How I got over 300 Tor exit nodes removed
A security researcher details how they identified and helped remove 333 Tor exit nodes that were performing man-in-the-middle attacks on SSH connections. The attackers used a Linux backdoor to intercept traffic and steal credentials from unsuspecting users.
Why it matters
This highlights a significant vulnerability in the Tor network's infrastructure and the ongoing risks of using unencrypted protocols over anonymizing relays.
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.
To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control.
The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux).
The attack appears to have had two primary goals:
By blocking certain ports, they made their exit nodes handle only unencrypted mail traffic. An interesting writeup by one of the victims (a veteran Tor operator) goes into great detail about that: lists.torproject.org/mailman3
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in