Do Son 
Image: KABA
A coordinated attack turned 333 Tor exit nodes into a trap for SSH users. The infected relays made up roughly 10% of all exits on the network. Even worse, the attackers had hidden the Ebury malware on the servers for two months before they struck.
In a detailed write-up on how the Tor exit nodes were removed, researcher KABA explains how he caught the campaign. He also shows how the Tor Project shut it down within days.
A Two-Pronged Attack
The campaign began on Friday, October 2, at 09:35. The attackers had broken into the servers in August. Then they quietly deployed Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux.
The attack had two goals. First, the relays blocked certain ports, so they only handled unencrypted mail traffic. Second, they hijacked SSH sessions on port 22. Victims were silently sent to one of 12 SSH interception servers.
KABA hit the trap himself. His SSH client warned that “REMOTE HOST IDENTIFICATION HAS CHANGED!” However, users who ignored that warning faced serious harm. The attacker stole their password and watched every command. In addition, a second connection infected their server with Ebury.
A Fast Takedown
KABA reported his findings that same Friday evening. The Tor network health team was surprised. As the team put it, “We’ve not seen an attack like that before.”
After that, the response moved quickly. On October 4, the team warned relay operators and flagged the relays as BadExit. As a result, clients stopped using them as exits. By October 5, all infected servers were offline.
The health team also described the attacker’s pattern. “It seems the attacker is gaining access to Linux based hosts,” the team said. Moreover, the attacker edited the torrc file on some servers to turn non-exit relays into exits.
How the Infected Relays Were Found
To find them, KABA used exitmap to test each of the roughly 3,000 Tor exit nodes. His script pinned one exit at a time. Then it opened an SSH connection between two of his own servers. About a dozen exits served a fake key. Meanwhile, over 300 others routed traffic through the same interception servers.
Open Questions Remain
Still, no one knows how the attackers got in. Likewise, their identity remains unclear, though the use of Ebury points to a profit-driven crime group. Researcher Marc-Etienne M. Leveille warns that “there are most likely other compromised Tor relays out there.”
The lesson is simple. Turn off SSH password logins and use keys instead. As one Tor operator put it, “relays/bridges need to be treated as highly targeted production machines.”
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
