● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
Over 300 Tor exit nodes compromised to intercept SSH and unencrypted mail traffic
Key points
- 333 Tor exit nodes (10% of network) were compromised.
- Attackers intercepted SSH connections and unencrypted mail traffic.
- Ebury 1.8.3 payload was used to steal credentials and monitor SSH.
- Tor Project's network health team initiated node removal.
- Attackers redirected SSH connections to 12 interception servers.
- Compromised relays made up 7.46% of Tor's exit capacity on October 4.
- The Tor Project began flagging relays on October 4.
- A researcher named kaba discovered the attack.
- Hijacking began in late August.
- Attackers used a reused password to access a Tor management server.
- Attackers connected from the management server to Switzerland2 via SSH.
- Attackers used an RSA key to access Switzerland2.
- Attackers reconfigured settings on two exit nodes hosted by Switzerland2.
Coordinated Attack on Tor Network
On Friday, October 2, 333 Tor exit nodes initiated a coordinated campaign to intercept SSH connections and gather unencrypted data. These nodes constituted approximately 10% of Tor's total exit relays. The attackers had gained access to the servers in August and deployed the Ebury 1.8.3 payload, which is an OpenSSH backdoor and credential stealer for Linux.
Attack Objectives and Methods
The attack had two primary goals: to gather unencrypted mail traffic and to intercept SSH connections via Man-in-the-Middle (MITM) attacks. By blocking certain ports, the compromised exit nodes were configured to handle only unencrypted mail traffic. For SSH connections, users attempting to connect over Port 22 were redirected to one of 12 SSH interception servers. If a user ignored the SSH warning about a changed remote host identification, their password would be stolen, their session monitored, and their server potentially infected with Ebury.
Discovery and Response
The compromise was discovered when an SSH connection was redirected, triggering a 'REMOTE HOST IDENTIFICATION HAS CHANGED!' warning. The individual who discovered this contacted the Tor Project's network health team on Friday evening. The team confirmed the novelty of the attack and began contacting the operators of the affected relays to facilitate their removal from the network.
Updates
- Hijacking began in late August.
- Attackers used a reused password to access a Tor management server.
- Attackers connected from the management server to Switzerland2 via SSH.
- Attackers used an RSA key to access Switzerland2.
- Attackers reconfigured settings on two exit nodes hosted by Switzerland2.
- Attackers redirected SSH connections to 12 interception servers.
- Compromised relays made up 7.46% of Tor's exit capacity on October 4.
- The Tor Project began flagging relays on October 4.
- A researcher named kaba discovered the attack.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub jaksi/sshesame GitHub eset/malware-research GitHub marc-etienne/eset-malware-researchHow outlets covered it
Unknown attackers hijacked 333 Tor exit nodes between October 2-5, reconfiguring them to redirect SSH connections and favor unencrypted email traffic. This allowed the attackers to potentially intercept SSH credentials and plaintext email messages from Tor users.
Attackers compromised over 300 Tor exit relays in early October, redirecting SSH connections to malicious servers to steal login passwords. The Tor Project identified and flagged these relays, removing them from the network's consensus by October 5, mitigating the threat.
On October 2, 333 Tor exit nodes, representing 10% of the network, began intercepting SSH connections and unencrypted email traffic. The attackers had deployed the Ebury 1.8.3 payload two months prior to steal credentials and monitor SSH sessions. The Tor Project's network health team was notified and began contacting affected relay operators to remove the compromised nodes.