1
00:00:04,640 --> 00:00:08,380
Eric, we've got a few questions already in the queue.

2
00:00:09,580 --> 00:00:12,420
I'll start off by asking you one here.

3
00:00:13,060 --> 00:00:14,960
I watched your talk, it was great.

4
00:00:14,960 --> 00:00:17,900
Thanks for doing the work you did and releasing that tool.

5
00:00:17,900 --> 00:00:20,700
It's going to be helpful for the attackers.

6
00:00:21,540 --> 00:00:28,000
Myself, as a Blue Teamer, some of the things we do as Trix is to look for...

7
00:00:28,000 --> 00:00:33,260
You talked about how to detect it on the wire, essentially in network traffic.

8
00:00:34,460 --> 00:00:39,400
Have you looked at anything like on an endpoint?

9
00:00:39,400 --> 00:00:42,840
Like if there's any artifacts or anything that would indicate that there's a problem?

10
00:00:42,840 --> 00:00:49,400
Maybe not necessarily that the domain is bad or that it's being fronted, but anything that would show there's a problem.

11
00:00:50,040 --> 00:00:55,020
Yeah, I think it's going to depend on the tooling that you use when you actually implement this technique.

12
00:00:55,020 --> 00:01:02,660
If you're using a test client or something like the demo C2 that I had, you'll obviously have an EXE executing.

13
00:01:03,000 --> 00:01:05,920
If you bake it into something else, maybe you inject.

14
00:01:06,800 --> 00:01:17,640
If you're running out of SVC host and it's supposed to have network connections and you're fronting on something that might look OK, that's probably going to be the best bet for the Red Teamers.

15
00:01:17,640 --> 00:01:28,980
But yeah, I think the last slide of my detection piece was just do the good old-fashioned police work and look at the endpoints and use that EDR.

16
00:01:29,240 --> 00:01:43,880
And you mentioned that a couple years ago that some of the major players were essentially removed this capability and Azure is only the last standing big cloud provider that does this.

17
00:01:44,480 --> 00:01:50,460
Is it possible for Cloudflare to decide the same thing and they say, hey, we're going to block this?

18
00:01:50,660 --> 00:01:52,360
Can they do anything about it?

19
00:01:52,640 --> 00:01:53,400
Yeah, definitely.

20
00:01:53,400 --> 00:01:56,060
They could turn it off tomorrow if they wanted to.

21
00:01:56,120 --> 00:02:08,540
I think the way that would work is once they decrypt the server name indication, they could check to see if it was sent to the IP that they have registered for an A record for that domain.

22
00:02:08,540 --> 00:02:11,140
And if it doesn't match, then they could drop the connection.

23
00:02:11,420 --> 00:02:13,200
But I don't think they're going to do that.

24
00:02:13,200 --> 00:02:19,440
Nick Sullivan, their head of research, has been aware of this technique ever since Robin Wood posted it last year.

25
00:02:19,480 --> 00:02:22,620
So it's not super new.

26
00:02:22,620 --> 00:02:27,060
And I think Cloudflare is kind of a progressive, freedom-loving company.

27
00:02:27,060 --> 00:02:34,560
And I think besides, if you're not running 8chan or DailyStorm or something crazy, you're probably pretty safe with Cloudflare.

28
00:02:34,560 --> 00:02:36,280
So I think it's going to live on.

29
00:02:36,280 --> 00:02:40,960
And unless governments really turn the screws, I think this has some shelf life in it.

30
00:02:40,960 --> 00:02:41,600
OK.

31
00:02:43,400 --> 00:02:51,760
So anything like when you said you specifically talked about, you know, how you can detect it on the network, what would that look like?

32
00:02:51,760 --> 00:02:54,640
So if I'm using this technique, you showed how it's happening.

33
00:02:54,640 --> 00:02:57,840
Again, my team is or my perspective is the blue side.

34
00:02:58,100 --> 00:02:59,460
How would I see this?

35
00:02:59,460 --> 00:03:01,980
You know, tell me, you know, give me some hints.

36
00:03:01,980 --> 00:03:06,200
How would I detect this and make sure that it's not happening on my network?

37
00:03:06,200 --> 00:03:08,940
Is there any quick and dirty tricks?

38
00:03:08,940 --> 00:03:16,600
Yeah, I think the best way is going to look for those packets that have both the encrypted server name and the regular SNI.

39
00:03:16,600 --> 00:03:25,320
If you're making a TLS connection and you use both of those, it's not normal, it's not expected, and it's probably not anything good.

40
00:03:25,320 --> 00:03:30,080
So I would drop any packet that's trying to do that and then investigate that endpoint for sure.

41
00:03:30,240 --> 00:03:38,780
If they're only using an encrypted server name indication, then it's a choice to either block all of it or allow all of it.

42
00:03:38,780 --> 00:03:40,860
So that's where it gets tough.

43
00:03:40,860 --> 00:03:46,220
And there's no easy button in any product right now to enable you to do that.

