Saturday, July 13, 2024

Over 25% of Tor Exit Nodes Intercept Traffic to Carry Out Spying Activities

An unknown threat actors using the malicious exit nodes to the Tor network for over a year (more than 16 months) simply to intercept the traffic and carry out SSL-stripping attacks on the users who are visiting the websites related to the cryptocurrency.

Now many of you might be thinking that what is SSL-stripping? It is a method through which the attackers downgrade a connection from secure HTTPS to plain HTTP.

Here the attacks became known back in August 2020, all thanks to a security researcher known as “Nusenu,” who is also the operator of the Tor exit node. 

At the time, it was reported that the attacks began in January last year, and at the height of the operation, the attackers controlled approximately four hundred malicious Tor exit nodes.

New Complicated Attack 

However, according to the report that summited by Nusenu over Medium, during the attacks, the attackers changed the addresses of cryptocurrency wallets with their own to intercept transactions.

Despite the reporting last year, the threat actors are still operating their attacks. As in February 2021, attacks hit 27% of malicious Tor exit nodes, although the second wave of attacks was noticed and neutralized.

But, after the malicious infrastructure had been active for several weeks. The main reason for the success of this operation is that the attackers added malicious nodes in small numbers, quietly creating an impressive infrastructure.

Apart from this, since May Nusenu has been reporting the malicious exit relays to the admins of the Tor network. Even he also claimed that the capabilities of the attackers have been decreased dramatically just after the latest takedown that took place on June 21.

In early May, the attackers tried to simultaneously return back online all the disconnected servers, that couldn’t go unnoticed. Here, the attack was discovered just a day after the number of Tor exit nodes skyrocketed from 1500 to more than 2500.

So, instead of shutting down over 1,000 malicious servers, still the attackers have 4-6% of Tor’s power output under their control. Moreover, Nusenu noted that, after the SSL-stripping attack, the attackers download modifications, but what they exactly do is still not clear.

In 2018, a Similar Attack Took Place

The cybersecurity specialists claimed that in 2018 a similar type of attack took place, but at that time Tor exit nodes were not targeted. Instead of Tor nodes, the attackers targeted the Tor-to-web (Tor2Web) proxies.

Moreover, the Tor-to-web (Tor2Web) proxies are the public websites that allow normal users to access the .onion websites that are only accessible through the Tor Browser.

During this operation, Proofpoint, a US security firm who reported that an unknown operator of the Tor-to-web proxy has been replacing the Bitcoin addresses for the users silently who are seeking to pay the ransom demands on the ransomware payment portals.

As a result, the threat actors who are in the middle are silently looting the ransom payments of the users, and leaving them aside without a decryption key, even after paying the ransom amount.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles