一名研究人员周二报告称，身份不明的黑客劫持了300多个Tor出口节点，并重新配置这些节点，使其优先处理未加密的电子邮件流量，并将SSH连接重定向到他们控制的服务器。
Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.
据Tor志愿者称，劫持始于8月下旬，攻击者使用了一个被重复使用的有效密码，从而获得了对一台Tor管理服务器的访问权限。随后，攻击者安装了Ebury——一种12年前发现的、为Linux编写的后门程序。
The hijacking began in late August, when, according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.
接着，攻击者通过SSH从管理服务器连接到第二台Tor服务器，名为Switzerland2，使用的是RSA密钥；出于不明原因，调查人员未能在Switzerland2的授权密钥中找到该密钥。在获得对Switzerland2的管理控制权后，攻击者也在该服务器上安装了Ebury。最后，攻击者重新配置了Switzerland2所托管的两台出口节点的设置。
Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.