44
00:03:46,360 --> 00:03:47,540
And you mentioned custom rules.

45
00:03:47,540 --> 00:03:50,160
You could create your own custom rules, obviously.

46
00:03:50,600 --> 00:03:57,780
Yeah, I think in Snort and Secure Kata, you're going to have to get into the content parser and really pick out those TLS extensions themselves.

47
00:03:57,980 --> 00:03:58,940
I'm not a blue teamer.

48
00:03:58,940 --> 00:04:04,520
I haven't dug into that super in depth, but I suspect we'll see some rules pretty soon for this kind of stuff.

49
00:04:05,500 --> 00:04:06,720
Maybe tomorrow.

50
00:04:06,720 --> 00:04:08,280
Maybe.

51
00:04:11,320 --> 00:04:20,820
Is there any other technologies besides WebSockets and HTTP that could be used to perform the same type of attack?

52
00:04:20,940 --> 00:04:21,900
Yeah, definitely.

53
00:04:21,900 --> 00:04:24,700
So this works right now at the TLS layer.

54
00:04:24,700 --> 00:04:28,960
So anything that you can wrap in TLS would also work with this technique.

55
00:04:28,960 --> 00:04:36,140
So I showed HTTP and I showed WebSockets working, but there's no reason you couldn't wrap arbitrary protocols in that.

56
00:04:36,140 --> 00:04:40,600
And that's kind of what Cloak is doing, although it uses WebSockets to do that.

57
00:04:40,700 --> 00:04:45,660
One thing you could also do is investigate QUIC, which is a UDP based protocol.

58
00:04:46,480 --> 00:04:51,480
Cloudflare supports that, and I have a suspicion that this would also work using QUIC.

59
00:04:52,260 --> 00:04:53,060
OK.

60
00:04:56,300 --> 00:05:08,640
Somebody's mentioned from the chat, you know, why if the ESNI is the problem, the traffic, they're asking why not just block it all or decrypt it all, I guess.

61
00:05:08,640 --> 00:05:12,300
Blocking it all obviously would have some impacts, but speak to both, I guess.

62
00:05:12,640 --> 00:05:14,080
Yeah, you could block it all.

63
00:05:14,080 --> 00:05:15,160
That is an option.

64
00:05:15,560 --> 00:05:20,540
As adoption grows, I think that's going to be a more difficult option.

65
00:05:20,540 --> 00:05:25,980
Right now, you might be able to get away with it since it's only a smaller percentage of the traffic.

66
00:05:26,040 --> 00:05:31,400
TLS 1.3 itself is 25 to 50 percent, I would guess, depending on the network.

67
00:05:31,980 --> 00:05:35,500
With ESNI, it's still a draft, so it's probably much lower.

68
00:05:35,500 --> 00:05:37,120
It's in Firefox and things like that.

69
00:05:37,120 --> 00:05:42,580
But you could probably get away with blocking all ESNI traffic right now and your users wouldn't yell at you too much.

70
00:05:43,300 --> 00:05:48,380
As far as decrypting goes, I don't think that's really an option.

71
00:05:48,380 --> 00:05:53,760
You're going to have to get in between the DNS and then put your own keys in there.

72
00:05:54,640 --> 00:05:59,900
Maybe a vendor will come out with a solution to do that, but right now it's going to be messy for sure.

73
00:06:00,080 --> 00:06:06,740
Probably a function of how big of a server you have to run, how much volume of data that's coming through.

74
00:06:09,840 --> 00:06:17,360
You mentioned there was a little comment in there, in parentheses, the AI and ML reference.

75
00:06:18,000 --> 00:06:19,760
Do you care to speak to that?

76
00:06:19,760 --> 00:06:26,940
Is there any sort of statistical analysis, machine learning that could be used to detect this stuff?

77
00:06:26,940 --> 00:06:34,020
Yeah, I think there's definitely space in there for solutions that do their machine learning and their anomaly detection especially.

78
00:06:34,020 --> 00:06:47,720
Like I said, if there's a computer, maybe an accounting or something, that all of a sudden every 30 minutes it reaches out to, it doesn't really matter what domain it is, but all of a sudden there's a new pattern of behavior from that machine, that should be suspect.

79
00:06:47,720 --> 00:06:51,020
And if you have a good solution, maybe you get an alert on that.

80
00:06:51,020 --> 00:06:52,200
Okay.

81
00:06:53,780 --> 00:06:54,540
All right.

82
00:06:54,540 --> 00:07:04,980
Have you heard any response from, you know, any, it sounds like you've been talking to some, most of these places, people, businesses, and providers.

83
00:07:04,980 --> 00:07:20,120
Have they mentioned that there's anything coming up or other than, you know, just expect expectation that once they see this on the, on the YouTube and Twitch, that it'll spark them to create some new rules?

84
00:07:20,120 --> 00:07:35,900
Yeah, I haven't, I haven't really communicated with the firewall vendors much, but I suspect that as adoption grows and as this becomes more of a problem, probably once the first major ransomware uses something similar to this, people will start taking notice.

