Onion Information
MITM attack vs Jabber.ru - Syst(em)
Notes.⚫ - This is basically a micro-blog. This is where I post notes, videos, images, back-links and random thoughts. TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle...
Onion Details
Page Clicks: 0
First Seen: 03/12/2024
Last Indexed: 10/23/2024
Onion Content
Notes.⚫ This is basically a micro-blog. This is where I post notes, videos, images, back-links and random thoughts. MITM attack vs Jabber.ru: TL;DR: we have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany. The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued. There are no indications of the server breach or spoofing attacks on the network segment, quite the contrary: the traffic redirection has been configured on the hosting provider network. The wiretapping may have lasted for up to 6 months overall (90 days confirmed). We believe this is lawful interception Hetzner and Linode were forced to setup. https://notes.valdikss.org.ru/jabber.ru-mitm/ https://archive.ph/jLjNT October 21, 2023 Info: Leet #mitm #cybersecurity