333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

Tor volunteers have reported that 333 Tor exit relays were used to intercept SSH connections and attempt to capture unencrypted email between October 2 and October 5, according to a report published Tuesday. The report, written by a volunteer identified as Kaba, disclosed new details about the campaign, including the number of compromised exit nodes and how attackers redirected SSH traffic.

The intrusions began in late August, when an attacker used a valid but reused password to reach a Tor management server, the volunteers said. The attacker installed Ebury, a Linux backdoor discovered 12 years ago, on that server. From there, the attacker connected over SSH to a second Tor server known as Switzerland2 using an RSA key that investigators could not find among Switzerland2’s authorized keys, then installed Ebury there as well. The attacker reconfigured settings on two exit nodes hosted by Switzerland2.

Those changes affected the 333 exit relays. One set redirected SSH traffic passing through Tor to one of 12 servers controlled by the attacker, so users who ignored warnings that the SSH host key had changed would enter their passwords on an interception server. Kaba described receiving the warning during an SSH session on Friday morning and said an investigation found that when users ignored it, the attacker stole the SSH password, opened a connection to observe all typed commands, and opened a second connection to infect the server with Ebury.

A second set of changes caused the exit nodes to block ports 25, 465, 587, 993 and 995, which accept various forms of encrypted email, while continuing to allow ports for receiving unencrypted email. The attackers used their access to obtain unencrypted messages if email services downgraded their connections. It is unclear whether any downgrade attempts succeeded.

Kaba built a script that polled all of Tor’s roughly 3,000 exit nodes to check whether they returned a correct SSH fingerprint from a test server, which then checked whether the connection came from a pinned exit node or one of the attacker’s 12 interception servers. The volunteer also set up a honeypot to observe the interception software attempting to log in and install Ebury.

Several questions remain unresolved. Tor volunteers still do not know how the attackers accessed so many servers, with one inconclusive possibility being that a company hosting them was hacked. The identity of the attackers is also unknown; Kaba wrote that the use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group, though that too is speculation. Kaba also noted the puzzling finding that Switzerland2 accepted an RSA key with no evidence it was an authorized SSH certificate.

The volunteers said the episode underscores the value of defense in depth, including configuring email accounts to accept only encrypted traffic and reject unencrypted ports, and disabling password authentication in favor of SSH keys.

More cybersecurity news from TechManNews.