Security researcher finds Tor exit node that puts malware in binaries

A security researcher has discovered that an exit node in the Tor network is actively intercepting and modifying binaries. In this way, a user can still be infected with malware when downloading files from secure servers.

1110 Tor exit nodes were investigated by security researcher Josh Pitts of Leviathan Security Group. One of them, stationed in Russia, turned out to be actively intercepting binaries from internet traffic and then modifying them with its own code. According to Pitts, the exit node in question is capable of adding malware to a file without the user noticing.

Pitts’ research shows that Tor users are prone to man-in-the-middle attacks. Because the user thinks he is downloading a file from a safe and reliable server, the malware infection is not noticed. To avoid the man-in-the-middle attacks, users should download files over an https connection.

Pitts states that the Tor project has been notified of the malware-propagating exit node; this has since been marked as unreliable, so no more traffic is being routed through it. It is still unclear whether Tor will build in checks to make modifications of binaries impossible, although it is being considered.