Attackers hijacked 333 Tor relays to intercept SSH and email traffic
Attackers hijacked 333 Tor exit relays for three days, redirecting SSH connections and attempting to expose email traffic. The campaign matters because Tor users who ignored a changed SSH host key warning could have handed over passwords, command histories and access to their servers.
The hijacking ran from 2 to 5 October. Investigators traced an initial breach to a reused password for a Tor management server and found the Linux backdoor Ebury on it and another server; they have not established how the attackers gained control of all the affected machines. Twelve attacker-controlled servers intercepted SSH connections, while compromised relays blocked several ports used for encrypted email but allowed unencrypted email traffic; it is unclear whether email connections were successfully downgraded.
In short
- 333 Tor exit relays were involved in the campaign.
- SSH connections were redirected to 12 attacker-controlled servers.
- Investigators do not know how all affected servers were accessed.
Read the full article at the source →
Originally published by Ars Technica as “333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email”.