How I got over 300 Tor exit nodes removed

kabakabakaba

Author here :) TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

96718923545809

Thank you for writing this. > But if you ignore the warning and go ahead with the login, the attacker does three things: > 1. Steals your password This shouldn't affect key-based authentication, though Also, this from Marc-Etienne M.Léveillé email linked in your post: > Another possibility is a compromised hosting provider. We identified a couple of them in the past where their management servers were compromised by Ebury and their customers' VPSes, containers, etc., ended up running Ebury as well. Provider-side compromise of customer VPS instances has been a growing trend in recent years. I stopped hosting anything privacy-related on VPS in favor of dedicated hardware. Many people still don't understand how easy it is for a provider to silently dump and/or manipulate both RAM and disk space in real-time.

evolve2k

> The lesson is the same as always: extra security is a worthwhile investment. Disable password authentication in favor of ssh keys. I for one am going to buy myself some hardware keys today. :) Question: Where to get these hardware keys? Which are good options and why?

cesarb

Once again, this shows the strength of mutual authentication (ssh user key authentication, or HTTPS client certificates): even if the client accepts the forged server key from a MITM server, the real server won't accept the client key exchange (since it, at least in the SSH protocol, is bound to the connection). For the three things the attacker did here: 1. It can't steal your password, since the private key never leaves your client; 2. It can observe each command you type, but it can't open a connection to the real server to know how it would respond to your commands; 3. It can't open any connection to the real server (it will fail authentication), so it can't do anything to the real server. If you really like passwords, there are ways to configure sshd to require both a client key and a password, in that order.

jszymborski

3000 is insanely few exit nodes.

phw

I built exitmap over ten years ago. Glad to see it's still of use :)

fguerraz

Any legit use case for using SSH over Tor?

privacyishuman

Tor guard nodes seemed to be under attack but the devs aren't really engaging with it publicly, at least. It happened to mine and I had to switch it to a middle relay. No problems now. https://forum.torproject.org/t/tor-relays-shutting-down-my-4... People say that even running a middle or guard node can get your IP blacklisted. I don't have personal experience of this because I don't use my home IP for regular use, just for selfhosting. All the other devices run on a network wide commercial VPN so if it did happen it wouldn't be an issue.

caaqil

> The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group. Collection of unencrypted data points to other players as well that have been known to have great interest in Tor exit nodes etc., but they're careful and not usually this noisy, so probably newgen trolls.

jandrese

The attack on SSH seems rather poorly conceived. Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks, but it allowed the admins to easily trace every infected node and respond quickly to shut the whole operation down. Had they stuck to email they would still be running today.

michaelt

> The biggest question is still how they got into all those servers in the first place. The simplest way is to just launch the servers yourself, using a cloud provider. Tor is completely OK with exit node operators being anonymous, and with exit nodes running in cheap cloud data centres.

Nifty3929

Not really the point of the article, but I'll use it as a soapbox anyway: Privacy (of the sort supported by Tor) is never a technology problem - it's a government / legislative problem. Whatever you try, whether Tor or VPNs or whatever - doesn't matter when the cops come knocking. VPNs are coming under legal attack now, and more and more sites refuse to work with them. You can say you're just running a relay, but if it came from your server they will put you in jail. Or consider the cyrpto anonymizer services - the folks running them might claim ignorance of where the crypto is coming from or going to - but they still go to jail. If you want privacy, you have to get it at the ballot box.

theamk

2>/dev/null && echo nopass || echo maybe) || echo none)" Writing a longer command to get less details and shorter output - this is so LLM! A human would simply run the two commands in sequence and parse errors on the remote side - this would have gave more information about unexpected errors.