Hello, welcome to the Wednesday, May 2nd, 2019 edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

Usually when Xavier talks about malicious documents, he talks about analyzing these documents.

Well, he's taking a different spin in his last diary. In this case, he came across

a little Python script that will actually create malicious documents. All he had to do is search

pastebin, so no dark web involved in this particular exploit. So the lessons learned here,

first of all, probably not all that surprising. It's pretty easy to find these exploit generators for different office vulnerabilities.

Secondly, it can actually be quite useful to take a look at one of these generators in a controlled

environment in order to figure out how these exploits work and also take a look at one of these generators in a controlled environment in order to figure out

how these exploits work and also test your detection techniques.

And looks like domain fronting will be more difficult after Google and also Amazon did disable

domain fronting for their cloud infrastructures. So let me talk a little bit about domain fronting for their cloud infrastructures.

So let me talk a little bit about domain fronting because it has come up a few times over the last few months.

It's really a technique to obfuscate traffic.

To understand domain fronting, let me first talk a little bit about HTTP. If you're setting up an

HTTP connection to a web server, the connection itself is encrypted, but it's still possible

for an observer to see what side you connect to. First of all, you have to do a DNS lookup.

The DNS lookup is in the clear and can easily be intercepted.

Secondly, as part of the client hello message that you sent at the beginning of the

HTTP handshake, you are transmitting the host name in the clear. That's a feature called

server name indication. Now once you do have a TLS connection established, then you send the actual HTTP request

and that is of course encrypted.

...