New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
More than 300 Tor Exit nodes were hacked
JohnFilch123
Member
in Security
@forest important news don't miss
So, quick summary of what happened:
The hacker interfered with more than 300 exit nodes of the Tor network, gaining the ability to intercept SSH connections and unencrypted user traffic.
Hacked nodes were infected with Ebury 1.8.3 malware, and the attacker himself changed the settings of the output nodes in such a way that more unencrypted traffic passed through them.
The Tor team officially confirmed this incident on October 5. The initial method of penetration and the identity of the hacker remain unknown. All hacked nodes were blacklisted and no longer available.
Difficult times.
Comments
Fvck
Hacking news appear more than deals drop...
This is baaaad.
We definitely need more 7/y deals for our own vpn
ssh over tor is lame
I wonder what was the common vector for those 300 nodes.
Same provider? Unpatched RCE in some service or monitoring software?
Finding it hard to believe it was an issue with the Tor daemon itself.
@forest
Can we get your view on that, please?
@forest dude, important news, don't miss.
I think he's busy managing all of them now. Maybe that's why he hasn't been as active lately.
well i can't see the blacklisted 300 tor relays (maybe there's a node list?)
Yeah, I've been noticing his absence too. I was sure something unusual was happening.
People these days are using setups that are too complicated, setups they will never be able to fully understand and that puts us all in danger.
Simple is not only simpler, it is also more secure. If you can't understand it then you're vulnerable.
When you rely on development stacks that are too big and convoluted you gain more power but you also make yourself and other people easier targets, you get hacked. INEVITABLY.
It will only get worse.
Nah, he is busy installing crypto miners on php servers.
@forest Hmm, not a bad idea... gotta fund more nodes somehow
Yaa, bro ain't even replying. Probably busy hunting the hacker through Tor rn.
For more info
Quetzalcoatl Forensic Report - https://lists.torproject.org/mailman3/hyperkitty/list/[email protected]/thread/QHRD6YOX6RZRDR7NCHNDO7GLCEA6VFM6/
Independent CollecTor Analysis - https://lists.torproject.org/mailman3/hyperkitty/list/[email protected]/message/Z2B6XYKJZBBQADU77MSNL6FJP7MHZHIV/
He replied in a post today correcting me because I made a mistake involving an em dash and an en dash, he even provided the UTF codes of both characters so I won't make the same mistake again, LOL.
I really like him.
This is such a lame attack, when you realize the capacity the actors had in the first place.
300 relays are around 10% of the global Tor network. Using it against SSH sessions is very opportunistic. SSH has TOFU (you generate your keys and then you have a warning if they are changed) so I guess most of those attempts were unsuccessful. With public keys it will
make it even harder, since no passwords are actually involved.
I don't want to give potential ideas to attackers and malicious exit operators, but you can make much more impact on websites that don't have proper HSTS policy.
The OP talks about unencrypted traffic, but how much of that is there really left these days? Everything is encrypted. Is this really about finding source IPs or MiTM attacks? Collecting ssh traffic for offline decrypting?
Edit: unencrypted email traffic and MiTM ssh.
Should have done on a long weekend or Black Friday or something.
I had a quick look a few hours ago and it seems that at least most (>>95%) of @forest's Tor hosts are working fine (again, I presume).
Pleasant news.
This came out first on the [email protected] mailing list (fairly low-volume, all relay operators should subscribe imo). The operator who had most compromised nodes apparently reused passwords and did other foolish things. The initial infection vector is still unknown, but the explanation of how they spread out laterally in his fleet was ultimately explained.
Thankfully the attacker was an idiot and didn't do much with his access, as @luckypenguin pointed out. I think he saw it as an easy way to MITM people. There's no evidence of sophistication or deanonymization motives.
Are you safe @forest ?
I was kidnapped unfortunately. I'm being held for ransom and they won't let me out unless they get a $7/yr VPS.
I’m willing to sacrifice one of my idlers for the cause. Please have them contact me.
I am listening
i dont have the time or energy to fix up what i broke