What Happened
The Hacker News reports a researcher known as kaba scanned about 3,000 Tor exit relays on October 2 and found 333 redirecting SSH traffic on port 22 to 12 interception servers. At the peak on October 4, the affected relays held 7.46 percent of Tor exit capacity. The Tor Project began flagging relays on October 4, and none remained in the consensus by 17:00 UTC on October 5.
The interceptor presented its own host key, captured the typed password, and relayed the session to the real server so the login looked normal. The attackers then tested for sudo access and ran a base64-encoded Perl installer. Key-based logins resisted relaying. One relay operator traced the entry point to a management server with the Ebury OpenSSH backdoor, reached on August 28 through a reused password.
Why This Matters for Canadian Organizations
Canadian security researchers, journalists, and administrators use Tor to reach servers without exposing their location. Anyone who connected over Tor between October 1 and 5, accepted a changed or new host key, and typed a password should treat the password as stolen.
Canadian universities and privacy groups run relays, and the entry point here was a reused password on an internet-facing server. Ebury targets OpenSSH hosts, so a compromised server tied to a Canadian business raises PIPEDA breach questions if it holds personal information.
What to Do
Switch SSH to key-based authentication and disable password logins. Treat every changed host key warning as an incident. Verify host keys through a second channel before first use. Change any password you typed over Tor during the window, then check the server for Ebury indicators.
Relay operators should review Relay Search for unfamiliar Exit flags, check torrc files for changed exit lines, and compare the tor binary against package checksums. Reinstall instead of cleaning a compromised host, create a new relay identity, and rotate every credential. Report bad relays to bad-relays@lists.torproject.org. More analysis sits in our Trends archive.
