Unknown attackers compromised more than 300 Tor exit nodes and reconfigured them to target unencrypted communications, according to findings disclosed Tuesday by a Tor project volunteer. The intrusion began in late August when attackers gained access to a Tor management server using a reused password, then installed Ebury, a Linux backdoor, on multiple systems including a server called Switzerland2. From October 2 to October 5, the compromised exit nodes were used to redirect SSH traffic to attacker-controlled interceptor servers and block encrypted email ports while allowing unencrypted email traffic to pass through.
The attackers’ methods exploited user behavior and technical vulnerabilities. When users attempted SSH connections through the infected exit nodes, they were redirected to one of 12 attacker servers without their knowledge. Users who ignored host key change warnings had their SSH credentials stolen, with attackers then accessing their systems and installing the Ebury backdoor. Additionally, the reconfigured exit nodes blocked common encrypted email ports while permitting unencrypted alternatives, potentially allowing attackers to capture email traffic if services downgraded connections.
Investigators have documented the initial compromise and the broad scope of the attack but face significant unanswered questions. It remains unclear how attackers gained administrative control of all 333 affected servers, though one theory suggests a hosting provider may have been compromised. The identity of the perpetrators is unknown, though the targeting of unencrypted data and use of Ebury suggest financially motivated actors. One lingering technical mystery involves how an RSA key was accepted on Switzerland2 despite no evidence it was authorized.
Experts emphasize that the incident underscores the importance of security practices including mandatory encryption for email connections and SSH key authentication rather than password-based access. The Tor volunteer who discovered the attack created detection tools to identify affected nodes and set up honeypots to observe the attackers’ methods.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI