333 Tor exit nodes hijacked to intercept SSH and email
Original title: 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Attackers reused a password, installed the Ebury backdoor, and sent port-22 SSH to 12 servers from October 2 to 5.
Unknown attackers compromised Tor infrastructure starting in late August with a reused password on a management server, then installed the Linux backdoor Ebury. They reached a second server, Switzerland2, over SSH and reconfigured exit nodes it hosted. In all, 333 exit relays redirected SSH to 12 attacker-controlled servers and blocked several encrypted-email ports while still allowing unencrypted mail. Investigators have not shown how every underlying server was taken over.
Unconfirmed: Investigators have not established control of all 333 servers or whether any email downgrade succeeded.
- Tor volunteers say the management-server intrusion began in late August.
- Ebury, a Linux backdoor discovered 12 years ago, was installed on two Tor servers.
- Exit nodes blocked ports 25, 465, 587, 993 and 995.
- The interception window ran from October 2 to October 5.
- Users who ignored a changed SSH host key could submit passwords.
Impact: SSH passwords and possibly downgraded unencrypted email
| Product | Affected |
|---|---|
| Tor exit relays | — |
- 1.Treat unexpected SSH host-key changes on Tor as possible interception.
- 2.Avoid sending passwords or unencrypted email through the affected exit period.
From the original article
2 min read at arstechnica.com
For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.