Attackers compromised more than 300 Tor exit relays in early October to redirect SSH traffic and steal login credentials, according to a recent report by The Hacker News.
The malicious campaign involved attackers gaining control of Tor exit relays to modify their configuration files. By altering the exit policies, the attackers enabled port 22, which is used for SSH, on relays that previously blocked it. When users connected to an SSH server through these compromised nodes, their traffic was routed to one of 12 interception servers. These servers presented fake host keys to users, allowing the attackers to capture passwords entered during the session. The attack was particularly effective against users who accepted the fraudulent host keys. While key-based authentication remained secure due to the nature of the SSH protocol, password-based logins were vulnerable. The Tor Project identified the malicious activity and successfully removed the affected relays from the network by Oct. 5. Investigations revealed that some compromised servers were infected with Ebury, a long-standing backdoor and credential-stealing malware. Security experts advise relay operators to perform thorough system checks, reinstall compromised hosts from scratch and rotate all credentials to mitigate the risk of persistent unauthorized access.
Source: The Hacker News
