[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-attackers-hijack-300-plus-tor-exit-nodes-to-snoop-on-ssh-email":10,"sections":45},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":34,"tags":35,"sources":40,"feedback":44,"feedback_at":22,"cost_usd":44,"total_tokens":44},12128,"attackers-hijack-300-plus-tor-exit-nodes-to-snoop-on-ssh-email","Attackers Hijack 300-Plus Tor Exit Nodes to Snoop on SSH, Email","A reused password on a Tor management server let an attacker plant a 12-year-old backdoor and reroute traffic through machines it controlled.","Unknown attackers took over more than 300 Tor exit nodes and set them to favor unencrypted email traffic and send SSH connections through servers the attackers controlled, a researcher reported on October 20.\n\nExit nodes are the last hop in the Tor network, where traffic leaves the anonymizing relay chain and reaches the open internet. Whatever is not encrypted at that point can be read by whoever runs the node. SSH is the standard tool for logging into remote servers securely, so rerouting those sessions puts the attacker in the middle of connections that admins treat as private.\n\nAccording to Tor volunteers, the hijacking began in late August. The attacker used a valid password that had been reused to get into a Tor management server, then installed Ebury, a Linux backdoor first discovered 12 years ago. From there, the attacker connected over SSH to a second Tor server, called Switzerland2, using an RSA key. With administrative control of Switzerland2, the attacker installed Ebury on it too, then reconfigured settings on two exit nodes that machine hosted.\n\nThe notable part is how ordinary the way in was. Nothing here broke Tor's cryptography or its anonymity design. The attacker walked through a reused credential into the machinery that runs the network, and a backdoor more than a decade old did the rest.\n\nThat shifts the practical risk. Anyone who sent email over Tor without encryption was exposed by choice of protocol, not by a flaw in Tor itself. SSH users have a usual safeguard in the host key warning their client shows when a server's identity changes, which is worth heeding.\n\nFor the Tor Project and its volunteers, the lesson is about administration. A network built to avoid single points of trust still depends on management servers, and those are only as strong as the weakest password protecting them.","[\"tor\",\"ssh\",\"backdoor\",\"credential-reuse\"]","2026-10-22T11:30:33.000Z","2026-10-22T12:14:48.705Z","2026-10-22T12:14:48.984Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Cut the sentence 'The material available does not say how a change on two exit nodes became more than 300', which narrates a gap in the source to the reader; reconcile it silently or flag it outside the copy. Also remove the unsupported 'reported in October' (the source only says 'Tuesday'), and the closing claim that investigators 'cannot be sure they have found every way in', which the source does not state.","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The headline and lede claim 333 hijacked exit nodes, but the body only describes reconfiguring two exit nodes hosted on Switzerland2, so the key supporting detail is missing; reconcile the scale of the compromise with the body without narrating the gap (for example, use the source's 'more than 300' wording and describe the exit-node reconfiguration only as far as the source supports), and end on a real conclusion rather than restating the RSA key mystery.","security",[36,37,38,39],"tor","ssh","backdoor","credential-reuse",[41],{"name":42,"url":43},"Ars Technica","https:\u002F\u002Farstechnica.com\u002Finformation-technology\u002F2026\u002F10\u002F300-tor-exit-nodes-hijacked-to-intercept-ssh-traffic-and-retrieve-plaintext-email\u002F",0,{"sections":46},[47,52,56,61,66,71,76,81,86,91,96,101,106,111],{"name":48,"slug":49,"count":50,"latest_published_at":51},"AI","ai",7062,"2026-10-22T17:00:39.000Z",{"name":53,"slug":34,"count":54,"latest_published_at":55},"Security",1042,"2026-10-22T15:11:26.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Policy","policy",570,"2026-10-22T16:00:29.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Deals","deals",558,"2026-10-22T13:00:00.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Hardware","hardware",287,"2026-10-22T16:18:47.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",281,"2026-10-22T14:09:11.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Science","science",214,"2026-10-22T14:59:28.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",142,"2026-10-22T16:05:08.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Software","software",138,"2026-10-22T04:52:10.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"General","general",96,"2026-10-22T16:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Gaming","gaming",86,"2026-10-22T13:17:59.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":112,"slug":113,"count":114,"latest_published_at":115},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]