A significant security breach has exposed vulnerabilities in the Tor network, with hackers compromising 333 exit nodes to intercept SSH connections. The attackers redirected traffic to 12 servers under their control, enabling them to capture passwords from users who accepted suspicious SSH identification keys.
The campaign extended beyond SSH interception. Attackers also modified communication ports, exposing unencrypted email connections and potentially compromising additional user credentials. The attack demonstrates how exit node operators—trusted to relay traffic out of the Tor network—can become points of failure if their systems are compromised or malicious.
The Tor Project has already removed the compromised nodes from its list of usable servers, mitigating further damage. This incident underscores the importance of using additional security measures when routing sensitive traffic through Tor, such as verifying SSH key fingerprints and avoiding public Wi-Fi for unencrypted communications. Users who regularly rely on Tor for privacy-sensitive operations should review their SSH key configurations and consider regenerating credentials if they connected during the attack window.