Technology
Hackers hijacked 333 Tor relays to redirect SSH and weaken email protections
Attackers compromised Tor infrastructure and reconfigured 333 exit relays during an October campaign to redirect SSH connections to 12 interception servers and block several encrypted-email ports. The intrusion began after a reused password enabled access to a Tor management server, where attackers installed the Ebury Linux backdoor and expanded their control. Researchers have not established how all affected servers were compromised, and it remains unclear whether email downgrade attempts successfully exposed messages.
Editorial summary · Publisher article
What matters
- The campaign operated from October 2 to October 5.
- SSH users who ignored changed-host-key warnings could disclose passwords to attackers.
- Ports used for encrypted email were blocked while unencrypted email remained available.
- The complete route by which attackers controlled all 333 relays is unresolved.
Context & caveats
- The supplied account says interception success for downgraded email is still unknown.
Why this made the edition
The report supplies a concrete intrusion path, affected Tor infrastructure, interception mechanisms, dates, and explicit uncertainty about the full scope and success of interception.
Source material