Administr\u00e1tor Jabber serveru jabber.ru (xmpp.ru) odhalil \u00fatok na de\u0161ifrov\u00e1n\u00ed u\u017eivatelsk\u00e9ho provozu (MITM), kter\u00fd prob\u00edh\u00e1 od 90 dn\u00ed do 6 m\u011bs\u00edc\u016f v s\u00edt\u00edch n\u011bmeck\u00fdch hostingov\u00fdch provider\u016f Hetzner a Linode, kde je um\u00edst\u011bn server projektu a pomocn\u00e1 VPS prost\u0159ed\u00ed. \u00datok byl proveden prost\u0159ednictv\u00edm p\u0159esm\u011brov\u00e1n\u00ed provozu na tranzitn\u00ed uzel, kter\u00fd substituoval TLS certifik\u00e1t pro XMPP spojen\u00ed, \u0161ifrovan\u00e9 s vyu\u017eit\u00edm roz\u0161\u00ed\u0159en\u00ed STARTTLS. <\/p>\n
\u00datok byl zaznamen\u00e1n d\u00edky chyb\u011b jeho organiz\u00e1tor\u016f, kte\u0159\u00ed nestihli prodlou\u017eit TLS certifik\u00e1t vyu\u017e\u00edvan\u00fd pro podvr\u017een\u00ed. Dne 16. \u0159\u00edjna administr\u00e1tor jabber.ru p\u0159i pokusu o p\u0159ipojen\u00ed k slu\u017eb\u011b obdr\u017eel chybov\u00e9 hl\u00e1\u0161en\u00ed kv\u016fli vypr\u0161en\u00ed platnosti certifik\u00e1tu, av\u0161ak certifik\u00e1t um\u00edst\u011bn\u00fd na serveru nebyl propadl\u00fd. Nakonec se uk\u00e1zalo, \u017ee certifik\u00e1t p\u0159ij\u00edman\u00fd klientem se li\u0161\u00ed od certifik\u00e1tu odes\u00edlan\u00e9ho serverem. Prvn\u00ed pad\u011blan\u00fd TLS certifik\u00e1t<\/a> byl z\u00edsk\u00e1n 18. dubna 2023 prost\u0159ednictv\u00edm slu\u017eby Let's Encrypt, ve kter\u00e9 \u00fato\u010dn\u00edk, maj\u00edc\u00ed mo\u017enost odchyt\u00e1vat provoz, dok\u00e1zal potvrdit p\u0159\u00edstup na weby jabber.ru a xmpp.ru. <\/p>\n P\u016fvodn\u011b se objevila domn\u011bnka o kompromitaci serveru projektu a proveden\u00ed podvodu z jeho strany. Av\u0161ak proveden\u00fd audit nenalezl \u017e\u00e1dn\u00e9 stopy po hacku. V logu na serveru bylo zaznamen\u00e1no kr\u00e1tkodob\u00e9 vypnut\u00ed a zapnut\u00ed s\u00ed\u0165ov\u00e9ho rozhran\u00ed (NIC Link is Down\/NIC Link is Up), kter\u00e9 bylo provedeno 18. \u010dervence v 12:58 a mohlo nazna\u010dovat manipulaci s p\u0159ipojen\u00edm serveru ke switchi. Zaj\u00edmav\u00e9 je, \u017ee dva fale\u0161n\u00e9 TLS certifik\u00e1ty byly vygenerov\u00e1ny n\u011bkolik minut p\u0159ed t\u00edm \u2014 18. \u010dervence v 12:49 a 12:38. <\/p>\n Krom\u011b toho doch\u00e1zelo k podvrh\u016fm nejen v s\u00edti poskytovatele Hetzner, kde je um\u00edst\u011bn hlavn\u00ed server, ale tak\u00e9 v s\u00edti poskytovatele Linode, kde byly um\u00edst\u011bny VPS prost\u0159ed\u00ed s pomocn\u00fdmi proxy, kter\u00e9 p\u0159esm\u011brov\u00e1valy provoz z jin\u00fdch adres. Nep\u0159\u00edm\u00fdmi cestami bylo zji\u0161t\u011bno, \u017ee provoz na s\u00ed\u0165ov\u00fd port 5222 (XMPP STARTTLS) je v s\u00edt\u00edch obou poskytovatel\u016f p\u0159esm\u011brov\u00e1n p\u0159es dodate\u010dn\u00fd