Attackers Hijacked 300+ Tor Exit Relays to Intercept SSH Passwords
Summary
Attackers altered more than 300 Tor exits in early October to redirect SSH connections. Passwords were exposed only when users accepted an interception server's host key and logged in by password; Tor removed the affected relays by October 5.
Key points
- A researcher found 333 Tor exits redirecting SSH traffic to 12 interception servers on October 2; directory data identified 377 relays that adopted the attacker's exit policy.
- The policy changes enabled port 22 and, on most affected relays, plaintext mail ports while closing encrypted mail ports.
- Interceptors could capture passwords after users accepted their host keys; key-based authentication could not be relayed to the real server in the same way. The number of exposed users is unknown.
- A Tor relay operator confirmed that two of his servers were infected with Ebury 1.8.3, which attackers used to gain access and alter relay configuration. The relationship between other affected hosts and Ebury remains unknown.
- The operator attributed the initial compromise to a reused password stored in plaintext, with SSH password authentication enabled on an internet-facing management server; the password's source is unknown.
- Tor authorities flagged and removed affected relays from the consensus by October 5. Operators were advised to check relay policies and hosts, rotate potentially exposed passwords, and reinstall infected systems.
Article Details
- Attack Vectors
- Attackers altered Tor relay exit policies to allow SSH traffic and redirect connections through interception servers.
- An SSH password could be captured when a user connected through an affected exit, accepted the interception server's host key, and authenticated with a password.
- In the Quetzalcoatl relay family, the attacker accessed a management server using a reused operator password, gained root access, installed Ebury, and then reached another server in the family.
- Ebury was present on two servers and could return after a reboot; the article describes it as a backdoor and credential stealer for OpenSSH.
- Defensive Notes
- Treat passwords entered after accepting an unfamiliar or changed SSH host key over Tor between October 1 and the afternoon of October 5 as stolen; change them and check the affected server for Ebury.
- Tor relay operators should check Relay Search for unexpected Exit flags or policies and inspect torrc and included files for changed ExitRelay, ExitPolicy, ContactInfo, MyFamily, or Nickname lines.
- Check for unexpected NAT rules on port 22, listening processes, outbound connections, users, authorized_keys entries, cron jobs, systemd units, and Tor binaries that fail package checks.
- Zimmer advised checking from a rescue system or offline disk image where possible, and using key-based login rather than typing a password into a suspected server.
- If Ebury is found, reinstall the system; the article reports that it survived a reboot. Report affected relays to [email protected].
MITRE ATT&CK
T1059.004 · Unix ShellThe attacker used shell commands to run a base64-encoded Perl installer after checking for sudo access.T1078 · Valid AccountsThe attacker logged in to the Quetzalcoatl management server using the operator account's password before gaining root access.T1557 · Adversary-in-the-MiddleThe attackers redirected SSH connections from hijacked Tor exits to interception servers, which presented their own host keys and captured passwords entered by users.
People
Georg KoppenTor Project representative who provided follow-up guidance about reporting affected relays and lifting blocks after cleanup.kabaResearcher who detected the SSH interception and scanned Tor exits using exitmap.Marc-Etienne M. LéveilléCo-wrote ESET's 2014 Ebury paper, wrote its 2024 report, and posted an updated detection script covering version 1.8.3.ZimmerOperator of the Quetzalcoatl relay family who reported that two of his servers ran Ebury version 1.8.3.
Malware
Vendors
Products
OpenSSHthe connection, it presented its own host key. A user who already knew the real server's key saw OpenSSH's warning that the remote host identification had changed, and a user connecting for the first time sawTorAttackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.