What I don't get: Why would you want to access hosts via ssh over TOR?

hackermailman 6 hours ago | parent | next [-]

The Ebury botnet that's been around for a decade now is likely spying on Tor exit ssh tunnels looking for other criminals logging into their h4xxr jump boxes, ransomware deployments they can intercept and exploit themselves, financial crime market operators, crypto drug dealers etc.

▲

M95D 7 hours ago | parent | prev | next [-]

- Default route is over tor and you didn't make an exception for ssh.

- Hide where you are in the world from your employer, who owns the server. (On vacation?)

- You're hacking the server.

▲

ndriscoll 7 hours ago | parent | next [-]

Tor sounds like just about the worst possible way to hide what you're doing from your employer. Why would you not proxy through... your house?

▲

tosti 6 hours ago | parent [-]

I did exactly that as an intern. The boss blocked traffic for everything except tcp 80 and 443 in an attempt to block IM. I set up a tunnel to my house on one of those ports and arp cache poisoned my coworkers so I was their default gw. Only the boss still had filtered Internet and didn't understand how.

	▲	jacquesm 6 hours ago \| parent [-]
		Hehe, that's funny. There are not that many opportunities to use your knowledge about the plumbing of the internet to good effect but that definitely was one of them.

▲

mschuster91 6 hours ago | parent | prev [-]

And 4) you're the owner of the server, which is paid in bitcoin and hosted at a "bulletproof provider", and you want to leave no trace back to your "real" IP address should the authorities ever manage to seize it. Often the case for piracy, drug marketplaces and CSAM.

▲

cesarb 6 hours ago | parent | prev | next [-]

> Why would you want to access hosts via ssh over TOR?

When you're behind a restrictive firewall which blocks anything other than HTTP/HTTPS (like at an Internet café), or when there's some upstream routing issue making reaching the server directly impossible from your location (these can be a pain to diagnose).

Or perhaps it's simply your default: you proxy everything through Tor, and need a reason to not go through it.

▲

nickdothutton 7 hours ago | parent | prev | next [-]

Remote admin some shady server you control and do not want LE seeing a direct inbound ssh from you in Upper Sandusky, Ohio.

▲

dustfinger 7 hours ago | parent | prev | next [-]

TOR provides anonymity at the network level, SSH does not.

▲

NoidFonsense 7 hours ago | parent | prev | next [-]

No public IP. you can use an onion service instead

▲

mmooss 6 hours ago | parent | prev | next [-]

How does this use case differ?

People ssh over Tor for the same reason they use Tor for any network activity: To make confidential 1) your identity to the remote host and 2) your activities to your network providers (including your ISP/workplace/etc.).

If you want only confidential content, ssh is sufficient and so is https for web browsing. If you want the other things, you must use Tor or maybe something similar.

	▲	jacquesm 5 hours ago \| parent [-]
		I can't really see legal use cases for (1) and (2) might get you fired if the second. 2a is a 'maybe'.

▲

dist-epoch 7 hours ago | parent | prev [-]

If the SSH host is a backdoor you installed in a company you hacked, you don't want the FBI tracing it back to you.