Top all-time · #3127
notes.valdikss.org.ru
Personal blog · notes.valdikss.org.rusecuritysystems
notes.valdikss.org.ru is a personal blog at notes.valdikss.org.ru about security and systems. Since 2021, 25 different Hacker News readers have linked it 38 times, most often “Encrypted traffic interception on Hetzner and Linode targeting Jabber service”. No feed was found, so read it on the site itself.
Rarely recommended · 4 of 34 sampled comments recommend it?
Why HN links it
HN readers link this site for its detailed write-up of the 2023 jabber.ru man-in-the-middle incident, which many comments cite for hosting-provider and CA trust. Other linked pages cover Linux low-RAM tuning (MGLRU).
Summarised by Claude from a sample of 34 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Encrypted traffic interception on Hetzner and Linode targeting Jabber service20 people · 25 mentions · first linked 2023-10-20
- Linux for PC from 2007: 37 browser tabs+Discord+Skype with no lag on 2 GB RAM2 people · 4 mentions · first linked 2021-07-10
What Hacker News says?
It's fixed since Kernel 6.1 + MGLRU, see above, or read this: https://notes.valdikss.org.ru/linux-for-old-pc-from-2007/en/...
Comment linking /linux-for-old-pc-from-2007/en/
on “Replacing a $3000/mo Heroku bill with a $55/mo server”Submitted Linux for PC from 2007 (2021) as a story · 21 points
HN discussion>I basically only trust hetzner in vps space https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Is Tor still safe to use?”Submitted Linux for PC from 2007: 37 browser tabs+Discord+Skype with no lag on 2 GB RAM as a story · 8 points
HN discussionAre you sure? Someone broke into a Hetzner data center and a Linode one, physically intercepted the Ethernet cables for jabber.ru, and got certificates signed on their behalf. https://notes.valdikss.org.ru/jabber.ru-mitm/ https://news.ycombinator.com/item?id=37961166
Comment linking /jabber.ru-mitm/
on “Shutting down our public encrypted DNS”Submitted SSL interception on Hetzner/Linode targeting largest .ru XMPP service (Nov 2023) as a story · 2 points
HN discussionUnfortunately it's quite easy for some actors to get a valid TLS cert https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Google Public DNS's approach to fight against cache poisoning attacks”Submitted Encrypted traffic interception on Hetzner and Linode targeting Jabber service as a story · 2 points
HN discussionhttps://notes.valdikss.org.ru/jabber.ru-mitm/ https://news.ycombinator.com/item?id=37961166
Comment linking /jabber.ru-mitm/
on “Off-path TCP hijacking in NAT-enabled Wi-Fi networks”Because it’s easier that the server be MITMed for a shorter duration to prevent discovery[1]. It’s also easier if you can just strong arm the CA to issue a certificate or have the shady CA issue it[2][3]. [1] http://notes.valdikss.org.ru/jabber.ru-mitm/ [2] https://www.wired.com/2010/03/packet-forensics/ [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1391063
Comment linking /jabber.ru-mitm/
on “Off-path TCP hijacking in NAT-enabled Wi-Fi networks”These are not theoretical concerns though. For example, since SSH uses a trust on first use model as opposed to a central trust/web of trust model, they can direct the victim to a different SSH server if they're connecting to a new one, and intercept all traffic. (Edit: Even with HTTPS, there are other ways to MITM a connection because each trusted CA is considered an equal. For example, instead of doing a full-on M…
Comment linking /jabber.ru-mitm/
on “Off-path TCP hijacking in NAT-enabled Wi-Fi networks”Just buy used from this list https://notes.valdikss.org.ru/printers/#Cheap%20used%20laser...
Comment linking /printers/
on “Reparaible and open source paper printer”> and attacks like this are just downright scary > https://notes.valdikss.org.ru/jabber.ru-mitm/ With an up to date Conversations on a modern server we have a pretty good chance to detect or prevent that style of attack due to a mechanism called SASL Channel Binding.
Comment linking /jabber.ru-mitm/
on “XMPP vs. Matrix”>and attacks like this are just downright scary https://notes.valdikss.org.ru/jabber.ru-mitm/ That attack strikes me as generic. As in not anything to do with XMPP specifically.
