How were 333 Tor exit nodes hijacked to read SSH and email traffic — and how do you protect yourself?

Researchers found 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email. Tor encrypts the path, but the exit node can read whatever you send unencrypted — here is how to protect yourself.

Tor has a well-earned reputation for privacy — which is exactly why this week’s research deserves a careful read. Short answer: Researchers found 333 Tor exit nodes hijacked to intercept SSH connections and retrieve plaintext email. An exit node is the final computer in the Tor chain: your traffic passes through several relays so no single one knows both who you are and where you are going, but the exit node is the one that actually connects to the site or server you asked for.

Tor encrypts your traffic along the path — yet at that last hop, anything you send unencrypted can be read by whoever controls the exit. Why it matters: SSH logins and older email setups can cross that final hop in readable form when they are not protected end to end, and the hijacked nodes were sitting exactly where that plaintext passes. This does not mean Tor is broken.

It means Tor protects the route, while protecting the message itself is a separate job — and only end-to-end encryption does that job.1. Use HTTPS, and verify SSH host keys. Check host-key fingerprints before accepting them; a changed fingerprint is a warning, not a nuisance.2.

Never read email over plaintext protocols. Use your provider’s encrypted TLS settings or its HTTPS webmail instead.3. Prefer onion services and end-to-end encrypted apps when the content itself is sensitive.4.

Keep Tor Browser updated. Defenses against exactly this kind of abuse ship in updates.5. Treat warnings as stop signs.

An unexpected certificate or host-key warning means close the connection and verify another way.Pro tip: Tor hides where you are, not what you send — encryption of the message itself is still your job.Ad’s take: Think of Tor as a private road, not a sealed envelope. Use both, and stories like this one become a lot less scary.