Cybersecurity News
Filters
Filtered by category: Cybersecurity News, tag: network interception × Clear
Hackers Hijack 333 Tor Exit Nodes to Intercept SSH Logins and Steal Credentials
Matched: health
Hackers compromised 333 Tor exit nodes beginning October 2, redirecting SSH connections to interception servers to steal credentials using Ebury, an OpenSSH backdoor. The affected relays represented roughly 10% of Tor's exit nodes. Attackers redirected port 22 traffic while passing other traffic normally. Users who ignored host-key warnings and used password authentication exposed their credentials. A researcher discovered the campaign via SSH fingerprint testing and reported it to Tor's network health team, which flagged affected relays by October 4. All identified servers were shut down October 5.