333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data. 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext. Text settings Story text Size Small Standard Large Width * Standard Wide Links Standard Orange * Subscribers only Learn more Minimize to nav Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago. Mysteries remain Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys.

With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted. Ultimately, 333 exit relays were involved in the SSH and email interception campaign, although investigators haven’t established how the attackers gained control of all the underlying servers.

One set of changes redirected SSH traffic traversing Tor to one of 12 attacker-controlled interceptor servers.