Link: https://kaba.cx/posts/20261020_Tor/

TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.

On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.

To give you a sense of scale, all of Tor has around 3000 exit relays, so roughly 10% were under their control.

SSH MitM attacks are nothing new, and very easy to pull off. To secure yourself, use key authentication instead of passwords, and don't ignore the warning that SSH will give you saying "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED".

If you are using something like Tails, you will need to make sure to persist the ssh hosts key file (~/.ssh/known_hosts), or else you will not not be warned when a MitM attack is being performed.

More discussion here: https://news.ycombinator.com/item?id=50166257

If your remote host changes and you don't know why, and login anyway, it's on you.

Dirty trick tho, could definitely have caught me if I was in a lazy mood.

Side note, why ssh over 22 anyway? It's so easy to change just to avoid lazy bots.

That warning about a modified fingerprint only applies if you’ve sshed to that host before. How many people carefully check the fingerprint if it’s the first time they’ve connected?

That's a good point. If you are using a physical server you own, hopefully you set it up locally first. If you are using a VPS, hopefully you configured it with key authentication from the get go. Otherwise, you'd need to find a way to identify that the box you ssh-ed into is indeed the one you expect. Luckily, if it's your first time logging in, then you probably don't have any data in the server either, so there's nothing to steal if the hackers get your password. So just enter your password, see if it's the right box, and if not then reset it and try from a different tor circuit.