Attackers hijacked over 300 Tor exit nodes, installing the Ebury Linux backdoor via compromised management servers to intercept SSH traffic and block encrypted email ports.
The case was revealed following an investigation published on Tuesday, while the actions of the unknown individuals were traced from October 2 to 5. According to the data, a total of 333 network exit nodes were affected by the operation.
How the breach started
The process began in late August, when an attacker used a reused password to gain access to a key network management computer, where he installed an old remote access program for Linux systems.
The attackers then connected from the first computer to a second one, using a digital key that was not on the list of approved keys. After gaining access to that computer, they made configuration changes to two nodes hosted there. Researchers have not yet been able to confirm exactly how the attackers gained control of all the underlying computers.
READ ALSO
GoBalance bug could allow dark web website addresses to be hijacked
What happened to the users?
The changes made to the nodes directly affected two basic types of communication:
- Remote control connections: Traffic from connections made over the network was redirected to 12 computers set up by the perpetrators themselves. Users who ignored warnings that the identity of the remote computer had changed ended up typing their passwords into the strangers' systems.
- Email messages: The compromised nodes blocked the ports used for secure and encrypted email, leaving only the ports that accept unencrypted messages open. The goal was to force the services to lower their security level so that messages could pass through without encryption.
So far, it remains unclear whether efforts to reduce email security have achieved their goal.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)