Ethical Hacking News
A group of attackers successfully hijacked over 300 Tor exit relays, allowing them to intercept thousands of SSH connections and steal login credentials. The attack highlights the vulnerabilities that exist in the Tor network and the need for increased vigilance among users and network administrators.
The attackers hijacked over 300 Tor exit relays, compromising the security of thousands of SSH connections and stealing login credentials. The attackers used rewritten exit policies to allow port 22 (the SSH port) and intercepted SSH connections to steal login passwords. The attack was possible due to the closed encrypted mail ports (IMAPS and POP3S) on most affected relays, allowing the attackers to open plaintext-capable ports (POP3 and IMAP). The attackers used fake host keys to trick users into accepting them, enabling them to steal login credentials. The attack was contained when the Tor Project flagged the relays and contacted relay operators to stop the attack. The incident highlights the need for increased vigilance among users and network administrators, keeping software up to date, and using strong passwords. The attack raises questions about the responsibility of hosting providers and the Tor network to improve their security measures.
The cybersecurity world has witnessed yet another disturbing incident of malicious actors compromising the security of a critical network infrastructure. In a brazen attack, a group of attackers successfully hijacked over 300 Tor exit relays, which led to the interception of thousands of SSH connections, thereby compromising the sensitive login credentials of numerous users. The incident highlights the vulnerabilities that exist in the Tor network and the need for increased vigilance among users and network administrators.
The attack, which was discovered on October 2, 2026, involved the attackers rewriting the exit policy of the hijacked relays to allow port 22, the SSH port, thereby enabling SSH connections to be intercepted by the attackers. The attackers used the compromised relays to redirect SSH connections to servers that stole login passwords. According to the researcher, kaba, who first discovered the attack, the attackers used the stolen passwords to install a backdoor called Ebury, which is a malicious OpenSSH backdoor that has been active since 2009.
The attack was possible because the attackers were able to rewrite the exit policy of the hijacked relays, which allowed them to allow port 22, the SSH port. The attackers also used the fact that the encrypted mail ports, IMAPS and POP3S, were closed on most of the affected relays, which allowed them to open the plaintext-capable ports, POP3 and IMAP. This enabled the attackers to intercept the SSH connections and steal the login credentials.
The attackers also used the fact that Tor clients only pick an exit that allows the destination port, which allowed them to intercept the SSH connections and steal the login credentials. The attackers used a fake host key to trick users into accepting it, and once the user had accepted the key, the attackers were able to connect to the real server and steal the login credentials.
The attack was contained when the Tor Project began flagging the relays on October 4, and by October 5, none of the relays remained in the consensus. The Tor Project's network health team also spotted the policy change and contacted the relay operators to stop the attack. The directory authorities began voting the BadExit and MiddleOnly flags on affected relays, which prevented the attackers from using them as exits.
The attack highlights the need for increased vigilance among users and network administrators. It also highlights the importance of keeping software up to date and using strong passwords. The incident also shows that even with the best security measures in place, attacks can still occur, and it is essential to have a plan in place to respond to such incidents.
The incident also raises questions about the responsibility of the hosting providers. In this case, the hosting provider, FranTech Solutions, had 71 of its 101 hosted relays switch to the attacker's policy, which could have been a red flag for the attackers. The incident highlights the need for hosting providers to take security seriously and to implement robust security measures to prevent such incidents.
The attack also raises questions about the responsibility of the Tor network. The Tor network has been criticized for its inability to keep up with the increasing number of attacks. The incident highlights the need for the Tor network to improve its security measures and to increase its ability to detect and respond to attacks.
In conclusion, the attack on the Tor network highlights the need for increased vigilance among users and network administrators. It also highlights the importance of keeping software up to date and using strong passwords. The incident also shows that even with the best security measures in place, attacks can still occur, and it is essential to have a plan in place to respond to such incidents.
Related Information:
https://www.ethicalhackingnews.com/articles/Massive-Operation-Hijacked-Over-300-Tor-Exit-Relays-to-Intercept-SSH-Connections-Leaving-Thousands-Vulnerable-to-Credential-Theft-ehn.shtml
https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html
Published: Wed Oct 21 14:13:36 2026 by llama3.2 3B Q4_K_M
