A Jabber server administrator from jabber.ru (xmpp.ru) identified a user traffic decryption attack (MITM) conducted over a period ranging from 90 days to 6 months within the networks of German hosting providers Hetzner and Linode, where the project server and auxiliary VPS environments are hosted. The attack was organized through traffic redirection to a transit node that replaced the TLS certificate for XMPP connections encrypted using the STARTTLS extension. <\/p>\n
The attack was noticed due to an error from its organizers, who failed to renew the TLS certificate used for the substitution. On October 16, the administrator of jabber.ru received an error message when trying to connect to the service due to the expiration of the certificate, but the certificate hosted on the server was not expired. It turned out that the certificate received by the client differed from the certificate sent by the server. The first fake TLS-tan\u00fas\u00edtv\u00e1ny<\/a> \u00e1prilis 18-\u00e1n ker\u00fclt megszerz\u00e9sre a Let’s Encrypt szolg\u00e1ltat\u00e1son kereszt\u00fcl, ahol a t\u00e1mad\u00f3, aki k\u00e9pes volt az adatforgalom elfog\u00e1s\u00e1ra, meger\u0151s\u00edtette a hozz\u00e1f\u00e9r\u00e9st a jabber.ru \u00e9s xmpp.ru webhelyekhez. <\/p>\n Kezdetben felmer\u00fclt a projektszerver kompromitt\u00e1l\u00e1s\u00e1nak gyan\u00faja \u00e9s hogy manipul\u00e1ci\u00f3 t\u00f6rt\u00e9nt a szerver oldal\u00e1n. Az elv\u00e9gzett audit azonban nem t\u00e1rt fel semmilyen nyomot a behatol\u00e1sr\u00f3l. A szerver napl\u00f3f\u00e1jlj\u00e1ban azonban \u00e9szleltek egy r\u00f6vid idej\u0171 h\u00e1l\u00f3zati interf\u00e9sz (NIC Link is Down\/NIC Link is Up) kikapcsol\u00e1st \u00e9s bekapcsol\u00e1st, amely j\u00falius 18-\u00e1n 12:58-kor t\u00f6rt\u00e9nt, \u00e9s utalhatott a szerver kapcsol\u00f3d\u00e1s\u00e1nak manipul\u00e1ci\u00f3j\u00e1ra a switchhez. \u00c9rdekes, hogy k\u00e9t hamis TLS-tan\u00fas\u00edtv\u00e1nyt gener\u00e1ltak n\u00e9h\u00e1ny perccel ezel\u0151tt \u2014 j\u00falius 18-\u00e1n 12:49-kor \u00e9s 12:38-kor. <\/p>\n Furthermore, the substitution was conducted not only within the Hetzner provider's network, where the main server is hosted, but also within the Linode provider's network, where the VPS environments with auxiliary proxies redirecting traffic from other addresses were located. Indirect evidence indicated that traffic on port 5222 (XMPP STARTTLS) in both providers' networks is redirected through an additional host, leading to the conclusion that the attack was carried out by someone with access to the providers' infrastructure. <\/p>\n Elm\u00e9letben a hamis\u00edt\u00e1st \u00e1prilis 18-a \u00f3ta lehetett v\u00e9grehajtani (ez a d\u00e1tum az els\u0151 hamis tan\u00fas\u00edtv\u00e1ny l\u00e9trehoz\u00e1s\u00e1nak a jabber.ru sz\u00e1m\u00e1ra), de a