Ars Technica reports that unknown attackers hijacked 333 Tor exit relays and set them up to redirect SSH connections to servers they controlled and to favor unencrypted email. The details come from a post by a Tor volunteer who goes by Kaba.
How it happened
- It started in late August with a reused password that got the attacker into a Tor management server. They installed Ebury, a Linux backdoor first discovered 12 years ago.
- From there they connected over SSH to a second Tor server, called Switzerland2, using an RSA key investigators couldn’t find in its authorized keys. They installed Ebury there too and reconfigured two exit nodes it hosted.
- Investigators haven’t worked out how the attackers got control of all the underlying servers behind the 333 relays. One theory is a hosting company breach, but that’s inconclusive.
What the exit nodes did
- SSH: port 22 traffic was redirected to one of 12 attacker-controlled interception servers. If you ignored the “REMOTE HOST IDENTIFICATION HAS CHANGED” warning, you typed your password to the attacker, who watched your commands and then opened a second connection to infect the server with Ebury.
- Email: the exit nodes blocked ports 25, 465, 587, 993 and 995 (used for encrypted mail) while allowing unencrypted mail ports. If a mail service downgraded to plaintext, the attackers could read the messages. It’s unclear whether any such downgrades succeeded.
- The hijacking took place October 2 to 5. Encrypted web traffic was forwarded as usual, so you wouldn’t notice anything at first.
- The volunteer found it by polling Tor’s roughly 3,000 exit nodes with a test server and checking whether each returned the correct SSH fingerprint. The use of Ebury and the broad data collection point to a financially motivated crime group, but that’s speculation.
What to take from it
- Never click through an SSH host key changed warning. Stop and verify the key through another channel.
- Use SSH keys instead of passwords, and disable password authentication on servers you run.
- Configure mail accounts and servers to require encryption and reject unencrypted ports and downgrades.
- Don’t reuse passwords on admin systems, ever. That’s the first domino here.
My take
The scary part is how boring the entry point was: a reused password. Everything else, the backdoor, the 333 relays, the SSH interception, followed from that. Tor is still a useful privacy tool, but it’s not a substitute for end-to-end encryption and pinned host keys.
Have a blessed day! And Happy Hacking!
