Tor Exit Nodes Hijacked to Intercept SSH Traffic and Email

Unknown hackers hijacked over 300 Tor exit nodes, reconfiguring them to favor unencrypted email traffic and redirect SSH connections through servers they controlled. The hijacking began in late August, when an attacker used a valid password to gain access to a Tor management server. The attacker then installed Ebury, a 12-year-old Linux backdoor, on the management server and a second Tor server, called Switzerland2. The attacker connected to Switzerland2 through SSH using an RSA key that investigators couldn't find among the server's authorized keys. With administrative control of Switzerland2, the attackers reconfigured settings on two exit nodes that the server hosted. The exact motives and extent of the hijacking remain unclear.