Ebury on 333 Tor exits stole mail and man-in-the-middled SSH
Original title: How I got over 300 Tor exit nodes removed
About 10% of Tor exits ran Ebury 1.8.3; relays were BadExit-flagged by October 4 and later shut down.
On Friday October 2, 333 infected Tor exit relays began intercepting SSH and collecting unencrypted mail, the author writes. Attackers had access since August and deployed Ebury 1.8.3, an OpenSSH backdoor and Linux credential stealer. SSH on port 22 was redirected to 12 interception servers that stole passwords, watched commands and tried to infect the destination with Ebury. The Tor network health team marked the relays BadExit on October 4; infected servers were shut down by October 5. How the hosts were first compromised, and who operated the campaign, is unknown.
Unconfirmed: Initial access and attribution are unknown; a hacked hosting provider and a financially motivated group are only theories.
- Tor has about 3,000 exit relays, so 333 was roughly 10%.
- Relays were marked BadExit on October 4 so clients would stop exiting through them.
- Attackers restarted many relays on October 5, but only as middle relays.
- Exitmap checks found a dozen fake SSH fingerprints and over 300 redirects.
- A metrics.torproject.org dip on October 4 had not recovered when the post was written.
Impact: SSH password theft, command interception and Ebury reinfection
| Product | Affected |
|---|---|
| Tor Project Tor exit relays | — |
- 1.Disable SSH password authentication and use SSH keys.
- 2.Treat Tor relays and bridges as highly targeted production machines.
- Malware
- Ebury
- Organizations
- Tor Project
From the original article
4 min read at kaba.cx
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible. To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control. The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.
By kabakabakaba · kaba.cx
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.