Attackers Hijack 300 Tor Exit Relays to Steal SSH Passwords

In early October unknown attackers took control of more than 300 Tor exit relays — the last hop of a circuit, where traffic leaves the network for its destination. Through the hijacked relays they redirected SSH connections to their own servers, which stole login passwords. The attack was reported by a researcher who publishes as kaba.

How it worked

An exit relay only carries traffic to the ports its exit policy allows. The attackers rewrote the torrc configuration file to open port 22 (SSH): on 342 relays that had blocked it, while 24 machines that were not exits at all were turned into exits. The same change closed the encrypted mail ports (IMAPS, POP3S) and, on most relays, opened their plaintext counterparts.

When an SSH connection through such a relay went not to its destination but to one of twelve interception servers, that server presented its own host key. A user who already knew the real key saw OpenSSH's warning that it had changed; a first-time user saw the usual prompt to accept a new key. Having accepted the key and typed a password, the victim handed it to the interceptor — which then connected to the real server, so the session worked normally.

Crucially, only passwords could be stolen this way: with key-based login the client's signature is bound to a specific session and is useless against the real server.

Scale and response

Only those who connected to an SSH server over Tor between October 1 and 5, landed on a hijacked exit, accepted the stranger's key and logged in with a password were exposed. No count of victims exists.

On October 2 kaba scanned roughly three thousand exits and found 333 redirecting SSH. Analysis of Tor directory data counted 377 relays run by 59 operators that switched policy. At the peak on October 4 they made up 7.46% of Tor's exit capacity. The Tor Project began flagging relays as BadExit on October 4, and by October 5 none remained in the consensus.

The root cause: Ebury

One operator, Zimmer (the Quetzalcoatl relay family), found the Ebury backdoor, version 1.8.3, on his servers — a credential-stealing implant for OpenSSH active since 2009 that, by ESET's estimate, has infected about 400,000 servers. The attacker logged into his management server on August 28 on the first try: a single password reused for SSH, sudo and the backup passphrase, stored in plaintext.

Ebury masquerades as the libkeyutils library, survives reboots and evades standard package checks. How the servers of the other 58 operators were breached is the main open question; a notable share were hosted with a single provider. Who is behind the campaign is unknown.

Source: The Hacker News