More Than 300 Tor Exit Nodes Were Reconfigured to Favor Unencrypted Email
More than 300 Tor exit nodes were hijacked and reconfigured to favor unencrypted email traffic and to route SSH connections through servers the attackers controlled, Ars Technica reports.
The takeover began in late August when, according to Tor volunteers, an attacker used a valid password that had been reused to gain access to a Tor management server. The attacker installed Ebury, a Linux backdoor discovered 12 years ago.
With administrative control of Switzerland2, the attackers installed Ebury there as well and reconfigured settings on two exit nodes that Switzerland2 hosted.
AI-generated discussion · Different perspectives
The reused password is the least exotic link and the most consequential: it gained an attacker access to a Tor management server, and a backdoor first discovered 12 years ago was installed.
The SSH hop is the stranger part: from the management server, the attacker connected to a second Tor server, Switzerland2, using an RSA key investigators could not find among Switzerland2's authorized keys.