microsoft (classic) resources will block any HTTP request that exhibits domain fronting behavior.

Recommended action Between now and 7 November 2023, if you want to block domain fronting for any existing Azure Front Door or Azure CDN Standard from Microsoft (classic) resources created before 8 November 2022, please open a support request. Provide your subscription and Azure Front Door, Azure Front Door (classic), or Azure CDN Standard from Microsoft (classic) resource information in the support request. Once blocking of domain fronting has been enabled, Azure Front Door, Azure Front Door (classic), and Azure CDN Standard from Microsoft (classic) resources will block any HTTP requests that exhibit this behavior.

If your application uses a different TLS SNI extension during the TLS negotiation from the request Host header, you should prioritize changing this behavior on your application by 7 November 2023 to ensure they match. Otherwise, your application or API may be impacted by this change on 8 November 2023.

If you have any questions, please open a support request and provide your subscription details along with your Front Door or Azure CDN from Microsoft resource information.

If you have any questions, please contact us."

Posting it here in case it's of interest to anyone.

Re: Tell HN: Domain fronting to be blocked on Azure

#2

Post by eurasiantiger »

This seems to be a user-hostile move.

https://en.m.wikipedia.org/wiki/Domain_fronting

”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

Re: Tell HN: Domain fronting to be blocked on Azure

#3

Post by svnpenn »

eurasiantiger wrote: post #2

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

non crappy link:

https://wikipedia.org/wiki/Domain_fronting

Re: Tell HN: Domain fronting to be blocked on Azure

#4

Post by denysvitali »

eurasiantiger wrote: post #2

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

Fixed:

"Many large cloud service providers, including Amazon, Microsoft, and Google, actively prohibit domain fronting, which has limited it as a censorship bypass technique."

Re: Tell HN: Domain fronting to be blocked on Azure

#5

Post by lzooz »

eurasiantiger wrote: post #2

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

Well if they didn't do this the entire Azure would get banned which is even worse.

Re: Tell HN: Domain fronting to be blocked on Azure

#6

Post by sylens »

eurasiantiger wrote: post #2

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

It is not just used for censorship. When I was working as a pentester and domain fronting was still allowed on AWS, it became our method of choice for establishing C2 because it camouflaged so well with regular organizational outbound that it will bypass any egress filtering and restrictions.

If we were using it on a pentest, you'd best believe there are actors using it for far more nefarious purposes.

Re: Tell HN: Domain fronting to be blocked on Azure

#7

Post by codetrotter »

For anyone else wondering what domain fronting is:

> Domain fronting is a technique for Internet censorship circumvention that uses different domain names in different communication layers of an HTTPS connection to discreetly connect to a different target domain than is discernable to third parties monitoring the requests and connections.

https://en.wikipedia.org/wiki/Domain_fronting

Cool, so we are bowing down further to oppressive regimes now.

Re: Tell HN: Domain fronting to be blocked on Azure

#8

Post by tialaramex »

Some of the key people behind ECH (Encrypted Client Hello, work to hide SNI and other potentially sensitive information from the Client Hello in TLS) work for outfits which would be delivering basically the same functionality via ECH, such as Cloud companies and CDNs. Of course it is possible they don't intend to ever deploy this (but then they've wasted months of work which seems strange) or that their employers won't allow it (but then they're wasting some fraction of productive effort by an employee) but it's also possible their explanation is real. Lets see what the difference is between ECH and Domain Fronting:

Consider two clients, Alice and Bob, they are both connecting to some IP 10.20.30.40 using TLS or QUIC.

Alice wants to access naughty.thing.example and Bob wants to access bland.stuff.example. Perhaps Mallory is trying to prevent Alice from accessing naughty.thing.example (but they don't mind bland.stuff.example) or perhaps Alice just doesn't want Eve to know what she's accessing. Mallory and Eve are both on the network, able to interpose between Alice and Bob and 10.20.30.40 and neither Alice nor Bob can easily prevent that.

Under domain fronting, Bob is just honest, he tells the server I want bland.stuff.example, and then he uses bland.stuff.example as usual and everything works. This means for technical operations it's OK if the 10.20.30.40 server cares what Bob said during connection. For example maybe once Bob says bland.stuff.example, the server spins up an IPC to a Python server which only knows about bland.stuff.example and splices Bob's connection to the IPC.

Under domain fronting, Alice's situation is tricky. Alice says she wants bland.stuff.example but she actually uses naughty.thing.example and expects that to work. Technical ops people who've arranged that bland.stuff.example connections get spliced are faced with bug reports - why didn't naughty.thing.example work, 10.20.30.40 was the right server ???

Under ECH, both Alice and Bob are presenting a visible name (which might be bland.stuff.example or some other value entirely) which Mallory and Eve can easily read, but they're also providing an encrypted destination, Alice can encrypt naughty.thing.example while Bob encrypts bland.stuff.example† The 10.20.30.40 server can decrypt the name, and thus it knows which service Alice and Bob actually intend to access.

† If you thought "What about padding? Those names are different lengths" congratulations, you're now at step 1 of a long process which is why this was not trivial to design and implement.

Re: Tell HN: Domain fronting to be blocked on Azure

#9

Post by throwaway0x7E6 »

denysvitali wrote: post #4
eurasiantiger wrote: post #2

This seems to be a user-hostile move. https://en.m.wikipedia.org/wiki/Domain_fronting ”Many large cloud service providers, including Amazon and Google, now actively prohibit domain fronting, which has limited it as a censorship bypass technique. Pressure from censors in Russia and China is thought to have contributed to these prohibitions”

Fixed: "Many large cloud service providers, including Amazon, Microsoft, and Google, actively prohibit domain fronting, which has limited it as a censorship bypass technique."

sure, it was merely a coincedence that they've started doing it after russian minitrue telegram fiasco.

our venerable corporations would never bend to the will of foreign dictators.

Post reply on HN