Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.
The hijacking began in late August when, according to Tor volunteers, the attacker used a valid reused password to access a Tor management server, installed the Ebury Linux backdoor, pivoted to a server called Switzerland2 via SSH with an unexplained RSA key, and reconfigured two exit nodes. Ultimately 333 exit relays were involved from October 2 to October 5.
One change redirected SSH on port 22 to 12 attacker-controlled interceptors; users who ignored host-key warnings had passwords stolen, sessions observed, and servers infected with Ebury. Another change blocked encrypted email ports (25, 465, 587, 993, 995) while allowing unencrypted reception to capture plaintext if services downgraded.
Tor volunteer Kaba polled ~3,000 exit nodes and ran honeypots to document the campaign. Investigators do not know how all servers were compromised or who is responsible; Ebury use suggests financially motivated actors. Mitigations: enforce encrypted email only, disable SSH password auth in favor of keys, heed host-key warnings.