Details of the incident have been published, during which attackers managed to gain control of 333 exit nodes in the Tor network (there are about 3000 exit nodes in total in Tor) and orchestrate the interception of unencrypted traffic and redirection of SSH connections. The attack began on October 2 (Friday evening) but was detected and started to be blocked on October 4. By October 5, all compromised servers were shut down by operators or the attackers themselves. The investigation revealed that the attackers gained access to the servers two months before the attack on Tor users and installed the Ebury 1.8.3 malware on the compromised systems.
The goal of the attack was to intercept passwords, keys, and confidential information in the transit unencrypted traffic, as well as to capture SSH passwords. During the analysis of unencrypted traffic, the attackers focused on unencrypted requests to mail servers. To encourage a rollback to unencrypted operation on exit nodes, network ports used to establish encrypted communication channels with the mail servers were blocked. serversUnencrypted traffic was analyzed on the fly.
To collect SSH passwords, SSH requests were redirected to one of the 12 servers controlled by the attackers. These servers accepted connections via SSH and prompted for the password on behalf of server, to which the connection was made. Since host keys did not match, ssh on the client side issued a warning about connecting to an unknown server.
If the user ignored this warning and entered the password for the connection, the malicious server would transmit the connection to the legitimate target SSH server, save the password entered by the victim, and intercept information about actions in the SSH session. Meanwhile, a connection was established to the target server with the captured password, and the Ebury malware was installed on it. By gaining control over non-Tor exit Linux servers, the attackers changed the settings in the torrc file and turned them into new malicious Tor exit nodes.
To identify all malicious exit nodes, the researcher who discovered the issue used the exitmap utility to probe all exit nodes, establish SSH connections through each of them, and verify the redirection of requests. It is still unclear how the attackers gained access to the compromised Tor nodes, although among other things, there are
suspicions of compromise of hosting operators.
Source: opennet.ru
