333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
摘要
一名研究人员报告称，未知黑客劫持了300多个Tor出口节点，并重新配置这些节点，使其偏向未加密的电子邮件流量，并将SSH连接重定向到其控制的服务器。劫持始于8月下旬，攻击者利用重复使用的有效密码进入Tor管理服务器，安装Linux后门Ebury，并通过SSH连接第二台Tor服务器Switzerland2，在其上安装Ebury并重新配置该服务器托管的两台出口节
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.
The hijacking began in late August, when according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.
Mysteries remain
Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