Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.

Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception server's host key, could have been captured.

The Tor Project began flagging relays on October 4, and by October 5, none remained in the consensus, the list of relays that Tor clients use. At the peak on October 4, the relays carrying the attacker's exit policy made up 7.46% of Tor's exit capacity, measured by consensus weight, according to an analysis of public Tor directory data posted to the tor-relays mailing list.

The researcher, who publishes as kaba, scanned all of Tor's roughly 3,000 exits on October 2 and found 333 redirecting SSH to the same 12 interception servers. The directory-data analysis counts 377 relays run by 59 operators that switched to the attacker's exit policy between October 1 and 4, which it calls "a policy match, not proof of compromise."

An exit relay only carries traffic to the ports its exit policy allows. The attackers rewrote that policy in the relays' torrc configuration files to allow port 22 (the SSH port), enabling SSH on 342 relays that had blocked it. Another 24 relays that had not been exits at all became exits.

Source link