Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Over 300 Tor exit relays were hijacked to man-in-the-middle SSH connections and steal passwords—a stark reminder to enforce key-based authentication and never rely on Tor for transport confidentiality.
Summary written by editorial AI · Source link below
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.
Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception
Editorial Analysis
The attack exploits a fundamental trust assumption about Tor exit relays, demonstrating that password-based SSH authentication over untrusted networks remains dangerously vulnerable.
Mandate certificate or key-based SSH authentication across all environments and block SSH password login from external or anonymised network sources.
Attackers compromised 300+ Tor nodes to steal SSH passwords, underscoring the need for key-based authentication across the enterprise.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d