{"id":111010,"date":"2023-10-20T21:10:22","date_gmt":"2023-10-20T19:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru"},"modified":"2023-10-20T21:10:22","modified_gmt":"2023-10-20T19:10:22","slug":"zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","title":{"rendered":"Fanget krypteret trafik fra jabber.ru og xmpp.ru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Administrator of the Jabber server jabber.ru (xmpp.ru) discovered an attack involving the decryption of user traffic (MITM), carried out over a period of 90 days to 6 months in the networks of the German hosting providers Hetzner and Linode, where the project's server and auxiliary VPS environments are located. The attack was organized through traffic redirection to a transit node, which substituted the TLS certificate for XMPP connections encrypted using the STARTTLS extension. <\/p>\n

The attack was noticed due to an error by its organizers, who failed to renew the TLS certificate used for spoofing. On October 16, the administrator of jabber.ru received an error message while trying to connect to the service due to the expiration of the certificate, but the certificate installed on the server was not expired. It turned out that the certificate received by the client differed from the certificate sent by the server. The first fake certificate TLS-certifikat<\/a> blev modtaget den 18. april 2023 via tjenesten Let’s Encrypt, hvor angriberen, med mulighed for at opsnappe trafik, kunne bekr\u00e6fte adgangen til hjemmesiderne jabber.ru og xmpp.ru. <\/p>\n

I f\u00f8rste omgang opstod der en mistanke om kompromittering af projektserveren og udf\u00f8relse af \u00e6ndringer p\u00e5 den side. Men den gennemf\u00f8rte revision afsl\u00f8rede ingen spor af hacking. I loggen p\u00e5 serveren blev der bem\u00e6rket en kortvarig afbrydelse og genstart af netv\u00e6rksinterface (NIC Link is Down\/NIC Link is Up), som fandt sted den 18. juli kl. 12:58 og kunne tyde p\u00e5 manipulation med serverens forbindelse til switchen. Bem\u00e6rkelsesv\u00e6rdigt er det, at to falske TLS-certifikater blev genereret f\u00e5 minutter f\u00f8r dette \u2014 den 18. juli kl. 12:49 og 12:38. <\/p>\n

Moreover, the substitution was carried out not only in the Hetzner provider's network, where the main server is located, but also in the Linode provider's network, where VPS environments with auxiliary proxies redirecting traffic from other addresses were hosted. Indirectly, it was discovered that traffic on port 5222 (XMPP STARTTLS) in both providers' networks is redirected through an additional host, which provided grounds to believe that the attack was conducted by someone with access to the providers' infrastructure. <\/p>\n

Teoretisk set kunne udskiftningen v\u00e6re sket fra den 18. april (datoen for oprettelsen af det f\u00f8rste falske certifikat for jabber.ru), men bekr\u00e6ftede tilf\u00e6lde af certifikatudskiftning er kun registreret fra den 21. juli til den 19. oktober, i hele denne periode kan den krypterede dataudveksling med jabber.ru og xmpp.ru betragtes som kompromitteret. Udskiftningen stoppede efter begyndelsen af efterforskningen, udf\u00f8relsen af tests og indsendelsen af en henvendelse til supporttjenesten hos udbyderne Hetzner og Linode den 18. oktober. P\u00e5 samme tid observeres der en ekstra omdirigering ved routingen af pakker, der sendes til port 5222 af en af servere<\/a> i Linode, men certifikatet udskiftes nu ikke l\u00e6ngere. <\/p>\n

Det antages, at angrebet kan v\u00e6re udf\u00f8rt med udbydernes vidende efter anmodning fra retsh\u00e5ndh\u00e6vende myndigheder, som et resultat af et brud p\u00e5 infrastrukturen hos begge udbydere eller af en medarbejder, der havde adgang til begge udbydere. Med mulighed for at opsnappe og modificere XMPP-trafik kunne angriberen f\u00e5 adgang til alle relaterede kontodata, s\u00e5som den gemte beskedhistorik p\u00e5 serveren, og kunne ogs\u00e5 sende beskeder p\u00e5 en andens vegne samt foretage \u00e6ndringer i andres beskeder. Beskeder sendt med brug af ende-til-ende kryptering (OMEMO, OTR eller PGP) kan betragtes som ikke kompromitterede, hvis krypteringsn\u00f8glerne er bekr\u00e6ftet af brugerne p\u00e5 begge sider af forbindelsen. Brugere af jabber.ru anbefales at \u00e6ndre adgangskoder og kontrollere OMEMO og PGP n\u00f8gler i deres PEP-lager for mulig udskiftning.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Der er registreret opsnapning af krypteret trafik fra jabber.ru og xmpp.ru | ProHoster","description":"Administrator for Jabber-serveren jabber.ru (xmpp.ru) har identificeret et angreb med dekryptering af brugernes trafik (MITM), der har fundet sted i en periode p\u00e5 90 dage til 6 m\u00e5neder i netv\u00e6rkene hos de tyske hosting-udbydere Hetzner og Linode.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}