Tagged: Tor
10 posts · browse all tags
-
Tor Deep Dive Part 1: How Over 300 Tor Exit Relays Were Hijacked to Steal SSH Passwords
In early October 2026, attackers rewrote the exit policy on hundreds of Tor relays and sent SSH traffic to interception servers. What happened, how it was found, what is still unknown, and what to change today.
-
Tor Deep Dive Part 10: Tor, VPN, Tailscale or Cloudflare Tunnel? A Decision Table
A who-sees-what comparison of Tor, a commercial VPN, Tailscale and Cloudflare Tunnel, and a ranking of ways to reach your own SSH server. Only Tor was tested; the rest is attributed to vendor documentation.
-
Tor Deep Dive Part 2: How Tor Works and What You Are Trusting
Guards, middles, exits, the consensus and the directory authorities, with live numbers from a real Tor consensus. Then the question that matters: who can see what, and who are you trusting to get it right.
-
Tor Deep Dive Part 3: Running a Tor Client on Debian 13
Installing Tor on Debian 13 from the Tor Project's own apt repository, what the package sets up by default, and how to prove traffic is really going through a circuit.
-
Tor Deep Dive Part 4: SSH Over Tor, Host Keys, and Why an Onion Service Beats an Exit
Real SSH sessions over Tor on Debian 13: an onion service for SSH, the changed-host-key warning from the October 2026 exit relay incident, and the silent first connect that has no warning at all.
-
Tor Deep Dive Part 5: What a Hostile Exit Can Do to an SSH Connection, Tested in an Isolated Lab
One NAT rule, four network namespaces and stock OpenSSH show exactly when a redirected SSH connection warns you, when it silently lands on the wrong server, and why key-based login gets nothing out of it.
-
Tor Deep Dive Part 6: Ebury, and How to Check Your Own Debian Hosts for It
Ebury is the SSH backdoor that sat on the hijacked Tor relays. How it hides inside a library sshd already loads, why dpkg -V stays silent, and what ESET's own detection script does and does not catch, tested on Debian 13.
-
Tor Deep Dive Part 7: Finding Bad Exit Relays with a Python Scanner
How kaba found the hijacked exits, and a small Python scanner of my own that pins each Tor exit, connects out through it and compares SSH host keys and TLS certificates. Tested on a Debian 13 VM against real exits.
-
Tor Deep Dive Part 8: Running a Tor Relay Securely on Debian
What the relay hijack teaches about running your own Tor relay on Debian 13: the tor.service trap, systemd hardening, file integrity checks with AIDE, a script that checks what the network publishes about your relay, and incident response.
-
Tor Deep Dive Part 9: Other Ways Tor Can Fail You
Traffic correlation, malicious relay groups like KAX17, DNS leaks I measured on Debian 13, application fingerprinting, and the availability problem. Honest limits of what Tor protects you from.