Cleartext HTTP/2 at Black Hat Asia: what threat hunters should notice

TL;DR: A Black Hat Asia NOC hunt found cleartext HTTP/2 requests to an authentication endpoint over port 443, exposing cookies and other headers, and later confirmed 71 instances on 16 clients, according to Corelight. The pattern shows why downgrade paths and failed-open client logic create hidden exposure in otherwise normal-looking traffic.

Editorial analysis by NHI Mgmt Group, based on content published by Corelight: “Precarious exposure of cookies when QUIC rage quits”.

Key questions

Q: What breaks when authentication traffic falls back to cleartext on a trusted port?

A: The security model breaks because operators and tools often assume the port implies encryption, while the application may still transmit cookies, headers, or tokens in readable form.

Q: Why does rare protocol usage matter in threat hunting?

A: Rare protocols often reveal paths that normal baselines ignore, especially when they appear in combinations that should not exist together.

Q: How should teams verify that secure transport failures are handled safely?

A: Test the full client-to-service path under failure conditions and confirm that the application terminates rather than downgrades the session.

Practitioner guidance

• Review authentication flows for failed-open transport paths Trace every auth endpoint and client SDK path that can downgrade from encrypted to cleartext behaviour, then verify that the request is terminated when transport security is unavailable.
• Search for secrets in application-layer headers Inspect request headers, cookies, and query parameters on uncommon protocol paths so that session material is not assumed safe just because the connection uses a familiar port.
• Pivot rare events into population-level hunts Use DNS, connection, and service logs to determine whether a single odd request is isolated or part of a broader pattern across multiple clients and addresses.

Bottom line: The article shows a hidden failure mode where authentication traffic continued in cleartext and exposed session material that defenders would normally assume was protected.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →