300+ Tor Exit Relays Hijacked: What It Means for Your SSH Security

Emily Davis · 2026-10-21

Imagine logging into a server, thinking your connection is private, and then finding out someone just stole your password. That's exactly what happened to some Tor users in early October. A researcher discovered that attackers took control of over 300 Tor exit relays and used them to redirect SSH connections to malicious servers. These servers then captured login credentials. If you use Tor for SSH, this is a wake-up call. ### What Are Tor Exit Relays? Tor exit relays are the last stop in a Tor circuit. When you browse through Tor, your traffic bounces through several relays before exiting onto the regular internet. The exit relay is the one that actually sends your data to its destination. So if you're connecting to an SSH server via Tor, the exit relay sees your traffic. Normally, that's fine because the traffic is encrypted. But if the exit relay is malicious, it can mess with your connection. ### How the Attack Worked Between October 1 and 5, attackers who controlled over 300 exit relays redirected SSH connections to their own servers. These servers impersonated the intended SSH server and captured passwords. The attack only worked if you used password authentication for SSH. If you used key-based authentication, you were safe. The researcher who found this (and chose to stay anonymous) said the attackers were likely after credentials to sensitive systems. > "This isn't about breaking encryption; it's about exploiting trust. When you connect to an SSH server through Tor, you're trusting the exit relay to pass your traffic along. A malicious relay can simply forward you to a fake server." That quote sums it up: the attackers didn't crack SSH encryption; they just tricked users into connecting to the wrong server. ### Who Was Affected? Only those who logged into an SSH server via Tor during that five-day window and used password authentication. If you used SSH keys, you're in the clear. But if you entered a password, your credentials could have been stolen. The researcher didn't specify how many users were affected, but with 300+ relays, the potential reach was significant. ### How to Protect Yourself Here are practical steps to keep your SSH connections safe: - **Use key-based authentication**: Disable password logins on your SSH server. Keys are much harder to steal. - **Verify host keys**: Always check the server's host key fingerprint before connecting. If it doesn't match, don't proceed. - **Avoid Tor for SSH when possible**: If you must use Tor, consider using a VPN or a trusted bridge. - **Monitor your logs**: Look for unusual login attempts or connections from unexpected IPs. - **Keep software updated**: Ensure your SSH client and server are patched. ### The Bigger Picture This incident highlights a broader issue: the Tor network relies on volunteers to run relays, and most are honest. But a coordinated attack like this shows that even privacy networks aren't immune to malicious actors. It's a reminder to stay vigilant, especially when using anonymity tools for sensitive tasks. For those in the antidetect browser community, this story is particularly relevant. Many of you rely on Tor for anonymity, but antidetect browsers offer a different approach. They let you manage multiple isolated browser profiles, each with its own fingerprint, without relying on exit relays. That reduces the risk of man-in-the-middle attacks like this one. If you're serious about privacy, consider diversifying your toolkit. ### Final Thoughts The Tor Project has likely removed the malicious relays by now, but the lesson stands: always use key-based SSH authentication and verify host keys. Your security is only as strong as your weakest link. Stay safe out there.