HN
Today

How I got over 300 Tor exit nodes removed

A cybersecurity researcher detailed how they uncovered a sophisticated attack that compromised 10% of Tor's exit nodes, redirecting SSH connections and stealing credentials. This deep dive into network security highlights the persistent threats to privacy infrastructure and the ingenuity required to detect them. The story resonates with HN's audience due to its technical rigor and the critical importance of Tor's integrity.

7
Score
4
Comments
#6
Highest Rank
8h
on Front Page
First Seen
Oct 20, 2:00 PM
Last Seen
Oct 20, 9:00 PM
Rank Over Time
2066611111613

The Lowdown

The author recounts a significant security incident where a coordinated attack compromised over 300 Tor exit nodes, representing about 10% of the entire network. This sophisticated operation aimed to intercept SSH connections and harvest unencrypted email traffic, posing a substantial threat to Tor users' privacy and security.

  • On October 2nd, 2026, 333 Tor exit nodes began a coordinated campaign after attackers had maintained access to the servers for two months, deploying the Ebury 1.8.3 payload.
  • The attack had dual objectives: gathering unencrypted mail traffic (by blocking other ports) and conducting Man-in-the-Middle (MITM) attacks on SSH connections.
  • For SSH, users connecting through compromised exit nodes were redirected to attacker-controlled servers; ignoring a host key warning allowed password theft, command observation, and Ebury infection of their own servers.
  • The author personally encountered the SSH MITM and promptly reported findings to the Tor Project's network health team.
  • The Tor team swiftly responded, notifying operators, marking affected relays as "BadExit," and leading to the eventual shutdown of all infected servers within days.
  • The author detailed their methodology for identifying compromised nodes, using exitmap to test all ~3000 relays for SSH fingerprint mismatches or redirections, and sshesame as a honeypot to analyze attacker tools and infection methods.
  • Key questions remain unanswered, including the initial compromise vector (possibly a hosting company hack) and the identity of the attackers (speculated to be a financially motivated crime group using Ebury).
  • The incident underscores the importance of advanced security measures like SSH keys over passwords and treating Tor relays as high-value targets.

This incident serves as a stark reminder of the continuous battle against sophisticated adversaries in the realm of internet privacy and security, showcasing both the vulnerability of critical infrastructure and the effectiveness of rapid community response.