{"id":183976,"date":"2026-10-23T23:40:30","date_gmt":"2026-10-23T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/okolo-10-vyhodnyh-uzlov-tor-byli-vovlecheny-v-ataku-po-perehvatu-ssh-podklyuchenij"},"modified":"2026-10-23T23:40:35","modified_gmt":"2026-10-23T21:40:35","slug":"around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","title":{"rendered":"Rreth 10% e nyjeve dal\u00ebse t\u00eb Tor ishin t\u00eb p\u00ebrfshira n\u00eb nj\u00eb sulm p\u00ebr kapjen e lidhjeve SSH","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Detajet e incidentit jan\u00eb publikuar, n\u00eb t\u00eb cilin sulmuesit arrit\u00ebn t\u00eb merrnin kontroll mbi 333 daljet e rrjetit Tor (n\u00eb total, n\u00eb Tor ka rreth 3000 dalje) dhe organizuan atje kapjen e trafikut t\u00eb shifruesh\u00ebm dhe ridrejtimin e lidhjeve SSH. Sulmi filloi m\u00eb 2 tetor (n\u00eb mbr\u00ebmjen e t\u00eb premtes), por u zbulua dhe filloi t\u00eb bllokohej m\u00eb 4 tetor. M\u00eb 5 tetor, t\u00eb gjith\u00eb server\u00ebt e komprometuar u \u00e7aktivizuan nga operator\u00ebt ose nga vet\u00eb sulmuesit. Hetimi tregoi se sulmuesit kishin akses n\u00eb server\u00ebt dy muaj para fillimit t\u00eb sulmit ndaj p\u00ebrdoruesve t\u00eb Tor dhe ishin instaluar n\u00eb sistemet e komprometuar malware Ebury 1.8.3.<\/p>\n

Q\u00ebllimi i sulmit ishte kapja e fjal\u00ebkalimeve, \u00e7el\u00ebsave dhe informacionit t\u00eb ndjesh\u00ebm n\u00eb trafikun e zakonsh\u00ebm t\u00eb pakoduar, si dhe kapja e fjal\u00ebkalimeve p\u00ebr SSH. Gjat\u00eb analiz\u00ebs s\u00eb trafikut t\u00eb pakoduar, sulmuesit u p\u00ebrqendruan n\u00eb k\u00ebrkesat pa kriptim p\u00ebr server\u00ebt e post\u00ebs elektronike. P\u00ebr t\u00eb stimuluar rikthimin n\u00eb pun\u00ebn pa kriptim n\u00eb daljet, u bllokuan portet e rrjetit t\u00eb p\u00ebrdorura p\u00ebr organizimin e nj\u00eb kanali t\u00eb kriptuar p\u00ebr komunikim me post\u00ebn. server\u00eb<\/a>. Trafiku i pakoduar u analizua n\u00eb koh\u00eb reale.<\/p>\n

P\u00ebr mbledhjen e fjal\u00ebkalimeve p\u00ebr SSH, u organizua ridrejtimi i k\u00ebrkesave SSH n\u00eb nj\u00eb nga 12 serverat e sulmuesve. K\u00ebta server\u00eb pranuan lidhjen p\u00ebr SSH dhe parashtronin k\u00ebrkes\u00ebn p\u00ebr fjal\u00ebkalim n\u00eb em\u00ebr server\u00eb<\/a>, me t\u00eb cilin po ndodhte lidhja. N\u00eb m\u00ebnyr\u00eb q\u00eb \u00e7el\u00ebsat e hostit t\u00eb mos p\u00ebrputheshin, ssh nga ana e klientit jepte nj\u00eb paralajm\u00ebrim p\u00ebr lidhjen me nj\u00eb host t\u00eb panjohur. serverit<\/a>. <\/p>\n

