Underminr domain-fronting attack masks activity through trusted websites
A new content delivery exploit called Underminr allows threat actors to modify web requests and use trusted websites to mask malicious activities. This domain-fronting attack can lead to brand hijacking by leveraging existing content delivery infrastructure. The article describes the technical mechanism of this exploit.
Key Takeaways
- Underminr is a domain-fronting attack that modifies Web requests.
- The exploit uses trusted websites to cloak malicious activity.
- Brand hijacking can ride on existing content delivery infrastructure.
Why It Matters
Underminr shows that content delivery infrastructure can be used to hide malicious Web traffic inside trusted domains, raising the risk of brand hijacking for websites that rely on shared delivery paths. For the streaming ecosystem, the key issue is not new content delivery capacity but abuse of the infrastructure already in place. The specific signal to watch is how the Underminr technique is described in follow-up technical guidance, especially any details on request modification and domain-fronting behavior.
Read full article at darkreading.com