More than 300 Tor exit nodes were compromised by unknown attackers in an operation designed to capture unencrypted communications and credentials, according to a report published this week. The attack began in late August when attackers used a reused password to access a Tor management server, then installed Ebury, a Linux backdoor discovered over a decade ago. From there, they extended their control to a second Tor server called Switzerland2 and ultimately affected 333 exit relays across the network.
The attackers employed two primary tactics to steal data. First, they redirected SSH connections through 12 attacker-controlled servers, allowing them to intercept passwords and monitor commands entered by users. When people ignored security warnings about changed host keys, attackers stole credentials, accessed target systems, and deployed additional malware. Second, they blocked encrypted email ports while permitting unencrypted ones, attempting to force email services to downgrade connections so messages could be intercepted in readable form. The campaign ran from October 2 through October 5.
A Tor volunteer investigating the incident discovered the compromise after personally encountering the SSH redirection and created scanning tools to identify all affected nodes. The investigation revealed that once users ignored host key warnings, attackers performed three sequential actions: password theft, command observation through an open connection, and malware installation. The researchers established several key facts but noted significant unanswered questions, including how attackers gained access to so many servers and the identity of the perpetrators.
Security experts believe the attackers were likely motivated by financial gain based on their focus on stealing credentials and unencrypted data. The incident underscores the importance of security measures such as enforcing encrypted email traffic, rejecting unencrypted ports, and disabling password-based authentication in favor of SSH key pairs. One remaining mystery involves how an RSA key gained access to Switzerland2 despite lacking evidence of proper authorization.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI