Unknown hackers took control of 333 Tor exit nodes, altered them to prioritize unencrypted email traffic and funnel SSH connections through servers under the attackers’ command, a researcher reported on Tuesday. The intrusion began in late August, when Tor volunteers say the perpetrators used a reused, valid password to access a Tor management server. Once inside, they deployed Ebury, a Linux backdoor that was first identified twelve years ago.
From the compromised management server, the attackers opened an SSH session to a second Tor server named Switzerland2, using an RSA key that investigators could not locate among the server’s authorized keys. With administrative rights on Switzerland2, they installed Ebury there as well. The final step involved reconfiguring the settings on two exit nodes that were hosted by Switzerland2, completing the takeover of the network of exit relays.