Unknown attackers compromised more than 330 Tor exit nodes in an operation designed to capture unencrypted communications, according to a report published earlier this week. The hijacking lasted several days in early October and involved sophisticated techniques to gain administrative control of multiple Tor infrastructure servers.
The attack began in late August when the perpetrators obtained valid credentials to access a Tor management server, which a password had been reused to protect. The attackers then installed Ebury, a Linux backdoor malware known since previous years, on the management infrastructure. Using this foothold, they connected to a second critical Tor server called Switzerland2 via SSH, deploying the same backdoor there despite unclear circumstances around their access method. From this position, they reconfigured settings affecting hundreds of exit relays.
The attackers deployed two categories of modifications across the 333 compromised exit nodes. The first redirected SSH traffic to 12 attacker-controlled interception servers, allowing credential theft from users who failed to heed host key warnings. The second blocked ports used for encrypted email while permitting unencrypted email transmission, enabling the attackers to capture messages if email services fell back to unencrypted connections. Researchers documented the scheme through honeypots and polling scripts that identified affected nodes.
Investigators remain uncertain about critical aspects of the operation. The methods used to compromise all underlying servers remain unclear, though a hosting company breach represents one possibility. The attacker’s identity is similarly unknown, though financial motivation appears likely based on targeting patterns. Additionally, unexplained circumstances surround how an RSA key gained acceptance on Switzerland2 despite appearing absent from authorized key records.
Security experts highlighted the incident’s implications for network defense, emphasizing configurations that enforce encrypted email-only policies and disable password authentication in favor of SSH key-based access.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI