Domain Borrowing - Catch My C2 Traffic if You Can

Domain Borrowing - Catch My C2 Traffic if You Can

Explore a new method for concealing Command and Control (C2) traffic using Content Delivery Networks (CDNs) in this 35-minute Black Hat conference talk. Learn about the limitations of domain fronting and domain hiding techniques, and discover how to circumvent censorship by leveraging CDN workflows. Delve into the concept of Domain Borrowing, including abandoning DNS, abusing CDN domain validation, and obtaining valid HTTPS certificates. Compare Domain Borrowing to other techniques, discuss detection methods and mitigation strategies, and understand how to bypass Palo Alto Firewalls. Gain insights from speakers Tianze Ding and Junyu Zhou on advanced red team tactics for protecting C2 infrastructure.