Attackers hijacked over 300 Tor exit relays in early October by modifying torrc configurations to enable and redirect SSH traffic to password-stealing servers.
The incident peaked at 7.46% of exit capacity before the Tor Project removed the nodes.
The incident occurred between October 1 and 5. Tor network administrators and security researchers detected the change, which was isolated and fixed within a few days.
How the attack worked
The Tor network uses exit nodes as the endpoints from which user traffic reaches its destination. The attackers were able to change the settings on hundreds of these nodes to allow remote administration connections to pass through.
When a user tried to connect to a remote computer via Tor during those days, the connection was redirected to servers controlled by the attackers. There, if the user typed in their password, the login details ended up in the wrong hands. At the peak of the incident on October 4, the compromised nodes represented 7,46% of Tor's total output capacity.
READ ALSO
TeamUpdraft breach: Login keys and personal customer information stolen
This process only affected password-based connections. Those using digital keys for identification could not be intercepted in this way, as the system relies on unique data per session.
The reaction and detection
The traffic was first detected by a researcher who scanned the nodes on October 2 and found 333 of them redirecting connections to 12 sniffer servers. At the same time, analysis of the data showed that dozens of nodes had changed their operating policies.
Starting on October 4, administrators began identifying and isolating affected nodes, excluding them from the network. By the afternoon of October 5, none of the compromised nodes remained active.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)