Over 300 Tor Exit Nodes Hijacked to Intercept SSH and Email Traffic

Initial Compromise

In late August an attacker gained access to a Tor management server by using a valid password that had been reused. The attacker then installed Ebury, a Linux backdoor discovered 12 years ago, on that server.

From the management server the attacker connected via SSH to a second Tor server named Switzerland2 using an RSA key that investigators could not find among the authorized keys on Switzerland2. With administrative control of Switzerland2 the attacker installed Ebury there as well.

Traffic Interception

The attacker changed settings on two exit nodes hosted by Switzerland2. Ultimately 333 exit relays were involved in the campaign, although investigators have not established how the attackers gained control of all the underlying servers. One set of changes redirected SSH traffic traversing Tor to one of 12 attacker controlled interceptor servers. Users who ignored warnings that the SSH host key had changed would enter their passwords; the attacker stole them, watched the commands typed on the server, and opened a second connection to infect it with Ebury.

A second set of changes caused the exit nodes to block ports 25, 465, 587, 993, and 995, which are used to accept various forms of encrypted email, while continuing to allow ports for unencrypted email. If email services downgraded connections the attackers could obtain unencrypted messages, though it is unclear whether any downgrade attempts succeeded.

Ongoing Investigation

The hijacking took place between October 2 and October 5. Tor volunteer Kaba described what happened to him on the morning of Friday, October 2, and his post appeared on Tuesday. Kaba wrote that he created a script that polled Tor's roughly 3,000 exit nodes to test SSH fingerprints, and set up a honeypot to observe the interception software attempting to log in and install Ebury.

Several mysteries remain. Investigators have not determined how the attackers gained control of all the underlying servers. One possibility is that a company hosting them was hacked, but that theory is inconclusive. Kaba wrote that the use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group, though he added that this too is just speculation. Another open question is why Switzerland2 accepted an RSA key when there is no evidence it was an authorized SSH certificate.

Sources: Ars Technica