333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

For 3 days this month, 333 exit nodes were hacked in hopes of stealing sensitive data.

The short version

• Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.
• The hijacking began in late August, when, according to Tor volunteers , the attacker used a valid password that had been reused to gain access to a Tor management server.
• The attacker then installed Ebury , a backdoor written for Linux that was discovered 12 years ago.

What happened

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well.

Why it matters

Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Summary by Nerd News Network. Read the full article at Ars Technica via the links above and below.