Monday, April 15, 2024

Over 25% of Tor Exit Nodes Intercept Traffic to Carry Out Spying Activities

An unknown threat actors using the malicious exit nodes to the Tor network for over a year (more than 16 months) simply to intercept the traffic and carry out SSL-stripping attacks on the users who are visiting the websites related to the cryptocurrency.

Now many of you might be thinking that what is SSL-stripping? It is a method through which the attackers downgrade a connection from secure HTTPS to plain HTTP.

Here the attacks became known back in August 2020, all thanks to a security researcher known as “Nusenu,” who is also the operator of the Tor exit node. 

At the time, it was reported that the attacks began in January last year, and at the height of the operation, the attackers controlled approximately four hundred malicious Tor exit nodes.

New Complicated Attack 

However, according to the report that summited by Nusenu over Medium, during the attacks, the attackers changed the addresses of cryptocurrency wallets with their own to intercept transactions.

Despite the reporting last year, the threat actors are still operating their attacks. As in February 2021, attacks hit 27% of malicious Tor exit nodes, although the second wave of attacks was noticed and neutralized.

But, after the malicious infrastructure had been active for several weeks. The main reason for the success of this operation is that the attackers added malicious nodes in small numbers, quietly creating an impressive infrastructure.

Apart from this, since May Nusenu has been reporting the malicious exit relays to the admins of the Tor network. Even he also claimed that the capabilities of the attackers have been decreased dramatically just after the latest takedown that took place on June 21.

In early May, the attackers tried to simultaneously return back online all the disconnected servers, that couldn’t go unnoticed. Here, the attack was discovered just a day after the number of Tor exit nodes skyrocketed from 1500 to more than 2500.

So, instead of shutting down over 1,000 malicious servers, still the attackers have 4-6% of Tor’s power output under their control. Moreover, Nusenu noted that, after the SSL-stripping attack, the attackers download modifications, but what they exactly do is still not clear.

In 2018, a Similar Attack Took Place

The cybersecurity specialists claimed that in 2018 a similar type of attack took place, but at that time Tor exit nodes were not targeted. Instead of Tor nodes, the attackers targeted the Tor-to-web (Tor2Web) proxies.

Moreover, the Tor-to-web (Tor2Web) proxies are the public websites that allow normal users to access the .onion websites that are only accessible through the Tor Browser.

During this operation, Proofpoint, a US security firm who reported that an unknown operator of the Tor-to-web proxy has been replacing the Bitcoin addresses for the users silently who are seeking to pay the ransom demands on the ransomware payment portals.

As a result, the threat actors who are in the middle are silently looting the ransom payments of the users, and leaving them aside without a decryption key, even after paying the ransom amount.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles