Hacker News Reader

Comment by kabakabakaba | Hacker News Reader

Author here :)

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

View on HN

Thankyou for taking the time to detect and validate/verify those hosts. Is there a way you could make an outbound connection from them (maybe curl) to a site like ifconfig.me [1] and start logging which providers they are on then post a report of them on HN?

[1] - https://ifconfig.me/

In my scan on October 2, 26 of the 27 compromised servers outside the Quetzalcoatl relay family (most hosting multiple exits) were at FranTech/BuyVM.

It's been discussed on the mailing list: https://lists.torproject.org/mailman3/hyperkitty/list/tor-re...

That doesnt prove FranTech itself was compromised, but its a strong cluster. AFAIK nobody has contacted them yet, if no one does, I plan to give them a heads up in the coming days.

That is useful information. Historically I have blocked BuyVM on my nodes due to their pro-privacy pro-tor-exit policy. Now I just put anyone arriving from them into a moderator review queue for my silly hobby sites.

It's a good policy to permit Tor exit nodes but it means their network will egress some of the most untoward behavior so that is expected and I would not default to assuming they are compromised, rather have some of the highest concentration of Tor exit nodes. There are pros and cons to such providers and you found one of them.

What I don't get: Why would you want to access hosts via ssh over TOR?

The Ebury botnet that's been around for a decade now is likely spying on Tor exit ssh tunnels looking for other criminals logging into their h4xxr jump boxes, ransomware deployments they can intercept and exploit themselves, financial crime market operators, crypto drug dealers etc.

- Default route is over tor and you didn't make an exception for ssh.

- Hide where you are in the world from your employer, who owns the server. (On vacation?)

- You're hacking the server.

Tor sounds like just about the worst possible way to hide what you're doing from your employer. Why would you not proxy through... your house?

I did exactly that as an intern. The boss blocked traffic for everything except tcp 80 and 443 in an attempt to block IM. I set up a tunnel to my house on one of those ports and arp cache poisoned my coworkers so I was their default gw. Only the boss still had filtered Internet and didn't understand how.

Hehe, that's funny. There are not that many opportunities to use your knowledge about the plumbing of the internet to good effect but that definitely was one of them.

And 4) you're the owner of the server, which is paid in bitcoin and hosted at a "bulletproof provider", and you want to leave no trace back to your "real" IP address should the authorities ever manage to seize it. Often the case for piracy, drug marketplaces and CSAM.

> Why would you want to access hosts via ssh over TOR?

When you're behind a restrictive firewall which blocks anything other than HTTP/HTTPS (like at an Internet café), or when there's some upstream routing issue making reaching the server directly impossible from your location (these can be a pain to diagnose).

Or perhaps it's simply your default: you proxy everything through Tor, and need a reason to not go through it.

Are there restrictive firewalls which block unknown HTTP/HTTPS but not Tor? I'd expect Tor to be blocked first.

(And then proxying via your home is much faster and safer. You can do websocket-based proxy, but even exposing ssh server on port 443 works in a lot of places!)

Remote admin some shady server you control and do not want LE seeing a direct inbound ssh from you in Upper Sandusky, Ohio.

How does this use case differ?

People ssh over Tor for the same reason they use Tor for any network activity: To make confidential 1) your identity to the remote host and 2) your activities to your network providers (including your ISP/workplace/etc.).

If you want only confidential content, ssh is sufficient and so is https for web browsing. If you want the other things, you must use Tor or maybe something similar.

I can't really see legal use cases for (1) and (2) might get you fired if the second. 2a is a 'maybe'.

Your argument seems to oppose anonymity overall, not just in Tor. Is that what you're really talking about here?

If so, the benefits and costs of anonymity, including legal benefits, are well-known. Why start that discussion over?

I use Tor for NAT traversal. I ssh into my home computers over Tor all the time

What's the advantage over say Tailscale for this application?

TOR provides anonymity at the network level, SSH does not.

No public IP. you can use an onion service instead

If the SSH host is a backdoor you installed in a company you hacked, you don't want the FBI tracing it back to you.

thank you, you saved the whole world.

Reply on news.ycombinator.com