85
00:07:36,200 --> 00:07:38,240
But yeah, nothing, nothing right now.

86
00:07:38,240 --> 00:07:42,700
I don't have any insight on what's coming down the pipe, but I'd look out for it for sure.

87
00:07:42,700 --> 00:07:43,400
Okay.

88
00:07:43,520 --> 00:07:44,460
So let's see.

89
00:07:44,460 --> 00:07:53,820
I was especially interested in your problem you were seeing with Palo Alto and the mismatch on support for 1.3.

90
00:07:53,820 --> 00:07:56,780
Did that get resolved after you recorded this?

91
00:07:57,300 --> 00:07:59,860
Yeah, so I don't think that's, it's not really an issue.

92
00:07:59,860 --> 00:08:03,260
It's just the default decryption profile that they have in place.

93
00:08:03,260 --> 00:08:09,420
If you just click on like, do HTTPS decryption for me, it just doesn't include 1.3 by default.

94
00:08:09,420 --> 00:08:12,860
But it's, if you're setting that up, you're probably going to want to fine tune that.

95
00:08:12,860 --> 00:08:15,900
So all you do is you check the extra box and then it works.

96
00:08:15,900 --> 00:08:22,180
But I was a little bit surprised when I tried to just do the easy button solution and turns out it just let everything through.

97
00:08:22,180 --> 00:08:23,920
It did log an error for every connection.

98
00:08:23,920 --> 00:08:30,900
So your logs would fill up pretty quickly and you should notice something, but a little strange that it's not included in the default profile.

99
00:08:31,540 --> 00:08:34,280
So what if I'm a, I'm a pen tester.

100
00:08:34,320 --> 00:08:36,600
I get paid for success.

101
00:08:37,360 --> 00:08:40,400
And I have my own little tool suite that I'm using.

102
00:08:40,400 --> 00:08:42,720
How would I utilize this technique?

103
00:08:42,720 --> 00:08:47,600
Like how is there, what did you have to go through to tailor your tool to work with?

104
00:08:48,020 --> 00:08:51,700
Yeah, I think there are two options right now for what you can do.

105
00:08:51,700 --> 00:08:58,220
One is you can use the kind of cloak proxy shadow socks method that I demonstrated with Cobalt Strike.

106
00:08:58,220 --> 00:09:01,840
So if your tool is proxy aware, you just bundle it with those two.

107
00:09:02,000 --> 00:09:07,380
It's going to be a little bigger and make a little more noise, but you can use this technique today with that.

108
00:09:07,500 --> 00:09:15,420
If you want to integrate it, if you're using Go for your language that you write your tool set in, then you can, there are instructions on the GitHub on how to integrate it.

109
00:09:15,420 --> 00:09:16,440
It's not too bad.

110
00:09:16,440 --> 00:09:18,020
Just a couple of changes.

111
00:09:18,180 --> 00:09:22,640
If it's another language, you're going to have to dig into the TLS library itself.

112
00:09:23,200 --> 00:09:24,180
There are two requirements.

113
00:09:24,180 --> 00:09:28,600
One, you've got to support the ESNI or the draft ESNI extension.

114
00:09:28,860 --> 00:09:45,020
And then two, you've got to kind of adjust that to do things that maybe it's not designed to do by spec, like maintain the ESNI or maintain the regular SNI if you're using ESNI, if you so want to do that kind of decoy SNI stuff.

115
00:09:45,020 --> 00:09:53,080
So digging into the actual TLS library of your language of choice might be required if you want to integrate it smoothly into your tool.

116
00:09:53,080 --> 00:10:09,260
And asking for the red teamers on the call, because I'm sure they want to know if they're trying to be secretive and not use, you know, even though it's you're hiding in the in the noise by using Cloudflare.

117
00:10:09,260 --> 00:10:21,760
What if I wanted to find something a little more rare, or make it so that it's less likely to get detected since, you know, most of the early rules are going to be based on essentially the examples that you had.

118
00:10:21,760 --> 00:10:28,320
How do I check to see if there's what other tool or what other domain fronting options there are?

119
00:10:28,700 --> 00:10:35,200
Yeah, I didn't actually show this in the talk, but there is a tool inside the Git repo that I call find fronts.

120
00:10:35,220 --> 00:10:41,300
And you can feed it a CSV of domain names and it will spit out which ones are available to use with this technique.

121
00:10:41,300 --> 00:10:43,520
But if you want to do it yourself, it's super easy.

122
00:10:43,520 --> 00:10:47,740
All it's doing basically is curling the domain and then looking at the response headers.

123
00:10:47,820 --> 00:11:08,300
And anything that comes back with a server name of Cloudflare has a set cookie with a, you know, underscore underscore CF, which is a Cloudflare value, or has an expect CT header that includes the Cloudflare domain pretty much indicates that that site is behind a Cloudflare worker or some other Cloudflare service,

124
00:11:08,300 --> 00:11:10,880
and it's available to be used with this technique.

