The short version
- Hackers compromised 333 Tor exit nodes between October 2 and 5 to intercept sensitive user data.
- The attack involved redirecting SSH traffic to attacker-controlled servers and blocking encrypted email ports.
- Investigation reveals the use of a decade-old backdoor tool and reused credentials to gain initial access.
A coordinated cyberattack targeted the Tor network this month, compromising more than 300 exit nodes in an effort to steal sensitive user data. The campaign, which lasted three days in early October, involved reconfiguring these relays to favor unencrypted email traffic and redirect Secure Shell connections through servers controlled by the attackers. This incident underscores persistent risks within anonymous browsing networks when legacy security practices are maintained.
The intrusion began in late August when an unknown actor gained access to a Tor management server using a valid password that had been reused elsewhere. Once inside, the attacker installed Ebury, a Linux backdoor tool first identified twelve years ago. From this foothold, the intruder connected via SSH to a second server known as Switzerland2, utilizing an RSA key that investigators could not locate among the authorized keys for that system. Administrative control of Switzerland2 allowed the attackers to install the same backdoor and subsequently reconfigure settings on two exit nodes hosted by that server.
The scope of the compromise expanded significantly from October 2 to October 5, ultimately involving 333 exit relays. While the exact method used to gain control over all underlying servers remains unclear, the attackers implemented two primary sets of changes. One modification redirected SSH traffic traversing Tor to one of twelve interceptor servers owned by the threat actors. Users who ignored warnings about changed host keys would unknowingly enter their credentials into these malicious endpoints.
The second set of modifications targeted email communications. The compromised exit nodes blocked ports associated with encrypted email protocols, including 25, 465, 587, 993, and 995. However, they continued to allow traffic on ports used for receiving unencrypted email. If email services downgraded their connections in response to these blocks, the attackers leveraged their access to the exit nodes to obtain messages in plaintext. It remains uncertain whether any such downgrade attempts successfully resulted in data theft.
A Tor volunteer identified as Kaba discovered the anomaly after experiencing unexpected behavior while attempting an SSH connection. Encrypted web traffic appeared normal, but the SSH attempt triggered a warning that remote host identification had changed. This alert indicated a potential man-in-the-middle attack or a change in the host key. When users disregarded such warnings, the attacker stole SSH passwords, observed typed commands through an open connection, and established a second connection to infect the target server with Ebury.
To investigate the extent of the campaign, Kaba developed a script that polled approximately 3,000 Tor exit nodes to verify whether they received correct SSH fingerprints from a test server. The test infrastructure checked if connections originated from pinned exit nodes or the twelve interception servers used by the attackers. Additionally, a honeypot was deployed to observe the interception software attempting to log in and install the backdoor tool. This technical analysis revealed the scale of the operation and the specific mechanisms employed.
Several questions regarding the attack remain unanswered. Tor volunteers have not determined how the attackers accessed such a large number of servers. One theory suggests that a company hosting these servers may have been compromised, but this hypothesis lacks conclusive evidence. The identity of the perpetrators is also unknown. The use of Ebury and the broad collection of unencrypted data suggest involvement by a financially motivated crime group, though this assessment remains speculative.
A particularly perplexing aspect of the investigation involves Switzerland2 accepting an RSA key despite no evidence that it was an authorized SSH certificate. This anomaly highlights gaps in current security auditing processes. The incident emphasizes the critical role of defense in depth in preventing data theft during mass hacks. Recommended measures include configuring email accounts to accept only encrypted traffic and rejecting unencrypted ports, as well as disabling password authentication in favor of SSH keys to mitigate credential theft.
Sources behind this briefing
Go to the original reporting
- Ars Technica↗333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
