Tor relay hijacking exposed SSH passwords through fake host keys
Researcher kaba found 333 Tor exit relays redirecting Secure Shell (SSH) connections to 12 interception servers in an October 2 scan, after attackers changed relay policies between October 1 and 4. At its October 4 peak, the altered exit policy covered 7.46% of Tor exit capacity. The Tor Project began flagging relays that day; none remained in the network consensus by October 5.
An exit relay’s policy controls which destination ports it carries. Attackers changed relay configurations to allow port 22, then routed SSH connections to servers that presented their own host keys. Users who accepted a changed key and logged in with a password could expose that password to the interception server.
For operators whose Linux hosts were compromised, disappearing from Tor’s consensus stopped clients selecting those relays but did not establish that the hosts were clean. Users who accepted changed keys and entered passwords during the affected period face a separate credential exposure.