Host key warnings get ignored partly because tooling makes it so easy — half the CI configs I’ve seen run with strict host key checking off, and accept-new silently trusts whatever key shows up on first connect. And that’s the real weak spot here: TOFU only protects you from the second connection onward. On a first connection through a hostile exit node, the attacker just presents their own key, you pin the wrong one, and no warning ever fires. Ebury being the payload tracks too, that thing’s been harvesting SSH credentials for over a decade and the takedowns never seem to get everyone. Kind of impressive someone compromised 333 exits at once though, that’s over 10% of the network.

The volunteer investigated further and found that when people ignored the warning, the attacker (1) stole the SSH password, (2) opened a connection to the server and observed all typed commands, and (3) opened a second connection and infected the server with Ebury.

To investigate the campaign, Kaba created a script that polled all of Tor’s roughly 3,000 exit nodes to check whether they received a correct SSH fingerprint from a test server. The test server then checked whether the connection came from a pinned exit node or one of 12 SSH interception servers used by the attacker. The volunteer further set up a honeypot to observe the interception software attempting to log in and install Ebury.

. . . The takeaway from the event is the crucial role in-depth defense plays in preventing data theft in mass hacks like this one. Those measures include configuring email accounts to accept only encrypted traffic and reject unencrypted ports. Another is to disable password authentication in favor of SSH keys.

I think the big takeaway here is that if you’re using Tor, or a VPN, or really the internet in general, you always need to think about MITM attacks. There are a lot of standard protections against exactly this kind of attack.

…users who ignored warnings that the SSH host key had changed…

SSH keys are one of those protections. Don’t ignore the warnings. That’s a big red flashing DANGER sign.

…block ports … used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections…

TLS connections are another of those protections; don’t use apps or services that allow plaintext communication.

I’d be interested to know which email clients will downgrade connections by default. That is an absolutely insane thing to do. I don’t think my email provider even accepts unencrypted connections anymore.

This is scary but really, nobody’s supposed to trust Tor exit nodes in the first place. This doesn’t drastically change my comfort level with Tor. But it’s a good reminder that you need to be mindful of how your apps are configured.

the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys

That’s what really makes my hair stand on end. Is there some vulnerability in ssh they exploited to gain full access, unauthorized?

Shout-out to whoever commandeered 333 of the FBI’s exit nodes.