{"id":111010,"date":"2023-10-20T21:10:22","date_gmt":"2023-10-20T19:10:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru"},"modified":"2023-10-20T21:10:22","modified_gmt":"2023-10-20T19:10:22","slug":"zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","title":{"rendered":"Zabilje\u017eeno je presretanje \u0161ifriranog prometa jabber.ru i xmpp.ru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Administrator Jabber server jabber.ru (xmpp.ru) otkrio je napad usmjeren na de\u0161ifriranje korisni\u010dkog prometa (MITM), koji se provodio od 90 dana do 6 mjeseci u mre\u017eama njema\u010dkih hosting provajdera Hetzner i Linode, gdje se nalazi server projekta i pomo\u0107na VPS okru\u017eenja. Napad je organiziran preusmjeravanjem prometa na tranzitnu \u010dvori\u0161te, koja zamjenjuje TLS certifikat za XMPP veze, \u0161ifrirane kori\u0161tenjem pro\u0161irenja STARTTLS. <\/p>\n

Napad je uo\u010den zbog gre\u0161ke njegovih organizatora, koji nisu uspjeli produ\u017eiti TLS certifikat kori\u0161ten za zamjenu. 16. listopada administrator jabber.ru je prilikom poku\u0161aja povezivanja na servis dobio poruku o gre\u0161ci zbog isteka certifikata, ali certifikat postavljen na serveru nije bio istekao. U kona\u010dnici, utvr\u0111eno je da se certifikat koji je klijent primio razlikuje od certifikata koji je poslao server. Prvi la\u017eni TLS certifikat<\/a> primljen 18. travnja 2023. godine putem usluge Let's Encrypt, u kojoj je napada\u010d, imaju\u0107i mogu\u0107nost presretanja prometa, mogao potvrditi pristup web stranicama jabber.ru i xmpp.ru. <\/p>\n

Isprva se pojavila sumnja o kompromitaciji poslu\u017eitelja projekta i zamjeni na njegovoj strani. Me\u0111utim, provedena revizija nije otkrila nikakve tragove provale. U logu poslu\u017eitelja primije\u0107eno je kratkotrajno isklju\u010denje i uklju\u010divanje mre\u017enog su\u010delja (NIC Link is Down\/NIC Link is Up), \u0161to se dogodilo 18. srpnja u 12:58 i moglo bi ukazivati na manipulacije s povezivanjem poslu\u017eitelja na preklopnik. Zanimljivo je da su dva la\u017ena TLS certifikata generirana nekoliko minuta prije toga \u2014 18. srpnja u 12:49 i 12:38. <\/p>\n

Osim toga, zamjena se provodila ne samo u mre\u017ei provajdera Hetzner, gdje se nalazi glavni server, ve\u0107 i u mre\u017ei provajdera Linode, gdje su se nalazila VPS okru\u017eenja s pomo\u0107nim proxyji, koji preusmjeravaju promet s drugih adresa. Indirektno je utvr\u0111eno da se promet na mre\u017enoj portu 5222 (XMPP STARTTLS) u mre\u017eama oba provajdera preusmjerava putem dodatnog hosta, \u0161to je dalo osnovu za pretpostavku da je napad izvr\u0161ila osoba koja ima pristup infrastrukturi provajdera. <\/p>\n

Teoretski, zamjena je mogla po\u010deti 18. travnja (datum stvaranja prvog la\u017enog certifikata za jabber.ru), ali potvr\u0111eni slu\u010dajevi zamjene certifikata zabilje\u017eeni su samo od 21. srpnja do 19. listopada. Tijekom tog razdoblja \u0161ifrirana razmjena podataka s jabber.ru i xmpp.ru mo\u017ee se smatrati kompromitiranom. Zamjena je prestala nakon po\u010detka istrage, provo\u0111enja testova i slanja 18. listopada zahtjeva podr\u0161ci pru\u017eatelja usluga Hetzner i Linode. U me\u0111uvremenu, dodatni prijelaz pri usmjeravanju paketa koji se \u0161alju na port 5222 jednog od poslu\u017eitelja<\/a> Linode, i dalje se uo\u010dava, ali certifikat sada nije kompromitiran. <\/p>\n

Pretpostavlja se da je napad mogao biti izvr\u0161en uz znanje pru\u017eatelja usluga na zahtjev policije, kao rezultat hakiranja infrastrukture oba pru\u017eatelja ili od strane zaposlenika koji je imao pristup kod oba pru\u017eatelja. Imaju\u0107i mogu\u0107nost presretanja i modifikacije XMPP prometa, napada\u010d je mogao dobiti pristup svim podacima vezanim uz ra\u010dune, kao \u0161to su pohranjena povijest razmjene poruka na poslu\u017eitelju, te je mogao slati poruke u tu\u0111e ime i unositi izmjene u tu\u0111e poruke. Poruke poslane kori\u0161tenjem end-to-end \u0161ifriranja (OMEMO, OTR ili PGP) mogu se smatrati nekompromitiranim, pod uvjetom da su \u0161ifriraju\u0107i klju\u010devi potvr\u0111eni od strane korisnika s obje strane veze. Korisnicima jabber.ru preporu\u010duje se da promijene lozinke i provjere klju\u010deve OMEMO i PGP u svojim PEP pohrana na mogu\u0107nost zamjene.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Potvr\u0111ena je presreta\u010dka \u0161ifriranog prometa jabber.ru i xmpp.ru | ProHoster","description":"Administrator Jabber poslu\u017eitelja jabber.ru (xmpp.ru) otkrio je napad na de\u0161ifriranje prometa korisnika (MITM), koji se provodio od 90 dana do 6 mjeseci u mre\u017eama njema\u010dkih pru\u017eatelja usluga hostinga Hetzner i Linode.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}