28
Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service (notes.valdikss.org.ru)
submitted 2 years ago by to c/programming@programming.dev
4 comments fedilink hide all child comments
 

TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued. There are no indications of the server breach or spoofing attacks on the network segment, quite the contrary: the traffic redirection has been configured on the hosting provider network. The wiretapping may have lasted for up to 6 months overall (90 days confirmed). We believe this is lawful interception Hetzner and Linode were forced to setup.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 2 years ago (1 child)

Hmm, wonder if there was some reason they didnt just extract the original certificates from the VPS if it was actually the hosting provider, I mean even with mitigation it should be sitting in a temp folder somewhere, surely they could? Issuing new ones seems like a surefire way to alert the operators, unless they already used Let's Encrypt of course.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 5 points 2 years ago (1 child)

    Hetzner machine in that article is bare metal. It’s much harder to extract the certificates from a running server without anyone noticing.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •