Hackers compromise 333 Tor exit nodes to siphon SSH credentials and read plaintext email
Researchers discovered that over 300 Tor exit relays were hijacked in early October, allowing attackers to redirect SSH connections and capture unencrypted email messages.
In a campaign uncovered by a Tor volunteer, more than three hundred exit relays were taken over between October 2 and October 5. The breach started with a valid, reused password that opened a Tor management server, where the attackers installed the Ebury backdoor, originally identified twelve years ago. They then accessed a second server, Switzerland2, via SSH using an undocumented RSA key and replicated the backdoor there.
With control of Switzerland2, they altered the configuration of two hosted exit nodes, ultimately compromising 333 relays. The modifications redirected SSH sessions to one of twelve malicious interceptors and blocked ports used for encrypted email (25, 465, 587, 993, 995) while allowing unencrypted mail, giving the attackers a window to read plaintext messages. The volunteer Kaba reported that users who ignored host-key warnings unwittingly exposed their SSH passwords, confirming the attack’s effectiveness on at least one occasion.
Why it matters
The breach shows that even privacy-focused networks like Tor can be subverted, exposing users' credentials and communications.
In this story