125
00:11:10,880 --> 00:11:15,640
So everything that's returned that so far has been great for this technique.

126
00:11:15,640 --> 00:11:17,520
So I'd do that.

127
00:11:17,600 --> 00:11:17,880
Okay.

128
00:11:17,880 --> 00:11:21,260
And you used Cloudflare as the example.

129
00:11:21,260 --> 00:11:25,460
Have you tried it with other services like Azure?

130
00:11:25,580 --> 00:11:32,760
I haven't worked on it with other services, mostly because most of them don't support the draft ESNI standard.

131
00:11:32,760 --> 00:11:41,900
So you need a CDN that supports this standard and then kind of also allows arbitrary IPs to be used for arbitrary domains that are hosted on it.

132
00:11:41,960 --> 00:11:42,060
Okay.

133
00:11:42,060 --> 00:11:44,320
And another thing is that the bigger the better, right?

134
00:11:44,320 --> 00:11:50,720
So you want it to be painful to block and Cloudflare being the biggest CDN, they supported all the things and they were the biggest.

135
00:11:50,720 --> 00:11:52,940
So kind of a one stop shop with that one.

136
00:11:52,940 --> 00:11:53,200
Yeah.

137
00:11:53,200 --> 00:11:57,260
And does your tool then, would that, you mentioned there's a couple of caveats there.

138
00:11:57,260 --> 00:12:01,120
Would your tool then work through that?

139
00:12:01,120 --> 00:12:08,060
You know, knowing that all those other conditions exist and tell you this is a legitimate website you could use?

140
00:12:09,060 --> 00:12:11,840
No, the FindFronts isn't going to do that for you.

141
00:12:11,840 --> 00:12:17,120
The FindFronts is just looking for specifically Cloudflare protected domains.

142
00:12:17,120 --> 00:12:24,600
So if you find another CDN that works with this technique, you're going to have to come up with your own method to detect which sites are available to front with those.

143
00:12:24,700 --> 00:12:24,920
Okay.

144
00:12:24,920 --> 00:12:26,000
Thanks for clarifying.

145
00:12:27,380 --> 00:12:30,640
Let's see, I got another request or question here.

146
00:12:31,240 --> 00:12:34,160
Let's see, the Tor project uses domain fronting.

147
00:12:34,160 --> 00:12:41,740
Are you aware of this being, of your tech, I think it's your technique being adopted or are they looking into it?

148
00:12:42,520 --> 00:12:49,320
Yeah, I don't know that the Tor project is aware that this kind of branch of domain fronting is available yet.

149
00:12:49,320 --> 00:12:51,720
Hopefully this will spark their interest.

150
00:12:51,720 --> 00:12:59,220
They use the Meek project to do domain fronting and they're kind of reliant on Azure right now since it's the only major CDN that still allows it.

151
00:12:59,240 --> 00:13:04,000
But I would love to see them roll out with this technology and same with Signal.

152
00:13:04,000 --> 00:13:07,500
I think they do some domain fronting in restricted countries as well.

153
00:13:07,500 --> 00:13:14,540
So besides being a red team tool, I'd also love to see it be used as a censorship bypass to give people free and open access to the internet.

154
00:13:14,540 --> 00:13:16,260
Yeah, can you speak a little bit more about that?

155
00:13:16,260 --> 00:13:19,980
We have another another request that's, you know, you walked right into it.

156
00:13:19,980 --> 00:13:21,540
That's exactly what they want to know.

157
00:13:21,540 --> 00:13:29,160
How would this be leveraged to essentially become a communication, you know, a tool for communication?

158
00:13:29,720 --> 00:13:33,000
I say secretly, but you know, to bypass censorship?

159
00:13:33,000 --> 00:13:44,460
Yeah, I think you'd probably set up a system similar to one of the demos that I had where you have Cloak or the Cloak fork in the Noctilucent project, a Shadowsocks server.

160
00:13:44,460 --> 00:13:54,000
You put that out on a VPS or a company sponsors a large instance, and then you run a Cloak client locally with a Shadowsocks client locally.

161
00:13:54,000 --> 00:14:11,320
And then you have a Socks proxy running on your host that tunnels arbitrary TCP or UDP traffic out to the open internet and you can bypass any great wall or other restrictive government that's trying to block specific sites or really anything.

162
00:14:11,320 --> 00:14:14,020
All your traffic is going to appear to come from that VPS.

163
00:14:14,020 --> 00:14:17,080
So it's like you're browsing from that VPS.

164
00:14:18,780 --> 00:14:19,740
Okay.

165
00:14:21,700 --> 00:14:25,280
All right, it looks like I

166
00:14:28,860 --> 00:14:30,360
don't see any new...

167
00:14:30,360 --> 00:14:39,600
There was one other question that said, apart from the fact that using domain fronting must also host the site on the same domain, what are the other downsides to this?

