[tor-relays] Re: Ebury 1.8.3 on two Quetzalcoatl relay servers: timeline, lessons, open questions

[kabacx--- via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Hi there Marc-Etienne

> Another possibility is a compromised hosting provider. We identified a
> couple of them in the past where their management servers were compromised
> by Ebury and their customers' VPSes, containers, etc., ended up running
> Ebury as well.

I think thats likely the case. In my scan on October 2, 26 of the 27 compromised non-Quetzalcoatl relay servers were hosted at FranTech/BuyVM.

> I wouldn't be surprised Ebury
> operators automated the process of installing "special tools" on Tor relay
> specifically, maybe to capture more SSH credentials from users connecting
> to SSH servers via Tor.

When one of them captured my credentials it used those to log into the destination (my honeypot) using paramiko.
The session checked for sudo and then ran perl, which seems similar to the installation method described in Zimmer's mail:

> echo "U=$(id -u) S=$(command -v sudo >/dev/null 2>&1 && (sudo -n true 2>/dev/null && echo nopass || echo maybe) || echo none)"
> perl

Though it disconnected after since sshesame didnt react as it expected to the perl command.

- Kaba
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx