More than 300 exit nodes within the Tor network were subjected to an organized compromise campaign involving 333 nodes, which were reconfigured to prioritize unencrypted email traffic and redirect Secure Shell (SSH) protocol connections through servers controlled by the attackers, according to a report released by a network volunteer.
The attacks began last August when the attacker used a previously used password to gain access to a Tor network management server, subsequently installing a malicious software known as Ebury, a Linux backdoor discovered twelve years ago. The compromise extended to a second Tor server called Switzerland2, where an RSA key was used that investigators were unable to find among the authorized keys for this server for unknown reasons.
Details of the Interception and Redirection Operation
Investigations revealed that the total number of affected exit nodes reached 333, which were exploited to carry out two main types of attacks between October 2 and October 5:
- Intercepting SSH connections: SSH traffic passing through the Tor network was redirected to one of 12 interception servers controlled by the attackers. When users ignore key change warnings, they are prompted to enter their passwords.
- Targeting email: Ports used for accepting encrypted email (25, 465, 587, 993, and 995) were blocked while unencrypted ports were left open, allowing attackers to attempt to obtain messages in cleartext if services downgraded from encryption.
How was the compromise detected?
The network volunteer known as Kaba, who was personally affected by the compromise, noted that a user might not notice any change initially when passing through one of the infected nodes, as encrypted web traffic is passed as usual. However, an attempt to connect via port 22 leads to an unauthorized redirection toward the attackers' servers, accompanied by an explicit warning that the remote host identification has changed.
To assess the scope of the campaign, the volunteer created a script to scan about 3,000 exit nodes in the Tor network and verify the validity of incoming SSH fingerprints, in addition to setting up a honeypot to monitor login attempts and malware installation.
What does this event represent for security experts?
This incident leaves open questions about how the attackers were able to access such a large number of servers, as well as the entity behind the attack, although investigators suggest that a financially motivated criminal group is behind the use of the Ebury malware.
What does this mean for users and system administrators? This compromise emphasizes the critical role that defense-in-depth strategies play in protecting data, and highlights the necessity of configuring email accounts to accept only encrypted traffic while rejecting unencrypted ports, in addition to relying on SSH keys and disabling traditional password authentication.