168
00:14:39,600 --> 00:14:42,800
Are there any solutions for detecting and blocking it?

169
00:14:43,560 --> 00:14:57,680
Yeah, so original domain fronting that was popular back in 2018, it required you to not only have your domain on the same service, but you'd have to run a service or a VPS on that provider.

170
00:14:57,680 --> 00:15:03,460
So if you were using Azure, you had to have an Azure VPS running on that same thing.

171
00:15:03,460 --> 00:15:09,280
If you were using Google Cloud, you'd have to have a Google app worker or something like that running on the same service.

172
00:15:09,280 --> 00:15:13,760
And all those required full name to sign up, credit cards, phone numbers.

173
00:15:13,760 --> 00:15:18,660
It was a little burdensome, plus expensive if you had a lot of traffic.

174
00:15:19,220 --> 00:15:24,840
I think the Tor project has some stats on how much money they were putting into domain fronting, but it wasn't trivial.

175
00:15:24,840 --> 00:15:26,320
It was an amount.

176
00:15:26,320 --> 00:15:35,160
With Cloudflare, all you need to do is you sign up for a free account, which just requires a name and an email, and they will take disposable emails.

177
00:15:35,160 --> 00:15:45,280
And then you point your domain, registrar, name servers to Cloudflare, and then you define your IPs in the Cloudflare web dashboard, and that's it.

178
00:15:45,280 --> 00:15:47,740
Those IPs can point to anywhere you want.

179
00:15:47,740 --> 00:15:56,540
It can be DigitalOcean, Amazon, Google Cloud, it doesn't matter where they're hosted, as long as your DNS is run from Cloudflare.

180
00:15:57,300 --> 00:16:09,440
I thought your example of the mail forwarding with the postcard in the envelope was a good analogy to help with the C-suite understand what the threat is and how it works.

181
00:16:09,440 --> 00:16:17,180
Essentially, you accept the letter and blindly open it and hand it off to whoever it needs to go to without inspecting it.

182
00:16:17,560 --> 00:16:18,400
Exactly.

183
00:16:18,460 --> 00:16:19,020
Yep.

184
00:16:19,280 --> 00:16:20,800
Oh, so you did watch the show, huh?

185
00:16:20,800 --> 00:16:21,320
I did.

186
00:16:21,320 --> 00:16:25,200
I was just joking, but I didn't watch it.

187
00:16:30,950 --> 00:16:32,070
Let's see.

188
00:16:32,070 --> 00:16:33,550
I had another question.

189
00:16:34,150 --> 00:16:36,590
Oh, the speed.

190
00:16:36,590 --> 00:16:40,090
I found that very interesting that the speed was so high.

191
00:16:40,090 --> 00:16:42,590
I was not expecting that.

192
00:16:42,590 --> 00:16:49,750
Do you think that is a function of Cloudflare's capabilities, or is it just a function of the protocol?

193
00:16:49,750 --> 00:16:57,230
Because it's used on the internet, there's a focus on making sure the throughput is high.

194
00:16:57,230 --> 00:17:00,030
Because you wouldn't want to slow people down to get their content.

195
00:17:00,350 --> 00:17:04,090
And most of the time it's being used for video or those types of things anyway.

196
00:17:04,690 --> 00:17:07,530
Yeah, I think it's a function of kind of every piece of the chain.

197
00:17:07,650 --> 00:17:12,890
Web sockets are great for bidirectional communication with low overhead.

198
00:17:12,950 --> 00:17:16,790
And then Cloudflare is just really good at delivering content.

199
00:17:16,790 --> 00:17:18,150
I mean, that's their bread and butter.

200
00:17:18,150 --> 00:17:24,910
So even when you're pushing 100 megs per second fronted through them, they handle it no problem.

201
00:17:24,910 --> 00:17:28,530
So yeah, everything from the web sockets to Cloudflare's infrastructure.

202
00:17:28,950 --> 00:17:32,550
I wonder what would happen if I paid for the higher tier AWS.

203
00:17:32,550 --> 00:17:33,790
Could I get even more?

204
00:17:33,790 --> 00:17:34,190
I don't know.

205
00:17:34,190 --> 00:17:37,670
Maybe that's a future research project is how fast can you do this?

206
00:17:37,670 --> 00:17:41,450
But 100 megs a second is pretty solid for everything I was doing.

207
00:17:42,290 --> 00:17:43,930
Yeah, yeah.

208
00:17:44,090 --> 00:17:48,610
Yeah, I was surprised at that when you showed that.

209
00:17:50,650 --> 00:17:54,470
So any other ideas for future research?

210
00:17:54,470 --> 00:17:59,530
Are you, you know, is there any other techniques or tricks?

211
00:17:59,530 --> 00:18:06,090
I saw the enhancements with the cloak was cool.

212
00:18:07,890 --> 00:18:18,330
You know, as a blue teamer, we're always looking for this type of stuff, both, you know, we realize that there's techniques that could be, we won't see them.

