US — Ars Technica
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Security2 min read
Hackers took over 333 Tor exit nodes, the final servers that send Tor traffic out to the regular internet. They used the access to spy on SSH logins and to try to read unencrypted email.
What happened
Unknown attackers broke into more than 300 Tor exit nodes. Tor is a privacy network that sends internet traffic through volunteer-run relays. The attackers changed the settings of these exit nodes. They sent SSH connections (a secure way to log into remote computers) through their own servers. They also blocked the ports used for encrypted email, which may have pushed email to an unencrypted form that they could read.
Key facts
- 333 exit relays were involved in the attack.
- The attackers used 12 SSH interception servers that they controlled.
- The hijacking happened from October 2 to October 5.
- The attack began in late August, when a reused password gave the attackers access to a Tor management server.
- Five email ports were blocked: 25, 465, 587, 993, and 995.
How the attack worked
The attacker first got into a Tor management server using a password that had been reused. Then they moved to a second Tor server, called Switzerland2, and installed a backdoor named Ebury on both machines. Ebury is a hidden tool that lets attackers control a computer without being seen. It was first found 12 years ago. Investigators still do not know how the attackers got control of all the servers, or why a key they used was not in Switzerland2's list of approved keys.
Why it matters
Tor is used to protect privacy, so users trust it to keep their connections safe. This attack shows that a bad exit node can see traffic that is not encrypted, and can trick users into giving away passwords. Users who ignore a warning that a server's identity has changed are at the greatest risk. The story is a reminder that a reused password can open the door to a much bigger problem.
What to watch
- Whether investigators find out how all 333 servers were taken over.
- Whether any email was actually downgraded and read by the attackers.
- Whether Tor volunteers remove the infected exit nodes and secure their servers.
- Whether more details about the attackers are revealed.
Glossary
- Tor
- A privacy network that sends internet traffic through many volunteer-run relays to hide where it comes from.
- Tor exit nodes
- The last relays in a Tor path. They send traffic out to regular websites and servers.
- SSH
- A secure way to log into and control another computer over the internet.
- Ebury
- A hidden backdoor for Linux computers that lets attackers control a machine secretly. It was first found 12 years ago.