Attackers use 70 exit nodes to eavesdrop on Tor mail service

An administrator of the anonymous Tor mailing service Sigaint states that an unknown party has set up about 70 Tor exit nodes in an attempt to intercept encrypted messages.

According to an anonymous administrator, Sigaint, a Tor-only mail service with approximately 43,000 users, has been the victim of a targeted attempt to intercept messages from anonymous users in recent weeks, Vice writes. The attackers allegedly set up approximately 70 Tor exit nodes to intercept traffic from the open and unencrypted part of the Internet and the Tor network. Thus they would be able to read emails.

The attack method would work on visitors who clicked a hard-to-remember .onion link via the unencrypted Sigaint.org to reach the anonymous mailing service on the Tor network. Since this site does not use https, malicious Tor exit nodes could be used to track traffic, essentially performing a man-in-the-middle attack.

The administrator thinks that an intelligence agency may be behind the attack, but a security researcher says the chance is slim: the 70 Tor exit nodes are statistically used by only 2.7 percent of Tor visitors, making the efficiency of the tapping method small. is. A Tor network administrator agrees, calling the number of 70 rogue exit nodes unusually high but “not a tragedy.” The two therefore state that it is completely unclear who is behind the attack method and that hacking Sigaint’s servers would be much more effective.