56
How I got over 300 Tor exit nodes removed (kaba.cx)
submitted 1 day ago by [B] to c/pulse_of_truth@infosec.pub
1 comment fedilink hide all child comments
 

On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.

To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control.

The attackers had gained access to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux).

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 11 hours ago

reposting what I commented in another thread:

SSH MitM attacks are very easy to pull off. To secure yourself, use key authentication instead of passwords, and don't ignore the warning that SSH will give you saying "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED".

If you are using something like Tails, you will need to make sure to persist the ssh hosts key file (~/.ssh/known_hosts), or else you will not not be warned when a MitM attack is being performed.

More discussion here: https://news.ycombinator.com/item?id=50166257

  • permalink
  • fedilink
  • source
    •