On Sun, Oct 22, 2023 at 08:56:26PM +0000, Gellner, Oliver via mailop wrote: > > On 22.10.2023 at 15:06 Philip Paeps via mailop wrote: > > On 2023-10-22 14:34:39 (+0530), Slavko via mailop wrote: > >> while not directly about email, recently was published details > >> about success MiTM attack against XMPP server, the attacker > >> was able to decrypt TLS communication without notice (from > >> both sides, the server and client) and was success for at least > >> three months, see > >> > >> https://notes.valdikss.org.ru/jabber.ru-mitm/ > > > > Indeed: not directly related to mailops. But a very instructive example of > > why monitoring C-T logs is a good idea. > > That’s true, but monitoring certificate transparency logs would have only > helped in this particular case, as the attack wasn’t very sophisticated > (they let their MITM certificate expire after all..). > > The attackers could have just ordered a certificate without CT signatures. > This certificate would not be accepted by webbrowers on third party > clients, but as the certificate was used on a Jabber server this would not > have mattered. Jabber happily accept certificates without any CT > signatures.
Getting a TLS-capable certificate that has not been pre-logged isn't trivial these days, as all CAs log by default (because very few TLS certificates are useful without SCTs). I'm *fairly* sure you can't get one from Let's Encrypt no matter what you do, and most other CAs cost money, which complicates the attack somewhat (although it's of course still quite feasible). While CAA is a good mitigation, and highly recommended, building CT enforcement into XMPP clients would also be a good defence-in-depth step, as well. Not particularly mailop-related, though. - Matt _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
