Administrator of the Jabber server jabber.ru (xmpp.ru) discovered an attack involving the decryption of user traffic (MITM), carried out over a period of 90 days to 6 months in the networks of the German hosting providers Hetzner and Linode, where the project's server and auxiliary VPS environments are located. The attack was organized through traffic redirection to a transit node, which substituted the TLS certificate for XMPP connections encrypted using the STARTTLS extension.
The attack was noticed due to an error by its organizers, who failed to renew the TLS certificate used for spoofing. On October 16, the administrator of jabber.ru received an error message while trying to connect to the service due to the expiration of the certificate, but the certificate installed on the server was not expired. It turned out that the certificate received by the client differed from the certificate sent by the server. The first fake certificate TLS-certifikat was obtained on April 18, 2023, through the Let’s Encrypt service, where the attacker, having the capability to intercept traffic, was able to confirm access to the websites jabber.ru and xmpp.ru.
Initially, there was a suspicion of server compromise and that the substitution occurred on its side. However, the conducted audit found no traces of hacking. At the same time, the server log noted a brief shutdown and restart of the network interface (NIC Link is Down/NIC Link is Up), which occurred on July 18 at 12:58 and could indicate manipulation with the server's connection to the switch. Notably, two fake TLS certificates were generated just minutes before this — on July 18 at 12:49 and 12:38.
Moreover, the substitution was carried out not only in the Hetzner provider's network, where the main server is located, but also in the Linode provider's network, where VPS environments with auxiliary proxies redirecting traffic from other addresses were hosted. Indirectly, it was discovered that traffic on port 5222 (XMPP STARTTLS) in both providers' networks is redirected through an additional host, which provided grounds to believe that the attack was conducted by someone with access to the providers' infrastructure.
Teoretisk set kunne udskiftningen være sket fra den 18. april (datoen for oprettelsen af det første falske certifikat for jabber.ru), men bekræftede tilfælde af certifikatudskiftning er kun registreret fra den 21. juli til den 19. oktober, i hele denne periode kan den krypterede dataudveksling med jabber.ru og xmpp.ru betragtes som kompromitteret. Udskiftningen stoppede efter begyndelsen af efterforskningen, udførelsen af tests og indsendelsen af en henvendelse til supporttjenesten hos udbyderne Hetzner og Linode den 18. oktober. På samme tid observeres der en ekstra omdirigering ved routingen af pakker, der sendes til port 5222 af en af servere i Linode, men certifikatet udskiftes nu ikke længere.
Det antages, at angrebet kan være udført med udbydernes vidende efter anmodning fra retshåndhævende myndigheder, som et resultat af et brud på infrastrukturen hos begge udbydere eller af en medarbejder, der havde adgang til begge udbydere. Med mulighed for at opsnappe og modificere XMPP-trafik kunne angriberen få adgang til alle relaterede kontodata, såsom den gemte beskedhistorik på serveren, og kunne også sende beskeder på en andens vegne samt foretage ændringer i andres beskeder. Beskeder sendt med brug af ende-til-ende kryptering (OMEMO, OTR eller PGP) kan betragtes som ikke kompromitterede, hvis krypteringsnøglerne er bekræftet af brugerne på begge sider af forbindelsen. Brugere af jabber.ru anbefales at ændre adgangskoder og kontrollere OMEMO og PGP nøgler i deres PEP-lager for mulig udskiftning.
Kilde: opennet.ru
