Attackers took over more than 300 Tor exit relays in early October and captured SSH passwords. Anyone who logged in to a server that way should change those passwords.
Attackers took control of more than 300 Tor exit relays in early October and used them to steal passwords for remote servers. A researcher who publishes as kaba found the attack. It affected people who logged in to a server over SSH through Tor with a password. The relays were out of the network by October 5.
Tor is a network that passes internet traffic through several relays. The last one, called an exit relay, is where traffic leaves for its destination. SSH is a common way to log in to and manage a remote server.
On October 2, kaba scanned Tor's roughly 3,000 exits and found 333 sending SSH traffic to the same 12 servers run by the attackers. A separate analysis of public data counted 377 relays run by 59 operators that switched to the attacker's setup between October 1 and 4. It calls that a policy match, not proof of compromise. At the peak on October 4, these relays made up 7.46% of Tor's exit capacity.
The attackers edited the relays' settings so they would carry SSH traffic. Instead of reaching the real server, a connection landed on one of the 12 interception servers. That server then connected to the real one, so everything seemed to work.
A password sent this way went straight to the attacker. The interceptor could also watch the session and log in separately with the stolen password. In kaba's test setup, it ran an installer in the same form as one that put Ebury on a relay operator's server. Ebury is a backdoor that hides inside OpenSSH, the common SSH software.
To be exposed, several things had to happen together. Someone connected to an SSH server over Tor between October 1 and the afternoon of October 5. The connection landed on a hijacked exit and was intercepted. The person accepted the interceptor's host key, which is the server's identity check. Then they typed a password. No count of victims exists.
This matters for businesses because IT staff, developers and vendors often manage servers this way. A stolen server password can give an outsider access to company systems.
Logins that use SSH keys instead of passwords could not be relayed to the real server. The same goes for anyone who did not use Tor, or who stopped when their software warned that the server's identity had changed. After October 5, no relay with the attacker's setup remained in the network.
The alert box above lists the steps. The key point is to treat any password typed after accepting an unfamiliar or changed host key over Tor in that window as stolen. Also have the server checked for signs of Ebury.
The Tor Project began flagging the relays on October 4 and told relay operators that attackers appear to be breaking into Linux machines and editing their settings. How the attackers got in, and who they are, is not stated in the material available. Other interception servers may have used different host keys than the one kaba recorded.
If you logged in to a server with a password over Tor in early October and accepted a new key, change that password and have the server checked.
Scammers are emailing Humboldt County well permit applicants and demanding $5,960 before a permit is issued. The county says the fee is fake.
Read more: Fake County Emails Demand $5,960 Fee for Well PermitsCallers posing as the Sheriff's Office told a Sarasota County woman she missed jury duty. She lost over $40,000, and the same scam is hitting others.
Read more: Fake jury duty calls cost one Florida woman over $40,000Europol warns that scam callers can fake the number on your screen, so the safest move is to hang up and call back using a number you found yourself.
Read more: Got a suspicious call? Hang up and look up the number yourself
