Unknown attackers compromised more than 300 Tor exit nodes over a three-day period in early October, redirecting network traffic to intercept sensitive information. According to a report published Tuesday by a Tor volunteer researcher, the campaign began in late August when attackers obtained a reused password to access a Tor management server.
Using that initial access, the attackers installed Ebury, a Linux backdoor malware, on the management server and then extended their control to a second Tor server called Switzerland2. From there, they configured 333 exit nodes to carry out their interception scheme. The attackers established 12 interceptor servers under their control and reconfigured the compromised nodes to redirect SSH connections through these servers. When users ignored security warnings about changed host keys and proceeded with their SSH connections, attackers captured passwords, observed commands entered by users, and infected target servers with Ebury malware.
In a parallel effort, the attackers blocked ports associated with encrypted email protocols while allowing unencrypted email traffic. This configuration was designed to force email systems to downgrade to unencrypted connections, though investigators have not confirmed whether downgrade attempts succeeded. The active phase of the hijacking ran from October 2 to October 5.
Investigators face several outstanding questions about the incident. The method by which attackers gained administrative control of all 333 underlying servers remains unclear, with theories including a compromised hosting provider but no confirmed explanation. The identities of the attackers are unknown, though the use of Ebury and the targeting of unencrypted data suggest financially motivated cybercriminals. Additionally, researchers are uncertain why Switzerland2 accepted an SSH key that does not appear in its authorized keys list.
The incident highlights the importance of security measures including disabling password authentication in favor of SSH keys and configuring email systems to accept only encrypted traffic while rejecting unencrypted ports.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI