333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
An attacker gained access to a Tor management server using a compromised password and installed the Ebury backdoor, a decade-old Linux malware. The attacker then accessed a second Tor server called Switzerland2 via SSH using an RSA key not found in authorized keys, allowing reconfiguration of exit nodes. The compromised nodes were used to intercept unencrypted email traffic and redirect SSH connections through attacker-controlled servers, targeting sensitive communications.
Key points
- 300+ Tor exit nodes hijacked starting late August
- Attack used reused credentials and Ebury Linux backdoor to gain access
- Attacker intercepted SSH traffic and unencrypted email communications
- Compromised infrastructure redirected connections through attacker servers
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Ars Technica did the reporting; read the original for the full story.
Read the full story at Ars Technica
