Attacker hijacks over 10% of Tor exit relays with Ebury
Original title: Risky Bulletin: Hacker hijacks 10% of Tor exit nodes
More than 330 relays were infected from October 2 to 5 to sniff SSH and downgrade email before Tor blocklisted them.
A unnamed threat actor compromised more than 330 Tor servers, installed the Ebury Linux malware, and turned them into exit relays. From those exits the attacker intercepted SSH connections and downgraded email connections to steal unencrypted mail. The campaign ran undetected from October 2 to October 5 until a Swiss engineer reported it. Operators took servers down or the Tor security team blocklisted them.
Unconfirmed: The threat actor is unidentified, and how the relays were initially hacked is not stated.
- More than 330 Tor servers were compromised earlier this month.
- The hacking went undetected for three days, October 2 through 5.
- The spread reached more than 10% of Tor exit relays before it stopped.
- Operators removed hacked servers or Tor added them to its blocklist.
Impact: Intercepted SSH sessions and stole downgraded unencrypted email
| Product | Affected |
|---|---|
| Tor relays | — |
- 1.Relay operators should confirm hosts were not infected with Ebury or blocklisted.
- Products
- Tor
- Malware
- Ebury
- Organizations
- Tor security team
From the original article
14 min read at news.risky.biz
In other news: Second ransomware negotiator linked to ShinyHunters; Chinese crime ring hacks Staples; hacker leaks AfD internal data.
By Catalin Cimpanu · news.risky.biz
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.