Jabber-serveri admin jabber.ru (xmpp.ru) tuvastas r\u00fcnnaku, mis p\u00fc\u00fcab kasutajate liiklust dekodeerida (MITM), mis kestis alates 90 p\u00e4evast kuni 6 kuuni Saksamaa hostiteenuse pakkujate Hetzner ja Linode v\u00f5rkudes, kus on majutatud projekti server ja abiv \u0441\u0435\u0440\u0432\u0435\u0440\u044b VPS-\u00fcmbrikud. R\u00fcnnak korraldati liikluse suunamise kaudu transiitpunkti, mis asendab TLS-sertifikaadi XMPP-\u00fchendustes, mida kr\u00fcpteeritakse STARTTLS laienduse kasutamisega. <\/p>\n
R\u00fcnnak avastati korraldaja vea t\u00f5ttu, kes ei j\u00f5udnud pikendada TLS-sertifikaati, mida kasutati asendamiseks. 16. oktoobril sai admin jabber.ru teenusele \u00fchenduse loomise katsel veateate sertifikaadi kehtivusaja l\u00f5pu t\u00f5ttu, kuid serveris olev sertifikaat ei olnud aegunud. L\u00f5ppkokkuv\u00f5ttes selgus, et kliendile \u00f6eldud sertifikaat erineb serveri poolt saadetavast sertifikaadist. Esimene vale TLS-sertifikaat<\/a> oli saadud 18. aprillil 2023 Let's Encrypti teenuse kaudu, kus r\u00fcndajal oli v\u00f5imalus liiklust pealt kuulata ja ta suutis kinnitada juurdep\u00e4\u00e4su saitidele jabber.ru ja xmpp.ru. <\/p>\n Alguses tekkis kahtlus projekti serveri kompromiteerimise ja selle poole pealt asendamise osas. Kuid l\u00e4bi viidud audit ei n\u00e4idanud mingeid murdumise j\u00e4lgi. Samuti m\u00e4rgiti serveri logis l\u00fchiajaline v\u00f5rguliidese (NIC Link is Down \/ NIC Link is Up) v\u00e4ljal\u00fclitamine ja sisset\u00f5mbamine, mis toimus 18. juulil kell 12:58 ning see v\u00f5is viidata manipuleerimisele serveri ja l\u00fcliti vahelise \u00fchenduse osas. Huvi pakub, et kaks vale TLS-sertifikaati genereeriti minutite jooksul enne seda \u2014 18. juulil kell 12:49 ja 12:38. <\/p>\n Lisaks toimus asendamine mitte ainult Hetzneri teenuse pakkuja v\u00f5rgus, kus asub peamine server, vaid ka Linode teenuse pakkuja v\u00f5rgus, kus olid VPS-\u00fcmbrikud abiproksid, mis suunasid liiklust teistelt aadressidelt. Kaudselt selgus, et liiklus 5222 v\u00f5rguporti (XMPP STARTTLS) m\u00f5lema teenuse pakkuja v\u00f5rkudes suunatakse l\u00e4bi lisahostitaja, mis andis alust arvata, et r\u00fcnnaku on teinud isik, kellel on juurdep\u00e4\u00e4s teenuse pakkujate infrastruktuurile. <\/p>\n Teoreetiliselt v\u00f5is sertifikaadi vale esitlemine alata 18. aprillil (esimese vale sertifikaadi loomise kuup\u00e4ev jabber.ru jaoks), kuid kinnitatud sertifikaadi vale esitlemise juhtumeid on registreeritud ainult 21. juulist kuni 19. oktoobrini; kogu selle aja jooksul v\u00f5ib jabber.ru ja xmpp.ru kr\u00fcpteeritud andmevahetust pidada kompromiteerituks. Vale esitlemine l\u00f5ppes p\u00e4rast uurimise algust, testide l\u00e4biviimist ja 18. oktoobril Hetzneri ja Linode'i teenusepakkujate tugiteenusele p\u00f6\u00f6rdumist. Samal ajal t\u00e4iendav marsruutimine pakettide suunamisel, mis saadetakse \u00fchel 5222 porti, serverid<\/a> Linodes, on endiselt v\u00e4ljas, kuid sertifikaati enam ei vale esitatata. <\/p>\n Eeldatakse, et r\u00fcnnak v\u00f5idi teostada teenusepakkujate n\u00f5usolekul \u00f5iguskaitseorganite n\u00f5udmisel, kahe teenusepakkuja infrastruktuuri h\u00e4kkimise tagaj\u00e4rjel v\u00f5i t\u00f6\u00f6taja poolt, kellel oli ligip\u00e4\u00e4s m\u00f5lema teenusepakkuja s\u00fcsteemidele. Kui r\u00fcndajal oli v\u00f5imalus XMPP liiklust pealt kuulata ja modifitseerida, v\u00f5is ta saada ligip\u00e4\u00e4su k\u00f5igile kontodele seotud andmetele, sealhulgas serveris hoitavale s\u00f5numite ajaloole, samuti saata s\u00f5numeid v\u00f5\u00f5raste nimede alt ja muuta teiste s\u00f5numeid. S\u00f5numid, mis on saadetud l\u00f5pp-punktide vaheliste kr\u00fcpteerimismeetoditega (OMEMO, OTR v\u00f5i PGP), v\u00f5ivad olla tervetena, kui kr\u00fcpteerimise v\u00f5tmed kinnitatakse m\u00f5lema osapoole kasutajate poolt \u00fchenduse peal. Jabber.ru kasutajatele soovitatakse vahetada juurdep\u00e4\u00e4suparoolid ning kontrollida OMEMO ja PGP v\u00f5tmeid oma PEP-hoidlas v\u00f5imalike valeesituste osas. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jabber.ru ja xmpp.ru kr\u00fcpteeritud liikluse pealtkuulamine on fikseeritud | ProHoster","description":"Jabber-serveri jabber.ru (xmpp.ru) administraator avastas kasutajate liikluse dekodeerimise r\u00fcnnaku (MITM), mida viidi l\u00e4bi 90 p\u00e4eva kuni 6 kuu jooksul Saksamaa veebimajutuse teenusepakkujate Hetzner ja Linode v\u00f5rkudes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"