Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Summary: Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to 12 interception servers that captured login passwords. The Tor Project began flagging relays on October 4 and by October 5 none remained in the consensus; at peak on October 4 the affected relays made up 7.46% of Tor's exit capacity by consensus weight.
What you should know: Only password logins made through Tor between October 1 and the afternoon of October 5, after accepting an unfamiliar or changed host key, were exposed, and no count of victims exists. The root cause on the largest affected relay family was one password reused for SSH login, sudo and the backup passphrase, stored in plaintext, plus SSH password authentication left enabled on an internet-facing management server.

Read the original at The Hacker News ↗