Yet another Hacker News

How I got over 300 Tor exit nodes removed

94 points kabakabakaba 2 hours ago 26 comments

kabakabakaba 2 hours ago | parent

Author here :)

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

Bender 1 hour ago | parent

Thankyou for taking the time to detect and validate/verify those hosts. Is there a way you could make an outbound connection from them (maybe curl) to a site like ifconfig.me [1] and start logging which providers they are on then post a report of them on HN?

[1] - https://ifconfig.me/

kabakabakaba 1 hour ago | parent

In my scan on October 2, 26 of the 27 compromised servers outside the Quetzalcoatl relay family (most hosting multiple exits) were at FranTech/BuyVM.

It's been discussed on the mailing list: https://lists.torproject.org/mailman3/hyperkitty/list/tor-re...

That doesnt prove FranTech itself was compromised, but its a strong cluster. AFAIK nobody has contacted them yet, if no one does, I plan to give them a heads up in the coming days.

Bender 35 minutes ago | parent

That is useful information. Historically I have blocked BuyVM on my nodes due to their pro-privacy pro-tor-exit policy. Now I just put anyone arriving from them into a moderator review queue for my silly hobby sites.

It's a good policy to permit Tor exit nodes but it means their network will egress some of the most untoward behavior so that is expected and I would not default to assuming they are compromised, rather have some of the highest concentration of Tor exit nodes. There are pros and cons to such providers and you found one of them.

jacquesm 1 hour ago | parent

What I don't get: Why would you want to access hosts via ssh over TOR?

M95D 1 hour ago | parent

- Default route is over tor and you didn't make an exception for ssh.

- Hide where you are in the world from your employer, who owns the server. (On vacation?)

- You're hacking the server.

ndriscoll 1 hour ago | parent

Tor sounds like just about the worst possible way to hide what you're doing from your employer. Why would you not proxy through... your house?

mschuster91 41 minutes ago | parent

And 4) you're the owner of the server, which is paid in bitcoin and hosted at a "bulletproof provider", and you want to leave no trace back to your "real" IP address should the authorities ever manage to seize it. Often the case for piracy, drug marketplaces and CSAM.

nickdothutton 1 hour ago | parent

Remote admin some shady server you control and do not want LE seeing a direct inbound ssh from you in Upper Sandusky, Ohio.

dustfinger 1 hour ago | parent

TOR provides anonymity at the network level, SSH does not.

dist-epoch 53 minutes ago | parent

If the SSH host is a backdoor you installed in a company you hacked, you don't want the FBI tracing it back to you.

NoidFonsense 45 minutes ago | parent

No public IP. you can use an onion service instead

cesarb 34 minutes ago | parent

> Why would you want to access hosts via ssh over TOR?

When you're behind a restrictive firewall which blocks anything other than HTTP/HTTPS (like at an Internet café), or when there's some upstream routing issue making reaching the server directly impossible from your location (these can be a pain to diagnose).

Or perhaps it's simply your default: you proxy everything through Tor, and need a reason to not go through it.

hackermailman 17 minutes ago | parent

The Ebury botnet that's been around for a decade now is likely spying on Tor exit ssh tunnels looking for other criminals logging into their h4xxr jump boxes, ransomware deployments they can intercept and exploit themselves, financial crime market operators, crypto drug dealers etc.

mmooss 5 minutes ago | parent

How does this use case differ?

People ssh over Tor for the same reason they use Tor for any network activity: To make confidential 1) your identity to the remote host and 2) your activities to your network providers (including your ISP/workplace/etc.).

If you want only confidential content, ssh is sufficient and so is https for web browsing. If you want the other things, you must use Tor or maybe something similar.

96718923545809 1 hour ago | parent

Thank you for writing this.

> But if you ignore the warning and go ahead with the login, the attacker does three things: > 1. Steals your password

This shouldn't affect key-based authentication, though

Also, this from Marc-Etienne M.Léveillé email linked in your post:

> Another possibility is a compromised hosting provider. We identified a couple of them in the past where their management servers were compromised by Ebury and their customers' VPSes, containers, etc., ended up running Ebury as well.

Provider-side compromise of customer VPS instances has been a growing trend in recent years. I stopped hosting anything privacy-related on VPS in favor of dedicated hardware. Many people still don't understand how easy it is for a provider to silently dump and/or manipulate both RAM and disk space in real-time.

mschuster91 42 minutes ago | parent

> Many people still don't understand how easy it is for a provider to silently dump and/or manipulate both RAM and disk space in real-time.

That depends on the VPS technology stack being used. IIRC, at least Amazon uses hardware features like IOMMU that prevent any kind of access to the guest's memory from the host side.

zzrrt 8 minutes ago | parent

And if Amazon disabled it for any reason, would the guest know?

evolve2k 58 minutes ago | parent

> The lesson is the same as always: extra security is a worthwhile investment. Disable password authentication in favor of ssh keys. I for one am going to buy myself some hardware keys today. :)

Question: Where to get these hardware keys? Which are good options and why?

hackermailman 33 minutes ago | parent

A Yubikey, though simply generating ssh keys instead of using passwords would stop this MITM attack. So would changing the rounds and port of ssh on your system and the remote box making yourself an invisible protocol nothing would recognize.

Yubikey benefits is it stores the keys in the hardware if your laptop is compromised somehow or stolen they at least don't get all the ssh keys too

g_p 29 minutes ago | parent

You don't need to go out and buy hardware keys today. You should be able to use any FIDO2 key these days for SSH, as long as your server runs a recent enough OpenSSH server, which supports ecdsa-sk or ed25519-sk public keys.

Reputable vendors of those hardware keys included Yubikey and Token2, among others. You are really just using them as FIDO2 tokens, so go for what's reputable there.

If you are just getting started, you can generate and use software-backed keys (using ssh-keygen) and copy the public keys to servers' authorized_keys file using ssh-copy-id (or manually adding it). You should probably start learning this way (with plenty of online guides, and fewer risks of an old server implementation not supporting FIDO2 credentials), and then move to hardware keys once you understand the mechanics of copying around public keys, etc. Your password manager might also support acting as an SSH agent for key based logins - I believe Bitwarden and some others now do this, for example.

cesarb 44 minutes ago | parent

Once again, this shows the strength of mutual authentication (ssh user key authentication, or HTTPS client certificates): even if the client accepts the forged server key from a MITM server, the real server won't accept the client key exchange (since it, at least in the SSH protocol, is bound to the connection). For the three things the attacker did here:

1. It can't steal your password, since the private key never leaves your client;

2. It can observe each command you type, but it can't open a connection to the real server to know how it would respond to your commands;

3. It can't open any connection to the real server (it will fail authentication), so it can't do anything to the real server.

If you really like passwords, there are ways to configure sshd to require both a client key and a password, in that order.

g_p 33 minutes ago | parent

You could also do mutual authentication of SSH, with a local password-encrypted private keyfile, if you really like passwords. That gives you all the benefits of the "something you know" factor, without exposing the password to the server. And you can inspect how the decryption and use of the key happens (since it is on your computer), and therefore see it doesn't leave your computer.

jszymborski 44 minutes ago | parent

3000 is insanely few exit nodes.

malfist 20 minutes ago | parent

It's insanely few, but also isn't that possibly an advantage? When lots of people's transfers are intermingled that means the possibility of separating out one person's traffic from the rest is harder.

phw 6 minutes ago | parent

I built exitmap over ten years ago. Glad to see it's still of use :)