213
00:18:18,330 --> 00:18:29,450
And so we have to combine network analysis with user behavior with, you know, anomalies that are detected on the endpoint.

214
00:18:29,450 --> 00:18:37,170
You know, like we were before we were on this, the chat, we're talking about, you know, somebody in finance running PowerShell.

215
00:18:37,170 --> 00:18:44,710
And, you know, maybe the PowerShell is running in the middle of the night, which is unexpected, those types of detection capabilities.

216
00:18:44,710 --> 00:18:58,130
And, you know, to me, what worries me is as when I was a consultant doing, you know, the pen testing stuff, I felt that a lot of the businesses were working with the small to medium sized businesses, which are, you know, 90% of the businesses in the country,

217
00:18:58,130 --> 00:18:59,990
or in the world, actually.

218
00:19:01,270 --> 00:19:10,910
There's not a lot of, you know, not a lot of hope for them in detecting this level of stuff, because they just don't have the resources.

219
00:19:10,910 --> 00:19:20,570
You know, it's difficult for them to, one, understand it, you did a great job of providing a way to understand, generally, what is happening.

220
00:19:21,790 --> 00:19:34,570
But, you know, if the tools, if you go to a vendor and the vendors tools don't, can't do it, you know, out of the box or very simply, it's, you know, it's a daunting task for them.

221
00:19:35,950 --> 00:19:49,010
Yeah, I think in this case, it might be more of a, you don't have to outrun the bear, you just have to outrun your friends situation where this technique is probably only going to be used by the most advanced actors or red team that you hire.

222
00:19:49,130 --> 00:19:57,910
So, you know, first step one is detect that the fact that PowerShell is running on the accountant box in the middle of the night and then start worrying about the more advanced stuff.

223
00:19:57,910 --> 00:20:01,690
But when you're ready for the more advanced stuff, it's there for sure.

224
00:20:01,690 --> 00:20:06,110
Somebody's scratching at the door, so you may want to check.

225
00:20:06,430 --> 00:20:06,990
Yeah.

226
00:20:09,570 --> 00:20:18,950
Somebody made a comment about Cloudflare has something called Bandwidth Alliance, where you aren't charged for your VPS.

227
00:20:19,510 --> 00:20:21,310
I don't know, it's just a comment, I guess.

228
00:20:22,390 --> 00:20:28,730
Is there anybody, any reason why you chose Cloak over some other pluggable transports like V2Ray?

229
00:20:28,730 --> 00:20:32,350
Yeah, there are a bunch of good projects out there.

230
00:20:32,350 --> 00:20:35,510
Chisel was another one that I looked at, which is also written in Go.

231
00:20:35,610 --> 00:20:45,870
I liked Cloak because it seemed to have the widest variety of potential secondary services that you can kind of glue on to it.

232
00:20:45,870 --> 00:21:01,450
I use Shadowsocks in my example, but the fact that you can tunnel UDP traffic through it, you could probably get WireGuard VPN running fronted through Cloudflare, which is just kind of crazy to think about, and at decent speeds as well.

233
00:21:02,150 --> 00:21:17,690
I went with Cloak because it seemed to be the most censorship unfriendly, because of the fingerprinting, although I think I kind of broke that when I just used the standard Go TLS library, and then the widest variety of things you can use it with.

234
00:21:17,690 --> 00:21:31,990
Yeah, I think that's, to me, that's what the biggest, any of these types of talks where you're kind of pushing the envelope and coming up with something new and building, you know, a concept is, is the where do we go from here?

235
00:21:31,990 --> 00:21:36,090
As soon as somebody shows, hey, look what I found over here.

236
00:21:36,090 --> 00:21:52,170
And then there's this explosion that happens in the next six to nine months where development kicks off and then somebody will do a presentation next year, based on what you presented and kind of taking it to the next level.

237
00:21:52,170 --> 00:22:05,030
Yeah, I hope to see, you know, C sharp TLS libraries that use this and C libraries and, you know, everybody kind of modifying their low level TLS libraries to enable these options.

238
00:22:05,030 --> 00:22:06,410
That'd be really cool.

239
00:22:06,910 --> 00:22:14,670
Do you have any other, somebody's asking about research, future research, any avenues you think would be fruitful?

240
00:22:14,670 --> 00:22:16,950
Yeah, I'd look into QUIC for sure.

241
00:22:16,950 --> 00:22:17,690
Q-U-I-C.

242
00:22:17,690 --> 00:22:26,470
It's the UDP based protocol that a lot of providers are, even Microsoft is now pushing QUIC and Cloudflare, of course, supports it.

243
00:22:26,470 --> 00:22:31,230
And I would be surprised if you couldn't do the same technique using QUIC.

244
00:22:31,230 --> 00:22:46,290
So you wouldn't, you wouldn't be using TLS and TCP, but you'd be using UDP, using that quicker protocol, potentially higher speed, and potentially harder to detect if you're, if you're allowing UDP out to port 53.

