alt Hacker NewsAuthor here :)
TLDR: on Oct 2, 333 exits (~10% of Tor exits) started redirecting port 22 to 12 interception servers running a paramiko-based MITM that stole passwords and tried to drop Ebury on the target.
Replies
jacquesm • today at 2:26 PM
What I don't get: Why would you want to access hosts via ssh over TOR?
➕ show 8 replies
m00dy • today at 4:09 PM
thank you, you saved the whole world.
Thankyou for taking the time to detect and validate/verify those hosts. Is there a way you could make an outbound connection from them (maybe curl) to a site like ifconfig.me [1] and start logging which providers they are on then post a report of them on HN?
[1] - https://ifconfig.me/