←back to thread

Mitigating the Hetzner/Linode XMPP.ru MitM interception incident

(www.devever.net)
341 points hlandau | 1 comments | 20 Oct 23 20:31 UTC | HN request time: 0.001s | source
Show context
abigail95 ◴[20 Oct 23 22:43 UTC] No.37962300[source]▶
> What would a perfect attacker do?

If you had physical access to the computer, some sort of bus interception to exfiltrate data from the machine.

replies(2): >>37962373 #>>37963714 #
whalesalad ◴[20 Oct 23 22:52 UTC] No.37962373[source]▶
extremely difficult to get physical access in a datacenter
replies(5): >>37962416 #>>37962421 #>>37962655 #>>37963217 #>>37963509 #
LeoPanthera ◴[20 Oct 23 22:58 UTC] No.37962421[source]▶
I would suggest that if you are the police, you can break into a datacenter with a flash of a badge. I can't imagine many would attempt to stop you.
replies(3): >>37962600 #>>37963230 #>>37964311 #
1. bsder ◴[21 Oct 23 05:23 UTC] No.37964311[source]▶
> I can't imagine many would attempt to stop you.

You would be 99% wrong. Even if law enforcment presented proper paperwork, every colo I have ever used would call and verify the paperwork. They might not call me, but they sure as hell would call their own lawyers. Once law enforcement is on the other side of the cage, important customers who pay real money could get compromised.

There is a massive difference between getting physical access to your server in a data center and coughing up everything about your server by simply emailing a minion in a cloud provider.