A Tor Operator Reports 333 Exit Relays, About 10%, Redirected SSH Logins to 12 Servers

An unnamed author who tested the network says that on Friday, October 2, at 09:35, 333 Tor exit relays, roughly 10% of the network's 3,000, began redirecting SSH connections on port 22 to 12 interception servers. The claim comes from a post dated October 20 on kaba.cx, whose author is not named. It is the only account of the incident this article could find, and the Tor Project had not published an advisory when it was written.

The mitigation comes before the drama. A user is exposed only if their circuit exits through an infected relay, they connect over port 22, and they click through the host-key warning the redirect triggers. Ordinary encrypted web traffic shows no change, according to the post.

What the post says the attackers did

The author says the servers were compromised in August, about two months before the interception began, and that they ran Ebury 1.8.3, a Linux OpenSSH backdoor and credential stealer. The attackers blocked certain ports so the exits handled mostly unencrypted mail, and redirected SSH to the 12 interception servers.

If a user ignored the warning and logged in, the post says, the attacker captured the password, opened a connection to the real server to watch every command, then opened a second connection to infect that server with Ebury.

How the relays were found

The author built a script on exitmap, a Tor tool, that pins one exit relay, opens an SSH connection from one server to a second, and checks two things. The first server checks it received the right host fingerprint; the second checks whether the connection arrived from the pinned exit or from one of the 12 interception servers.

Run against about 3,000 exits, about a dozen served a fake fingerprint and over 300 were redirected. A honeypot, sshesame, recorded the attackers using paramiko, a Python SSH library, and trying to install Ebury through Perl.

The response timeline

Date	Event, per the post
Friday, October 2	Interception begins; author reports it that evening to the Tor network health team
Sunday, October 4	Operators told; affected relays flagged BadExit
Monday, October 5	Attackers restart many relays; as flagged relays they can only serve as middle relays

The Tor Project's bad-relay page says BadExit means "Never use the relay as an exit relay", and that the project can also restrict a relay to the middle position or remove it from the consensus. The post says exit counts on metrics.torproject.org dipped on October 4 and had not recovered by the time of writing.

What is not known

How the attackers got in is unknown. The author floats the theory that a hosting company was hacked and calls it unconfirmed. The author also suggests a financially motivated crime group, based on the use of Ebury and the interest in mail, and calls that speculation.

A mailing-list contributor quoted in the post wrote: "Given how many servers had Ebury between 2009 and 2023 (400 000!) there are most likely other compromised Tor relays". The Tor network health team is quoted as saying: "We've not seen an attack like that before."

Defences are older than the attack. Use SSH keys instead of passwords, and compare host fingerprints out of band; the post's author says they plan to buy hardware security keys. OpenSSH 10.6 shipped with OpenBSD 8.0, and exposed Cairn panels show criminals running intrusions at about $5 a task, the economics that make stolen SSH passwords worth collecting.

The next datapoint is the exit-relay count on metrics.torproject.org, which the author says had not recovered.