Hacker News new | past | comments | ask | show | jobs | submit login

Could this be a blue pill attack? A vulnerability in the xmpp server exploited to inject a rootkit, which then hides itself inside the kernel?

Or creates network/pid namespaces and puts you in them, while leaving the mitm server in the original one?

If so, the mitm could be on the same host, and wouldn't need the cooperation of the hosting provider.

I'm not sure how to check for either of these without restarting (which the admin does not seem to want to do, as it is a live service).

https://en.wikipedia.org/wiki/Blue_Pill_(software)




If this had happened, the attacker would have likely stolen the servers TLS certificate and keys

Whereas this attack generated new keys (and was detected!), suggesting the attacker didn't compromise the server itself.


No because traffic redirection occured in provider's infrastructure, not on a server.


Let's say you are blue-pilled and what you see as your eth0 interface is actually a virtual interface controlled by the rootkit.

In that case, where the redirection happened is no longer something you would be able to tell, right?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: