<- Back
Comments (43)
- phwI built exitmap over ten years ago. Glad to see it's still of use :)
- privacyishumanTor guard nodes seemed to be under attack but the devs aren't really engaging with it publicly, at least. It happened to mine and I had to switch it to a middle relay.https://forum.torproject.org/t/tor-relays-shutting-down-my-4...
- 96718923545809Thank you for writing this.> But if you ignore the warning and go ahead with the login, the attacker does three things: > 1. Steals your passwordThis shouldn't affect key-based authentication, thoughAlso, this from Marc-Etienne M.Léveillé email linked in your post:> Another possibility is a compromised hosting provider. We identified a couple of them in the past where their management servers were compromised by Ebury and their customers' VPSes, containers, etc., ended up running Ebury as well.Provider-side compromise of customer VPS instances has been a growing trend in recent years. I stopped hosting anything privacy-related on VPS in favor of dedicated hardware. Many people still don't understand how easy it is for a provider to silently dump and/or manipulate both RAM and disk space in real-time.
- jszymborski3000 is insanely few exit nodes.
- fguerrazAny legit use case for using SSH over Tor?
- cesarbOnce again, this shows the strength of mutual authentication (ssh user key authentication, or HTTPS client certificates): even if the client accepts the forged server key from a MITM server, the real server won't accept the client key exchange (since it, at least in the SSH protocol, is bound to the connection). For the three things the attacker did here:1. It can't steal your password, since the private key never leaves your client;2. It can observe each command you type, but it can't open a connection to the real server to know how it would respond to your commands;3. It can't open any connection to the real server (it will fail authentication), so it can't do anything to the real server.If you really like passwords, there are ways to configure sshd to require both a client key and a password, in that order.
- kabakabakabaAuthor here :)TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.
- anonundefined
- evolve2k> The lesson is the same as always: extra security is a worthwhile investment. Disable password authentication in favor of ssh keys. I for one am going to buy myself some hardware keys today. :)Question: Where to get these hardware keys? Which are good options and why?