Details of the incident have been published, during which attackers managed to take control of 333 exit nodes of the Tor network (there are about 3000 exit nodes in total in Tor) and organize interception of unencrypted traffic and redirection of SSH connections. The attack began on October 2 (Friday evening), but was detected and started to be blocked on October 4. On October 5, all compromised servers were shut down by operators or the attackers themselves. Investigations revealed that the attackers gained access to the servers two months prior to the attack on Tor users and installed malware Ebury 1.8.3 on the compromised systems.
The goal of the attack was to intercept passwords, keys, and confidential information in unencrypted transit traffic, as well as to capture SSH passwords. When analyzing unencrypted traffic, the attackers focused on non-encrypted requests to mail servers. To encourage a rollback to non-encrypted work on exit nodes, network ports used for establishing an encrypted communication channel with the mail servers were blocked. servers. Unencrypted traffic was analyzed in real-time.
To collect SSH passwords, SSH requests were redirected to one of the 12 attacker servers. These servers accepted SSH connections and presented a password prompt on behalf of de server, to which the connection was being made. Since the host keys did not match, SSH on the client side issued a warning about connecting to an unknown server.
If the user ignored this warning and entered the password for connection, the malicious server transmitted the connection to the legitimate target SSH server, saved the password entered by the victim, and intercepted information about actions in the SSH session. At the same time, a connection was established to the target server with the captured password, and malware Ebury was installed on it. By gaining control over Linux servers that were not exit nodes of Tor, the attackers changed settings in the torrc file and turned them into new malicious exit nodes of Tor.
Om alle malafide exit nodes te identificeren, gebruikte de onderzoeker het hulpmiddel exitmap om alle exit nodes te verkennen, SSH-verbindingen via elk van hen te maken en te controleren of de aanvraag werd omgeleid. Hoe de aanvallers toegang kregen tot de gecompromitteerde Tor-nodes is nog onduidelijk, onder andere worden
vermoedens over de compromis van hostingoperatoren geuit.
Bron: opennet.ru
