A coordinated campaign targeting the Tor network compromised more than 300 exit nodes over a three-day period earlier this month, according to a report from a Tor volunteer researcher. The attackers sought to capture sensitive data by intercepting unencrypted communications and SSH credentials.
The breach began in late August when an unauthorized actor obtained valid credentials to access a Tor management server. Using the compromised credentials, the attacker installed Ebury, a Linux backdoor originally discovered over a decade ago. The attacker subsequently accessed a second server called Switzerland2 via SSH, though investigators could not locate the RSA key used in the authorized keys file. After establishing administrative control of Switzerland2, the attackers deployed the Ebury backdoor there as well and reconfigured settings on exit nodes hosted by that server.
During the October 2 to October 5 incident, the hijacked exit nodes were configured to intercept both SSH and email traffic. SSH connections were redirected to 12 attacker-controlled servers designed to capture login credentials and execute commands on compromised systems. Simultaneously, the nodes blocked encrypted email ports while allowing unencrypted ones, potentially enabling the attackers to harvest messages if services downgraded to unencrypted connections. A Tor volunteer discovered the compromise after receiving a host key change warning when attempting an SSH connection.
To identify the affected nodes, the researcher developed a detection method polling approximately 3,000 Tor exit nodes and established honeypots to observe the attackers’ activities. The investigation confirmed that users ignoring security warnings would have their SSH passwords stolen, had their commands monitored, and risked infection with additional malware.
Key questions remain unresolved, including how the attackers gained control of so many servers and the identity of the perpetrators. Investigators noted that the use of Ebury and focus on collecting unencrypted data suggest financially motivated actors. Experts recommend implementing encrypted-only email policies and disabling password-based authentication in favor of SSH keys as preventive measures.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI