Administratorul serverului Jabber jabber.ru (xmpp.ru) a descoperit un atac de decriptare a traficului utilizatorilor (MITM), desf\u0103\u0219urat pe o perioad\u0103 de la 90 de zile p\u00e2n\u0103 la 6 luni \u00een re\u021belele furnizorilor de hosting germani Hetzner \u0219i Linode, \u00een care este g\u0103zduit serverul proiectului \u0219i medii VPS auxiliare. Atacul a fost organizat prin redirec\u021bionarea traficului c\u0103tre un nod de tranzit, care substituie certificatul TLS pentru conexiunile XMPP, criptate cu utilizarea extensiei STARTTLS. <\/p>\n
Atacul a fost observat din cauza unei erori a organizatorilor, care nu au reu\u0219it s\u0103 re\u00eennoiasc\u0103 certificatul TLS utilizat pentru substitu\u021bie. Pe 16 octombrie, administratorul jabber.ru, \u00een \u00eencercarea de a se conecta la serviciu, a primit un mesaj de eroare din cauza expir\u0103rii certificatului, dar certificatul g\u0103zduit pe server nu era expirat. \u00cen cele din urm\u0103, s-a constatat c\u0103 certificatul primit de client difer\u0103 de certificatul trimis de server. Primul fals certificatul TLS<\/a> a fost ob\u021binut pe 18 aprilie 2023 prin serviciul Let’s Encrypt, unde atacatorul, av\u00e2nd capacitatea de a intercepta traficul, a reu\u0219it s\u0103 confirme accesul la site-urile jabber.ru \u0219i xmpp.ru. <\/p>\n La \u00eenceput, a ap\u0103rut suspiciunea unei compromiteri a serverului proiectului \u0219i a unei posibile substituiri pe partea acestuia. \u00cens\u0103 auditul efectuat nu a relevat nicio urm\u0103 a unei bre\u0219e de securitate. \u00cen plus, \u00een jurnalul serverului a fost observat\u0103 o deconectare \u0219i reconectare temporar\u0103 a interfe\u021bei de re\u021bea (NIC Link is Down\/NIC Link is Up), care a avut loc pe 18 iulie la ora 12:58 \u0219i ar fi putut indica manipul\u0103ri cu conexiunea serverului la switch. Este demn de remarcat c\u0103 dou\u0103 dintre certificatele TLS false au fost generate cu c\u00e2teva minute \u00eenainte de aceasta \u2014 pe 18 iulie la 12:49 \u0219i 12:38. <\/p>\n \u00cen plus, substituirea s-a realizat nu doar \u00een re\u021beaua furnizorului Hetzner, \u00een care este g\u0103zduit serverul principal, ci \u0219i \u00een re\u021beaua furnizorului Linode, unde erau g\u0103zduite medii VPS cu proxy-uri auxiliare, redirec\u021bion\u00e2nd traficul din alte adrese. S-a descoperit indirect c\u0103 traficul pe portul de re\u021bea 5222 (XMPP STARTTLS) \u00een re\u021belele ambilor furnizori este redirec\u021bionat printr-un gazd\u0103 suplimentar\u0103, ceea ce a dat motive de a b\u0103nui c\u0103 atacul a fost realizat de o persoan\u0103 cu acces la infrastructura furnizorilor. <\/p>\n Teoretic, \u00eenlocuirea ar fi putut avea loc din 18 aprilie (data cre\u0103rii primului certificat fals pentru jabber.ru), dar cazurile confirmate de \u00eenlocuire a certificatului au fost \u00eenregistrate doar \u00eentre 21 iulie \u0219i 19 octombrie; tot acest timp, schimbul de date criptate cu jabber.ru \u0219i xmpp.ru poate fi considerat compromis. \u00cenlocuirea s-a oprit dup\u0103 \u00eenceperea investiga\u021biei, desf\u0103\u0219urarea testelor \u0219i trimiterea pe 18 octombrie a unei cereri c\u0103tre serviciul de suport al furnizorilor Hetzner \u0219i Linode. \u00cen acela\u0219i timp, un traseu suplimentar \u00een rutarea pachetelor trimise c\u0103tre portul 5222 al unuia dintre servere<\/a> furnizorii Linode se observ\u0103 \u0219i \u00een prezent, dar certificatul acum nu mai este \u00eenlocuit. <\/p>\n Se presupune c\u0103 atacul ar fi putut fi efectuat cu \u0219tirea furnizorilor la cererea autorit\u0103\u021bilor judiciare, ca urmare a spargerii infrastructurii ambelor furnizori sau de c\u0103tre un angajat care a avut acces la ambele. Av\u00e2nd capacitatea de a intercepta \u0219i modifica traficul XMPP, atacatorul ar fi putut accesa toate datele legate de conturi, cum ar fi istoricul de schimb de mesaje stocat pe server, precum \u0219i putea trimite mesaje \u00een numele altora \u0219i face modific\u0103ri \u00een mesajele str\u0103ine. Mesajele trimise folosind criptare end-to-end (OMEMO, OTR sau PGP) pot fi considerate nesupuse compromiterii, dac\u0103 cheile de criptare sunt confirmate de utilizatori pe ambele p\u0103r\u021bi ale conexiunii. Utilizatorilor jabber.ru li se recomand\u0103 s\u0103 \u00ee\u0219i schimbe parolele de acces \u0219i s\u0103 verifice cheile OMEMO \u0219i PGP \u00een stoc\u0103rile lor PEP pentru posibile \u00eenlocuiri. \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d \u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0438 \u0432\u0441\u043f\u043e\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0435 VPS-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0410\u0442\u0430\u043a\u0430 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043d\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0443\u0437\u0435\u043b, \u043f\u043e\u0434\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0439 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0434\u043b\u044f XMPP-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u0448\u0438\u0444\u0440\u0443\u0435\u043c\u044b\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f STARTTLS. \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111010","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Interceptare confirmat\u0103 a traficului criptat jabber.ru \u0219i xmpp.ru | ProHoster","description":"Administratorul serverului Jabber jabber.ru (xmpp.ru) a identificat un atac de decriptare a traficului utilizatorilor (MITM), desf\u0103\u0219urat pe o perioad\u0103 cuprins\u0103 \u00eentre 90 de zile \u0219i 6 luni \u00een re\u021belele furnizorilor de g\u0103zduire germani Hetzner \u0219i Linode.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 jabber.ru \u0438 xmpp.ru | ProHoster","og:description":"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Jabber-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 jabber.ru (xmpp.ru) \u0432\u044b\u044f\u0432\u0438\u043b \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0435 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (MITM), \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043c\u0443\u044e \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 \u043e\u0442 90 \u0434\u043d\u0435\u0439 \u0434\u043e 6 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0432 \u0441\u0435\u0442\u044f\u0445 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0445\u043e\u0441\u0442\u0438\u043d\u0433-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u043e\u0432 Hetzner \u0438 Linode, \u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/zafiksirovan-perehvat-shifrovannogo-trafika-jabber-ru-i-xmpp-ru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-20T19:10:22+00:00","article:modified_time":"2023-10-20T19:10:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111010","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 21:02:30","updated":"2026-02-09 16:51:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=111010"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111010\/revisions"}],"predecessor-version":[{"id":158943,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/111010\/revisions\/158943"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=111010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=111010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=111010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"