Attacker takes over more than 300 Tor exit relays through a reused password

Users who rely on Tor to hide their traffic may have had it intercepted by relays run by an unknown party.

Between late August and the time of reporting, an unknown attacker took control of more than 300 Tor exit relays, reconfiguring them to tamper with traffic passing through them. The intrusion started with a reused password that let the attacker into a Tor management server, after which the Linux backdoor Ebury was installed. From there the attacker logged into a second Tor server, Switzerland2, over SSH using an RSA key that investigators could not match to any authorized key on that machine. Ebury was placed on Switzerland2 as well, and two exit nodes it hosted were altered. The episode shows how a single credential reuse can compromise infrastructure that many users rely on to hide their traffic.