333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.
In a recent attack, over 300 Tor exit nodes were compromised and manipulated to intercept Secure Shell (SSH) traffic, enabling hackers to retrieve unencrypted email data, a researcher reported on Tuesday. The breach began in late August, when an attacker gained access to a Tor management server using a reused valid password. The intruder subsequently installed Ebury, a Linux backdoor that dates back 12 years.
Further mysteries emerged when the attacker established a connection from the management server to a second Tor server, Switzerland2, via SSH using an RSA key that investigators were unable to locate among Switzerland2's authorized keys. Having gained administrative control of Switzerland2, the attacker installed Ebury on this server as well. Lastly, the hacker reconfigured two exit nodes that Switzerland2 was hosting.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