245
00:22:46,570 --> 00:22:50,010
Maybe you can, you know, slip some traffic through that way.

246
00:22:51,150 --> 00:22:51,950
Okay.

247
00:22:53,970 --> 00:22:56,510
All right, well, we're getting close to the end here.

248
00:22:56,510 --> 00:22:59,550
Got about seven, eight minutes.

249
00:22:59,610 --> 00:23:05,010
Do you have any other comments or ideas for people to...

250
00:23:06,410 --> 00:23:07,230
Yeah, for sure.

251
00:23:07,230 --> 00:23:08,910
Anything, anything you want to let us know?

252
00:23:08,910 --> 00:23:12,370
Any new tools or updates you want to improve on?

253
00:23:12,710 --> 00:23:13,670
Or know...

254
00:23:13,670 --> 00:23:14,210
I'd be...

255
00:23:14,210 --> 00:23:14,730
Go ahead.

256
00:23:14,730 --> 00:23:15,110
Sorry.

257
00:23:15,110 --> 00:23:28,650
I'd be lying if I, if I didn't have a, if I told you I didn't have a DC 29 folder on my computer already with a, with a notes document in there thinking about, about the next talk and how to take this the next step.

258
00:23:28,650 --> 00:23:36,790
But yeah, I think people should just keep up with the latest news, either on Twitter or Reddit, Netsack, or anything like that.

259
00:23:36,790 --> 00:23:43,650
When you see a little nugget, like I saw Robin Wood was the one who originally kind of showed that this was even possible.

260
00:23:43,990 --> 00:23:49,790
And you can kind of run with that and productize it and take it to the next level and then explain how it works.

261
00:23:49,790 --> 00:23:51,610
And, and that's good enough for a talk.

262
00:23:51,610 --> 00:23:58,550
So yeah, definitely stay, stay with your ear to the ground and keep looking for what's going to be the next thing.

263
00:23:58,550 --> 00:24:05,750
And who knows, you know, I was, I was at DEF CON, I think it was like 23 was my first DEF CON and watching speakers talk.

264
00:24:05,750 --> 00:24:06,950
And I thought that, man, that's crazy.

265
00:24:06,950 --> 00:24:08,810
These guys are, you know, next level.

266
00:24:08,810 --> 00:24:15,210
And then you keep working at it for a couple of years and you find your little niche, you know, you don't have to, you don't have to understand everything.

267
00:24:15,210 --> 00:24:17,710
Just expand the universe a little bit.

268
00:24:17,710 --> 00:24:19,510
And here you are.

269
00:24:19,510 --> 00:24:26,970
So, so speaking to that, let's say I'm, this is my first DEF CON, you know, I, for whatever reason, I couldn't afford it or couldn't go.

270
00:24:26,970 --> 00:24:30,970
And now, hey, I find myself quarantined at home and I'm watching you.

271
00:24:31,630 --> 00:24:39,890
And I'm, and this is something I find interesting and is, I know you posted your contact information on the end of your presentation.

272
00:24:39,950 --> 00:24:55,890
Is it okay for people to call you and, or maybe not call you, but, you know, get ahold of you, ping you and say, you know, hey, I got this idea or can you explain something or is there any place they can go to find more basic information, you know, a little more of the one-on-one?

273
00:24:56,110 --> 00:25:00,930
Is there any, do you know of any known or, you know, common sites we can push them to?

274
00:25:01,430 --> 00:25:02,270
Yeah, sure.

275
00:25:02,270 --> 00:25:10,270
I mean, you're always available to hit me up at Bad Sector Labs is my personal Twitter handle and 6gen.io if you need commercial support.

276
00:25:10,570 --> 00:25:20,010
But for basic stuff, I would, I would look at the kind of the introduction CTF, intro level CTFs, like over the wire is really great.

277
00:25:20,570 --> 00:25:30,090
And those, those will kind of walk you through kind of the basics of how do you get into this mindset of, you know, there's something that's supposed to work a certain way.

278
00:25:30,090 --> 00:25:31,870
How can I get it to work a different way?

279
00:25:31,870 --> 00:25:35,350
Or how can I do things to it that the author didn't intend?

280
00:25:35,450 --> 00:25:45,870
And that kind of mindset is just, if you apply that to everything that you see that comes out with cybersecurity and even just the latest technologies, yeah, I think you'll go far.

281
00:25:45,870 --> 00:25:51,690
And honestly, reading the RFCs, as boring as it is, you know, that's, that's where a lot of gold is.

282
00:25:51,690 --> 00:25:55,910
So stay up to date on the latest RFCs, dig in, look at implementations.

283
00:25:55,910 --> 00:25:57,570
Are people doing it correctly?

284
00:25:57,570 --> 00:25:58,650
Probably not.

285
00:25:58,650 --> 00:26:00,390
Break their implementations.

286
00:26:00,390 --> 00:26:01,730
And there you go.

