While reading about Domain Fronting (and Google and Amazon's decision to ban it), I came across this blog where the author has identified domains that allow fronting.
From the blog, doing something like
curl -s -H "Host: images-na.ssl-images-amazon.com" -H "Connection: close" "https://cdn.atlassian.com/images/I/01rgQ3jqo7L.css"
will allow us to access the said CSS file from the
images-na.ssl-images-amazon.com domain even though all surveillance systems will show that we connected to
cdn.atlassian.com system. I tried to change the Host to something else (say wikipedia) and Cloudfront gave a "Bad Request" error so presumably both the sub-domains have to be on the same domain. (cdn.atlassian.com is hosted on cloudfront from their
My Questions are:
- If Amazon has already banned fronting why is it possible to successfully make the above request?
- At a practical level, how can a malicious user leverage fronting for hosting a malware C&C service?
- Are there any best practices using which an individual customer ensure his subdomain (say xyzabc.cloudfront.com) is not susceptible to fronting?
- Is domain fronting something that only CDNs have to worry about or can a poorly configured stand-alone web-server also be (ab)used as a front?