How I got over 300 Tor exit nodes removed
Points and comments are a snapshot, not live.
333 Tor exit nodes were compromised in an SSH MITM attack using the Ebury backdoor.
On October 2, 333 infected Tor exit nodes (about 10% of all exits) launched a coordinated SSH man-in-the-middle attack. Attackers redirected port 22 traffic to 12 interception servers running a paramiko-based SSH library, stealing passwords and attempting to install the Ebury OpenSSH backdoor on target servers. The author detected the attack when his SSH connection triggered a host key warning, then used exitmap to scan all ~3000 exit relays, finding over 300 redirecting through the interception servers. The Tor network health team responded by marking the relays as BadExit and contacting operators, taking them offline by October 5. The attack vector remains unknown, with one theory pointing to a compromised hosting provider (FranTech/BuyVM).
What commenters are saying
Commenters thanked the author for the detection work. Several questioned why anyone would SSH over Tor, citing legal uses like bypassing restrictive firewalls, hiding from employers, or accessing servers without public IPs. Others noted that key-based authentication prevents password theft but warned that users who accept changed host keys remain vulnerable to MITM. On the attack vector, one commenter confirmed 26 of 27 compromised servers were at FranTech/BuyVM, noting that provider-side compromise of VPS instances is a growing concern. Some advocated for dedicated hardware over VPS for sensitive operations, while others argued that hardware security features like IOMMU mitigate host-level snooping.