287
00:26:01,730 --> 00:26:06,010
Yeah, I think the RFCs is a key piece, because it may be not a new feature.

288
00:26:06,010 --> 00:26:08,330
It may be an old feature that people forgot.

289
00:26:08,630 --> 00:26:14,610
And nobody's looked, you know, under the covers to know, hey, look at this feature, I can use this.

290
00:26:14,890 --> 00:26:16,690
You also mentioned WireGuard.

291
00:26:17,670 --> 00:26:22,290
I think that's another, you know, cool project that's come about the last few years.

292
00:26:23,030 --> 00:26:24,430
Can you speak to that?

293
00:26:24,430 --> 00:26:26,910
You're using that in this kind of attack?

294
00:26:27,950 --> 00:26:30,910
Yeah, I didn't, I didn't test it out with this tool.

295
00:26:30,910 --> 00:26:32,870
But I love WireGuard.

296
00:26:32,870 --> 00:26:40,470
And I think it's going to be the future of VPN, super fast, super easy to set up small code base auditable props to the author on that.

297
00:26:40,470 --> 00:26:41,810
That's, that's an amazing tool.

298
00:26:41,810 --> 00:26:50,050
But yeah, if you can tunnel UDP traffic, then you can probably put WireGuard behind this kind of fronting or hiding.

299
00:26:50,050 --> 00:26:56,890
And therefore, the sky's the limit, you know, once once you get out to the open internet, and then you can run your VPN through there.

300
00:26:57,610 --> 00:27:01,450
Censorship is kind of, they're playing catch up for sure.

301
00:27:02,050 --> 00:27:20,450
Yeah, I mean, to me, this is, you know, from a hacker's perspective, I think a good application of this would be tunneling out through a censored network and getting access to Netflix so I could watch, you know, the latest, the latest, whatever hot lava show or whatever.

302
00:27:20,450 --> 00:27:34,790
And that's one of the last questions here is, so we'd mentioned if, I think we've talked about this a little bit, but they're asking what if government made the demanded that domain fronting illegal?

303
00:27:36,130 --> 00:27:37,970
What would break?

304
00:27:37,970 --> 00:27:46,750
I guess, you know, obviously making it illegal is one thing and then you have to have the capability of stopping it because you can say it's illegal.

305
00:27:46,750 --> 00:27:51,370
If people continue to do it, you know, but I'll let you speak to it.

306
00:27:51,470 --> 00:27:59,790
Yeah, I think I think we saw this happen in 2018 when the Russian government turned the screws on on AWS and Google and they they eventually capitulated.

307
00:27:59,790 --> 00:28:15,570
So it's a possibility that, you know, enough governments with enough power, turn the screws on Cloudflare that they say it's not worth fighting this and we're gonna, you know, succumb to the demands and they're not a government so they can't really fight that fight.

308
00:28:15,570 --> 00:28:23,390
But I think that they're going to try their hardest to to maintain the ability for any of their IP range to go to any of their domains.

309
00:28:23,390 --> 00:28:26,970
I think it's it's one of their business advantages, honestly.

310
00:28:26,970 --> 00:28:33,150
So turning that off might be detrimental to even just the basic operating of Cloudflare.

311
00:28:33,270 --> 00:28:36,690
So while it's possible, I think they're going to fight it as hard as they can.

312
00:28:36,690 --> 00:28:42,210
But if the government makes you do it, I mean, we've seen it time and time again.

313
00:28:42,210 --> 00:28:45,910
Eventually, I think these companies will succumb to what the government forces.

314
00:28:45,910 --> 00:28:52,510
This isn't like a Bitcoin or a magic blockchain solution to anything where, you know, it's going to survive no matter what happens.

315
00:28:52,510 --> 00:28:54,490
But we'll see.

316
00:28:54,490 --> 00:28:55,890
Yeah, yeah.

317
00:28:55,890 --> 00:28:57,850
And things continue to evolve.

318
00:28:57,850 --> 00:29:02,890
So yeah, we're, they might, this might get fixed by the industry.

319
00:29:02,890 --> 00:29:06,370
And then a new technique comes up, you know, so.

320
00:29:06,430 --> 00:29:08,850
So we're about out of time.

321
00:29:09,290 --> 00:29:12,010
Thank you for speaking here at DEF CON.

322
00:29:12,010 --> 00:29:14,250
And it was a great talk.

323
00:29:14,250 --> 00:29:16,850
And I appreciate all the questions you had.

324
00:29:17,310 --> 00:29:18,390
Yeah, thanks, guys.

325
00:29:18,390 --> 00:29:20,810
And thanks to all the goons who made this possible.

326
00:29:20,810 --> 00:29:26,490
I think a lot of people tuning in don't realize that it was a major effort to get everything coordinated and work.

327
00:29:26,490 --> 00:29:27,790
So thanks to you guys.

328
00:29:28,070 --> 00:29:29,230
Thank you.

329
00:29:30,830 --> 00:29:31,750
All right.