A researcher's writeup dated Oct. 20 says 333 Tor exit relays, about 10% of the roughly 3,000 exit relays, were infected and used to intercept SSH logins. If you connected to a server over Tor in early October and saw a host key warning, do not treat it as routine.

What to do

The warning to stop at looks like this:

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
  • Stop at the warning. On a port 22 connection through Tor, "REMOTE HOST IDENTIFICATION HAS CHANGED" is the sign. Do not continue and do not type a password.
  • The fake key. The researcher lists a fake ED25519 host key fingerprint, SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E. If your warning showed it, you were being intercepted.
  • If you clicked through, treat that password as stolen, and change it everywhere you reused it. Treat the server as compromised: check it for signs of intrusion or rebuild it.
  • Switch to keys. The researcher advises disabling SSH password authentication and using keys. Our passkeys guide covers the same idea for everyday accounts.
  • Skip plaintext mail over Tor. The infected exits were built to collect unencrypted mail.

What happened

Attackers got into servers in August and quietly installed Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux. Coordinated interception began Friday, Oct. 2, at 9:35 a.m.

  • SSH: connections on port 22 were redirected to one of 12 interception servers.
  • Mail: the infected exits blocked certain ports so they handled only unencrypted mail.
  • Web: encrypted web traffic was forwarded normally.

The researcher says that if a user clicked past the host key warning, the attacker stole the password, watched the commands typed over a second connection, and infected the server with Ebury through another connection.

How it was shut down

The researcher reported it to the Tor Project network health team the evening of Oct. 2. The team announced it to relay operators on Oct. 4 and flagged the relays BadExit, so Tor clients stopped using them to exit. On Oct. 5 attackers restarted many relays, but as flagged relays they could only act as middle relays, and all infected servers were then shut down.

The exit relay count dipped on Oct. 4 and had not recovered, per the post. The account of the health team's actions comes from the researcher's post; we found no Tor Project statement on its blog. The team described the attack as break-ins to Linux hosts running non-exit relays, where attackers edited the torrc configuration file to make them exits.

What is unknown

  • How the attackers got in. One unconfirmed theory is a compromise at a hosting company.
  • Who is behind it.

Why it matters

Tor hides who you are, not what you send. The trade-off is that the last hop sees traffic that is not encrypted end to end, and SSH only protects you if you heed its host key check. Clicking past one warning gave attackers the password and a way into the server.

Related: home camera privacy lock-down and Computing.