Key facts
- 333 Tor exit nodes were hijacked.
- SSH traffic was redirected to 12 attacker-controlled servers.
Hackers Hijack 333 Tor Exit Nodes to Intercept SSH and Email Traffic
IN SHORT
Hackers hijacked 333 Tor exit nodes between October 2 and October 5, reconfiguring them to intercept unencrypted email and redirect SSH traffic to attacker-controlled servers. The compromise began in late August with the exploitation of a reused password on a Tor management server, allowing the attackers to install a Linux backdoor known as Ebury.
Key Numbers
333Tor exit nodes hijacked
12attacker-controlled interceptor servers
October 2 to October 5hijacking period
12years since Ebury backdoor discovered
Who's Involved
hackers
hijacked 333 Tor exit nodes to intercept traffic
Tor volunteers
partially outlined initial compromise and email interception attempt
Kaba
Tor volunteer who authored the post detailing the attack
↳ Why This Matters
The hijacking of Tor exit nodes poses a significant risk to user privacy and security by enabling the interception of sensitive data, including plaintext emails and SSH credentials, potentially compromising communications and systems.