How I got over 300 Tor exit nodes removed

On Friday, October 2nd at 9:35am, 333 infected Tor exit nodes initiated a coordinated campaign to intercept SSH connections and gather unencrypted data. These exit nodes, out of the approximately 3000 total exit relays, comprised roughly 10% of the network. The attackers had compromised these servers two months earlier, in August, and deployed their Ebury 1.8.3 payload, an OpenSSH backdoor and credential stealer for Linux.

The primary objectives of the attack were to block certain ports, forcing their exit nodes to handle only unencrypted mail traffic, and to execute an SSH Man-in-the-Middle (MITM) attack.

When a user attempted to establish an SSH connection over port 22, they were unknowingly redirected to one of 12 interception servers. This incident went unnoticed initially, as encrypted web traffic continued to function as usual. Upon receiving a warning and proceeding with the login, the attacker executed three actions. I alerted the Tor Project's network health team about my findings, and they promptly confirmed the attack and contacted the affected relay operators.

The Tor Network Health Team described the attack pattern, noting that the attacker gained access to Linux-based hosts, modified the torrc file to turn non-exit machines into exit nodes, and then executed the SSH attack.

In an effort to identify the infected exit nodes, I developed a script using exitmap to test connections from one server to another while pinning each exit node. Around a dozen relays displayed a fake fingerprint, while over 300 did not intercept any traffic but redirected through the interception servers. This confirmed the infected status of these nodes.

Further analysis involved using sshesame as a honeypot, which revealed the attackers used the Python SSH library paramiko and attempted to install Ebury using Perl. The attackers also checked for permissions before executing a base64-encoded command.

The source of the compromise is still a mystery, with potential theories including a hacking of the hosting company (as discussed on lists.torproject.org) or a financially motivated crime group behind the attack, given the wide use of Ebury and the collection of unencrypted data. Marc-Etienne M. Léveillé from the Tor Project suspects that the attacker deliberately launched the attack on a Friday, hoping for minimal response.

Regardless of the origin, the attack's impact is evident, as demonstrated by a clear dip in metrics.torproject.org on October 4th. The Tor Team's swift response is commendable and highlights the importance of enhanced security measures for relays and bridges, such as disabling password authentication and using SSH keys.