N\u00ebse p\u00ebrdoruesi e injoronte k\u00ebt\u00eb paralajm\u00ebrim dhe jepte fjal\u00ebkalimin p\u00ebr lidhjen, malware-i server<\/a> transmetonte lidhjen me serverin e legjitim p\u00ebr SSH, ruante fjal\u00ebkalimin e futur nga viktima dhe kapte informacionin mbi veprimet n\u00eb seanc\u00ebn SSH. Paralelisht, ndodhte lidhja me serverin e synuar me fjal\u00ebkalimin e kapur dhe instalimi i malware Ebury n\u00eb t\u00eb. Duke marr\u00eb kontroll mbi server\u00ebt Linux, t\u00eb cil\u00ebt nuk ishin dalje t\u00eb Tor, sulmuesit ndryshonin konfigurimin n\u00eb skedarin torrc dhe i kthenin ata n\u00eb dalje t\u00eb reja t\u00eb d\u00ebmshme t\u00eb Tor.<\/p>\n

<\/center><\/p>\n

P\u00ebr t\u00eb identifikuar t\u00eb gjitha nodet dal\u00ebse t\u00eb d\u00ebmshme, hulumtuesi q\u00eb identifikoi problemin p\u00ebrdori utilitarin exitmap p\u00ebr t\u00eb skanuar t\u00eb gjitha nodet dal\u00ebse, duke vendosur nj\u00eb lidhje SSH p\u00ebrmes \u00e7do nj\u00ebrit prej tyre dhe duke verifikuar faktin e redirectimit t\u00eb k\u00ebrkes\u00ebs. Si sakt\u00ebsisht sulmuesit arrit\u00ebn t\u00eb qasen n\u00eb nodet e kapura t\u00eb Tor-it mbetet e paqart\u00eb, nd\u00ebr t\u00eb tjera, jan\u00eb ngritur
\n supozime p\u00ebr kompromitimin e operator\u00ebve t\u00eb hostimit.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 333 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0437\u043b\u0430\u043c\u0438 \u0441\u0435\u0442\u0438 Tor (\u0432\u0441\u0435\u0433\u043e \u0432 Tor \u043e\u043a\u043e\u043b\u043e 3000 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432) \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043d\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439. \u0410\u0442\u0430\u043a\u0430 \u043d\u0430\u0447\u0430\u043b\u0430\u0441\u044c 2 \u043e\u043a\u0442\u044f\u0431\u0440\u044f (\u0432 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 \u0432\u0435\u0447\u0435\u0440\u043e\u043c), \u043d\u043e \u0431\u044b\u043b\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0438 \u043d\u0430\u0447\u0430\u043b\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f. 5 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0432\u0441\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0431\u044b\u043b\u0438 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":183978,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rreth 10% e nodave dal\u00ebse t\u00eb Tor ishin p\u00ebrfshir\u00eb n\u00eb sulmin p\u00ebr kapjen e lidhjeve SSH | ProHoster","description":"Jan\u00eb publikuar detajet e incidentit, n\u00eb t\u00eb cilin sulmuesit arrit\u00ebn t\u00eb merrnin kontroll mbi 333 nodet dal\u00ebse t\u00eb rrjetit Tor (n\u00eb total ka rreth 3000 nodet dal\u00ebse n\u00eb Tor) dhe t\u00eb organizonin p\u00ebr t\u00eb kapur trafik t\u00eb pazgjuar.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043a\u043e\u043b\u043e 10% \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 Tor \u0431\u044b\u043b\u0438 \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u044b \u0432 \u0430\u0442\u0430\u043a\u0443 \u043f\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0443 SSH-\u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u0445\u043e\u0434\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 333 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0437\u043b\u0430\u043c\u0438 \u0441\u0435\u0442\u0438 Tor (\u0432\u0441\u0435\u0433\u043e \u0432 Tor \u043e\u043a\u043e\u043b\u043e 3000 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0443\u0437\u043b\u043e\u0432) \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u043d\u0435\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-23T21:40:31+00:00","article:modified_time":"2026-10-23T21:40:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183976","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=183976"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183976\/revisions"}],"predecessor-version":[{"id":183977,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183976\/revisions\/183977"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/183978"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=183976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=183976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=183976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}