Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
Stories per day · 30 days
2 RSS
Relatedebury7credential-theft5exit-nodes4ssh3dark-web2exit-relays2linux2openssh2android1apt281arti1awareness1censorship-circumvention1email-interception1f-droid1graph-neural-networks1huntress1identity1
27 stories, newest first · one card per story
Stories tagged #tor
Shared resources can cut the real cost of Sybil identities
Published phone-verification prices overstate per-account cost 1.6 to 4.3 times; a Tor relay-limit change cut modeled attack cost 8 to 72%.
Quantum and classical models compared on dark-web link prediction
A four-qubit classifier stayed near chance under degree control, while VGAE reached mean ROC-AUC about 0.91.
333 Tor exit nodes hijacked to intercept SSH and email
Attackers reused a password, installed the Ebury backdoor, and sent port-22 SSH to 12 servers from October 2 to 5.
Attackers ran Ebury on 333 Tor exits to steal SSH passwords
About one in ten cited exit relays redirected port 22 to 12 interception servers from October 2 until BadExit flags and shutdowns on October 5.
Attackers hijacked 300-plus Tor exits to steal SSH passwords
Only password SSH logins over Tor from October 1 to 5 that accepted a fake host key could be captured.
Attackers compromise 333 Tor exits to steal SSH passwords and deploy Ebury
The relays were about 10% of Tor’s exit capacity; Tor flagged them BadExit by October 4 and infected servers were shut down October 5.
Attacker hijacks over 10% of Tor exit relays with Ebury
More than 330 relays were infected from October 2 to 5 to sniff SSH and downgrade email before Tor blocklisted them.
Ebury on 333 Tor exits stole mail and man-in-the-middled SSH
About 10% of Tor exits ran Ebury 1.8.3; relays were BadExit-flagged by October 4 and later shut down.
Tor Project recounts building Tor VPN Beta for Android
Each app gets its own Tor circuit, and WebTunnel bridges arrived in 1.4.0 beta after censored-region use reshaped the product.
What Does the Dark Web Look Like? Pulling Back the Curtain | Huntress
Huntress explains the surface, deep, and dark web and basic precautions for using Tor.
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys
GoBalance signing flaw lets attackers recover Tor .onion master keys from public descriptors and hijack dark-web sites, as seen with Dread.
Onions in the ATmosphere: Decentralizing Trust in Identity
Paper extends secure onion-domain association to AT Protocol DIDs and grounds identity trust in context.
tor-0.4.9.14 released
Tor 0.4.9.14 fixes high-severity bugs affecting relays, clients, onion services, and authorities.
Fake Express Packages on npm Spread a Linux Worm
Nine fake Express and React npm packages install a Linux worm deploying a CHAOS RAT backdoor that spreads via SSH keys and npm tokens.
2
The Cost of Stability: Deanonymizing Onion Services Long-Lived Introduction Circuits
An intersection attack on Tor's long-lived introduction circuits located a test onion service in a median 2.2 hours.
Fwd: Tor Project Forum: Security Release 0.4.9.13
Tor Project releases security update 0.4.9.13 with several high-severity fixes affecting relays, clients, and onion services; immediate upgrade urged.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Extortion group ShinyHunters hacked the Clop ransomware gang's leak site, defacing it and stealing server data and onion service private keys.
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
ShinyHunters exploited a Grav CMS file upload flaw to breach and deface the Clop ransomware gang's leak site, claiming theft of source code, logs, and Tor private keys.
3
Sociotechnical Aspects of Tor Relay Rejection
User study and simulations of Tor's relay end-of-life rejection policy find operators favor it; network churn affects anonymity more than EoL exclusions.
Evaluating Practical Enumeration and Blocking Attacks on the Snowflake Circumvention System
Ethical measurements enumerated 21,000+ Snowflake proxy IPs across ~1,000 ASes; blocking top 1% of ASes disrupts 30% of Snowflakes.
Fwd: Tor Project Forum: Security Release 0.4.9.12
Tor released 0.4.9.12 with several high-severity fixes, some found via LLMs, plus recommended protocol updates and removal of TAP key acceptance.
Understanding the Privacy-Preserving Potential of HTTP/2 Against Webpage Fingerprinting
Researchers show HTTP/2 features can emulate website fingerprinting defenses like FRONT and Tamaraw with tunable privacy-overhead trade-offs.
Confused about which VPN is right, US senator asks the NSA for guidance
Senator Ron Wyden asked the NSA to update public guidance on VPN configurations, questioning single-hop designs and services like Tor.