Someone took over hundreds of Tor exit relays in early October and repointed SSH traffic at servers built to swallow passwords. The researcher known as kaba scanned roughly 3,000 exits on October 2 and found 333 redirecting port 22 to the same twelve interception hosts.
Directory data analysed afterward counts 377 relays run by 59 operators that adopted the attacker’s exit policy between October 1 and 4. The analysis calls that a policy match rather than proof of compromise, which matters if you are working out who was exposed.
The torrc edit that rerouted everything
The intrusion was mechanical. Whoever held access to those Linux hosts rewrote the exit policy in each torrc file to permit port 22, switching SSH on for 342 relays that had blocked it and turning 24 non-exits into exits. The same edit closed IMAPS and POP3S and, on most machines, opened the plaintext mail ports.
Clients pick an exit by destination port, so SSH sessions flowed through relays that had no business carrying them. About a dozen exits presented a forged host key. The rest forwarded traffic without touching the key, so anyone who accepted a fresh one typed a password into an attacker’s terminal while their session kept working.
Key-based authentication survived. Each SSH signature is bound to a session identifier, so one captured by a middlebox is worthless against the genuine server.
What to check now
The Tor Project began flagging relays on October 4 and had them cleared from the consensus by October 5. If you logged into a server by password over Tor between October 1 and the afternoon of October 5 and accepted an unfamiliar key, rotate that password and treat the host as suspect. The honeypot’s follow-on installer matched the command used to plant the Ebury backdoor inside OpenSSH.
