Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Summary
Attackers gained control of over 300 Tor exit relays in early October to intercept SSH connections. They redirected these connections to malicious servers designed to steal user login passwords.
IFF Assessment
FOE
This is bad news for defenders as it highlights a method for attackers to compromise credentials through man-in-the-middle attacks on Tor network traffic.
Defender Context
This incident underscores the risks associated with using public anonymity networks like Tor for sensitive operations like SSH, especially when exit nodes are compromised. Defenders should be aware that credentials transmitted over such networks could be intercepted and advises caution against using Tor for critical access.