Attackers hijacked 300-plus Tor exits to steal SSH passwords
Original title: Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Only password SSH logins over Tor from October 1 to 5 that accepted a fake host key could be captured.
A researcher found more than 300 Tor exit relays in early October redirecting SSH to interception servers that stole login passwords. At peak on October 4 those relays were 7.46% of Tor exit capacity. The Tor Project flagged them on October 4, and by October 5 none remained in the consensus. Key-based logins could not be relayed to the real server; no victim count exists.
Unconfirmed: A matching exit policy is not proof of compromise, the victim count is unknown, and who restarted 55 Quetzalcoatl hosts on October 5 is unknown.
- On October 2, 333 of about 3,000 exits redirected SSH to 12 servers.
- Directory data counts 377 relays from 59 operators matching the attack exit policy.
- Attackers opened port 22 on 342 relays and turned 24 non-exits into exits.
- A honeypot saw a Perl installer matching the form used to deploy Ebury.
- One interceptor ED25519 fingerprint is SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
Impact: SSH passwords captured and sessions watched
| Product | Affected |
|---|---|
| Tor Project Tor exit relays | — |
- 1.If you accepted a changed SSH host key over Tor from October 1 to 5, change that password.
- 2.Check that server for the Ebury signs described by the researcher.
- 3.Look in known_hosts for the published interceptor ED25519 fingerprint.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1021.004 Remote Services: SSHT1059 Command and Scripting Interpreter
- Malware
- Ebury
- Organizations
- Tor Project
From the original article
10 min read at thehackernews.com
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.