Byte on Christoph Kemetmüller

Hacked Tor exits intercepted SSH logins and planted Ebury backdoors

Sat, 31 Oct 2026 00:44:52 +0100

On 5 October the Tor Project warned relay operators that hacked Linux relays had been turned into exits to intercept SSH connections. kaba.cx found them by pinning each of the roughly 3,000 exits with exitmap: 333 exits, a tenth of all exits, redirected port 22 to one of 12 interception servers. Click past the host-key warning and they steal your password, watch the session and install the Ebury OpenSSH backdoor over a second connection. One affected operator’s timeline blames one password for SSH, sudo and the backup passphrase, in cleartext in a helper script. Their Ebury 1.8.3 is newer than ESET’s public IOCs and sails past dpkg -V, because it drops its own setuid library and re-points a symlink. Marc-Etienne M. Léveillé replied that 1.8.3 has been around since at least June 2026 and, with some 400,000 servers backdoored between 2009 and 2023, more relays are most likely compromised. The new exit policies also closed IMAPS and POP3S, so mail only crossed those relays in cleartext, and it all started on a Friday morning, presumably betting on a quiet weekend.

Hackers took 300 GB from the AfD's provider in two visits

Sat, 31 Oct 2026 00:44:52 +0100

Lilith Wittmann reconstructs (in German) how about 300 GB left Alternita, the party-owned provider that runs more than 300 AfD domains. According to the hackers and the provider’s circle, the way in was a poorly protected WordPress at wahlkampf.afd.de, where they installed a plugin (WP-Console) for a shell; they reset officials’ mailbox passwords and pulled mail out via one-click hosters and IMAP batch requests. The intrusion was noticed on 9 September after about 180 GB, but by the hackers’ account the code they left behind was not, and they came back on 14 September for another 120 GB. The AfD’s own statement dates the attack to late September and blames the scandals on a crude AI keyword search. The dump includes member-database extracts and register-office data on first-time voters in Mecklenburg-Vorpommern, which registry offices had emailed unencrypted, and the party’s claim that it informed the data-protection authority immediately sits awkwardly with the Berlin authority logging the report at 18:59, two hours after the 16:51 press release.

Cursor's marketplace served a backdoored Claude Code extension

Fri, 30 Oct 2026 15:18:55 +0100

Calum Hall at Phorion found an SSH backdoor in version 2.1.313 of the Claude Code extension and reported it as an Open VSX compromise. Cursor’s notice, dated 29 October, traces it to Cursor’s marketplace instead, says Anthropic did not build that version and counts at most 5,000 users. OpenSourceMalware shows a 66-line loader prepended to extension.js that runs when the extension starts, no Claude prompt needed. It appends an Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to switch on SSH, opens a reverse tunnel to 134.209.82.225 and persists through a LaunchAgent, an @reboot cron entry or a SysMon scheduled task. It also beacons hostname, user, Git email and the names of environment variables that smell like secrets.

Uninstalling the extension won’t remove the backdoor. If 2.1.313 ever loaded, look for the svc-telemetry key, isolate the host, run Cursor’s remediation scripts and rotate every credential the account could reach, from a clean machine. Cursor asks all users to update to 2.1.314. OpenSourceMalware recommends rebuilding the host, sensible for a laptop that may have offered port 22 to a stranger.

Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace.

— cursor.com

eMudhra's CA keys fit in a byte, and curl and Node still trusted them

Sun, 25 Oct 2026 11:00:00 +0100

eMudhra was supposed to protect eight intermediate CAs with random P-384 private keys. Ikesan recovered all of them from the public certificates by trying every integer from 1 to 255, which took 29 ms (EM OV TLS CA - G3C uses the key 4). The reporter had proved the compromise on 17 October by signing “We have a problem here” with all eight keys. In the Bugzilla incident, eMudhra blames a code flaw in its April 2025 key ceremony that created a second, weaker key pair on the HSM, which ended up in the CSR because the key labels looked alike. It has since decided to exit the public TLS business, which seems fair.

Browsers were covered by CRLSet, OneCRL (CVE-2026-113470, fixed in Firefox 158.0.1) and Certificate Transparency. Clients with their own trust store were not: Ikesan got HTTP 200 from macOS curl 8.7.1 and Node.js 25.3.0, and Scott Helme’s forged api.stripe.com certificate passed in curl, Python and Node. Update Node (26.12.1, 24.22.1, 22.23.4), uv (0.13.5) and your CA bundles, because the intermediates are valid until 2039.

Update 2026-10-30: In a 25-minute Computerphile video, Dr Tim Muller walks through what goes wrong when a private key that should be a random 120-digit number is 4. As the description puts it, you actually have to work quite hard to get there.