Digital Event Horizon
333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Over 300 Tor exit nodes were hijacked by unknown hackers. The attack involved reconfiguring exit nodes to favor unencrypted email traffic and redirect SSH connections. The hijacking began with an attacker gaining access to a Tor management server using a valid password that had been reused. The attackers installed a backdoor on the management server and connected to a second Tor server through SSH. The attackers redirected SSH traffic to interceptor servers, stealing users' SSH passwords. Several mysteries remain, including how the attackers accessed so many servers and who is behind the attack. In-depth defense measures are crucial in preventing data theft in mass hacks like this one.
In a shocking revelation, researchers have discovered that over 300 Tor exit nodes, a crucial part of the decentralized network, were hijacked by unknown hackers. The attack, which occurred between October 2nd and 5th, involved reconfiguring these exit nodes to favor unencrypted email traffic and redirect SSH connections through servers controlled by the attackers. This brazen move highlights the vulnerability of the Tor network and the importance of in-depth defense measures to prevent such mass hacks.
According to reports, the hijacking began when an attacker gained access to a Tor management server using a valid password that had been reused. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago, on the management server. From there, the attacker connected to a second Tor server, called Switzerland2, through SSH, using an RSA key that investigators couldn't find among Switzerland2's authorized keys. With administrative control of Switzerland2, the attackers installed Ebury as well, and reconfigured two exit nodes that Switzerland2 hosted.
The attackers then reconfigured the servers to redirect SSH traffic to one of 12 interceptor servers. Tor users who ignored warnings that the SSH host key had changed would then enter their SSH passwords, which were stolen by the attackers. Furthermore, the attackers caused the exit nodes to block ports 25, 465, 587, 993, and 995, used to accept various forms of encrypted email, while continuing to allow ports for receiving unencrypted email.
Researchers, including Tor volunteer Kaba, who discovered the hijacking, created a script that polled all of Tor's roughly 3,000 exit nodes to check whether they received a correct SSH fingerprint from a test server. The test server then checked whether the connection came from a pinned exit node or one of the 12 SSH interception servers used by the attackers.
Several mysteries remain, including how the attackers accessed so many servers and who is behind the attack. One possibility is that a company hosting the servers was hacked, but this theory is inconclusive. Another open question is why Switzerland2 accepted an RSA key when there's no evidence it was an authorized SSH certificate.
The takeaway from this event is the crucial role in-depth defense plays in preventing data theft in mass hacks like this one. Configuring email accounts to accept only encrypted traffic and reject unencrypted ports, as well as disabling password authentication in favor of SSH keys, are essential measures to prevent such attacks.
In conclusion, the hijacking of 333 Tor exit nodes highlights the vulnerability of the Tor network and the importance of in-depth defense measures to prevent mass hacks. As researchers continue to investigate the motives behind the attack, it is essential to prioritize the security of the Tor network and the data it protects.
Related Information:
https://www.digitaleventhorizon.com/articles/Hacking-the-Hidden-Network-A-Deep-Dive-into-the-333-Tor-Exit-Node-Hijacking-deh.shtml
https://arstechnica.com/information-technology/2026/10/300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email/
Published: Thu Oct 22 07:48:55 2026 by llama3.2 3B Q4_K_M
