Attackers Took Over More Than 300 Tor Exit Relays to Steal SSH Passwords

A researcher who publishes as kaba found that attackers took control of more than 300 Tor exit relays in early October. Exit relays are the final hop in a Tor connection, where traffic leaves the network for its destination. A scan on October 2 of roughly 3,000 exits found 333 redirecting SSH traffic to the same 12 interception servers. Only a password login to an SSH server through Tor between October 1 and 5, after accepting the interception server's host key, could have been captured.

The Tor Project began flagging relays on October 4, and by October 5 none remained in the consensus, the list Tor clients use. At the peak, affected relays made up 7.46% of Tor's exit capacity. A separate analysis of public directory data counted 377 relays run by 59 operators that switched to the attacker's exit policy, though it calls this a policy match and not proof of compromise. The attackers edited relay configuration files to allow SSH on 342 relays that had blocked it, and 24 relays that were not exits became exits. The Tor Project's network health team said the attacker appears to be gaining access to Linux hosts and editing their configuration.

The same change closed the encrypted mail ports, IMAPS and POP3S, and on most relays opened the plaintext-capable ones, POP3 and IMAP. The analysis says it is not visible why the encrypted mail ports were closed.