Hackers compromised more than 10% of Tor’s exit relays in one of the largest security incidents in the network’s history. The attackers infected servers with Ebury Linux malware and changed the settings to intercept SSH connections and expose unencrypted email traffic.
The attack took place between October 2 and October 5 and was discovered by a Swiss engineer, who reported it to the Tor security team.
The hackers changed relay settings to allow SSH traffic and redirect connections through attacker-controller servers, which allowed them to capture passwords when users accepted fake security keys and entered login details. Threat actors could then use stolen passwords to access real servers and monitor user activity.
The attackers also changed email settings, closing ports used for encrypted email while allowing connections that could carry messages in plain text.
At the peak of the attack on October 4, the compromised relays accounted for 7.46% of Tor’s total exit capacity. The attackers also turned 24 servers that were not exit relays into exit relays and enabled SSH traffic on 342 servers that had previously blocked it.
After the attack was discovered, the Tor Project warned relay operators and blocked the compromised servers. Operators shut down affected systems, and the security team added others to the blocklist.