8
Unidentified hackers hijacked more than 300 Tor exit nodes, prioritizing unencrypted email traffic and redirecting SSH connections through servers they control. The hijacking, starting in late August, involved using a valid password to access the Tor management server and installing a Linux backdoor called Ebury. The attacker then connected to a second Tor server, Swiss2, and reconfigured two exit nodes. This campaign affected 333 exit relays, redirecting SSH traffic to attacker-controlled servers and blocking encrypted email ports. Tor volunteers shared details of the compromise and interception attempts. The full impact of the hijacking, including successful downgrade attempts, remains unclear.
Source: arstechnica.com
