More than 300 Tor exit nodes were compromised by unknown attackers in an operation designed to intercept unencrypted communications and steal login credentials, according to a report released Tuesday.
The breach began in late August when attackers obtained valid credentials to access a Tor management server through password reuse. Once inside, they deployed Ebury, a Linux backdoor from 12 years prior, and used it to establish further access to a second Tor infrastructure server called Switzerland2. The attackers then modified configurations on multiple exit nodes to redirect traffic and monitor communications. The actual compromise of the 333 exit nodes occurred from October 2 to October 5, lasting approximately three days before being detected.
The attackers implemented two primary attack vectors on the compromised nodes. First, they redirected SSH traffic to 12 interceptor servers under attacker control, allowing them to capture SSH passwords from users who proceeded despite host key change warnings. Second, they blocked encrypted email ports while permitting unencrypted ones, attempting to force email services to downgrade connections. The attackers then positioned themselves to capture plaintext email messages in transit. A Tor volunteer who encountered the compromised nodes received a host identification warning and subsequently discovered that users ignoring such warnings had their credentials stolen, server access compromised, and systems infected with the Ebury backdoor.
Investigators remain uncertain about several aspects of the operation. It remains unclear how attackers gained administrative control over all 333 affected servers, whether a hosting company itself was breached, or the identity of the threat actors. Questions also persist regarding why Switzerland2 accepted an RSA key that investigators could not locate in its authorized keys file. Experts have speculated that financially motivated crime groups may be responsible, based on the choice of tools and data collection methods employed.
Security researchers recommend multiple defensive measures to prevent similar attacks, including configuring email systems to accept only encrypted connections and disabling password-based SSH authentication in favor of key-based methods.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI