How I got over 300 Tor exit nodes removed

259 points - today at 1:39 PM

Comments

phw today at 3:57 PM

I built exitmap over ten years ago. Glad to see it's still of use :)

jandrese today at 5:33 PM

The attack on SSH seems rather poorly conceived. Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks, but it allowed the admins to easily trace every infected node and respond quickly to shut the whole operation down. Had they stuck to email they would still be running today.

96718923545809 today at 2:11 PM

Thank you for writing this.

> But if you ignore the warning and go ahead with the login, the attacker does three things: > 1. Steals your password

This shouldn't affect key-based authentication, though

Also, this from Marc-Etienne M.Léveillé email linked in your post:

> Another possibility is a compromised hosting provider. We identified a couple of them in the past where their management servers were compromised by Ebury and their customers' VPSes, containers, etc., ended up running Ebury as well.

Provider-side compromise of customer VPS instances has been a growing trend in recent years. I stopped hosting anything privacy-related on VPS in favor of dedicated hardware. Many people still don't understand how easy it is for a provider to silently dump and/or manipulate both RAM and disk space in real-time.

jszymborski today at 3:20 PM

3000 is insanely few exit nodes.

michaelt today at 7:06 PM

> The biggest question is still how they got into all those servers in the first place.

The simplest way is to just launch the servers yourself, using a cloud provider. Tor is completely OK with exit node operators being anonymous, and with exit nodes running in cheap cloud data centres.

privacyishuman today at 5:11 PM

Tor guard nodes seemed to be under attack but the devs aren't really engaging with it publicly, at least. It happened to mine and I had to switch it to a middle relay. No problems now.

https://forum.torproject.org/t/tor-relays-shutting-down-my-4...

People say that even running a middle or guard node can get your IP blacklisted. I don't have personal experience of this because I don't use my home IP for regular use, just for selfhosting. All the other devices run on a network wide commercial VPN so if it did happen it wouldn't be an issue.

kabakabakaba today at 1:39 PM

Author here :)

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

cesarb today at 3:19 PM

Once again, this shows the strength of mutual authentication (ssh user key authentication, or HTTPS client certificates): even if the client accepts the forged server key from a MITM server, the real server won't accept the client key exchange (since it, at least in the SSH protocol, is bound to the connection). For the three things the attacker did here:

1. It can't steal your password, since the private key never leaves your client;

2. It can observe each command you type, but it can't open a connection to the real server to know how it would respond to your commands;

3. It can't open any connection to the real server (it will fail authentication), so it can't do anything to the real server.

If you really like passwords, there are ways to configure sshd to require both a client key and a password, in that order.

deleted today at 3:18 PM

caaqil today at 5:27 PM

> The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group.

Collection of unencrypted data points to other players as well that have been known to have great interest in Tor exit nodes etc., but they're careful and not usually this noisy, so probably newgen trolls.

evolve2k today at 3:05 PM

> The lesson is the same as always: extra security is a worthwhile investment. Disable password authentication in favor of ssh keys. I for one am going to buy myself some hardware keys today. :)

Question: Where to get these hardware keys? Which are good options and why?

fguerraz today at 5:09 PM

Any legit use case for using SSH over Tor?