Friday, March 29, 2024

Over 25% of Tor Exit Nodes Intercept Traffic to Carry Out Spying Activities

An unknown threat actors using the malicious exit nodes to the Tor network for over a year (more than 16 months) simply to intercept the traffic and carry out SSL-stripping attacks on the users who are visiting the websites related to the cryptocurrency.

Now many of you might be thinking that what is SSL-stripping? It is a method through which the attackers downgrade a connection from secure HTTPS to plain HTTP.

Here the attacks became known back in August 2020, all thanks to a security researcher known as “Nusenu,” who is also the operator of the Tor exit node. 

At the time, it was reported that the attacks began in January last year, and at the height of the operation, the attackers controlled approximately four hundred malicious Tor exit nodes.

New Complicated Attack 

However, according to the report that summited by Nusenu over Medium, during the attacks, the attackers changed the addresses of cryptocurrency wallets with their own to intercept transactions.

Despite the reporting last year, the threat actors are still operating their attacks. As in February 2021, attacks hit 27% of malicious Tor exit nodes, although the second wave of attacks was noticed and neutralized.

But, after the malicious infrastructure had been active for several weeks. The main reason for the success of this operation is that the attackers added malicious nodes in small numbers, quietly creating an impressive infrastructure.

Apart from this, since May Nusenu has been reporting the malicious exit relays to the admins of the Tor network. Even he also claimed that the capabilities of the attackers have been decreased dramatically just after the latest takedown that took place on June 21.

In early May, the attackers tried to simultaneously return back online all the disconnected servers, that couldn’t go unnoticed. Here, the attack was discovered just a day after the number of Tor exit nodes skyrocketed from 1500 to more than 2500.

So, instead of shutting down over 1,000 malicious servers, still the attackers have 4-6% of Tor’s power output under their control. Moreover, Nusenu noted that, after the SSL-stripping attack, the attackers download modifications, but what they exactly do is still not clear.

In 2018, a Similar Attack Took Place

The cybersecurity specialists claimed that in 2018 a similar type of attack took place, but at that time Tor exit nodes were not targeted. Instead of Tor nodes, the attackers targeted the Tor-to-web (Tor2Web) proxies.

Moreover, the Tor-to-web (Tor2Web) proxies are the public websites that allow normal users to access the .onion websites that are only accessible through the Tor Browser.

During this operation, Proofpoint, a US security firm who reported that an unknown operator of the Tor-to-web proxy has been replacing the Bitcoin addresses for the users silently who are seeking to pay the ransom demands on the ransomware payment portals.

As a result, the threat actors who are in the middle are silently looting the ransom payments of the users, and leaving them aside without a decryption key, even after paying the ransom amount.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles