Attackers Hijacked 300 Tor Relays to Steal SSH Logins

Attackers hijacked hundreds of Tor exit relays, using them to perform man-in-the-middle attacks and steal SSH login credentials from users.

Attackers took control of more than 300 Tor exit relays for five days in early October, using them to intercept secure shell (SSH) connections and steal login credentials. According to a researcher who discovered the campaign, the attack ran from October 1 to October 5. The attackers configured the compromised relays to perform a man-in-the-middle (MITM) attack, a technique where they secretly position themselves between two parties to eavesdrop or alter communication. By hijacking such a large number of exit relays—the final hop where traffic leaves the anonymized Tor network for the public internet—the attackers significantly increased their chances of intercepting connections from their intended targets. This incident highlights a major operational security risk for technical users who rely on Tor for privacy while managing remote servers.

This attack worked by exploiting a critical step in the SSH connection process: host key verification. When a user connects to an SSH server for the first time, their client receives the server's public key fingerprint. The user is prompted to verify and accept this key. In this attack, the malicious Tor exit relays presented a fake server fingerprint to the user. If the user accepted this unknown key, their SSH traffic was redirected to a server controlled by the attackers. This malicious server would then capture the user's password in plain text before forwarding the connection to the legitimate destination, making the interception difficult to detect. The attack's success depended entirely on users ignoring the crucial security warning about an untrusted host key, a common mistake when connecting to new or unfamiliar systems.

The use of malicious exit relays to compromise user security is not a new phenomenon on the Tor network. For years, researchers have documented cases where attackers use control of these nodes to perform SSL stripping attacks, which downgrade secure HTTPS connections to unencrypted HTTP, or to inject malicious code into downloads. However, this incident is notable for both its scale and its specific targeting of SSH. Hijacking over 300 relays represents a significant portion of the network's exit capacity. The focus on SSH, a protocol primarily used by developers, system administrators, and other technical staff, suggests a sophisticated adversary aiming to steal high-value credentials that could grant access to critical corporate or private infrastructure, rather than just targeting general web users.

The most important takeaway from this incident is that Tor provides anonymity, not end-to-end security. The security of the data itself still relies on application-layer protocols like TLS and proper SSH key management. For developers and security teams, this serves as a powerful reminder to enforce strict SSH security hygiene. This includes never blindly accepting new or changed host key fingerprints without verifying them through a separate, trusted channel. Organizations should mandate the use of public key or certificate-based authentication over passwords, as these methods are not vulnerable to simple credential theft. This attack will likely pressure the Tor Project to enhance its monitoring and vetting processes for relay operators to prevent such large-scale compromises in the future.

This attack demonstrates a significant operational risk for developers and sysadmins using Tor for privacy during remote server administration. It proves that a large portion of Tor's exit infrastructure can be compromised to specifically target and steal high-value credentials for a core protocol like SSH.

A successful SSH credential theft can lead to a full-scale data breach, system compromise, or ransomware deployment. This incident highlights a critical risk for companies whose employees use privacy tools like Tor for remote work, potentially exposing sensitive corporate infrastructure to attackers.