How I got over 300 Tor exit nodes removed

Original Article ↗ Hacker News Discussion ↗

Around 10% of Tor exit nodes were recently found intercepting SSH port 22 traffic, performing man‑in‑the‑middle attacks to steal credentials and deploy the long‑running Ebury malware, leading to hundreds of exits being taken offline. Commenters examine how the attack worked, why SSH over Tor is used, and how key-based or hardware-backed authentication can mitigate such threats, while also debating the security and legal risks of running Tor relays or exits on VPS and cloud infrastructure. The incident is framed as both a technical warning about endpoint and hosting-provider compromise and a reminder that strong operational security and legal protections are critical for privacy technologies like Tor.

Compromised Tor exits and provider clustering

  • Around 10% of exits were found redirecting SSH (port 22) to MITM servers stealing passwords and attempting Ebury deployment.
  • Many compromised exits outside one relay family were hosted at a single “pro-privacy” VPS provider; posters stress this suggests clustering, not proof the provider itself is hacked.
  • Some want the provider informed; others already treat that ASN’s traffic as higher risk (e.g., extra moderation queues).

Why use SSH over Tor?

  • Use cases listed:
    • Default “all traffic via Tor” setups with no SSH exception.
    • Hiding physical location from an employer or from law enforcement when administering questionable servers.
    • Remote admin of compromised backdoors, dark-market infrastructure, or NAT-traversed home servers/onion services.
    • Working behind highly restrictive firewalls or routing issues.
  • Skeptics argue Tor is slow, often blocked, and a poor choice if you could tunnel via home instead.

Mitigations: SSH keys, hardware tokens, mutual auth

  • Disabling password auth and using SSH keys would have prevented password theft in this attack.
  • Even if the user accepts a bogus host key, public-key auth prevents the attacker from logging into the real server, though they can still see commands.
  • Discussion of hardware security keys (FIDO2/YubiKey, Secure Enclave, Touch ID) for storing private keys and requiring user presence.
  • Emphasis that users must heed SSH host-key change warnings; some note “ephemeral” Tor users who avoid persistent known-hosts lose that protection.

Trust in VPS and “confidential computing”

  • Several posters distrust VPS for privacy-critical workloads, noting providers can snapshot RAM/disk or be compromised.
  • Debate on whether cloud features like IOMMU, Nitro, and SEV-SNP meaningfully protect against the host:
    • One side says these mainly defend VM-to-VM attacks; the host still ultimately wins.
    • Another side claims large clouds invest heavily in virtualization security and key destruction mechanisms.
  • Some call confidential-computing marketing overstated, citing that many vulnerabilities were found by outsiders, not cloud vendors.

Running Tor exits and relays: scale, abuse, and legal risk

  • Only ~3000 exits is seen as “insanely few,” yet also a “miracle” given:
    • Exit operators often face law-enforcement visits, equipment seizures, and hosting bans.
    • In some countries, even relays are perceived as legally risky.
  • Many believe a nontrivial share of exits are run by intelligence services, cybersecurity firms, or criminals logging everything.
  • Several people avoid running exits (or even Tor at all) due to fear of association with CSAM, fraud, and other serious crimes.

Tooling, attacks on Tor, and operational notes

  • The exit-scanning tool “exitmap” is credited as crucial; concerns about abusing it for DDoS are dismissed since it uses Tor’s existing circuit options.
  • Separate reports mention DDoS on guard nodes, forcing some operators to downgrade to middle relays; these are distinguished from the Ebury compromise.

Broader privacy and law perspective

  • Some argue that technical tools (Tor, VPNs) can’t fully protect users once law enforcement targets them; operators of privacy services still get prosecuted.
  • From that view, durable privacy is framed as a political/legislative issue rather than purely a technical one.