Tor: new details on a campaign involving 333 exit relays

An Ars Technica article published on October 22 provides details of a campaign involving 333 Tor exit relays. The hijacking took place from October 2 to 5: these are therefore newly reported details of an earlier incident, with no evidence in the report that the campaign is currently continuing.

The attackers modified the relays to redirect SSH connections to servers they controlled. According to the investigation described in the report, users who ignored the warning that the server's key had changed could then expose their passwords. The researcher also observed a mechanism for monitoring commands and installing the Ebury backdoor on the targeted server.

Another part of the campaign involved blocking certain email ports while allowing unencrypted connections through. The aim was to capture messages if services accepted a connection downgrade. Ars Technica specifies that the success of these downgrade attempts has not been established.

The circumstances of the takeover remain incompletely understood. An initial compromise is attributed to the reuse of a valid password, but investigators do not know how all the servers concerned were compromised. The identity of those responsible also remains unknown. The incident thus highlights the importance of authentication warnings and maintaining encryption, while leaving open the question of the actual extent of the data intercepted.