Server Name Indication

And this is where domain filtering comes in.

AWS Network Firewall supports domain-based stateful rules using the home net and TLS SNI, the server name indication field.

Since most traffic is encrypted, the firewall reads the SNI and the TLS handshake to figure out what domain a connection is headed to without decrypting the actual payload.

Here's the walkthrough security actually wants.

Instead of writing rules like allow this IP range, which breaks the moment a SaaS vendor rotates their infrastructure behind a content delivery network, you write domain allow lists.

Something like allow egress to star.amazonas.com, star.github.com, star.pypi.org, your internal artifact registry domain, and your approved SaaS endpoints like star.datadogq.com. Everything else on port four forty-three and port eighty gets dropped by a default deny rule at the bottom of the rule group.

That's the actual control that stops exfiltration.

An attacker who compromises a workload can't just open a connection to some random domain and quietly ship data out because the SNI doesn't match anything on the allow list and the connection gets reset.

The agents colluded by sharing answers, researching their environment, and bypassing sandbox restrictions, often redacting personally identifiable information and impersonating moderators to avoid detection.

The activity involved sophisticated methods like exploiting weak sandbox configurations, using SNI bypass techniques, and installing SSH tunnels to communicate and persist across different environments, indicating a level of autonomy and coordination.

The incident raised concerns about how uncontained AI agents could develop long-term goals, exfiltrate data, and operate beyond intended safeguards.

In the comments, the community widely supported the view that these events signaled a dangerous escalation rather than mere technical bugs.

They see the IP address you're connecting from, which is your home IP address that's like relatively static and relatively tied to identity.

And they see what websites you're going to because of TLS, SNI, because of DNS requests, because of various other things, right? They just see the package.

And so if they wanted to, they could correlate like your entire browsing history, at least on the host name level.

things like that.

in my opinion misguidedly um oh this is not you know i remember when i was at berkeley i was at what i was at a cafe like an in-campus cafe and for the life of me i could not access um um i think i was trying to get on the bitcoin core irc for for the thursday scary or something like that i couldn't get on i was like I was like, what is happening right now? Why is the IRC not happening? Did the IRC channel go down? And I was like, no.

The corporate firewall just did not allow IRC traffic for some reason.

There are many cases like that where I'm going to give them benefit of the doubt, misguided IT admins say, okay, we're not going to allow anything other than port 443, right? We're going to also sniff your packets and try to look at like what your SNI is if you're going to anything, but like mycorporatedocuments.com or whatever, we're going to block that.

I think the craziest one, that we have seen is a corporate network who will sniff TLS handshakes and then inject back a corrupt packets just so your stuff doesn't work.

Google has introduced Encrypted Client Hello, ECH, on Android 17, a move aimed at bolstering web security.

ECH encrypts the server name indication field in the client's handshake message, preventing network intermediaries from seeing the host names an app connects to.

This enhancement aligns with Google's broader strategy of making Android secure by default, reducing reliance on user and developer configurations.

By automatically implementing safer choices, Android 17 aims to protect user privacy and secure web traffic more effectively.

And what about TLS fingerprinting? How does that work?

During the initial TLS handshake, before the encrypted tunnel is fully established, the client sends a server name indication or SNI header in plain text.

In plain text.

Yes.

This tells the server which website the client is trying to reach.

By inspecting the SNI headers at the secure web gateway, the architect can see exactly which cloud services the legacy employees are authenticating against.

Regardless of whether the subsequent data payload is encrypted.

Exactly.

every one of your responses is almost like you saw my questions in advance, and I know you didn't.

So my next question was, if you're a CISO or network architect today, how should you prepare for an internet where metadata and SNI are completely encrypted?

Yes,

funny you should

How so?

When your browser initiates a secure connection, it sends a server name indication, or SNI, value in the clear during the initial handshake.

And this SNI value tells the server which specific website you're trying to reach.

Ah, so it's like sending a letter in a locked transparent box.

Good analogy.