Tor

How I got over 300 Tor exit nodes removed

The author of KABA.CX describes discovering that 333 compromised Tor exit relays, about 10% of all exits, were redirecting SSH connections to interception servers to steal passwords and spread the Ebury backdoor. They explain how an exitmap script and an sshesame honeypot exposed the relays, and how the Tor network health team got them flagged and shut down within days.

Blog post · Security · Tor · SSH · Privacy