Published details incident, during which attackers managed to gain control of 333 output nodes of the Tor network (in total there are about 3000 output nodes in Tor) and organize an interception on them unencrypted traffic and redirection of SSH connections. The attack began on October 2 (Friday evening), but was detected and began to be blocked on October 4. On October 5, all compromised servers were shut down by operators or the attackers themselves. The investigation showed that the attackers gained access to the servers two months before the attack on Tor users and installed malware on the compromised systems Ebury 1.8.3.
The purpose of the attack was to intercept passwords, keys and confidential information in transit unencrypted traffic, as well as capturing SSH passwords. When analyzing unencrypted traffic, attackers focused on unencrypted calls to mail servers. To encourage a rollback to work without encryption, the network ports used to organize an encrypted communication channel with mail servers were blocked at the output nodes. Unencrypted traffic was analyzed on the fly.
To collect SSH passwords, SSH requests were redirected to one of the attackers’ 12 servers. These servers accepted an SSH connection and prompted for a password on behalf of the server to which the connection was made. Since the host keys did not match, ssh on the client side issued a warning about connecting to an unknown server.
If the user ignored this warning and entered a password to connect, the malicious server broadcast the connection to the legitimate target SSH server, saved the password entered by the victim, and intercepted information about the actions in the SSH session. At the same time, they connected to the target server with the captured password and installed the Ebury malware on it. By gaining control of Linux servers that were not Tor exit nodes, the attackers changed the settings in the torrc file and turned them into new malicious Tor exit nodes.
To identify all malicious exit nodes, the researcher who identified the problem used the exitmap utility to enumerating all output nodes, establishing an SSH connection through each of them and checking that the request was forwarded. How exactly the attackers gained access to the captured Tor nodes is not yet clear; among other things, there have been speculations about operators being compromised hosting.