Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Traffic

A Tor volunteer known as Kaba logged in over the anonymity network on a Friday morning this month and got a message no one wants to see: a warning that the remote host's identity had changed, a classic sign of a man-in-the-middle attack. Kaba had just become one of the people caught in a three-day hijacking of more than 300 Tor exit nodes, according to a post-mortem reported Tuesday by Ars Technica.

What happened to the Tor network this month?

Between October 2 and October 5, unknown attackers took control of 333 Tor exit relays — the servers that carry traffic out of the Tor network to its final destination, according to Ars Technica. The relays were reconfigured to redirect SSH connections and to make unencrypted email easier to intercept. Tor volunteers had already posted a partial account of the breach; Tuesday's report added the full count of affected relays and new detail on how SSH traffic was rerouted.

How did the attackers get in?

The intrusion started in late August, when the attacker used a reused password to break into a Tor management server, Tor volunteers said, as reported by Ars Technica. From there the attacker installed Ebury, a Linux backdoor first discovered 12 years ago, then moved via SSH to a second server called Switzerland2, logging in with an RSA key investigators could not find among that server's authorized keys. With control of Switzerland2, the attacker installed Ebury again and reconfigured two exit nodes it hosted. Investigators have not determined how the remaining relays, out of the 333 total, were compromised, according to the report.

What did the hijacked nodes actually do?

Two changes stood out. SSH traffic passing through the infected exit nodes was rerouted to one of 12 servers the attackers controlled, so anyone who clicked past the host-key warning and typed a password handed it over. Separately, the nodes blocked encrypted email ports — 25, 465, 587, 993 and 995 — while leaving plain-text mail ports open, a setup designed to catch any email service that downgraded a connection. Ars Technica reported it remains unclear whether any such downgrade attempts succeeded.

"If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won't notice anything at first," Kaba wrote in the post-mortem, adding, "That's exactly what happened to me on Friday morning."

Who is affected, and what should Tor users do now?

Anyone whose Tor circuit exited through one of the 333 relays during the three-day window was at risk, but the exposure was limited to SSH logins and unencrypted email — encrypted web traffic kept working normally, according to the report. The practical step for Tor users is the one built into SSH itself: never click past a host-key warning. The affected relays have since been removed or fixed, per the volunteer report cited by Ars Technica.

What is still unknown about the attack?

Investigators have not identified who carried out the intrusion or how most of the 333 relays beyond the first two were taken over, Ars Technica reported. The use of Ebury, a backdoor tied to a long-running cybercrime campaign first documented in 2014, suggests a motive of harvesting credentials and data rather than simple vandalism, though the report does not name a suspect or confirm that motive.