333 Tor exit nodes hijacked to intercept SSH traffic and plaintext email

What happened

Unknown attackers hijacked more than 300 Tor exit nodes, a researcher reported Tuesday. The nodes were reconfigured to favor unencrypted email traffic and to redirect SSH connections through servers controlled by the attackers.

How the attack unfolded

According to Tor volunteers, the hijacking began in late August. The attacker used a valid password that had been reused elsewhere to gain access to a Tor management server and installed Ebury, a Linux backdoor discovered 12 years ago.

The attacker then connected from the management server to a second Tor server called Switzerland2 over SSH. The RSA key used for that connection could not be found among Switzerland2's authorized keys, and investigators do not know why.

The outcome

With administrative control of Switzerland2, the attackers installed Ebury there as well and finally reconfigured settings on two exit nodes hosted by that server, enabling interception and redirection of traffic.

What it means for users

Unencrypted email and SSH connections over Tor can be monitored by whoever controls the exit node. Communications without end-to-end encryption remain exposed in such compromises.