333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Summary
Hackers took control of 333 Tor exit nodes to capture unencrypted email and redirect SSH connections through servers they controlled. They used stolen passwords and a backdoor called Ebury to install malicious software and intercept sensitive data from Tor users between October 2 and 5.Key Facts
- More than 300 Tor exit nodes were hijacked to capture unencrypted emails and SSH traffic.
- The attackers accessed a Tor management server using a reused password.
- They installed a Linux backdoor named Ebury, first discovered 12 years ago.
- Attackers redirected SSH traffic to 12 servers under their control to steal passwords and commands.
- Ports for encrypted email were blocked, while ports allowing unencrypted email were kept open to intercept messages.
- The attack lasted from October 2 to October 5.
- Tor volunteers found that ignoring SSH warnings exposed users to password theft.
- Researchers are still unsure how the attackers gained access to so many servers.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
