[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-relays] Re: Ebury 1.8.3 on two Quetzalcoatl relay servers: timeline, lessons, open questions
- To: tor-relays@xxxxxxxxxxxxxxxxxxxx
- Subject: [tor-relays] Re: Ebury 1.8.3 on two Quetzalcoatl relay servers: timeline, lessons, open questions
- From: kabacx--- via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>
- Date: Thu, 08 Oct 2026 18:46:15 -0000
- Cc: kabacx@xxxxxxxxx
- In-reply-to: <CAGzwqTFW9S47MYK6wuZ+9+YZVcPt7x+EBK25NkCmHQpPQtk=Bw@mail.gmail.com>
- List-id: "support and questions about running Tor relays (exit, non-exit, bridge)" <tor-relays.lists.torproject.org>
- References: <CAGzwqTFW9S47MYK6wuZ+9+YZVcPt7x+EBK25NkCmHQpPQtk=Bw@mail.gmail.com>
- Reply-to: "support and questions about running Tor relays (exit, non-exit, bridge)" <tor-relays@xxxxxxxxxxxxxxxxxxxx>
- User-agent: HyperKitty on https://lists.torproject.org/
Hi there Zimmer
Thanks for the detailed and honest write up, it was an interesting read. I was the one who notified the network health team last Friday after my SSH login was intercepted.
I was wondering how the other relay operators were compromised since it seems unrealistic that they just happen to get the credentials of ~27 other operators.
Looking at my data from October 2 again, 26 of the 27 other compromised relays were hosted at FranTech/BuyVM.
Could they have compromised those servers at the hoster level?
- Kaba
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx