Tor Exit Relays Hijacked to Steal SSH Passwords

In early October, attackers compromised more than 300 Tor exit relays to intercept SSH connections and steal login credentials. This alarming discovery was made by a cybersecurity researcher who uncovered that the manipulated relays redirected traffic to servers designed to capture passwords.

Tor exit relays serve as the final node where traffic leaves the Tor network to reach its destination. The attackers exploited these relays between October 1 and 5, targeting SSH connections that accepted the interception server’s host key.

Details of the Attack

The Tor Project identified and began flagging these compromised relays on October 4, and by the following day, they were removed from the Tor network consensus. At their height, these rogue relays accounted for 7.46% of the network’s exit capacity, based on consensus weight.

A researcher known as kaba conducted a scan of Tor’s approximately 3,000 exit nodes on October 2, revealing 333 redirects to 12 specific interception servers. Data analysis indicated that 377 relays, operated by 59 different entities, had adopted the attacker’s exit policy within the first few days of October.

Technical Mechanism Behind the Breach

To facilitate the attack, the exit policy of the compromised relays was modified to allow traffic on port 22, the standard port for SSH, enabling the interception of SSH connections. This change also inadvertently disabled encrypted email ports and opened plaintext-capable ones.

When users made SSH connections through these relays, they were redirected to one of the interception servers instead of their intended destination. The interception server would present its own host key, leading to a warning for users familiar with the legitimate server’s key.

Implications and Countermeasures

Users who connected to SSH servers via Tor during the attack window and accepted an unfamiliar host key are advised to change their passwords immediately and inspect their servers for signs of the Ebury malware, which was used in the attack.

The Tor Project’s network health team and kaba collaborated to identify and neutralize the threat. The compromised relays were flagged as ‘BadExit,’ preventing them from being used as exit nodes.

The attack raises concerns about the security of Tor nodes and the need for vigilance among relay operators. The breach was partly facilitated by the reuse of passwords and the presence of the Ebury backdoor on compromised servers.

Future Outlook

The incident emphasizes the importance of maintaining robust security practices for Tor relay operators and underscores the potential vulnerabilities in the network. As investigations continue, the Tor Project recommends proactive measures for detecting unauthorized changes in relay configurations.

Relay operators are urged to verify their configurations for any unauthorized changes and follow the Tor Project’s guidelines for securing their systems. This includes checking for unusual system processes, network rules, and unauthorized SSH keys.