{"id":111010,"date":"2023-10-20T21:10:22","date_gmt":"2023-10-20T19:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru"},"modified":"2023-10-20T21:10:22","modified_gmt":"2023-10-20T19:10:22","slug":"zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","title":{"rendered":"Jabber.ru ja xmpp.ru kr\u00fcpteeritud liiklus on pealtkuulatud","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jabber-serveri administraator jabber.ru (xmpp.ru) tuvastas kasutajate liikluse dekodeerimise (MITM) r\u00fcnnaku, mida viidi l\u00e4bi 90 p\u00e4evast kuni 6 kuuni Saksamaa hostiteenuse pakkujate Hetzner ja Linode v\u00f5rkudes, kus asub projekti server ja abivahendid VPS-keskkonnad. R\u00fcnnak korraldati liikluse suunamise kaudu transiitt\u00f5lke p\u00f5lvele, mis asendas TLS-sertifikaadi XMPP-\u00fchendusteks, mis oli kr\u00fcpteeritud STARTTLS laienduse kasutamisega. <\/p>\n

R\u00fcnnak m\u00e4rgati koos korraldajate vea t\u00f5ttu, kes ei suutnud \u00f5igel ajal pikendada asendust TLS-sertifikaati. 16. oktoobril sai jabber.ru administraator teenusele \u00fchendamise katse ajal t\u00f5rkeotsingus teate sertifikaadi aegumise t\u00f5ttu, kuid serveris asuv sertifikaat ei olnud aegunud. L\u00f5puks selgus, et kliendile saadud sertifikaat erineb serveri saatetud sertifikaadist. Esimene vale TLS-sertifikaat<\/a> saadi 18. aprillil 2023 l\u00e4bi teenuse Let's Encrypt, kus r\u00fcndaja, kellel oli v\u00f5imalus liiklust pealt kuulata, suutis kinnitada juurdep\u00e4\u00e4su saitidele jabber.ru ja xmpp.ru. <\/p>\n

Algul kahtlustati projekti serveri kompromiteerimist ja sellele poole pealt asendamist. Kuid l\u00e4biviidud audit ei tuvastanud \u00fchtegi h\u00e4kkimise j\u00e4lge. Samuti m\u00e4rgati serveri logis l\u00fchiajalist v\u00f5rguinterfeisi v\u00e4ljal\u00fclitamist ja k\u00e4ivitamist (NIC Link is Down\/NIC Link is Up), mis toimus 18. juulil kell 12:58 ja v\u00f5is viidata serveri \u00fchenduse manipuleerimisele l\u00fclitiga. T\u00e4helepanu v\u00e4\u00e4rib, et kaks vale TLS-sertifikaati genereeriti vaid m\u00f5ni minut enne seda \u2014 18. juulil kell 12:49 ja 12:38. <\/p>\n

Lisaks toimus petmine mitte ainult Hetzneri teenusepakkuja v\u00f5rgus, kus asub peamine server, vaid ka Linode teenusepakkuja v\u00f5rgus, kus asusid VPS-keskkonnad abiproksid, mis suunasid liiklust teistest aadressidest. Kaudselt selgus, et liiklust 5222 v\u00f5rgupordile (XMPP STARTTLS) m\u00f5lema teenusepakkuja v\u00f5rkudes suunatakse l\u00e4bi lisahosti, mis andis alust arvata, et r\u00fcnnakut sooritas isik, kellel on juurdep\u00e4\u00e4s teenusepakkujate infrastruktuurile. <\/p>\n

Teoreetiliselt v\u00f5is sertifikaatide vahetamine toimuda alates 18. aprillist (esimese vale sertifikaadi loomise kuup\u00e4ev jabber.ru jaoks), kuid kinnitatud sertifikaatide vahetamise juhtumid on fikseeritud ainult ajavahemikus 21. juulist kuni 19. oktoobrini. Kogu selle aja v\u00e4ltel v\u00f5ib andmevahetus jabber.ru ja xmpp.ru vahel loetud olla kompromiteerituks. Sertifikaatide vahetamine l\u00f5ppes p\u00e4rast uurimise algust, testide l\u00e4biviimist ja 18. oktoobril Hetzneri ja Linode teenusepakkujate tugiteenusesse p\u00f6\u00f6rdumist. Samas t\u00e4iendav \u00fcleminek pakettide marsruutimisel, mis saadetakse 5222 sadamasse \u00fchte serverite<\/a> Linode'i, on endiselt t\u00e4heldatav, kuid sertifikaati enam ei vahetata. <\/p>\n

Eeldatakse, et r\u00fcnne v\u00f5idi sooritada teenusepakkujate teadmisega, \u00f5iguskaitseorganite n\u00f5udmisel, m\u00f5lema teenusepakkuja infrastruktuuri h\u00e4kkimise tagaj\u00e4rjel v\u00f5i t\u00f6\u00f6taja poolt, kellel oli juurdep\u00e4\u00e4s m\u00f5lemale teenusepakkujale. R\u00fcnnakul oli v\u00f5imalus XMPP liiklust p\u00fc\u00fcdma ja modifitseerima, mis v\u00f5imaldas r\u00fcndajal p\u00e4\u00e4seda ligi k\u00f5igile seotud kontoandmetele, nagu serveris hoitud s\u00f5numite ajalugu, saata s\u00f5numeid kellegi teise nimel ja muuta teiste s\u00f5numeid. S\u00f5numid, mis on saadetud l\u00f5pp-punkti kr\u00fcpteerimisega (OMEMO, OTR v\u00f5i PGP), v\u00f5ib pidada mitte kompromiteerituks, kui kr\u00fcpteerimisv\u00f5tmed on kummagi poolse \u00fchenduse kasutajate poolt kinnitatud. Jabber.ru kasutajatele soovitatakse vahetada juurdep\u00e4\u00e4suparoolid ja kontrollida OMEMO ning PGP v\u00f5tmeid oma PEP-hoidlates v\u00f5imalike vahetuste jaoks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tuvastatud jabber.ru ja xmpp.ru kr\u00fcpteeritud liikluse pealtkuulamine | ProHoster","description":"Jabber-serveri administratiivsel jabber.ru (xmpp.ru) tuvastas 90 p\u00e4evast kuni 6 kuuni kestnud kasutajate liikluse dekr\u00fcpteerimise r\u00fcnnaku (MITM) Saksamaa hostimisteenuste pakkujate Hetzner ja Linode v\u00f5rkudes, kus asub projekti server ja abiv VPS-\u00fcmbritsed. R\u00fcnnak korraldati liikluse suunamise kaudu \u00fcleminekute s\u00f5lme, mis asendab TLS-sertifikaadi XMPP-\u00fchenduste jaoks, mis on kr\u00fcpteeritud STARTTLS laienduse abil. R\u00fcnnak avastati","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}