{"id":183976,"date":"2026-10-23T23:40:30","date_gmt":"2026-10-23T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/okolo-10-vyhodnyh-uzlov-tor-byli-vovlecheny-v-ataku-po-perehvatu-ssh-podklyuchenij"},"modified":"2026-10-23T23:40:35","modified_gmt":"2026-10-23T21:40:35","slug":"around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","title":{"rendered":"Umbes 10% Tor'i v\u00e4ljuvatest s\u00f5lmedest oli kaasatud SSH-\u00fchenduste pealtkuulamise r\u00fcnnakusse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on \u00fcksikasjad juhtumist, kus kurjategijatel \u00f5nnestus kontrollida 333 Tor'i v\u00e4lja\u00f5iguspunkti (kokku on Tor'is umbes 3000 v\u00e4lja\u00f5iguspunkti) ning korraldada nende kaudu mittekr\u00fcpteeritud liikluse pealtkuulamine ja SSH-seoste suunamine. R\u00fcnnak algas 2. oktoobril (reedel \u00f5htul), kuid tuvastati ja hakati blokeerima 4. oktoobril. 5. oktoobril l\u00fclitati k\u00f5ik kompromiteeritud serverid v\u00e4lja operaatorite v\u00f5i r\u00fcndajate poolt. Uurimine n\u00e4itas, et r\u00fcndajad p\u00e4\u00e4sesid serveritesse ligi kaks kuud enne r\u00fcnnakut Tor'i kasutajate osas ja installeerisid kompromiteeritud s\u00fcsteemidesse pahavara Ebury 1.8.3.<\/p>\n

R\u00fcnnaku sihtm\u00e4rgiks oli paroolide, v\u00f5tmete ja konfidentsiaalse teabe pealtkuulamine mittekr\u00fcpteeritud liikluses, samuti SSH paroolide hankimine. Mittekr\u00fcpteeritud liikluse anal\u00fc\u00fcsimisel keskendusid r\u00fcndajad n\u00e4idetele, mis ei kasutanud kr\u00fcptimist, postiserverite poole. Kr\u00fcptimatutele v\u00e4ljav\u00f5tjatele tagasi minema suunamise stimuleerimiseks blokeeriti v\u00f5rgupordid, mida kasutati kr\u00fcpteeritud side organisatsiooniks postiserveritega. serveritega<\/a>. Mittekr\u00fcpteeritud liiklust anal\u00fc\u00fcsiti reaalajas.<\/p>\n

SSH paroolide kogumiseks korraldati SSH-p\u00e4ringute suunamine \u00fchele 12 r\u00fcndajate serverist. Need serverid aktsepteerisid SSH-\u00fchendust ja edastasid paroolip\u00e4ringu nimel serverid<\/a>, millega \u00fchendus loodi. Kuna hostkey'd ei vastanud, andis klientide pool ssh hoiatuse tundmatule \u00fchendusele \u00fchenduda. serveri<\/a>. <\/p>\n

Kui kasutaja ignoreeris seda hoiatust ja sisestas parooli \u00fchenduseks, siis pahavara server<\/a> edastas enda kaudu \u00fchenduse legitiimse siht SSH-serveriga, salvestas sisestatud parooli ja pealtkuulas identiteedi tegevust SSH-istungil. Samal ajal loodi \u00fchendus sihtserveriga, kasutades hankitud parooli ja installeeriti sellele pahavara Ebury. Hankides kontrolli Linux-serverite \u00fcle, mis ei olnud Tor'i v\u00e4lja\u00f5iguspunktid, muutsid r\u00fcndajad failis torrc seadistusi ja muundasid need uued pahatahtlikud v\u00e4lja\u00f5iguspunktid Tor'iks.<\/p>\n

<\/center><\/p>\n

Probleemi avastanud uurija kasutas utiliiti exitmap, et luua k\u00f5ikide v\u00e4ljundipunktide jaoks SSH-\u00fchendusi ja kontrollida suunamise toimumist. Kuidas r\u00fcndajad p\u00e4\u00e4sesid ligi h\u00f5ivatud Tor-s\u00f5lmedele, pole veel selge, sealhulgas on esitatud
\n kahtlusi hostimise operaatorite kompromiteerimise kohta.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 333 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0437\u043b\u0430\u043c\u0438 \u0441\u0435\u0442\u0438 Tor (\u0432\u0441\u0435\u0433\u043e \u0432 Tor \u043e\u043a\u043e\u043b\u043e 3000 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432) \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043d\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f (\u0432 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 \u0432\u0435\u0447\u0435\u0440\u043e\u043c), \u043d\u043e \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f. 5 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u0441\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0431\u044b\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":183978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Umbes 10% Tor-v\u00e4ljundis\u00f5lmedest olid kaasatud SSH-\u00fchenduste pealtkuulamise r\u00fcnnakusse | ProHoster","description":"Avalikustatud on \u00fcksikasjad intsidentist, kus kurjategijatel \u00f5nnestus saada kontroll 333 Tor-v\u00e4ljundis\u00f5lme \u00fcle (kokku on Toris umbes 3000 v\u00e4ljundis\u00f5lme) ja korraldada nende kaudu mitte\u0161ifreeritud liikluse pealtkuulamine.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043a\u043e\u043b\u043e 10% \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 Tor \u0431\u044b\u043b\u0438 \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u044b \u0432 \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 SSH-\u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 333 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0437\u043b\u0430\u043c\u0438 \u0441\u0435\u0442\u0438 Tor (\u0432\u0441\u0435\u0433\u043e \u0432 Tor \u043e\u043a\u043e\u043b\u043e 3000 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432) \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043d\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-23T21:40:31+00:00","article:modified_time":"2026-10-23T21:40:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183976"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183976\/revisions"}],"predecessor-version":[{"id":183977,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183976\/revisions\/183977"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/183978"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}