hostitel, co\u017e d\u00e1v\u00e1 d\u016fvod domn\u00edvat se, \u017ee \u00fatok byl proveden osobou s p\u0159\u00edstupem k infrastruktu\u0159e poskytovatel\u016f. <\/p>\n Teoreticky mohla v\u00fdm\u011bna prob\u00edhat od 18. dubna (datum vytvo\u0159en\u00ed prvn\u00edho fale\u0161n\u00e9ho certifik\u00e1tu pro jabber.ru), ale potvrzen\u00e9 p\u0159\u00edpady v\u00fdm\u011bny certifik\u00e1tu byly zaznamen\u00e1ny pouze od 21. \u010dervence do 19. \u0159\u00edjna, po celou tuto dobu lze \u0161ifrovanou v\u00fdm\u011bnu dat s jabber.ru a xmpp.ru pova\u017eovat za kompromitovanou. V\u00fdm\u011bna skon\u010dila po zah\u00e1jen\u00ed vy\u0161et\u0159ov\u00e1n\u00ed, proveden\u00ed test\u016f a zasl\u00e1n\u00ed 18. \u0159\u00edjna \u017e\u00e1dosti do z\u00e1kaznick\u00e9ho servisu poskytovatel\u016f Hetzner a Linode. P\u0159itom se st\u00e1le pozoruje dodate\u010dn\u00fd p\u0159echod p\u0159i sm\u011brov\u00e1n\u00ed paket\u016f pos\u00edlan\u00fdch na port 5222 jednoho z servery<\/a> v Linode, ale certifik\u00e1t ji\u017e nen\u00ed nahrazov\u00e1n. <\/p>\n P\u0159edpokl\u00e1d\u00e1 se, \u017ee \u00fatok mohl b\u00fdt proveden se souhlasem poskytovatel\u016f na \u017e\u00e1dost org\u00e1n\u016f \u010dinn\u00fdch v trestn\u00edm \u0159\u00edzen\u00ed, v d\u016fsledku hacknut\u00ed infrastruktury obou poskytovatel\u016f nebo zam\u011bstnancem, kter\u00fd m\u011bl p\u0159\u00edstup k ob\u011bma poskytovatel\u016fm. M\u00edt mo\u017enost odchyt\u00e1vat a modifikovat XMPP provoz, \u00fato\u010dn\u00edk mohl z\u00edskat p\u0159\u00edstup ke v\u0161em souvisej\u00edc\u00edm \u00fadaj\u016fm o \u00fa\u010dtech, jako je historie zpr\u00e1v ulo\u017een\u00e1 na serveru, a tak\u00e9 mohl pos\u00edlat zpr\u00e1vy pod ciz\u00edm jm\u00e9nem a prov\u00e1d\u011bt zm\u011bny v ciz\u00edch zpr\u00e1v\u00e1ch. Zpr\u00e1vy odeslan\u00e9 pomoc\u00ed koncov\u00e9ho \u0161ifrov\u00e1n\u00ed (OMEMO, OTR nebo PGP) lze pova\u017eovat za nekompromitovan\u00e9, pokud jsou \u0161ifrovac\u00ed kl\u00ed\u010de potvrzeny u\u017eivateli na obou stran\u00e1ch spojen\u00ed. U\u017eivatel\u016fm jabber.ru se doporu\u010duje zm\u011bnit p\u0159\u00edstupov\u00e1 hesla a zkontrolovat kl\u00ed\u010de OMEMO a PGP ve sv\u00fdch PEP \u00falo\u017ei\u0161t\u00edch na mo\u017en\u00e9 v\u00fdm\u011bny. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zaznamen\u00e1n odposlech \u0161ifrovan\u00e9ho provozu jabber.ru a xmpp.ru | ProHoster","description":"Administr\u00e1tor Jabber serveru jabber.ru (xmpp.ru) odhalil \u00fatok na de\u0161ifrov\u00e1n\u00ed provozu u\u017eivatel\u016f (MITM), prov\u00e1d\u011bn\u00fd po dobu od 90 dn\u00ed do 6 m\u011bs\u00edc\u016f v s\u00edt\u00edch n\u011bmeck\u00fdch hostingov\u00fdch poskytovatel\u016f Hetzner a Linode, v.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"