🔐 The offline master keys were not offline. Zimmer, who ran the largest group of hijacked Tor relays, said so in his post-mortem. Copies sat in a backup on his management server, encrypted with a password the attacker already found. 😬
He was just as blunt about the cause: The root cause was ours: one password reused for SSH login, sudo, and the backup passphrase, stored in plaintext on both servers, plus SSH password authentication left enabled on the internet-facing management server. Credit to him for putting that in writing. 👏 I'd guess plenty of servers out there would earn the same sentence, maybe a few of yours.
In early October, attackers took over more than 300 Tor exit relays and rerouted SSH connections to 12 interception servers. At the peak on October 4, those relays carried 7.46% of Tor's exit capacity, according to an analysis of public directory data. Zimmer's own break-in came earlier. On August 28, the attacker logged into his management server with the account password on the first try and gained root within five minutes.
The victims got hit through passwords too. To get burned, you had to accept the interceptor's host key and type a password. Some people saw an OpenSSH warning that the server had changed... others just got the usual prompt to accept a new key. If you used key-based login, the attacker couldn't pass it through to the real server because the signature is tied to that session.
The backdoor is Ebury version 1.8.3, a single library file that leaves the packaged library alone, so the normal package checks come back clean. Zimmer's servers showed none of the host-level signs on the Tor Projects checklist. The only thing that gave it away was the changed exit policy.
🚨 If you run anything with SSH open to the internet, turn off password login and use keys. If you accepted an unfamiliar or changed host key over Tor between October 1 and 5, assume that password is stolen, change it, and check the server. And if you're poking around a box you suspect, log in with a key, since Ebury captures typed passwords.
Nobody knows yet how the other 58 operators got hit. On FranTech, the network behind BuyVM, 71 of 101 relays switched to the attackers' policy, compared with 13 of 9,054 hosted elsewhere. The researcher who spotted this asked whether the attackers got in at the hosting provider level, and so far nobody has answered.
https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html
#Cybersecurity #InfoSec #Tor #SSH #Linux #Malware #ThreatIntel #IncidentResponse #RiskManagement #security #privacy #cloud #darkweb