Comment linking /jabber.ru-mitm/
on “XMPP vs. Matrix”The main reason we won't list it on privacyguides.org is the encryption is not always on by default. There are two major problems, the implementations and the fact the spec isn't specific. I'm not particularly bothered by the imaginary, the dude is a furry what do you expect? Some furry bloggers do have pictures throughout their blog posts to split things up and lighten things. As for the reply from the spec author,…
Comment linking /jabber.ru-mitm/
on “XMPP vs. Matrix”Just keep in mind that https://notes.valdikss.org.ru/jabber.ru-mitm happened, although it's probably done by almost all hosting services
Comment linking /jabber.ru-mitm
on “Hetzner Pricing”I feel like that BGP attacks (and outright mistakes) haven't gone away, so I wonder how useful MPIC is these days. Also, hosting companies have been known to MITM their customers connections in order to get valid fake certs. https://isbgpsafeyet.com/ https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Certification Authority/Browser Forum adopts new security standards”https://notes.valdikss.org.ru/linux-for-old-pc-from-2007/en/ The patch prevents eviction of file cache from the RAM, which, when using with zram, makes the system very fast when it is swapping. On regular Linux, when the system is low on RAM, file cache is evicted so quickly and is re-read from the (slow) HDD relatively slowly, that's why the software "lags" (it can't reload the code and resources fast enough to sta…
Comment linking /linux-for-old-pc-from-2007/en/
on ““Le9” Strives to Make Linux Usable on Systems with Small Amounts of RAM”It has been fixed by MGLRU patchset since kernel 6.1. Do: cat > /etc/tmpfiles.d/mglru-min-ttl.conf <<EOF w- /sys/kernel/mm/lru_gen/enabled - - - - y w- /sys/kernel/mm/lru_gen/min_ttl_ms - - - - 1000 EOF and reboot. I've been struggling with this issue, as many others, for years. Now I can run two VMs with 8 GB physical RAM and 5+ GB swapped, and it barely noticeable. More information, although a bit outdated (pre-MG…
Comment linking /linux-for-old-pc-from-2007/en/
on “Linuxatemyram.com”And another one: https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Is BGP Safe Yet? No. Test Your ISP”Thanks for mentioning, this is fascinating. The original report is a masterpiece of forensics investigation. Worth a read: https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Hetzner is terminating contracts with all users who had a Russian postal address”Uh. Hetzner and Linode just got caught doing it. https://notes.valdikss.org.ru/jabber.ru-mitm/ https://www.devever.net/~hl/xmpp-incident
Comment linking /jabber.ru-mitm/
on “EU Digital Identity Reform: The Good, Bad and Ugly in the EIDAS Regulation”Hetzner/Linode were MITMing their client(jabber.ru): https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “European Alternatives”Reminder: Hetzner/Linode were MITMing their client(jabber.ru) withour any legal basis and past prosecution: https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Migrating to the EU”> much better privacy controls than any American company would be legally able to provide Yeah, sure. They even MITM your TLS for extra privacy I suppose. https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Hetzner increased dedicated server prices 3-4x”Yes, there have been cases where this has happened ( https://notes.valdikss.org.ru/jabber.ru-mitm/ ), but it's really now into the realm of 1) How to secure routing information (some says RPKI, some argues that's not enough) 2) Principal-Agent problem (jabber.ru's hijack relied on (presumably) Hetzner being forced to do it by German law agents based on the powers provided under the German Telecommunications Act)
Comment linking /jabber.ru-mitm/
on “6-Day and IP Address Certificates Are Generally Available”How can you check other people's certs? How do you know whether a cert issued is authorized by them or not? The only one who can check for maliciously published certs is the entity authorized to request them. I think most companies are happy when they manage to have valid, not expired certs and do not care too much about making sure there are not too many of them. You are right that if the state would start issuing…
Comment linking /jabber.ru-mitm/
on “Let's Encrypt bans certificate usage in any US sanctioned territory [pdf]”Success story with this patch: https://notes.valdikss.org.ru/linux-for-old-pc-from-2007/en/
Comment linking /linux-for-old-pc-from-2007/en/
on “Protect clean file pages under memory pressure to prevent thrashing”For anyone who’s about to say that surveillance isn’t the point of this legislation: it definitely is; we very recently saw Germany trying to MITM jabber.ru users[1], having a CA that can be asked to issue any certificate is definitely something that’d be used for surveillance purposes. [1] https://notes.valdikss.org.ru/jabber.ru-mitm/
Comment linking /jabber.ru-mitm/
on “Last Chance to Fix eIDAS (Mozilla)”The summary of the attack from https://notes.valdikss.org.ru/jabber.ru-mitm/ is very interesting: * The attacker managed to issue multiple SSL/TLS certificates via Let’s Encrypt for jabber.ru and xmpp.ru domains since 18 Apr 2023 * The Man-in-the-Middle attack for jabber.ru/xmpp.ru client XMPP traffic decryption confirmed to be in place since at least 21 July 2023 for up to 19 Oct 2023, possibly (not confirmed) sinc…
Comment linking /jabber.ru-mitm/
on “How to mitigate the Hetzner/Linode XMPP.ru MitM interception incident”
