How I received over 300 Tor exit nodes eliminated
On Friday Oct 2, 09:35am, 333 contaminated exit nodes began a coordinated marketing campaign to intercept SSH connections and collect as a lot unencrypted information as potential.
To provide you with a way of scale, all of Tor has round 3000 exit relays, so roughly 10% have been below their management.
The attackers had gained entry to the servers two months earlier, in August, and quietly deployed their Ebury 1.8.3 payload (an OpenSSH backdoor and credential stealer for Linux).
The Attack
The assault seems to have had two main objectives:
- Gather as a lot unencrypted mail site visitors as potential
- Intercept SSH connections (MITM)
By blocking sure ports, they made their exit nodes deal with solely unencrypted mail site visitors.
An fascinating writeup by one of many victims (a veteran Tor operator) goes into nice element about that:
lists.torproject.org/mailman3
In this publish I’ll give attention to the second assault, the SSH MITM.
If you occur to get a circuit that exits over a type of 333 contaminated exit nodes, you will not discover something at first.
Encrypted internet site visitors is forwarded as common, however for those who try an SSH connection over Port 22, you are unknowingly redirected to one among 12 SSH interception servers.
That’s precisely what occurred to me on Friday morning.
My SSH connection received redirected, and I used to be greeted with this warning:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone may very well be eavesdropping on you proper now (man-in-the-middle assault)!
It can also be potential {that a} host key has simply been modified.
The fingerprint for the ED25519 key despatched by the distant host is
SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
Please contact your system administrator.
But for those who ignore the warning and go forward with the login, the attacker does three issues:
- Steals your password
- Opens a connection to your server and observes every command you kind (MITM)
- Opens a second connection to your server and infects it with Ebury
Getting them taken down
On Friday night I contacted the Tor Project’s network health team with my findings.
They confirmed this was one thing new and started working by contacting the affected relay operators.
“We’ve not seen an assault like that earlier than.”
– Tor Network Health Team
- Fri Oct 2: Interception began.
- Sun Oct 4: The Tor community well being staff made an announcement to the operators, who started shutting their exit nodes down.
- Sun Oct 4: The relays have been marked UnhealthyExit, so shoppers would now not use them to exit site visitors.
- Mon Oct 5: The attackers restarted lots of the relays, however since they have been already flagged they might solely function center relays.
- Mon Oct 5: All contaminated servers have been shut down, partly by the operators and partly by the attackers.
In their announcement, the well being staff described the sample:
“It appears the attacker is having access to Linux based mostly hosts and when these machines are operating non-exits they’re enhancing the torrc file and turning them into exits to have the ability to perform the SSH assault.”
– Tor Network Health in the announcement
You can see the affect of these 333 exit nodes being shut down.
On metrics.torproject.org a transparent dip is seen on October 4th and has not recovered since.
Consider operating a relay: community.torproject.org/relay/setup/
The technical half: how I discovered them
In this half I’ll go into element about how I discovered all of the contaminated exit nodes.
Using exitmap, I constructed a easy script that did the next:
it pinned an exit node, then opened an SSH connection from my server A to my server B.
- Server A checked whether or not it acquired the right SSH fingerprint from server B.
- Server B checked whether or not the connection got here from the pinned exit node or from one of many 12 SSH interception servers.
I ran the script in opposition to each single one of many ~3000 exit relays.
Around a dozen served a pretend fingerprint, and over 300 did not intercept something however redirected by means of those self same interception servers.
Redirecting alone was sufficient to substantiate the exit was contaminated.
In some additional evaluation I used sshesame as a honeypot.
Tricking the MITM into logging into the honeypot confirmed that they used paramiko (a Python SSH library) and likewise how they tried to put in Ebury utilizing Perl.
> echo "U=$(id -u) S=$(command -v sudo >/dev/null 2>&1 && (sudo -n true 2>/dev/null && echo nopass || echo possibly) || echo none)"
> sudo bash -c 'echo | base64 -d | perl'
Checking for permissions first, then executing a base64-encoded command.
Open Questions
The largest query continues to be how they received into all these servers within the first place.
One principle is that the internet hosting firm itself was hacked
(mentioned right here: lists.torproject.org).
But that is only a principle floating round. In reality, nobody actually is aware of.
Another is who’s behind it.
The use of Ebury and the broad assortment of unencrypted information level to a financially motivated crime group.
Though this too is simply hypothesis.
“Given what number of servers had Ebury between 2009 and 2023 (400 000!) there are almost definitely different compromised Tor relays on the market.”
– Marc-Etienne M. Léveillé
(lists.torproject.org)
I additionally suspect they intentionally launched their assault on a Friday, hoping that nobody would wish to wreck their weekend by responding.
All the extra credit score to the Tor Team for performing so rapidly!
Takeaway
The lesson is identical as at all times: additional safety is a worthwhile financial backing.
Disable password authentication in favor of ssh keys.
I for one am going to purchase myself some {hardware} keys at present. 🙂
“At the top of the day, relays/bridges have to be handled as extremely focused manufacturing machines.”
– George
(lists.torproject.org)