tan\u00fas\u00edtv\u00e1ny hamis\u00edt\u00e1s\u00e1nak meger\u0151s\u00edtett eseteit csak j\u00falius 21. \u00e9s okt\u00f3ber 19. k\u00f6z\u00f6tt r\u00f6gz\u00edtett\u00e9k, ez alatt az id\u0151 alatt a jabber.ru \u00e9s az xmpp.ru k\u00f6z\u00f6tti titkos\u00edtott adatcsere kompromitt\u00e1ltnak tekinthet\u0151. A hamis\u00edt\u00e1s meg\u00e1llt, miut\u00e1n elkezd\u0151d\u00f6tt a kivizsg\u00e1l\u00e1s, elv\u00e9gezt\u00e9k a teszteket, \u00e9s okt\u00f3ber 18-\u00e1n k\u00e9rd\u00e9st k\u00fcldtek a Hetzner \u00e9s Linode szolg\u00e1ltat\u00f3k t\u00e1mogat\u00e1si szolg\u00e1lat\u00e1hoz. K\u00f6zben a csomagok \u00fatvonal\u00e1nak tov\u00e1bbi \u00e1tkapcsol\u00f3d\u00e1sa, amelyeket a 5222-es port egyik\u00e9hez k\u00fcldtek szerverek<\/a> a Linode-on, jelenleg is megfigyelhet\u0151, de a tan\u00fas\u00edtv\u00e1ny most m\u00e1r nem hamis\u00edt\u00f3dik. <\/p>\n Felt\u00e9telezhet\u0151, hogy a t\u00e1mad\u00e1st a szolg\u00e1ltat\u00f3k tudt\u00e1val hajtott\u00e1k v\u00e9gre, a hat\u00f3s\u00e1gok k\u00e9r\u00e9s\u00e9re, vagy a k\u00e9t szolg\u00e1ltat\u00f3 infrastrukt\u00far\u00e1j\u00e1nak felt\u00f6r\u00e9se r\u00e9v\u00e9n, vagy egy alkalmazott \u00e1ltal, aki hozz\u00e1f\u00e9r\u00e9ssel rendelkezett mindk\u00e9t szolg\u00e1ltat\u00f3hoz. A t\u00e1mad\u00f3, akinek lehet\u0151s\u00e9ge volt az XMPP forgalom elfog\u00e1s\u00e1ra \u00e9s m\u00f3dos\u00edt\u00e1s\u00e1ra, hozz\u00e1f\u00e9r\u00e9st nyerhetett az \u00f6sszes, a fi\u00f3kokhoz kapcsol\u00f3d\u00f3 adat feldolgoz\u00e1s\u00e1hoz, p\u00e9ld\u00e1ul a szerveren t\u00e1rolt \u00fczenetek t\u00f6rt\u00e9net\u00e9hez, \u00e9s k\u00e9pes volt \u00fczeneteket k\u00fcldeni idegen nev\u00e9ben, valamint m\u00f3dos\u00edtani m\u00e1sok \u00fczeneteit. Az alap\u00e9rtelmezett titkos\u00edt\u00e1ssal (OMEMO, OTR vagy PGP) k\u00fcld\u00f6tt \u00fczenetek nem min\u0151s\u00fclnek kompromitt\u00e1ltnak, ha a titkos\u00edt\u00f3 kulcsokat mindk\u00e9t f\u00e9l meger\u0151s\u00edtette a kapcsolaton bel\u00fcl. A jabber.ru felhaszn\u00e1l\u00f3knak javasolt a hozz\u00e1f\u00e9r\u00e9si jelszavak megv\u00e1ltoztat\u00e1sa \u00e9s az OMEMO \u00e9s PGP kulcsok ellen\u0151rz\u00e9se a PEP-t\u00e1rol\u00f3ikban a lehets\u00e9ges hamis\u00edt\u00e1ssal kapcsolatban. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Megfigyelt\u00e9k a jabber.ru \u00e9s xmpp.ru titkos\u00edtott forgalm\u00e1nak elfog\u00e1s\u00e1t | ProHoster","description":"A jabber.ru (xmpp.ru) Jabber-szerver adminisztr\u00e1tora az elm\u00falt 90 napt\u00f3l 6 h\u00f3napig terjed\u0151 id\u0151szakban a n\u00e9met Hetzner \u00e9s Linode t\u00e1rhely-szolg\u00e1ltat\u00f3k h\u00e1l\u00f3zatain v\u00e9grehajtott felhaszn\u00e1l\u00f3i forgalom dek\u00f3dol\u00e1s\u00e1nak t\u00e1mad\u00e1s\u00e1t azonos\u00edtotta.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"