Attackers hijack over 300 Tor exit relays to intercept SSH sessions and steal passwords

A researcher found more than 300 malicious Tor exit relays, at their October 4 peak about 7.46 percent of exit capacity, rerouting SSH connections to twelve interception servers. The attackers edited relay torrc files to allow port 22, and each hijacked exit presented its own host key before connecting onward to the real server, so sessions worked while passwords typed by users who accepted the key were captured. Key-based logins could not be relayed. The operator of the largest affected relay family traced the root cause to the Ebury backdoor and a reused plaintext password with SSH password authentication left enabled. Tor flagged the relays by October 5.

Check

If you used SSH over Tor between October 1 and 5 and accepted a changed host key, treat typed passwords as stolen and rotate them immediately.

Affected

Users who sent SSH password logins through a hijacked Tor exit relay and accepted the interceptor's host key had their passwords and session activity captured.

Fix

Use key-based SSH rather than passwords, verify host keys, rotate any exposed credentials, and have relay operators check torrc files and hosts for the Ebury backdoor.